Your company wants to discover and monitor its internet-facing assets, including unknown subdomains and exposed services, to reduce the attack surface. You have enabled Microsoft Defender External Attack Surface Management (EASM). What is the first step you should take?

Run a vulnerability scan on all known IP addresses.

Connect EASM to Microsoft Sentinel.

Create a custom standard for external assets.

Create an EASM workspace and define the discovery seed.

A security administrator wants to find all virtual machines that have a specific security recommendation applied. Which feature in Microsoft Defender for Cloud should they use?

Secure Score, by looking at the score value

Policy, by checking the policy assignments

Security alerts, by reviewing alerts for those VMs

Inventory, by filtering resources based on the recommendation

Your organization is required to comply with the PCI DSS standard. You have enabled the PCI DSS standard in Microsoft Defender for Cloud, but the compliance dashboard shows a compliance score of 85%. You need to identify which specific controls are failing. What should you do?

Open the Regulatory compliance dashboard and expand the failing controls.

Run an Azure Policy compliance scan.

Review the Inventory page for resources with high-severity recommendations.

Check the Secure Score page for recommendations related to PCI DSS.

A company is required to comply with the 'Azure Security Benchmark' and 'CIS Microsoft Azure Foundations Benchmark'. They have enabled both standards in Defender for Cloud. They notice that the Secure Score is lower than expected because some recommendations are duplicated across standards. What should they do to avoid double-counting in the Secure Score?

Disable one of the standards to avoid duplication and improve the Secure Score.

Use the 'Exempt' feature to remove duplicate recommendations from the Secure Score.

Keep both standards enabled; Secure Score is based on unique recommendations and does not double-count the same control across standards.

Create a custom standard that merges both benchmarks to eliminate duplicates.

What is required to create a custom compliance standard in Microsoft Defender for Cloud?

A Log Analytics workspace configured for security events

A custom Azure Active Directory role

An Azure Policy initiative that defines the security controls and assessments

Microsoft Certified:Azure Security Engineer Associate

Domain 4Objective 2

Manage Security Posture by Using Microsoft Defender for Cloud AZ-500 Practice Questions (Page 9)

Part of the Secure Azure using Microsoft Defender for Cloud and Microsoft Sentinel domain, which accounts for 30–35% of the AZ-500 exam. Microsoft does not publish an official question count, but from its 100-minute exam (~40–65 total, ~12–23 in this domain), expect 3–6 from this objective — we provide 47 practice questions to prepare you well beyond it. (estimate)

47questions here

10free pages

9concepts

30–35%of the exam

Questions 41–45

41application · medium
Your company wants to discover and monitor its internet-facing assets, including unknown subdomains and exposed services, to reduce the attack surface. You have enabled Microsoft Defender External Attack Surface Management (EASM). What is the first step you should take?
Select an answer first
42foundation · easy
A security administrator wants to find all virtual machines that have a specific security recommendation applied. Which feature in Microsoft Defender for Cloud should they use?
Select an answer first
43application · medium
Your organization is required to comply with the PCI DSS standard. You have enabled the PCI DSS standard in Microsoft Defender for Cloud, but the compliance dashboard shows a compliance score of 85%. You need to identify which specific controls are failing. What should you do?
Select an answer first
44application · medium
A company is required to comply with the 'Azure Security Benchmark' and 'CIS Microsoft Azure Foundations Benchmark'. They have enabled both standards in Defender for Cloud. They notice that the Secure Score is lower than expected because some recommendations are duplicated across standards. What should they do to avoid double-counting in the Secure Score?
Select an answer first
45foundation · easy
What is required to create a custom compliance standard in Microsoft Defender for Cloud?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to AZ-500

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Microsoft. “AZ-500” is a trademark of its owner, used for identification only.