AZ-500 : Microsoft Azure Security Technologies : Part 09

AZ-500 : Microsoft Azure Security Technologies : Part 09

1. HOTSPOT

   You have an Azure subscription that contains the resources shown in the following table.

   

   An IP address of 10.1.0.4 is assigned to VM5. VM5 does not have a public IP address.

   VM5 has just in time (JIT) VM access configured as shown in the following exhibit.

   

   You enable JIT VM access for VM5.

   NSG1 has the inbound rules shown in the following exhibit.

   

   For each of the following statements, select Yes if the statement is true. Otherwise, select No.

   NOTE: Each correct selection is worth one point.

   

   

2. You have an Azure Active Directory (Azure AD) tenant and a root management group.

   You create 10 Azure subscriptions and add the subscriptions to the root management group.

   You need to create an Azure Blueprints definition that will be stored in the root management group.

   What should you do first?

   • Modify the role-based access control (RBAC) role assignments for the root management group.
   • Add an Azure Policy definition to the root management group.
   • Create a user-assigned identity.
   • Create a service principal.

3. HOTSPOT

   You have an Azure Active Directory (Azure AD) tenant named contoso.com that contains the users shown in the following table.

    

   

   Contoso.com contains a group naming policy. The policy has a custom blocked word list rule that includes the word Contoso.

   Which users can create a group named Contoso Sales in contoso.com? To answer, select the appropriate options in the answer area.

   NOTE: Each correct selection is worth one point.

    

   

   

4. DRAG DROP

   You have five Azure subscriptions linked to a single Azure Active Directory (Azure AD) tenant.

   You create an Azure Policy initiative named SecurityPolicyInitiative1.

   You identify which standard role assignments must be configured on all new resource groups.

   You need to enforce SecurityPolicyInitiative1 and the role assignments when a new resource group is created.

   Which three actions should you perform in sequence? To answer, move the appropriate actions from the list of actions to the answer area and arrange them in the correct order.

   

   

5. You have three on-premises servers named Server1, Server2, and Server3 that run Windows Server 2019. Server1 and Server2 are located on the internal network. Server3 is located on the perimeter network. All servers have access to Azure.

   From Azure Sentinel, you install a Windows firewall data connector.

   You need to collect Microsoft Defender Firewall data from the servers for Azure Sentinel.

   What should you do?

   • Create an event subscription from Server1, Server2, and Server3.
   • Install the On-premises data gateway on each server.
   • Install the Microsoft Monitoring Agent on each server.
   • Install the Microsoft Monitoring Agent on Server1 and Server2. Install the On-premises data gateway on Server3.

6. You have an Azure subscription that contains several Azure SQL databases and an Azure Sentinel workspace.

   You need to create a saved query in the workspace to find events reported by Azure Defender for SQL.

   What should you do?

   • From Azure CLI, run the Get-AzOperationalInsightsWorkspace cmdlet.
   • From the Azure SQL Database query editor, create a Transact-SQL query.
   • From the Azure Sentinel workspace, create a Kusto Query Language query.
   • From Microsoft SQL Server Management Studio (SSMS), create a Transact-SQL query.

7. HOTSPOT

   You plan to use Azure Sentinel to create an analytic rule that will detect suspicious threats and automate responses.

   Which components are required for the rule? To answer, select the appropriate options in the answer area.

   NOTE: Each correct selection is worth one point.

   

   

8. You are collecting events from Azure virtual machines to an Azure Log Analytics workspace.

   You plan to create alerts based on the collected events.

   You need to identify which Azure services can be used to create the alerts.

   Which two services should you identify? Each correct answer presents a complete solution.

   NOTE: Each correct selection is worth one point.

   • Azure Monitor
   • Azure Security Center
   • Azure Analysis Services
   • Azure Sentinel
   • Azure Advisor

9. Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.

   After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.

   You use Azure Security Center for the centralized policy management of three Azure subscriptions.

   You use several policy definitions to manage the security of the subscriptions.

   You need to deploy the policy definitions as a group to all three subscriptions.

   Solution: You create an initiative and an assignment that is scoped to a management group.

   Does this meet the goal?

   • Yes
   • No

10. Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.

    After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.

    You use Azure Security Center for the centralized policy management of three Azure subscriptions.

    You use several policy definitions to manage the security of the subscriptions.

    You need to deploy the policy definitions as a group to all three subscriptions.

    Solution: You create a policy initiative and assignments that are scoped to resource groups.

    Does this meet the goal?

    • Yes
    • No
    Explanation:

    Instead use a management group.

    Management groups in Microsoft Azure solve the problem of needing to impose governance policy on more than one Azure subscription simultaneously.

11. Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.

    After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.

    You use Azure Security Center for the centralized policy management of three Azure subscriptions.

    You use several policy definitions to manage the security of the subscriptions.

    You need to deploy the policy definitions as a group to all three subscriptions.

    Solution: You create a policy definition and assignments that are scoped to resource groups.

    Does this meet the goal?

    • Yes
    • No

12. Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.

    After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.

    You use Azure Security Center for the centralized policy management of three Azure subscriptions.

    You use several policy definitions to manage the security of the subscriptions.

    You need to deploy the policy definitions as a group to all three subscriptions.

    Solution: You create a resource graph and an assignment that is scoped to a management group.

    Does this meet the goal?

    • Yes
    • No
    Explanation:
    Management groups in Microsoft Azure solve the problem of needing to impose governance policy on more than one Azure subscription simultaneously. However, you need to use an initiative, not a resource graph to bundle the policy definitions into a group that can be applied to the management group.

13. HOTSPOT

    You suspect that users are attempting to sign in to resources to which they have no access.

    You need to create an Azure Log Analytics query to identify failed user sign-in attempts from the last three days. The results must only show users who had more than five failed sign-in attempts.

    How should you configure the query? To answer, select the appropriate options in the answer area.

    NOTE: Each correct selection is worth one point.

    

    

    Explanation:

    The following example identifies user accounts that failed to log in more than five times in the last day, and when they last attempted to log in.

    let timeframe = 1d;
    SecurityEvent
    | where TimeGenerated > ago(1d)
    | where AccountType == ‘User’ and EventID == 4625 // 4625 – failed log in
    | summarize failed_login_attempts=count(), latest_failed_login=arg_max(TimeGenerated, Account) by Account
    | where failed_login_attempts > 5
    | project-away Account1

14. You have an Azure subscription named Sub1.

    In Azure Security Center, you have a security playbook named Play1. Play1 is configured to send an email message to a user named User1.

    You need to modify Play1 to send email messages to a distribution group named Alerts.

    What should you use to modify Play1?

    • Azure DevOps
    • Azure Application Insights
    • Azure Monitor
    • Azure Logic Apps Designer
    Explanation:
    You can change an existing playbook in Security Center to add an action, or conditions. To do that you just need to click on the name of the playbook that you want to change, in the Playbooks tab, and Logic App Designer opens up.

15. You create a new Azure subscription.

    You need to ensure that you can create custom alert rules in Azure Security Center.

    Which two actions should you perform? Each correct answer presents part of the solution.

    NOTE: Each correct selection is worth one point.

    • Onboard Azure Active Directory (Azure AD) Identity Protection.
    • Create an Azure Storage account.
    • Implement Azure Advisor recommendations.
    • Create an Azure Log Analytics workspace.
    • Upgrade the pricing tier of Security Center to Standard.
    Explanation:
    D: You need write permission in the workspace that you select to store your custom alert.

16. You have an Azure subscription named Sub1 that contains an Azure Log Analytics workspace named LAW1.

    You have 100 on-premises servers that run Windows Server 2012 R2 and Windows Server 2016. The servers connect to LAW1. LAW1 is configured to collect security-related performance counters from the connected servers.

    You need to configure alerts based on the data collected by LAW1. The solution must meet the following requirements:

    – Alert rules must support dimensions.
    – The time it takes to generate an alert must be minimized.
    – Alert notifications must be generated only once when the alert is generated and once when the alert is resolved.

    Which signal type should you use when you create the alert rules?

    • Log
    • Log (Saved Query)
    • Metric
    • Activity Log
    Explanation:

    Metric alerts in Azure Monitor provide a way to get notified when one of your metrics cross a threshold. Metric alerts work on a range of multi-dimensional platform metrics, custom metrics, Application Insights standard and custom metrics.

    Note: Signals are emitted by the target resource and can be of several types. Metric, Activity log, Application Insights, and Log.

17. HOTSPOT

    You have an Azure subscription that contains an Azure Sentinel workspace.

    Azure Sentinel is configured to ingest logs from several Azure workloads. A third-party service management platform is used to manage incidents.

    You need to identify which Azure Sentinel components to configure to meet the following requirements:

    – When Azure Sentinel identifies a threat, an incident must be created.
    – A ticket must be logged in the service management platform when an incident is created in Azure Sentinel.

    Which component should you identify for each requirement? To answer, select the appropriate options in the answer area.

    NOTE: Each correct selection is worth one point.

    

    

18. HOTSPOT

    You have an Azure subscription.

    You need to create and deploy an Azure policy that meets the following requirements:

    – When a new virtual machine is deployed, automatically install a custom security extension.
    – Trigger an autogenerated remediation task for non-compliant virtual machines to install the extension.

    What should you include in the policy? To answer, select the appropriate options in the answer area.

    NOTE: Each correct selection is worth one point.

    

    

19. You have an Azure subscription named Subscription1 that contains the resources shown in the following table.

    

    You need to identify which initiatives and policies you can add to Subscription1 by using Azure Security Center.

    What should you identify?

    • Policy1 and Policy2 only
    • Initiative1 only
    • Initiative1 and Initiative2 only
    • Initiative1, Initiative2, Policy1, and Policy2

20. You have an Azure subscription named Sub1.

    In Azure Security Center, you have a workflow automation named WF1. WF1 is configured to send an email message to a user named User1.

    You need to modify WF1 to send email messages to a distribution group named Alerts.

    What should you use to modify WF1?

    • Azure Application Insights
    • Azure Monitor
    • Azure Logic Apps Designer
    • Azure DevOps