AZ-500 practice questions 301–310

1. Question 301 · 496 in bank

   HOTSPOT - You plan to use Azure Sentinel to create an analytic rule that will detect suspicious threats and automate responses. Which components are required for the rule? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point. Hot Area:

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   Reference: https://docs.microsoft.com/en-us/azure/sentinel/tutorial-detect-threats-custom https://docs.microsoft.com/en-us/azure/sentinel/tutorial-respond-threats-playbook

   Source: Adapted from community discussion — Johnvic

   

   Next question

2. Question 302 · 496 in bank

   Select 2

   You are collecting events from Azure virtual machines to an Azure Log Analytics workspace. You plan to create alerts based on the collected events. You need to identify which Azure services can be used to create the alerts. Which two services should you identify? Each correct answer presents a complete solution. NOTE: Each correct selection is worth one point.

   • AAzure Monitor
   • BAzure Security Center
   • CAzure Analysis Services
   • DAzure Sentinel
   • EAzure Advisor

   Show answer

   Answer: AD

   Explanation

   azure analytics is different than azure logs analytics. azure analytics is a service to leverage big-data (cosmodb) even if is used in background of sentinel an logs analytics. it's not the service to activate directly to have log analysis. you must use azure sentinel ( detect analysis and action) or azure monitor. source:https://docs.microsoft.com/en-us/azure/analysis-services/analysis-services-overview A and D should be the response

   Source: Adapted from community discussion — stewfreed

   References

   • Microsoft Learn

   Next question

3. Question 303 · 496 in bank

   Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution. After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen. You use Microsoft Defender for Cloud for the centralized policy management of three Azure subscriptions. You use several policy definitions to manage the security of the subscriptions. You need to deploy the policy definitions as a group to all three subscriptions. Solution: You create an initiative and an assignment that is scoped to a management group. Does this meet the goal?

   • AYes
   • BNo

   Show answer

   Answer: A

   Explanation

   Resources covered by Azure Policy Although a policy can be assigned at the management group level, only resources at the subscription or resource group level are evaluated. Policy definition The journey of creating and implementing a policy in Azure Policy begins with creating a policy definition. Every policy definition has conditions under which it's enforced. And, it has a defined effect that takes place if the conditions are met Initiative definition An initiative definition is a collection of policy definitions that are tailored toward achieving a singular overarching goal. Initiative definitions simplify managing and assigning policy definitions. They simplify by grouping a set of policies as one single item. For example, you could create an initiative titled Enable Monitoring in Microsoft Defender for Cloud, with a goal to monitor all the available security recommendations in your Microsoft Defender for Cloud instance. https://learn.microsoft.com/en-us/azure/governance/policy/overview Answer =A

   Source: Adapted from community discussion — ITFranz

   References

   • Microsoft Learn
   • Microsoft Learn

   Next question

4. Question 304 · 496 in bank

   Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution. After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen. You use Microsoft Defender for Cloud for the centralized policy management of three Azure subscriptions. You use several policy definitions to manage the security of the subscriptions. You need to deploy the policy definitions as a group to all three subscriptions. Solution: You create a policy initiative and assignments that are scoped to resource groups. Does this meet the goal?

   • AYes
   • BNo

   Show answer

   Answer: B

   Explanation

   Scoping the initiative and assignments to resource groups would only enforce the policies to the resources within the resource groups, and not to the entire subscriptions. To achieve the goal of deploying the policy definitions as a group to all three subscriptions, it would be more appropriate to create the policy initiative and assignments scoped to a management group.

   Source: Adapted from community discussion — OrangeSG

   References

   • Microsoft Learn

   Next question

5. Question 305 · 496 in bank

   Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution. After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen. You use Microsoft Defender for Cloud for the centralized policy management of three Azure subscriptions. You use several policy definitions to manage the security of the subscriptions. You need to deploy the policy definitions as a group to all three subscriptions. Solution: You create a policy definition and assignments that are scoped to resource groups. Does this meet the goal?

   • AYes
   • BNo

   Show answer

   Answer: B

   Next question

6. Question 306 · 496 in bank

   Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution. After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen. You use Microsoft Defender for Cloud for the centralized policy management of three Azure subscriptions. You use several policy definitions to manage the security of the subscriptions. You need to deploy the policy definitions as a group to all three subscriptions. Solution: You create a resource graph and an assignment that is scoped to a management group. Does this meet the goal?

   • AYes
   • BNo

   Show answer

   Answer: B

   References

   • Microsoft Learn

   Next question

7. Question 307 · 496 in bank

   HOTSPOT - You suspect that users are attempting to sign in to resources to which they have no access. You need to create an Azure Log Analytics query to identify failed user sign-in attempts from the last three days. The results must only show users who had more than five failed sign-in attempts. How should you configure the query? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point. Hot Area:

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   The following example identifies user accounts that failed to log in more than five times in the last day, and when they last attempted to log in. let timeframe = 1d; SecurityEvent - | where TimeGenerated > ago(1d) | where AccountType == 'User' and EventID == 4625 // 4625 - failed log in | summarize failed_login_attempts=count(), latest_failed_login=arg_max(TimeGenerated, Account) by Account | where failed_login_attempts > 5 | project-away Account1 Reference: https://docs.microsoft.com/en-us/azure/azure-monitor/log-query/examples

   

   Next question

8. Question 308 · 496 in bank

   You have an Azure subscription that contains the resources shown in the following table.

   

   You plan to implement Microsoft Defender for Cloud. Which resources can be protected by using Defender for Cloud?

   • AVM1 only
   • BVM1 and storage1 only
   • CVault1 and storage1 only
   • DVM1, Vault1, and storage1 only
   • EVNet1, VM1, Vault1, and storage1

   Show answer

   Answer: E

   References

   • Microsoft Learn

   Next question

9. Question 309 · 496 in bank

   Select 2

   You create a new Azure subscription. You need to ensure that you can create custom alert rules in Azure Security Center. Which two actions should you perform? Each correct answer presents part of the solution. NOTE: Each correct selection is worth one point.

   • AOnboard Azure Active Directory (Azure AD) Identity Protection.
   • BCreate an Azure Storage account.
   • CImplement Azure Advisor recommendations.
   • DCreate an Azure Log Analytics workspace.
   • EUpgrade the pricing tier of Security Center to Standard.

   Show answer

   Answer: DE

   Explanation

   Wrong Correct Answers is D and E You need to upgrade the pricing tier of Azure Security Center to standard. You can also create a new Log Analytics workspace which can be used by Azure Security Center to send data with regards to your Azure resources

   Source: Adapted from community discussion — eug45

   References

   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn

   Next question

10. Question 310 · 496 in bank

    You have an Azure subscription named Sub1 that contains an Azure Log Analytics workspace named LAW1. You have 100 on-premises servers that run Windows Server 2012 R2 and Windows Server 2016. The servers connect to LAW1. LAW1 is configured to collect security-related performance counters from the connected servers. You need to configure alerts based on the data collected by LAW1. The solution must meet the following requirements: ✑ Alert rules must support dimensions. ✑ The time it takes to generate an alert must be minimized. ✑ Alert notifications must be generated only once when the alert is generated and once when the alert is resolved. Which signal type should you use when you create the alert rules?

    • ALog
    • BLog (Saved Query)
    • CMetric
    • DActivity Log

    Show answer

    Answer: C

    Explanation

    C, for sure There are many benefits for using Metric Alerts for Logs over query based Log Alerts in Azure; some of them are listed below: Metric Alerts offer near-real time monitoring capability and Metric Alerts for Logs forks data from log source to ensure the same. Metric Alerts are stateful - only notifying once when alert is fired and once when alert is resolved; as opposed to Log alerts, which are stateless and keep firing at every interval if the alert condition is met. Metric Alerts for Log provide multiple dimensions, allowing filtering to specific values like Computers, OS Type, etc. simpler; without the need for penning query in analytics.

    Source: Adapted from community discussion — gfhbox0083

    References

    • Microsoft Learn

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

AZ-500 practice, question 301. 496 questions available.