A company's Secure Score is 85%. They want to increase it to 90% within a month. They have limited staff and need to focus on the most impactful actions. Which approach is most effective?

Exempt all recommendations that are not required for the 'Azure Security Benchmark' standard.

Enable all Defender plans to automatically increase the Secure Score.

Remediate all recommendations in the 'High severity' category first, regardless of score impact.

Prioritize recommendations with the highest potential score increase that can be remediated with automated remediation or quick fixes.

A company wants to use Microsoft Defender EASM to monitor its external attack surface. They have already created an EASM resource and configured the scan. They want to see the discovered assets and their associated security findings. Where should they look?

In the 'Regulatory compliance' dashboard, which includes EASM controls.

In the 'Inventory' feature of Defender for Cloud, which includes EASM assets.

In the EASM resource's 'Inventory' page, which lists all discovered assets and their details.

In the Defender for Cloud 'Secure Score' dashboard, which includes EASM findings.

A security team wants to identify all resources that are associated with a specific recommendation in Defender for Cloud, such as 'Vulnerabilities in Azure Container Registry images should be remediated'. They want to see the list of affected resources and then export it. What should they do?

Use the Inventory feature to filter by 'Recommendations' and select the specific recommendation, then export.

Use the Secure Score dashboard to click on the recommendation and view the affected resources.

Open the recommendation in Defender for Cloud and use the 'Affected resources' tab to view and export the list.

Create a custom compliance standard that includes the recommendation and export the compliance report.

Your organization uses AWS and Azure. You need to assess AWS resources against the CIS AWS Foundations Benchmark and also track an internal framework that includes AWS-specific controls. You have connected AWS to Defender for Cloud and enabled the CIS AWS standard. What should you do to track the internal framework?

Modify the CIS AWS standard to include the internal controls.

Disable the CIS AWS standard and create a custom standard that includes both.

Use AWS Security Hub to track the internal framework.

Create a custom standard and assign it to the AWS connector.

Microsoft Certified:Azure Security Engineer Associate

Domain 4Objective 2

Manage Security Posture by Using Microsoft Defender for Cloud AZ-500 Practice Questions (Page 2)

Part of the Secure Azure using Microsoft Defender for Cloud and Microsoft Sentinel domain, which accounts for 30–35% of the AZ-500 exam. Microsoft does not publish an official question count, but from its 100-minute exam (~40–65 total, ~12–23 in this domain), expect 3–6 from this objective — we provide 47 practice questions to prepare you well beyond it. (estimate)

47questions here

10free pages

9concepts

30–35%of the exam

Questions 6–10

6application · medium
A company's Secure Score is 85%. They want to increase it to 90% within a month. They have limited staff and need to focus on the most impactful actions. Which approach is most effective?
Select an answer first
7foundation · easy
Which component is typically installed on an on-premises server to connect it to Microsoft Defender for Cloud?
Select an answer first
8application · medium
A company wants to use Microsoft Defender EASM to monitor its external attack surface. They have already created an EASM resource and configured the scan. They want to see the discovered assets and their associated security findings. Where should they look?
Select an answer first
9application · medium
A security team wants to identify all resources that are associated with a specific recommendation in Defender for Cloud, such as 'Vulnerabilities in Azure Container Registry images should be remediated'. They want to see the list of affected resources and then export it. What should they do?
Select an answer first
10expert · hard
Your organization uses AWS and Azure. You need to assess AWS resources against the CIS AWS Foundations Benchmark and also track an internal framework that includes AWS-specific controls. You have connected AWS to Defender for Cloud and enabled the CIS AWS standard. What should you do to track the internal framework?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to AZ-500

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Microsoft. “AZ-500” is a trademark of its owner, used for identification only.

Manage Security Posture by Using Microsoft Defender for Cloud AZ-500 Practice Questions (Page 2)

Questions 6–10

A company's Secure Score is 85%. They want to increase it to 90% within a month. They have limited staff and need to focus on the most impactful actions. Which approach is most effective?

Which component is typically installed on an on-premises server to connect it to Microsoft Defender for Cloud?

A company wants to use Microsoft Defender EASM to monitor its external attack surface. They have already created an EASM resource and configured the scan. They want to see the discovered assets and their associated security findings. Where should they look?

A security team wants to identify all resources that are associated with a specific recommendation in Defender for Cloud, such as 'Vulnerabilities in Azure Container Registry images should be remediated'. They want to see the list of affected resources and then export it. What should they do?

Keep studying — Secure Azure using Microsoft Defender for Cloud and Microsoft Sentinel