AZ-500 practice questions 311–320

1. Question 311 · 496 in bank

   Your company has an Azure Active Directory (Azure AD) tenant named contoso.com. You plan to create several security alerts by using Azure Monitor. You need to prepare the Azure subscription for the alerts. What should you create first?

   • Aan Azure Storage account
   • Ban Azure Log Analytics workspace
   • Can Azure event hub
   • Dan Azure Automation account

   Show answer

   Answer: B

   Explanation

   basically, you need LAW to store the security-related logs and use Kusto to query the logs. Base on the result of query, create security alert. Therefore, you have to create LAW first. B is correct

   Source: Adapted from community discussion — poplovic

   References

   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn

   Next question

2. Question 312 · 496 in bank

   HOTSPOT - You have an Azure subscription that contains an Azure Sentinel workspace. Azure Sentinel is configured to ingest logs from several Azure workloads. A third-party service management platform is used to manage incidents. You need to identify which Azure Sentinel components to configure to meet the following requirements: ✑ When Azure Sentinel identifies a threat, an incident must be created. ✑ A ticket must be logged in the service management platform when an incident is created in Azure Sentinel. Which component should you identify for each requirement? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point. Hot Area:

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   Reference: https://docs.microsoft.com/en-us/azure/sentinel/create-incidents-from-alerts https://docs.microsoft.com/en-us/azure/sentinel/tutorial-respond-threats-playbook

   Source: Adapted from community discussion — gcpbrig01

   References

   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn

   

   Next question

3. Question 313 · 496 in bank

   HOTSPOT - You have an Azure subscription. You need to create and deploy an Azure policy that meets the following requirements: ✑ When a new virtual machine is deployed, automatically install a custom security extension. ✑ Trigger an autogenerated remediation task for non-compliant virtual machines to install the extension. What should you include in the policy? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point. Hot Area:

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   Reference: https://docs.microsoft.com/en-us/azure/governance/policy/how-to/remediate-resources

   Source: Adapted from community discussion — neokrieg

   References

   • Microsoft Learn
   • Microsoft Learn

   

   Next question

4. Question 314 · 496 in bank

   You have an Azure subscription named Subscription1 that contains the resources shown in the following table.

   

   You need to identify which initiatives and policies you can add to Subscription1 by using Azure Security Center. What should you identify?

   • APolicy1 and Policy2 only
   • BInitiative1 only
   • CInitiative1 and Initiative2 only
   • DInitiative1, Initiative2, Policy1, and Policy2

   Show answer

   Answer: C

   Explanation

   the correct answer should be " C. Initiative1 and Initiative2 only " as ASC does not support the integration of policies as is, just initiatives (which is a set of policies)

   Source: Adapted from community discussion — D999999

   References

   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn

   Next question

5. Question 315 · 496 in bank

   You have an Azure resource group that contains 100 virtual machines. You have an initiative named Initiative1 that contains multiple policy definitions. Initiative1 is assigned to the resource group. You need to identify which resources do NOT match the policy definitions. What should you do?

   • AFrom Azure Security Center, view the Regulatory compliance assessment.
   • BFrom the Policy blade of the Azure Active Directory admin center, select Compliance.
   • CFrom Azure Security Center, view the Secure Score.
   • DFrom the Policy blade of the Azure Active Directory admin center, select Assignments.

   Show answer

   Answer: B

   Explanation

   Answer is clearly A. We use this daily basis in our system. You go to security center -> Under Cloud Security -> Regulatory Compliance. You see all information you need to see there. I cannot understand why people here "Blindly" say the answer is B. B is wrong because it says "Azure AD Admin Centre", the Azure AD Admin Center has nothing to do with Regulatory compliance and there is no option there. Please read the answer completely before confusing others. Thanks.

   Source: Adapted from community discussion — sureshatt

   References

   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • azure.microsoft.com documentation
   • Microsoft Learn

   Next question

6. Question 316 · 496 in bank

   You have an Azure subscription named Subscription1. You need to view which security settings are assigned to Subscription1 by default. Which Azure policy or initiative definition should you review?

   • Athe Audit diagnostic setting policy definition
   • Bthe Enable Monitoring in Azure Security Center initiative definition
   • Cthe Enable Azure Monitor for VMs initiative definition
   • Dthe Azure Monitor solution 'Security and Audit' must be deployed policy definition

   Show answer

   Answer: B

   Explanation

   and now it is Microsoft cloud security benchmark. "Microsoft cloud security benchmark is the successor of Azure Security Benchmark (ASB), which was rebranded in October 2022. It is currently in public preview." https://learn.microsoft.com/en-us/security/benchmark/azure/introduction "The default initiative automatically assigned to every subscription in Microsoft Defender for Cloud is Microsoft cloud security benchmark." https://learn.microsoft.com/en-us/azure/defender-for-cloud/security-policy-concept#what-is-a-security-initiative

   Source: Adapted from community discussion — Simon_G

   References

   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn

   Next question

7. Question 317 · 496 in bank

   DRAG DROP - You have an Azure Sentinel workspace that has an Azure Active Directory (Azure AD) data connector. You are threat hunting suspicious traffic from a specific IP address. You need to annotate an intermediate event stored in the workspace and be able to reference the IP address when navigating through the investigation graph. Which three actions should you perform in sequence? To answer, move the appropriate actions from the list of actions to the answer area and arrange them in the correct order. Select and Place:

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   Reference: https://docs.microsoft.com/en-us/azure/sentinel/bookmarks

   Source: Adapted from community discussion — rsharma007

   References

   • Microsoft Learn

   

   Next question

8. Question 318 · 496 in bank

   HOTSPOT - You have 20 Azure subscriptions and a security group named Group1. The subscriptions are children of the root management group. Each subscription contains a resource group named RG1. You need to ensure that for each subscription RG1 meets the following requirements: ✑ The members of Group1 are assigned the Owner role. ✑ The modification of permissions to RG1 is prevented. What should you do? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point. Hot Area:

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   Question 1 is Blueprints Question 2: Azure blueprint locking won't affect existing resources, RG1 already exists A resource lock will either make RG1 read only or prevent deletion, not just stopping permission changes, not the best solution. The only good answer is RBAC role assignment at the RG level.

   Source: Adapted from community discussion — hang10z

   References

   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn

   

   Next question

9. Question 319 · 496 in bank

   Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution. After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen. You use Microsoft Defender for Cloud for the centralized policy management of three Azure subscriptions. You use several policy definitions to manage the security of the subscriptions. You need to deploy the policy definitions as a group to all three subscriptions. Solution: You create a policy initiative and an assignment that is scoped to the Tenant Root Group management group. Does this meet the goal?

   • AYes
   • BNo

   Show answer

   Answer: A

   Next question

10. Question 320 · 496 in bank

    You have an Azure environment. You need to identify any Azure configurations and workloads that are non-compliant with ISO 27001:2013 standards. What should you use?

    • AAzure Sentinel
    • BAzure Active Directory (Azure AD) Identity Protection
    • CMicrosoft Defender for Cloud
    • DMicrosoft Defender for Identity

    Show answer

    Answer: C

    Explanation

    Correct Answer... Microsoft Defender for Cloud helps streamline the process for meeting regulatory compliance requirements, using the regulatory compliance dashboard.

    Source: Adapted from community discussion — F117A_Stealth

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

AZ-500 practice, question 311. 496 questions available.