Manage Security Posture by Using Microsoft Defender for Cloud AZ-500 Practice Questions (Page 8)

Questions 36–40

1. 36expert · hard

   Your security team is overwhelmed by the number of recommendations in Defender for Cloud. You need to prioritize remediation efforts to improve the Secure Score most efficiently, but you also need to ensure that critical vulnerabilities are addressed first. What should you do?

   • ARemediate only recommendations that affect fewer than 10 resources.
   • BRemediate recommendations in alphabetical order.
   • CSort recommendations by the potential score improvement and remediate those with the highest impact first.
   • DUse the 'Exempt' feature to hide low-priority recommendations.
   Reveal Solution Discussion Select an answer first
2. 37application · medium

   Your security team has a policy that all high-severity recommendations must be remediated within 30 days. You have a recommendation 'SQL databases should have vulnerability findings resolved' that affects 20 SQL databases. You have already remediated 15 of them, but the Secure Score has not changed. What is the most likely reason?

   • AThe Secure Score is updated only once a month.
   • BThe recommendation is not included in the Secure Score calculation.
   • CThe recommendation is still showing as 'Unhealthy' for the remaining 5 databases.
   • DYou need to manually refresh the Secure Score page.
   Reveal Solution Discussion Select an answer first
4. 38foundation · easy

   In Microsoft Defender for Cloud, what is the purpose of the 'Remediate' action on a security recommendation?

   • ATo create a new security policy that prevents the issue from occurring
   • BTo suppress the recommendation so it no longer appears in the list
   • CTo automatically apply the configuration change that resolves the security issue described by the recommendation
   • DTo assign the recommendation to another user for manual action
   Reveal Solution Discussion Select an answer first
5. 39application · medium

   A company has an on-premises Hyper-V environment with 50 servers that they want to monitor in Microsoft Defender for Cloud. They have already installed Azure Arc on all servers and connected them to Azure. The servers appear in the Inventory, but they are not contributing to the Secure Score. What should the administrator do first?

   • AEnable the appropriate Defender plans (e.g., Defender for Servers) for the subscription where the Arc-enabled servers are registered.
   • BAssign the 'Security Reader' role to the on-premises servers' service principal.
   • CReinstall the Azure Arc agent on all servers to ensure they are properly connected.
   • DVerify that the Azure Arc agents are reporting to the correct Log Analytics workspace.
   Reveal Solution Discussion Select an answer first
6. 40application · medium

   Your organization has discovered that an unknown subdomain of your main domain is hosting a phishing page. You want to use Microsoft Defender External Attack Surface Management (EASM) to proactively identify such assets. What should you configure in EASM to ensure this subdomain is discovered?

   • AConnect EASM to Microsoft Sentinel for alerting.
   • BCreate a custom standard that includes subdomain monitoring.
   • CAdd the main domain as a discovery seed and run continuous discovery.
   • DManually add the subdomain to the EASM inventory.
   Reveal Solution Discussion Select an answer first