A company has a Defender for Cloud workflow automation that triggers a Logic App on high-severity alerts. The Logic App sends an email to the security team. Recently, the Logic App has been failing due to throttling, and emails are not being sent. The team wants to ensure that all high-severity alerts trigger the email without manual intervention. What should you do?

Change the workflow automation to trigger on all alerts instead of only high-severity.

Disable the workflow automation and manually send emails for high-severity alerts.

Review the Logic App's concurrency and retry policies, and increase the limit if necessary, or split the workflow into multiple Logic Apps for different alert types.

Use a different email service that does not throttle.

In Microsoft Defender for Cloud, which action is the primary way to respond to a security alert that has been triaged and confirmed as a real threat?

Assign the alert to a security analyst for investigation

Dismiss the alert to remove it from the dashboard

Trigger a remediation action on the affected resource

Suppress the alert with a suppression rule

In Azure Monitor, what is the primary purpose of a data collection rule (DCR)?

To secure network traffic between Azure resources

To store collected data in Azure Blob Storage

To create alerts based on collected performance data

To define how data from Azure resources is collected and sent to a destination

A company wants to monitor network security events from their Windows VMs in Azure, including successful and failed logons, and send these events to a Log Analytics workspace for analysis. They also want to ensure that Defender for Cloud can use these events for its security alerts. What should you configure?

Enable the Azure Security Baseline in Defender for Cloud and rely on its built-in collection of security events.

Configure a diagnostic setting on the VM to stream the security event log to the Log Analytics workspace.

Install the Microsoft Monitoring Agent on each VM and configure the workspace to collect all Windows event logs.

Create a data collection rule in Azure Monitor that collects Windows security events and sends them to the Log Analytics workspace.

A company uses Microsoft Sentinel and wants to ingest AWS CloudTrail logs for threat detection. They have set up the AWS data connector and are receiving logs. However, they notice that the 'AWSCloudTrail' table is empty. The connector status shows 'Connected'. What is the most likely cause?

The AWS S3 bucket is not configured to send logs to the Sentinel workspace via the connector's SQS queue.

The Azure Monitor Agent is not installed on the AWS resources.

The analytics rules are not enabled for AWS CloudTrail.

The Log Analytics workspace is not connected to Sentinel.

Microsoft Certified:Azure Security Engineer Associate

Domain 4Objective 4

Configure and Manage Security Monitoring and Automation Solutions AZ-500 Practice Questions (Page 3)

Part of the Secure Azure using Microsoft Defender for Cloud and Microsoft Sentinel domain, which accounts for 30–35% of the AZ-500 exam. Microsoft does not publish an official question count, but from its 100-minute exam (~40–65 total, ~12–23 in this domain), expect 3–6 from this objective — we provide 37 practice questions to prepare you well beyond it. (estimate)

37questions here

8free pages

6concepts

30–35%of the exam

Questions 11–15

11expert · hard
A company has a Defender for Cloud workflow automation that triggers a Logic App on high-severity alerts. The Logic App sends an email to the security team. Recently, the Logic App has been failing due to throttling, and emails are not being sent. The team wants to ensure that all high-severity alerts trigger the email without manual intervention. What should you do?
Select an answer first
12foundation · easy
In Microsoft Defender for Cloud, which action is the primary way to respond to a security alert that has been triaged and confirmed as a real threat?
Select an answer first
13foundation · easy
In Azure Monitor, what is the primary purpose of a data collection rule (DCR)?
Select an answer first
14application · medium
A company wants to monitor network security events from their Windows VMs in Azure, including successful and failed logons, and send these events to a Log Analytics workspace for analysis. They also want to ensure that Defender for Cloud can use these events for its security alerts. What should you configure?
Select an answer first
15expert · hard
A company uses Microsoft Sentinel and wants to ingest AWS CloudTrail logs for threat detection. They have set up the AWS data connector and are receiving logs. However, they notice that the 'AWSCloudTrail' table is empty. The connector status shows 'Connected'. What is the most likely cause?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to AZ-500

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Microsoft. “AZ-500” is a trademark of its owner, used for identification only.

Configure and Manage Security Monitoring and Automation Solutions AZ-500 Practice Questions (Page 3)

Questions 11–15

In Microsoft Defender for Cloud, which action is the primary way to respond to a security alert that has been triaged and confirmed as a real threat?

In Azure Monitor, what is the primary purpose of a data collection rule (DCR)?

A company uses Microsoft Sentinel and wants to ingest AWS CloudTrail logs for threat detection. They have set up the AWS data connector and are receiving logs. However, they notice that the 'AWSCloudTrail' table is empty. The connector status shows 'Connected'. What is the most likely cause?

Keep studying — Secure Azure using Microsoft Defender for Cloud and Microsoft Sentinel