Manage Security Posture by Using Microsoft Defender for Cloud AZ-500 Practice Questions (Page 1)

Questions 1–5

1. 1application · medium

   A company uses both Azure and AWS. They have connected their AWS environment to Microsoft Defender for Cloud using the native connector. They want to see AWS resources in the same Secure Score and recommendations as Azure resources. What should they do to ensure AWS resources are fully integrated?

   • AInstall the Azure Arc agent on each AWS EC2 instance to bring them into Azure management.
   • BCreate a custom compliance standard that includes AWS resources and assign it to the Azure subscription.
   • CEnable the required Defender plans (e.g., Defender for Servers) for the AWS connector and ensure the CloudFormation template is deployed in the AWS account.
   • DUse the Inventory feature to manually add AWS resources to the Azure subscription.
   Reveal Solution Discussion Select an answer first
2. 2expert · hard

   A security team is reviewing a recommendation in Defender for Cloud that suggests enabling 'Just-in-time (JIT) VM access' for a set of VMs. The team wants to implement this recommendation but is concerned about the operational impact on administrators who need continuous access to some VMs. What should they do?

   • AExempt all VMs from the recommendation to avoid any operational impact.
   • BEnable JIT for all VMs and require administrators to request access each time they need to connect.
   • CEnable JIT for the VMs that do not require continuous access, and exclude the VMs that need always-on access from the JIT recommendation.
   • DUse the Inventory feature to identify VMs with the highest risk and enable JIT only for those.
   Reveal Solution Discussion Select an answer first
4. 3application · medium

   A company has an internal security policy that requires all storage accounts to have 'Minimum TLS version' set to 1.2. They want to track compliance with this policy in Microsoft Defender for Cloud's regulatory compliance dashboard. The built-in standards do not include this specific requirement. What should the administrator do?

   • AUse the Inventory feature to manually track storage accounts that do not meet the TLS requirement.
   • BModify the built-in 'Azure Security Benchmark' standard to add the TLS requirement.
   • CEnable the 'Defender for Storage' plan to automatically enforce TLS 1.2 on all storage accounts.
   • DCreate a custom compliance standard in Defender for Cloud that includes the storage account TLS requirement as a control.
   Reveal Solution Discussion Select an answer first
5. 4foundation · easy

   In Microsoft Defender for Cloud, what does the Compliance feature allow you to do?

   • AAutomatically enforce all security policies across your subscriptions
   • BAssess your environment against regulatory standards and industry benchmarks
   • CManage user access to Azure resources
   • DMonitor real-time network traffic for malicious activity
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   You have on-premises servers that you connected to Azure Arc and enabled Defender for Cloud. You notice that the Secure Score is lower than expected because the servers show as 'Unhealthy' for the recommendation 'Log Analytics agent should be installed on Windows-based Arc-enabled machines'. What should you do?

   • AReconnect the servers to Azure Arc.
   • BDisable the recommendation in the security policy.
   • CExempt the servers from the recommendation.
   • DInstall the Log Analytics agent on the Arc-enabled servers.
   Reveal Solution Discussion Select an answer first