Courseiva

CCNA Secure Azure using Microsoft Defender for Cloud and Microsoft Sentinel Questions

20 questions · Secure Azure using Microsoft Defender for Cloud and Microsoft Sentinel · All types, answers revealed

Practice these questionsDomain overviewAll questions
1
MCQhard

Your organization is using Microsoft Defender for Cloud to protect Azure SQL databases. You need to enable Advanced Threat Protection (ATP) for all existing and future Azure SQL databases in a subscription. The solution must minimize administrative effort. What should you do?

A.Configure Microsoft Sentinel to monitor Azure SQL databases.
B.Enable the Azure SQL databases plan in Microsoft Defender for Cloud at the subscription level.
C.Create an Azure Policy to deploy Advanced Threat Protection on Azure SQL databases.
D.Enable Advanced Threat Protection on each Azure SQL database individually.
AnswerB

Correct. Enabling the plan at the subscription level applies to all current and future resources.

Why this answer

Enabling the Azure SQL databases plan in Microsoft Defender for Cloud at the subscription level automatically enables Advanced Threat Protection (ATP) for all existing and future Azure SQL databases within that subscription. This approach requires minimal administrative effort because it applies the protection globally without needing to configure each database individually or create custom policies. Microsoft Defender for Cloud manages the ATP settings centrally, ensuring consistent security coverage across the entire subscription.

Exam trap

The trap here is that candidates often confuse enabling a Defender for Cloud plan (which is a simple toggle at the subscription level) with creating an Azure Policy (which is a more complex, policy-as-code approach), leading them to choose Option C even though it requires more administrative effort than the direct plan enablement.

How to eliminate wrong answers

Option A is wrong because Microsoft Sentinel is a Security Information and Event Management (SIEM) tool used for threat detection and response across multiple sources, not a mechanism to enable ATP on Azure SQL databases; it can ingest alerts from Defender for Cloud but does not enable the ATP feature itself. Option C is wrong because while an Azure Policy can enforce the deployment of ATP on Azure SQL databases, it requires creating and assigning a custom policy definition, which introduces additional administrative overhead compared to simply enabling the plan at the subscription level; the question specifically asks to minimize administrative effort. Option D is wrong because enabling ATP on each Azure SQL database individually is the most labor-intensive approach and contradicts the requirement to minimize administrative effort, as it does not automatically cover future databases.

Practice this question →
2
Multi-Selectmedium

Which TWO actions can be performed using Microsoft Defender for Cloud's 'Regulatory Compliance' dashboard?

Select 2 answers
A.Upload evidence documents for manual controls.
B.Automatically remediate non-compliant resources.
C.View compliance score against a specific regulatory standard.
D.Configure continuous export of compliance data.
E.Integrate with third-party GRC tools directly from the dashboard.
AnswersA, C

Dashboard allows uploading evidence for manual controls.

Why this answer

Options A and C are correct. The Regulatory Compliance dashboard in Microsoft Defender for Cloud displays compliance scores against specific regulatory standards and allows uploading evidence documents for manual controls. Option B is incorrect because automatic remediation of non-compliant resources is handled through Azure Policy, not directly from the compliance dashboard.

Option D is incorrect because continuous export of compliance data is configured in the continuous export settings, not from the dashboard. Option E is incorrect because direct integration with third-party GRC tools is not available from the dashboard.

Practice this question →
3
MCQmedium

You are using Microsoft Defender for Cloud to protect Azure Kubernetes Service (AKS) clusters. You need to receive alerts about suspicious activities within the cluster, such as privilege escalations. What should you enable?

A.Microsoft Defender for Containers
B.Microsoft Sentinel with AKS data connector
C.Azure Policy for AKS
D.Azure Security Center (classic)
AnswerA

Provides threat detection and alerts for AKS clusters.

Why this answer

Microsoft Defender for Containers is the correct solution because it provides threat detection for AKS clusters, including alerts for privilege escalations, suspicious process execution, and other runtime threats. It integrates directly with Defender for Cloud to monitor the Kubernetes audit logs and container workloads without requiring additional data connectors or agents.

Exam trap

The trap here is that candidates often confuse Microsoft Sentinel (a SIEM) with Microsoft Defender for Cloud (a cloud security posture management and threat detection tool), assuming that ingesting AKS logs into Sentinel provides the same built-in threat detection alerts as Defender for Containers, but Sentinel requires custom analytics rules to generate alerts, whereas Defender for Containers provides out-of-the-box detection for privilege escalations.

How to eliminate wrong answers

Option B is wrong because Microsoft Sentinel with the AKS data connector ingests logs for security information and event management (SIEM) purposes, but it does not natively generate the specific threat detection alerts for privilege escalations within the cluster; that requires Defender for Containers. Option C is wrong because Azure Policy for AKS enforces compliance and governance rules (e.g., restricting privileged containers) but does not produce real-time security alerts for suspicious activities like privilege escalations. Option D is wrong because Azure Security Center (classic) is the predecessor to Microsoft Defender for Cloud and lacks the container-specific threat detection capabilities that Defender for Containers provides; it has been superseded and does not support the same level of AKS runtime monitoring.

Practice this question →
4
MCQmedium

Your organization uses Microsoft Defender for Cloud to secure a multi-cloud environment that includes Azure, AWS, and GCP resources. You need to ensure that all resources are assessed against a consistent set of security standards. What should you configure first?

A.In Defender for Cloud, add a regulatory compliance standard such as 'Azure CIS 1.4.0' and enable continuous export for all connected clouds.
B.Connect the AWS and GCP accounts to AWS Security Hub and Google Security Command Center respectively, then enable Defender for Cloud's multicloud connector.
C.Create Azure Policy initiatives and assign them to the management groups that contain the multicloud resources.
D.Configure Microsoft Sentinel to ingest security findings from AWS and GCP, then create custom alerts for compliance deviations.
AnswerA

Defender for Cloud supports applying Azure compliance standards to multicloud resources via connectors.

Why this answer

In Microsoft Defender for Cloud, you can add regulatory compliance standards such as 'Azure CIS 1.4.0' and enable continuous export for all connected clouds. This ensures consistent security standards are applied across Azure, AWS, and GCP resources. Option B is wrong because connecting AWS and GCP accounts to AWS Security Hub and Google Security Command Center does not leverage Defender for Cloud's multicloud connector; the correct approach is to use Defender for Cloud's native multicloud capabilities.

Option C is wrong because Azure Policy is designed for Azure-only resources, not for AWS or GCP. Option D is wrong because Microsoft Sentinel is a SIEM tool for security analytics, not for defining and enforcing compliance standards across clouds.

Practice this question →
5
MCQhard

Your company uses Microsoft Sentinel to correlate data from multiple sources. You need to create an analytics rule that triggers an incident when a user signs in from an unfamiliar location and then performs a high-risk action in Azure. What is the best approach?

A.Run a custom anomaly detection job
B.Create a Scheduled analytics rule with a KQL query
C.Create a Near-Real-Time (NRT) analytics rule
D.Create a Fusion analytics rule
AnswerD

Fusion rules correlate multiple alerts from different sources.

Why this answer

The Fusion analytics rule is designed to correlate alerts from multiple Microsoft security products (e.g., Microsoft Defender for Identity, Microsoft Defender for Cloud Apps) to detect multi-stage attacks. In this scenario, the rule automatically matches a sign-in from an unfamiliar location (detected by Microsoft Defender for Identity) with a subsequent high-risk action in Azure (detected by Microsoft Defender for Cloud Apps) to create a single incident, reducing alert fatigue and providing context.

Exam trap

The trap here is that candidates often choose a Scheduled or NRT rule because they think they need to write a custom KQL query to join logs, but they overlook that Fusion is specifically designed for multi-stage correlation across Microsoft security products without requiring any manual query writing.

How to eliminate wrong answers

Option A is wrong because a custom anomaly detection job in Microsoft Sentinel is used to identify unusual patterns in a single data source over time, not to correlate specific events from multiple sources into a single incident. Option B is wrong because a Scheduled analytics rule with a KQL query requires you to manually write a query that joins data from different tables (e.g., SigninLogs and AuditLogs), which is complex and less efficient than using the built-in Fusion correlation engine that automatically handles multi-source alert fusion. Option C is wrong because a Near-Real-Time (NRT) analytics rule runs a KQL query every minute on a single table or a set of tables, but it cannot natively correlate alerts from different security products like Fusion does; it is designed for low-latency detection on a single data stream.

Practice this question →
6
MCQhard

You are a security analyst using Microsoft Sentinel. You need to create an analytics rule that triggers an incident when more than 10 failed sign-ins occur from the same IP address within 5 minutes. The rule should use a KQL query. Which query should you use?

A.SigninLogs | where ResultType !in ("0","50125") // failed attempts | summarize Count = count() by IPAddress, bin(TimeGenerated, 5m) | where Count > 10
B.SigninLogs | where ResultType != "0" | make-series Count=count() default=0 on TimeGenerated from ago(5m) to now() step 5m by IPAddress
C.SigninLogs | where ResultType == "0" | summarize Count = count() by IPAddress, bin(TimeGenerated, 5m) | where Count > 10
D.SigninLogs | where ResultType == "0" | summarize Count = count() by IPAddress, bin(time-generated, 5m) | where Count > 10
AnswerA

This query correctly groups failed sign-ins by IP and 5-minute bin, and filters for >10.

Why this answer

It filters for failed sign-ins by excluding successful results (ResultType '0' and '50125', where '50125' is a non-failure code), then uses `summarize` with `bin(TimeGenerated, 5m)` to count failed attempts per IP address within 5-minute windows, and finally filters for counts exceeding 10. This directly meets the requirement to trigger an incident when more than 10 failed sign-ins occur from the same IP within 5 minutes.

Exam trap

The trap here is that candidates often confuse the ResultType values, mistakenly filtering for successful sign-ins (ResultType == '0') instead of failed sign-ins, or they use `make-series` which is designed for time-series analysis rather than event counting with threshold filtering.

How to eliminate wrong answers

Option B is wrong because `make-series` creates a time series with default values, which is not appropriate for counting discrete events and does not filter for failed sign-ins (it includes all ResultType values except '0'). Option C is wrong because it filters for successful sign-ins (`ResultType == '0'`), which is the opposite of what is needed. Option D is wrong because it filters for successful sign-ins (`ResultType == '0'`) and uses an incorrect field name `time-generated` (should be `TimeGenerated`), which would cause the query to fail or return no results.

Practice this question →
7
Multi-Selectmedium

Your company uses Microsoft Defender for Cloud to protect Azure resources. You want to enable the 'Defender for Containers' plan to secure AKS clusters. Which two configurations are necessary? (Choose two.)

Select 2 answers
A.Assign the 'Kubernetes cluster should be accessible only through private endpoint' Azure Policy.
B.Connect the AKS cluster to Azure Arc.
C.Enable the 'Defender for Containers' plan in Microsoft Defender for Cloud.
D.Install the Log Analytics agent on each AKS node.
E.Ensure the AKS cluster's audit logs are enabled and streamed to a Log Analytics workspace.
AnswersC, E

Enabling the 'Defender for Containers' plan in Microsoft Defender for Cloud is the fundamental step that activates threat detection, vulnerability assessment, and security recommendations for AKS clusters. This plan must be turned on for the subscription that contains the cluster; once enabled, Defender automatically deploys the necessary components to collect and analyze security signals. Without this plan, no amount of audit logging or agent installation will produce Defender's container-specific protection.

Why this answer

Enabling the 'Defender for Containers' plan in Microsoft Defender for Cloud is the primary configuration required to activate threat detection and security monitoring for AKS clusters. Option E is correct because audit logs must be enabled and streamed to a Log Analytics workspace to provide the necessary data for Defender for Containers to analyze Kubernetes audit events and detect suspicious activities.

Exam trap

The trap here is that candidates often confuse the Log Analytics agent requirement with the actual data collection mechanism, mistakenly thinking it must be installed on each node, whereas Defender for Containers uses its own dedicated Defender profile and relies on audit log streaming instead.

Practice this question →
8
Multi-Selectmedium

Your organization uses Microsoft Sentinel to monitor security events. You need to configure automated response actions for incidents. Which TWO of the following can be used to trigger automated responses in Microsoft Sentinel?

Select 2 answers
A.Workbooks
B.Watchlists
C.Hunting queries
D.Automation rules
E.Playbooks (Azure Logic Apps)
AnswersD, E

Automation rules allow you to centrally manage automated responses for incidents.

Why this answer

Automation rules in Microsoft Sentinel allow you to define automated responses that trigger when an incident is created or updated, based on conditions like severity or specific analytics rules. They can run playbooks (Azure Logic Apps) to execute complex workflows, such as sending notifications or creating tickets, without manual intervention.

Exam trap

The trap here is that candidates often confuse Workbooks or Hunting queries as automation triggers because they are interactive tools, but they lack the event-driven trigger capability that Automation rules and Playbooks provide.

Practice this question →
9
Multi-Selectmedium

Which TWO of the following are valid ways to integrate Microsoft Sentinel with Microsoft Defender XDR?

Select 2 answers
A.Configure the Microsoft Defender XDR data connector
B.Use Azure Lighthouse to connect Defender XDR to Sentinel
C.Deploy a playbook that polls Defender XDR APIs
D.Enable automatic incident creation in the Microsoft Defender XDR connector
E.Create a custom log analytics workspace query
AnswersA, D

The data connector ingests alerts and incidents.

Why this answer

The Microsoft Defender XDR data connector is the official and supported method to ingest alerts and incidents from Microsoft Defender XDR into Microsoft Sentinel. This connector enables bi-directional synchronization, allowing incidents created in Defender XDR to appear in Sentinel and vice versa, with automatic correlation and enrichment.

Exam trap

The trap here is that candidates may confuse Azure Lighthouse (a cross-tenant management tool) with a data integration method, or think that any API-based polling (Option C) is a valid alternative to the native connector, when in fact only the official connector provides the required synchronization and automation features.

Practice this question →
10
Multi-Selecthard

Which THREE are prerequisites for integrating Microsoft Sentinel with Microsoft Defender XDR? (Choose three.)

Select 3 answers
A.Appropriate permissions (Security Administrator or Global Administrator)
B.The Microsoft 365 Defender data connector must be enabled in Sentinel
C.The Microsoft Monitoring Agent installed on all endpoints
D.A valid license for Microsoft 365 Defender (or individual workloads)
E.An Azure Sentinel workspace in the same region as the Microsoft 365 tenant
AnswersA, B, D

Correct: Required to enable the connector.

Why this answer

Integrating Microsoft Sentinel with Microsoft Defender XDR requires the user to have either Security Administrator or Global Administrator roles in Azure Active Directory. These permissions are necessary to grant consent for the data connector and to configure cross-tenant or cross-service access policies that enable Defender XDR to send incident and alert data to Sentinel.

Exam trap

The trap here is that candidates often assume the Microsoft Monitoring Agent is required for all Microsoft security integrations, but the Sentinel–Defender XDR connector is API-based and does not use MMA, and they also mistakenly think the workspace must be in the same region as the tenant, which is not enforced by the integration.

Practice this question →
11
MCQeasy

Your security team wants to use Microsoft Defender for Cloud's 'Just-In-Time (JIT) VM access' to reduce the attack surface. Which Azure policy must be enabled on the subscription to use JIT?

A.Microsoft Defender for Databases
B.Microsoft Defender for Servers
C.Microsoft Defender for Storage
D.Microsoft Defender for Key Vault
AnswerB

Microsoft Defender for Servers is the only plan that includes Just-in-Time VM access, which locks down inbound management ports by default and lets defenders request temporary, time-bound access through Defender for Cloud. The feature works by automatically configuring and updating NSG rules to allow a specific source IP and port pair for a defined window, then reverting to close the port. This makes Defender for Servers the correct choice for a security team seeking JIT capabilities for their virtual machines.

Why this answer

Just-In-Time (JIT) VM access is a feature of Microsoft Defender for Cloud that requires the Microsoft Defender for Servers plan to be enabled on the subscription. This plan provides the advanced threat protection and access control capabilities, including JIT, which dynamically locks down inbound traffic to VMs and opens ports only when authorized users request access via Azure Policy or the portal.

Exam trap

The trap here is that candidates often confuse the 'Microsoft Defender for Servers' plan with other Defender plans (like Databases or Storage) because they assume any 'Defender' plan can enable JIT, but only the Servers plan provides the necessary VM-level access control and network security group management.

How to eliminate wrong answers

Option A is wrong because Microsoft Defender for Databases is designed to protect database services (e.g., Azure SQL, Azure Database for PostgreSQL) and does not include JIT VM access functionality. Option C is wrong because Microsoft Defender for Storage protects Azure Blob Storage, Azure Files, and Data Lake Storage from threats, but it has no role in managing VM network access. Option D is wrong because Microsoft Defender for Key Vault provides advanced threat protection for Azure Key Vault, focusing on secrets and key management, not VM network-level just-in-time access.

Practice this question →
12
MCQhard

You are a security architect for a large enterprise with 500 Azure subscriptions organized into a management group hierarchy. The company uses Microsoft Defender for Cloud to assess security posture. The CISO wants a single dashboard view of the secure score across all subscriptions, but with the ability to drill down into individual management groups. You need to recommend a solution that provides this capability with minimal administrative overhead. The company already has Log Analytics workspaces deployed per region. Which approach should you take?

A.Export the secure score to a Log Analytics workspace and create a custom workbook
B.Integrate Defender for Cloud with Microsoft Power BI and create a report
C.Use the Microsoft Defender for Cloud dashboard in the Azure portal, selecting the root management group to view aggregated score
D.Use the Microsoft Defender for Cloud REST API to retrieve the secure score and build a custom dashboard
AnswerC

The Defender for Cloud dashboard in the Azure portal provides built-in aggregation at the management group level, allowing you to view the secure score for the root management group and drill down. This is the simplest approach with minimal overhead.

Why this answer

The Microsoft Defender for Cloud dashboard in the Azure portal naturally aggregates secure scores at the management group level when you select the root management group. This provides a single dashboard view with drill-down capability into individual management groups without any additional configuration, minimizing administrative overhead. Option A is incorrect because exporting to a Log Analytics workspace and creating a custom workbook adds unnecessary complexity and overhead for a simple aggregated view.

Option B is incorrect because integrating with Power BI requires additional setup and licensing, and is not the simplest approach. Option D is incorrect because building a custom dashboard using the REST API requires development effort and maintenance, which is more overhead than using the built-in dashboard.

Practice this question →
13
MCQeasy

Your company has a hybrid environment with Azure resources and on-premises servers. You have deployed Microsoft Sentinel and connected it to Azure AD, Azure Activity Logs, and Windows Security Events from on-premises servers via the Log Analytics gateway. You need to create a workbook that shows the number of sign-ins from each country over the last 24 hours. The data source is the SigninLogs table. However, the workbook does not display any data. You verify that the Log Analytics workspace is receiving sign-in logs from Azure AD. Which of the following is the most likely reason the workbook shows no data?

A.The workbook uses a different visualization type that requires KQL.
B.The Log Analytics gateway is blocking the sign-in logs.
C.The workbook's time range filter is set to 'Last 7 days' but the query uses a 24-hour filter incorrectly.
D.The Log Analytics workspace is not receiving sign-in logs from Azure AD.
AnswerC

This is correct. The workbook's time range filter might be set to a broader range (e.g., last 7 days) while the query uses a 24-hour filter. If the query does not correctly use the time parameter, it may return no results when the dashboard filter is applied.

Why this answer

The workbook likely has a time range filter set to 'Last 7 days', but the underlying KQL query uses a hardcoded 24-hour filter. This mismatch causes the query to return data only for the last 24 hours, but the dashboard filter may interfere or the query may be incorrectly referencing the time parameter. As a result, no data is displayed.

Option A is incorrect because workbooks rely on KQL queries regardless of visualization type. Option B is incorrect because the Log Analytics gateway is used for on-premises data, not for Azure AD sign-in logs which stream directly to the workspace. Option D is incorrect because the problem statement confirms sign-in logs are being received.

Exam trap

The most common trap is assuming that if logs are flowing into the Log Analytics workspace, the workbook will automatically show data. However, workbook queries often have their own time filters that must align with the dashboard's time range. Misconfigured time parameters are a frequent hidden issue.

Practice this question →
14
Multi-Selectmedium

Which THREE of the following are features of Microsoft Defender for Cloud's Cloud Security Posture Management (CSPM)?

Select 3 answers
A.Vulnerability scanning of containers
B.Security recommendations for resources
C.Secure Score
D.Threat detection for VMs
E.Regulatory compliance assessments
AnswersB, C, E

CSPM generates recommendations to improve security.

Why this answer

CSPM in Microsoft Defender for Cloud continuously assesses Azure resources against built-in security policies and industry best practices, generating actionable security recommendations to harden the environment. These recommendations are derived from the Azure Security Benchmark and are displayed in the Recommendations blade, directly influencing the Secure Score.

Exam trap

The trap here is that candidates confuse CSPM's configuration-based recommendations and Secure Score with the threat detection and vulnerability scanning features that belong to separate Defender for Cloud workload protection plans, leading them to select options A or D as CSPM features.

Practice this question →
15
MCQmedium

A company uses Microsoft Defender for Cloud to protect its hybrid workloads. Security administrators report that critical alerts for SQL servers are not appearing in the Defender for Cloud dashboard. The SQL servers are on-premises and have Azure Arc enabled. Which configuration step should be verified first?

A.Deploy the Log Analytics agent to the SQL servers
B.Configure Azure Firewall logs for SQL traffic
C.Assign the 'Configure Azure Defender for SQL agents on virtual machines' policy
D.Enable the 'SQL servers on machines' plan in Microsoft Defender for Cloud
AnswerD

Enabling the 'SQL servers on machines' plan in Microsoft Defender for Cloud is the prerequisite that activates threat detection for Azure Arc-enabled SQL Server instances. This plan, part of Defender for Cloud's enhanced security features, turns on SQL-specific alerts, vulnerability assessments, and advanced threat protection for on-premises and multi-cloud SQL servers. Without this plan enabled, no SQL server security alerts will be generated regardless of other configurations, so this is the required first step.

Why this answer

For on-premises SQL servers with Azure Arc, the 'SQL servers on machines' plan must be enabled in Microsoft Defender for Cloud to surface alerts. Without enabling this plan, alerts for SQL servers will not appear. Options A and C are related to agent deployment and policy assignment, but the first step is to ensure the plan is enabled.

Option B is unrelated as Azure Firewall logs are not required for SQL-specific alerts.

Practice this question →
16
MCQhard

Your organization has multiple Azure subscriptions and uses Microsoft Defender for Cloud. You need to ensure that all subscriptions have a consistent security policy applied. You create a management group containing all subscriptions. What should you do next to assign a Defender for Cloud initiative to all subscriptions?

A.Use Azure Blueprints to define the initiative and assign it to the management group.
B.Assign the initiative as an Azure Policy at the management group scope.
C.Create a custom RBAC role that includes the initiative and assign it to the management group.
D.Assign the initiative to each subscription individually using the Defender for Cloud interface.
AnswerB

Correct: Policy assignment at management group scope applies to all subscriptions under it.

Why this answer

Assigning the initiative as an Azure Policy at the management group scope is the correct approach because Azure Policy can be applied at the management group, subscription, or resource group level, and it will be inherited by all child subscriptions. This ensures a consistent security policy across all subscriptions without manual per-subscription configuration. Microsoft Defender for Cloud uses Azure Policy initiatives (such as the Microsoft Cloud Security Benchmark) to enforce security controls, and assigning at the management group scope is the most efficient method for bulk compliance.

Exam trap

The trap here is that candidates often confuse Azure Blueprints with Azure Policy inheritance, thinking Blueprints can apply policies across a management group hierarchy, when in fact Blueprints require per-subscription assignment and do not support automatic inheritance like Azure Policy does.

How to eliminate wrong answers

Option A is wrong because Azure Blueprints are used for deploying repeatable sets of Azure resources and policies, but they require explicit assignment to each subscription and do not automatically inherit down the management group hierarchy like Azure Policy does. Option C is wrong because RBAC roles control permissions to Azure resources, not the assignment of policy initiatives; a custom RBAC role cannot assign or enforce a Defender for Cloud initiative. Option D is wrong because assigning the initiative to each subscription individually is inefficient and error-prone, and it does not leverage the management group inheritance that Azure Policy provides for consistent application.

Practice this question →
17
MCQeasy

Refer to the exhibit. This is an excerpt from an Azure Policy assignment. What is the effect of the 'notScopes' property?

A.The policy will apply only to the VM-Sensitive virtual machine.
B.The policy will apply to all resources in RG-Prod except the entire resource group.
C.The policy will apply to all resources in RG-Prod except the VM-Sensitive virtual machine.
D.The policy will apply to the subscription but not to RG-Prod.
AnswerC

The assignment's scope is RG-Prod, making every contained resource subject to policy evaluation. The notScopes array specifies the VM-Sensitive virtual machine resource ID, so that VM alone is excluded from compliance evaluation. All other resources, regardless of type, remain within the assignment's scope and are evaluated.

Why this answer

'notScopes' excludes specific sub-scopes from the policy assignment. In this case, the policy applies to all resources in 'RG-Prod' except the VM named 'VM-Sensitive'. Option A is wrong because 'notScopes' do not add resources.

Option B is wrong because it does not remove the entire resource group. Option D is wrong because it does not affect subscription-level exclusions.

Practice this question →
18
Multi-Selectmedium

Which TWO actions can be performed using Microsoft Defender for Cloud's security alerts? (Choose two.)

Select 2 answers
A.Directly modify the affected Azure resource's configuration from the alert.
B.Export alerts to a third-party SIEM using continuous export.
C.Change the severity of an alert after it is generated.
D.Create suppression rules to automatically dismiss alerts that meet specific criteria.
E.Trigger a logic app playbook automatically when an alert is generated.
AnswersD, E

Suppression rules allow you to suppress alerts based on conditions.

Why this answer

Microsoft Defender for Cloud allows you to create suppression rules that automatically dismiss alerts matching specific criteria, such as alert name, resource, or severity. This is useful for reducing noise from known benign activities without disabling the underlying security detection. Suppression rules are configured per alert type and can be set to expire after a defined period.

Exam trap

The trap here is that candidates often confuse the ability to modify alert severity (which is not supported) with the ability to create suppression rules or trigger automated responses, both of which are valid actions but require understanding of Defender for Cloud's specific capabilities.

Practice this question →
19
MCQeasy

Your organization uses Microsoft Defender for Cloud. You need to ensure that all Azure subscriptions have the 'Auto-provisioning' extension enabled for Log Analytics agent on new VMs. What should you configure?

A.Configure Azure Automation State Configuration to push the agent.
B.Set up data connectors in Microsoft Sentinel.
C.Enable 'Auto-provisioning' in Defender for Cloud's environment settings.
D.Create an Azure Policy assignment to deploy the Log Analytics agent.
AnswerC

In Defender for Cloud's environment settings, enabling 'Auto-provisioning' deploys the Log Analytics agent extension automatically to new VMs without manual intervention. This satisfies the stem's requirement for a subscription-wide, automated mechanism that ensures all new VMs receive the agent, as opposed to per-VM manual installation or policy-based assignment.

Why this answer

Defender for Cloud's environment settings include a dedicated 'Auto-provisioning' toggle for the Log Analytics agent. When enabled, Defender for Cloud automatically installs the agent on any new Azure VM that is provisioned in the selected subscriptions, ensuring continuous monitoring without manual intervention. This is the native mechanism within Defender for Cloud to enforce agent deployment at scale.

Exam trap

The trap here is that candidates often confuse the Azure Policy-based deployment of the Log Analytics agent (which is a valid method but not the one specified in the question) with Defender for Cloud's native auto-provisioning toggle, leading them to select option D instead of C.

How to eliminate wrong answers

Option A is wrong because Azure Automation State Configuration (DSC) is a configuration management tool that can install software, but it is not the built-in method for auto-provisioning the Log Analytics agent across all subscriptions; it requires custom DSC configurations and does not integrate with Defender for Cloud's auto-provisioning logic. Option B is wrong because data connectors in Microsoft Sentinel are used to ingest logs from various sources into Sentinel, not to enable auto-provisioning of the Log Analytics agent on new VMs; Sentinel relies on the agent being already present or deployed separately. Option D is wrong because while an Azure Policy assignment can deploy the Log Analytics agent via the 'Deploy Log Analytics agent' built-in policy, it is a separate mechanism from Defender for Cloud's auto-provisioning setting; the question specifically asks for the configuration within Defender for Cloud, not a policy-based approach.

Practice this question →
20
MCQmedium

Your organization uses Microsoft Defender for Cloud to assess the security posture of Azure subscriptions. The security team wants to implement a continuous compliance monitoring solution using Microsoft Defender for Cloud's regulatory compliance dashboard. They need to monitor compliance against the 'CIS Microsoft Azure Foundations Benchmark' and 'PCI DSS v3.2.1'. Currently, the subscription has the 'Azure Security Benchmark' initiative assigned. You need to configure the compliance dashboard to show both CIS and PCI DSS standards. The subscription already has Microsoft Defender for Cloud's CSPM plan enabled. You have also enabled the 'Defender for Cloud' plan for servers. What should you do to meet the requirements?

A.Add the CIS Microsoft Azure Foundations Benchmark and PCI DSS v3.2.1 policy initiatives to the regulatory compliance dashboard.
B.Enable the CIS benchmark in the Microsoft Defender for Cloud settings.
C.Enable Microsoft Defender for Cloud's regulatory compliance add-on.
D.Remove the Azure Security Benchmark initiative and assign the CIS and PCI DSS initiatives.
AnswerA

You can add multiple compliance standards by assigning their policy initiatives.

Why this answer

To add compliance standards to the regulatory compliance dashboard, you need to add the corresponding policy initiatives. Option A is correct because you can add the CIS Microsoft Azure Foundations Benchmark and PCI DSS v3.2.1 initiatives to the existing dashboard without removing the Azure Security Benchmark. Option B is incorrect because the CIS benchmark is not a setting but a policy initiative that must be added.

Option C is incorrect because there is no separate regulatory compliance add-on; you add initiatives directly. Option D is incorrect because removing the Azure Security Benchmark is unnecessary and would cause loss of monitoring for that standard.

Practice this question →

Ready to test yourself?

Try a timed practice session using only Secure Azure using Microsoft Defender for Cloud and Microsoft Sentinel questions.

Start 20-question session