CCNA Secure Azure using Microsoft Defender for Cloud and Microsoft Sentinel Questions

Option A is correct because the 'Defender for Containers' plan provides threat protection for AKS, including runtime threat detection. Option B is wrong because Defender for Cloud's foundational CSPM is free and does not provide advanced workload protection. Option C is wrong because Defender for Servers applies to VMs, not AKS.

Option D is wrong because Defender for SQL applies to databases.

Foundational CSPM provides continuous assessment and compliance against benchmarks like Azure Security Benchmark, and security recommendations for resources. Option C is wrong because JIT is part of enhanced security, not foundational. Option D is wrong because Firewall Manager is a separate service.

Option E is wrong because vulnerability assessment requires enabling Defender plans.

Option A is correct because Azure Arc enables non-Azure machines to be managed by Azure and monitored by Defender for Cloud. Option B is wrong because the MMA is legacy and being replaced by Azure Monitor Agent. Option C is wrong because the Log Analytics agent is similar to MMA.

Option D is wrong because the Azure Security Center agent is not a standalone agent.

Option D is correct because the query counts failed logins (EventID 4625) per account and IP address in the last hour, then filters for more than 10. Option A is wrong because it's about failed logins, not successful. Option B is wrong because it's per account and IP, not just per account.

Option C is wrong because it's per hour, not cumulative across days.

Option A, B, and E are correct. Enabling sentinel in the Log Analytics workspace allows interactive retention of up to two years. After that, you can set up Azure Blob Storage or Azure Data Lake Storage for long-term retention at lower cost.

You can also use Azure Archive Storage for even cheaper storage. Option C is wrong because continuous export to Event Hubs is for real-time streaming, not long-term retention. Option D is wrong because Azure SQL Database is expensive for log storage and not designed for this purpose.

Options A and D are correct. Defender for SQL includes vulnerability assessment and advanced threat protection (ATP) for detecting anomalies. Option B is wrong because adaptive network hardening is for VMs, not SQL.

Option C is wrong because just-in-time VM access is for VMs. Option E is wrong because file integrity monitoring is for VMs and servers.

Option B is correct because Defender for Cloud only shows recommendations for policies that are part of its regulatory compliance or security benchmarks. A custom or built-in policy assigned directly via Azure Policy may not appear in Defender for Cloud unless it is included in a security initiative. Option A is wrong because the policy scope is correct.

Option C is wrong because the policy effect is 'Audit', which generates compliance results. Option D is wrong because the policy assignment should work regardless of resource existence; it audits existing resources.

Option C is correct because ATP for Azure SQL is enabled at the server level, not the database level. Option A is wrong because it's at server level. Option B is wrong because it's not a subscription-level setting.

Option D is wrong because it's not a resource group setting.

Enabling the integrated Qualys or Microsoft Defender vulnerability assessment solution at the subscription level will automatically onboard all current and future VMs. Option A is wrong because manual installation is not scalable. Option B is wrong because enabling Defender for Servers plan P2 includes vulnerability assessment but may be more costly than needed.

Option D is wrong because it only addresses a subset of VMs.

Options A, C, and E are correct. Defender for Cloud plans include Defender for Servers (A), Defender for SQL (C), and Defender for Storage (E). Option B is wrong because Defender for Office is part of Microsoft 365 Defender, not Defender for Cloud.

Option D is wrong because Defender for Identity is a separate Microsoft 365 Defender product.

Option C is correct because when using CMK with Log Analytics, you must grant the Log Analytics service principal (or managed identity) access to the Key Vault key. Option A is wrong because Sentinel itself does not directly use the key. Option B is wrong because the key must be in the same region as the workspace.

Option D is wrong because soft-delete must be enabled, not purge protection specifically.

Option D is correct because the sentinel resource (onboardingStates) is defined but it is not linked to the workspace resource. In Bicep, you need to create a dependency or reference the workspace ID to link Sentinel to that workspace. Without a dependency, the resources are deployed but Sentinel is not onboarded to the workspace.

Option A is wrong because the pricing tier is Standard, which is correct. Option B is wrong because the SKU is PerGB2018, which is correct. Option C is wrong because retention is 90 days, which is allowed.

Options A and D are correct. Option A is correct because Amazon Web Services S3 connector is available. Option D is correct because Azure Active Directory (now Microsoft Entra ID) connector is available.

Option B is wrong because there is no direct connector for Google Cloud Platform; it requires a custom solution. Option C is wrong because Microsoft SQL Server connector does not exist directly; it uses Windows Event Forwarding. Option E is wrong because VMware vCenter connector is not a built-in connector.

Options A and B are correct. Defender for Cloud alerts support suppression rules and automated response via playbooks. Option C is wrong because Defender for Cloud does not directly modify resources; it triggers actions via playbooks.

Option D is wrong because alerts can be dismissed. Option E is wrong because alert severity is set by Defender for Cloud, not by users.

Options B and D are correct. The regulatory compliance dashboard allows you to assign compliance standards to subscriptions and view compliance status for built-in standards like SOC 2. Option A is wrong because automating remediation is done via Azure Policy, not the dashboard.

Option C is wrong because enabling Defender plans is done in the Environment settings. Option E is wrong because custom recommendations are created via Azure Policy or custom initiatives.

Options A, B, and D are correct. JIT requires a Log Analytics workspace for policy, a VM with a public IP, and the network security group (NSG) must be associated. Option C is wrong because Azure Bastion is an alternative to JIT but not required.

Option E is wrong because Azure Firewall is not needed.

Option B is correct because if the VM does not have the Log Analytics agent (or Azure Monitor Agent) installed, the Qualys extension cannot communicate findings. Option A is wrong because the vulnerability assessment solution is deployed at the subscription level, not per VM. Option C is wrong because the Qualys solution is included with Defender for Servers P2; no separate license is needed.

Option D is wrong because network security groups are not the primary reason for missing findings; the agent is required.

Option B is correct because 'Unhealthy' in regulatory compliance means that the corresponding Azure Policy assessments have failed. Option A is wrong because if no resources were assessed, it would be 'Not registered'. Option C is wrong because the standard is enabled.

Option D is wrong because the dashboard does not require manual attestation for SOC 2.

The 'Security alerts' blade shows security alerts, not vulnerability findings. The 'Recommendations' blade includes vulnerability assessment findings. Option B is correct.

Option A is for alerts. Option C is for inventory. Option D is for regulatory compliance.

Deploying Azure Arc on on-premises servers allows them to be managed by Defender for Cloud. Installing the Log Analytics agent enables data collection. Option C is wrong because VPN is not required.

Option D is wrong because Azure Stack HCI is for hyperconverged infrastructure, not general servers. Option E is wrong because Microsoft Endpoint Manager is for device management.

Option A is correct because Auto-provisioning settings in Defender for Cloud allow you to automatically deploy the Log Analytics agent to new VMs. Option B is wrong because Azure Policy can be used but is not the direct setting for auto-provisioning in Defender for Cloud. Option C is wrong because Azure Automation State Configuration is not used for this purpose.

Option D is wrong because Microsoft Sentinel is a SIEM, not a configuration tool for agent deployment.

Option B is correct because Microsoft Defender for Cloud provides a unified dashboard that aggregates security alerts and incidents from all subscriptions in the tenant. Option A is wrong because Azure Security Center has been replaced by Defender for Cloud. Option C is wrong because Azure Monitor alerts are separate from Defender for Cloud incidents.

Option D is wrong because Microsoft Sentinel can ingest Defender for Cloud alerts but is not required for a unified view.

Option A is correct because to enable Defender for Servers on a specific subscription, you configure the Defender for Cloud environment settings at the subscription level. Option B is wrong because enabling on the VM itself is not directly supported; the plan must be enabled at the subscription or resource group level. Option C is wrong because the plan covers supported OS types.

Option D is wrong because the plan covers Azure VMs, not just on-premises.

To run a playbook automatically in response to alerts, you need to create an automation rule in Microsoft Sentinel that triggers the playbook when an alert is generated. Option B is correct. Option A is incorrect because analytics rules are for generating alerts, not for response.

Option C is incorrect because playbooks are not created in Defender for Cloud. Option D is incorrect because the Logic App itself does not trigger on alerts without an automation rule.

Option C is correct because filtering by ResultType != "0" excludes successful sign-ins (ResultType == "0"). Option A is wrong because ResultType == "0" only includes successful sign-ins. Option B is wrong because Status is not a column; the correct column is ResultType.

Option D is wrong because the column is ResultType, not Result.

Option C is correct because Defender for Cloud alerts are based on the latest vulnerability assessment scans; if the VM hasn't been rescanned since remediation, the alert remains. Option A is wrong because default policies don't suppress alerts. Option B is wrong because Silent Remediation suppresses alerts after remediation.

Option D is wrong because alerts are not automatically dismissed after a time period.

Option C is correct because an automation rule in Microsoft Sentinel can trigger a playbook when an incident is created. Option A is wrong because a playbook alone does not automatically trigger on incident creation; it needs an automation rule. Option B is wrong because analytics rules generate alerts, not automated responses.

Option D is wrong because a workbook is a visualization tool.

NRT rules run queries every minute with near real-time latency and can correlate events across multiple hosts. Option A is wrong because scheduled rules run on a schedule and may miss correlation. Option C is wrong because ML behavior analytics is for UEBA.

Option D is wrong because Fusion is for multi-stage attacks.

Options B, C, and D are correct. CSPM provides security recommendations, continuous assessment, and a secure score. Option A is wrong because file integrity monitoring is part of Defender for Servers, not CSPM.

Option E is wrong because JIT VM access is part of Defender for Servers Plan 2.

Option A is correct because the 'Azure Active Directory' data connector is specifically designed to ingest both sign-in logs and audit logs. Option B is wrong because the Azure AD Identity Protection connector only brings in risky user and sign-in events, not full audit logs. Option C is wrong because the Office 365 connector brings in Exchange, SharePoint, and Teams logs, not Azure AD logs.

Option D is wrong because the Azure AD Authentication connector is not a standard Microsoft Sentinel data connector.

Option A is correct because you can configure data retention for specific tables up to 2 years using the Azure portal or API. Option B is wrong because archiving to a storage account would require additional configuration and is not a direct retention setting. Option C is wrong because changing the workspace retention policy to 2 years is possible but may incur high costs; however, it is a valid option.

But the question implies a cost-effective solution: table-level retention. Option A is more precise. Option D is wrong because Azure Policy does not change retention settings.

Option A is correct because the recommendation indicates vulnerabilities found by Defender for Containers. Remediation involves updating the base image and rebuilding the container. Option B is wrong because turning off the scanner does not fix the vulnerability.

Option C is wrong because the recommendation is not about Defender for Cloud Apps. Option D is wrong because the recommendation is already enabled; you need to fix the image.

Option D is correct because Microsoft Defender for Cloud allows you to assign regulatory compliance standards, including MCSB, at the management group level, which automatically applies to all subscriptions under that group. Option A is wrong because Azure Policy can enforce standards, but the question specifically asks about MCSB in Defender for Cloud. Option B is wrong because assigning at the subscription level does not cover new subscriptions automatically.

Option C is wrong because Defender for Cloud plans enable features but do not assign compliance standards.

Option C is correct because Microsoft Sentinel is a cloud-native SIEM and SOAR solution that centralizes security data and provides advanced analytics. Option A is wrong because Azure Monitor is for monitoring, not SIEM. Option B is wrong because Microsoft Defender for Cloud provides security posture management and threat detection but does not centralize alerts from multiple sources as a SIEM.

Option D is wrong because Microsoft 365 Defender is for Microsoft 365 security, not multi-subscription Azure alerts.

Option B is correct because Microsoft Defender XDR provides automated investigation and remediation. Option A is wrong because a playbook can create incidents but not automatically block. Option C is wrong because Azure AD Identity Protection only provides risk detection.

Option D is wrong because a detection rule triggers alerts but not automated response.

Options A and D are correct. Azure Active Directory (now Microsoft Entra ID) sign-in logs and audit logs are key sources for UEBA. Option B is wrong because Azure Activity Logs are for resource operations, not user behavior.

Option C is wrong because Azure SQL Database audit logs are not a default source for UEBA. Option E is wrong because Azure Firewall logs are network logs, not user behavior.

Option A (Defender for Containers) is the correct plan for AKS threat detection. Option B (Defender for Servers) is for VMs, not containers. Option C (Microsoft Defender for Cloud's vulnerability assessment for container images) is part of Defender for Containers.

Option D (Azure Policy add-on for AKS) enables policy enforcement but is not threat detection. Option E (Microsoft Defender for Cloud's continuous export) is for exporting alerts, not detection.

Options A, D, and E are correct. Option A is correct because Azure Firewall must have diagnostic logs enabled. Option D is correct because a Log Analytics workspace is needed to store the logs.

Option E is correct because the Azure Firewall data connector in Sentinel pulls the logs. Option B is wrong because the Log Analytics agent is not used for Azure Firewall; it uses diagnostic settings. Option C is wrong because Azure Policy is not required for ingestion.

Option B is correct because live response allows you to collect forensic data and investigate the VM without shutting it down. Option A is wrong because disconnecting the VM from the network might disrupt the application. Option C is wrong because taking a snapshot is forensic but doesn't allow live investigation.

Option D is wrong because restarting the VM could destroy volatile data and disrupt service.

Option B is correct because the Microsoft Defender XDR connector ingests incidents and alerts from Defender XDR into Sentinel. Option A is wrong because the Office 365 connector is for Office logs. Option C is wrong because the Azure Activity connector is for Azure resource logs.

Option D is wrong because the Windows Security Events connector is for Windows events.

Option C is correct because continuous export allows you to export alerts and recommendations to a Log Analytics workspace, and you can filter by severity using the export settings. Option A is wrong because diagnostic settings on individual resources would be inefficient and not filter by severity globally. Option B is wrong because Azure Event Hubs is for streaming, not Log Analytics.

Option D is wrong because Microsoft Sentinel is not needed for this export.

Option B is correct because the Security Admin role can manage security policies and enable JIT. Option A is wrong because Contributor can manage VMs but not security policies. Option C is wrong because Reader cannot make changes.

Option D is wrong because Owner has more permissions than needed, but the question asks for minimum.

The correct answer is A. Microsoft Defender for Cloud's continuous export feature automatically assesses all subscriptions for security misconfigurations and compliance. Option B is wrong because Azure Policy initiative assignment is used for compliance but not continuous assessment.

Option C is wrong because Azure Blueprints are deprecated. Option D is wrong because Microsoft Sentinel is for SIEM, not continuous assessment.

Option B is correct because automation rules in Sentinel can trigger playbooks or other responses automatically based on incident conditions. Option A is wrong because analytic rules generate alerts, not automated responses. Option C is wrong because workbooks are for visualization.

Option D is wrong because entity behavior analytics is for detection, not response.

Option C is correct because the policy mode is 'Indexed', which only evaluates resource types that support tags and location; virtual machines are indexed, but the policy might not trigger if the assignment scope is not a management group or subscription. Option A is wrong because the parameter is required. Option B is wrong because the agent is not installed, but the policy should evaluate.

Option D is wrong because built-in policies can be assigned.

Option A is correct because JIT only opens ports for approved source IPs; if the administrator's IP is not approved, access is denied. Option B is wrong because JIT does not require the VM to be in a specific location. Option C is wrong because the JIT policy can be set per VM.

Option D is wrong because the VM agent is used for other purposes, not JIT approval.

Option B is correct because Microsoft Entra ID (formerly Azure AD) sign-in logs contain location information and are commonly used for unfamiliar sign-in detection. Option A is wrong because Azure Activity logs record resource operations, not sign-ins. Option C is wrong because Azure AD audit logs track changes, not sign-ins.

Option D is wrong because Microsoft 365 Defender alerts are not sign-in logs.

Options B and D are correct. A connector is the standard way to ingest data from various sources. Custom logs using Log Analytics agents is also a valid method.

Option A is wrong because PowerShell cmdlets do not directly ingest data into Sentinel. Option C is wrong because Azure Policy can enforce compliance but not ingest data. Option E is wrong because Power BI is a visualization tool, not data ingestion.

Option C is correct because MDTI data connectors must be enabled in Microsoft Sentinel, and if not, indicators will not populate the table. Option A (Azure Lighthouse) is unrelated. Option B (data connector disabled) is the correct reason but option C is more specific; however, among the choices, C is the most accurate as the connector must be enabled.

Option D (subscription not onboarded to Defender for Cloud) does not affect Sentinel's threat intelligence.

Option B is correct because if the AKS cluster does not have the 'azurepolicy' namespace, the add-on is not properly installed or the cluster was created without it. Option A is wrong because the add-on is for Azure Policy, not Defender. Option C is wrong because a custom policy might override but would not cause this specific recommendation.

Option D is wrong because the recommendation is about installation, not configuration.

The vulnerability assessment identifies configuration issues like missing firewall rules. The correct action is to add a firewall rule to allow only necessary IP ranges. Option A is wrong because enabling Defender for Cloud does not fix existing findings.

Option B is wrong because changing audit settings does not affect firewall. Option C is wrong because enabling Advanced Threat Protection does not resolve vulnerability findings.

Options A and C are correct. Option A: The Log Analytics agent (legacy) can forward syslog to Sentinel. Option C: The Azure Monitor Agent (AMA) with syslog data collection rules is the current recommended method.

Option B is wrong because Event Hubs are used for CEF or custom logs, not raw syslog. Option D is wrong because Azure Policy does not collect logs. Option E is wrong because Azure Arc enables management but not directly syslog ingestion.

Option C is correct because the built-in PCI DSS initiative includes policies that may have effects not supported in all regions, causing assessment failures. Option A is wrong because the CSPM plan is already enabled. Option B is wrong because the initiative at management group should assess all subscriptions.

Option D is wrong because the compliance dashboard uses assessments from policies, not manual checks.

Option B is correct because the storage account's security policy 'Secure transfer required' enforces HTTPS for all requests. Option A is wrong because Azure Policy can audit but not enforce the setting directly. Option C is wrong because a firewall rule controls network access, not protocol.

Option D is wrong because private endpoints are for network isolation, not protocol enforcement.

DeployIfNotExists policies require a managed identity to perform remediation. If the policy assignment does not have a managed identity, it cannot deploy the agent. Option A is wrong because 'Disabled' effect would not attempt deployment.

Option B is wrong because the workspace location does not need to match. Option D is wrong because the agent can be deployed to multiple workspaces via policy.

Microsoft Defender for Cloud's adaptive application controls use machine learning to analyze processes and create allowlists automatically. Option A is wrong because AppLocker requires manual configuration. Option B is wrong because Windows Defender Application Control (WDAC) requires policy creation.

Option D is wrong because just-in-time VM access controls network access, not application execution.

To add compliance standards to the regulatory compliance dashboard, you need to add the corresponding policy initiatives. Option D is correct. Option A is incorrect because you do not need to remove existing initiatives.

Option B is incorrect because the CIS benchmark is not automatically enabled; you must add it. Option C is incorrect because you need to add the initiatives, not just enable Defender plans.

Option A is correct because Defender for Cloud has an auto-provisioning setting for the Log Analytics agent. Option B is wrong because Azure Policy can be used but is not the default mechanism. Option C is wrong because VM extensions can be installed manually but not automatically for all new VMs.

Option D is wrong because Azure Automation is not designed for this purpose.

Option A is correct because regulatory compliance standards can be assigned at the management group level in Defender for Cloud. Option B is wrong because Azure Policy assignments are for individual policies, not security standards. Option C is wrong because security policies in Defender for Cloud are applied per subscription, not management group.

Option D is wrong because Secure Score is a metric, not a compliance standard.

Option B is correct because automation rules in Sentinel can trigger playbooks that send emails. Option A is wrong because Azure Monitor alerts are for metrics/logs, not Sentinel incidents. Option C is wrong because Logic Apps can send emails but need to be triggered by an automation rule.

Option D is wrong because Microsoft Teams integration would require a playbook, not a direct connector.

Option C is correct because UEBA in Sentinel requires the Microsoft Entra ID (Azure AD) data connector to ingest user identity and sign-in logs. Option A (Azure Activity) provides subscription-level logs. Option B (Azure AD) is correct.

Option D (Office 365) is not required for UEBA.