Microsoft AZ-500 Practice Test 117
Question 1160
A compliance engineer expects specific Windows event IDs in Azure Monitor but current DCR XPath filters exclude them. A review identifies this consequence: Incorrect XPath criteria or a missing association leaves events invisible despite the agent being installed. What is the BEST controlled recovery once this failure is recognized?
- The controlled remediation is to grant local VM Owner and expect it to substitute for agent event collection settings.
- The controlled remediation is to assume NSG diagnostic logs are identical to guest Windows Security events.
- The controlled remediation is to correct event selectors and confirm a known safe event reaches the expected destination.
- The controlled remediation is to delete all DCR associations to accelerate collection.
Explanation
Correct Answer
C:Test using these records: DCR event selectors, agent heartbeat, Windows event source and workspace records. Azure Monitor Agent uses assigned data collection rules to select and route supported Windows event data.
Incorrect Answers
A:Grant local VM Owner and expect it to substitute for agent event collection settings. This would not reliably restore the intended security boundary. Incorrect XPath criteria or a missing association leaves events invisible despite the agent being installed. The appropriate controlled recovery is: Correct event selectors and confirm a known safe event reaches the expected destination.
B:Assume NSG diagnostic logs are identical to guest Windows Security events. This would not reliably restore the intended security boundary. Incorrect XPath criteria or a missing association leaves events invisible despite the agent being installed. The appropriate controlled recovery is: Correct event selectors and confirm a known safe event reaches the expected destination.
D:Delete all DCR associations to accelerate collection. This would not reliably restore the intended security boundary. Incorrect XPath criteria or a missing association leaves events invisible despite the agent being installed. The appropriate controlled recovery is: Correct event selectors and confirm a known safe event reaches the expected destination.
Question 1161
Microsoft Sentinel has an enabled workspace but Azure Activity events do not appear because the data connector is not configured. What is the BEST supported implementation or corrective action?
- Use a firewall application rule as a substitute for Sentinel data connector setup.
- Assume installing a Sentinel content solution automatically grants all tenant audit permissions.
- Disable source diagnostic settings and rely only on workbook visualizations.
- Enable the supported Sentinel connector and validate its destination and event prerequisites.
Explanation
Correct Answer
D:Confirm the change against these records: Sentinel connector health, permissions, source diagnostic settings and event ingestion table. Sentinel requires configured source connectors to ingest supported security signals into the workspace.
Incorrect Answers
A:Having a Sentinel solution enabled does not automatically collect every Azure service's audit records.
B:Assume installing a Sentinel content solution automatically grants all tenant audit permissions. The proposed change targets the wrong mechanism or lacks essential validation. Sentinel requires configured source connectors to ingest supported security signals into the workspace. Relevant evidence is Sentinel connector health, permissions, source diagnostic settings and event ingestion table.
C:Having a Sentinel solution enabled does not automatically collect every Azure service's audit records. The intended action is: Enable the supported Sentinel connector and validate its destination and event prerequisites.
Question 1162
Microsoft Sentinel has an enabled workspace but Azure Activity events do not appear because the data connector is not configured. Which evidence BEST verifies the intended technical behavior?
- Sentinel connector health, permissions, source diagnostic settings and event ingestion table.
- An incident title without its actual source telemetry and detection results.
- An inventory item list from a different subscription or connected cloud account.
- A connected agent indicator without a matching data collection rule or event record.
Explanation
Correct Answer
A:These records test the actual Sentinel data connector enablement behavior rather than an unrelated dashboard state. Sentinel requires configured source connectors to ingest supported security signals into the workspace.
Incorrect Answers
B:On its own, that evidence does not prove the specified security control works. Sentinel requires configured source connectors to ingest supported security signals into the workspace.
C:On its own, that evidence does not prove the specified security control works. The more relevant observations are: Sentinel connector health, permissions, source diagnostic settings and event ingestion table.
D:On its own, that evidence does not prove the specified security control works. In the given case, Microsoft Sentinel has an enabled workspace but Azure Activity events do not appear because the data connector is not configured.
Question 1163
Microsoft Sentinel has an enabled workspace but Azure Activity events do not appear because the data connector is not configured. Which principle BEST explains why the recommended solution is appropriate?
- A published security standard alone grants managed identities permission to change resources.
- Sentinel requires configured source connectors to ingest supported security signals into the workspace.
- A subscribed cloud asset automatically sends all possible security logs to Microsoft Sentinel.
- Turning off an alert source is equivalent to remediating the underlying threat.
Explanation
Correct Answer
B:This principle supports the security response: Enable the supported Sentinel connector and validate its destination and event prerequisites. Confirmation depends on Sentinel connector health, permissions, source diagnostic settings and event ingestion table.
Incorrect Answers
A:A published security standard alone grants managed identities permission to change resources. This is an incorrect assumption for Sentinel data connector enablement. The relevant security behavior is: Sentinel requires configured source connectors to ingest supported security signals into the workspace. Check evidence such as Sentinel connector health, permissions, source diagnostic settings and event ingestion table.
C:A subscribed cloud asset automatically sends all possible security logs to Microsoft Sentinel. This is an incorrect assumption for Sentinel data connector enablement. The relevant security behavior is: Sentinel requires configured source connectors to ingest supported security signals into the workspace. Check evidence such as Sentinel connector health, permissions, source diagnostic settings and event ingestion table.
D:Turning off an alert source is equivalent to remediating the underlying threat. This is an incorrect assumption for Sentinel data connector enablement. The relevant security behavior is: Sentinel requires configured source connectors to ingest supported security signals into the workspace. Check evidence such as Sentinel connector health, permissions, source diagnostic settings and event ingestion table.
Question 1164
Microsoft Sentinel has an enabled workspace but Azure Activity events do not appear because the data connector is not configured. Suppose the operator instead follows this unsafe shortcut: Use a firewall application rule as a substitute for Sentinel data connector setup. What is the MOST significant failure introduced by that shortcut?
- Maintaining the required incident log is itself the unauthorized API request.
- Having a Sentinel solution enabled does not automatically collect every Azure service's audit records.
- A successful remediation test was the original reason the plan was disabled.
- Documenting an approved policy assignment is the cause of its earlier absence.
Explanation
Correct Answer
B:The suitable control is: Enable the supported Sentinel connector and validate its destination and event prerequisites. Sentinel requires configured source connectors to ingest supported security signals into the workspace.
Incorrect Answers
A:This does not explain the real Sentinel data connector enablement weakness after the shortcut. The material failure is: Having a Sentinel solution enabled does not automatically collect every Azure service's audit records.
C:This does not explain the real Sentinel data connector enablement weakness after the shortcut. Inspect evidence such as Sentinel connector health, permissions, source diagnostic settings and event ingestion table.
D:This does not explain the real Sentinel data connector enablement weakness after the shortcut. In the given case, Microsoft Sentinel has an enabled workspace but Azure Activity events do not appear because the data connector is not configured.
Question 1165
Microsoft Sentinel has an enabled workspace but Azure Activity events do not appear because the data connector is not configured. A review identifies this consequence: Having a Sentinel solution enabled does not automatically collect every Azure service's audit records. What is the BEST controlled recovery once this failure is recognized?
- Assume installing a Sentinel content solution automatically grants all tenant audit permissions.
- Configure the intended connector and verify fresh events appear in the correct table.
- Disable source diagnostic settings and rely only on workbook visualizations.
- Use a firewall application rule as a substitute for Sentinel data connector setup.
Explanation
Correct Answer
B:Test using these records: Sentinel connector health, permissions, source diagnostic settings and event ingestion table. This addresses the observed security problem while providing a verifiable outcome.
Incorrect Answers
A:Assume installing a Sentinel content solution automatically grants all tenant audit permissions. This would not reliably restore the intended security boundary. Having a Sentinel solution enabled does not automatically collect every Azure service's audit records. The appropriate controlled recovery is: Configure the intended connector and verify fresh events appear in the correct table.
C:Disable source diagnostic settings and rely only on workbook visualizations. This would not reliably restore the intended security boundary. Having a Sentinel solution enabled does not automatically collect every Azure service's audit records. The appropriate controlled recovery is: Configure the intended connector and verify fresh events appear in the correct table.
D:That option would use a firewall application rule as a substitute for Sentinel data connector setup, but it addresses a different concern. This addresses the observed security problem while providing a verifiable outcome.
Question 1166
A security operations team expects Entra sign-in events in Sentinel but the relevant connector or diagnostic source is missing. Which configuration decision MOST directly resolves the issue?
- For this Azure workload, the team should assume installing a Sentinel content solution automatically grants all tenant audit permissions.
- For this Azure workload, the team should disable source diagnostic settings and rely only on workbook visualizations.
- For this Azure workload, the team should enable the supported Sentinel connector and validate its destination and event prerequisites.
- For this Azure workload, the team should use a firewall application rule as a substitute for Sentinel data connector setup.
Explanation
Correct Answer
C:Confirm the change against these records: Sentinel connector health, permissions, source diagnostic settings and event ingestion table.
Incorrect Answers
A:Assume installing a Sentinel content solution automatically grants all tenant audit permissions. The proposed change targets the wrong mechanism or lacks essential validation. Sentinel requires configured source connectors to ingest supported security signals into the workspace. Relevant evidence is Sentinel connector health, permissions, source diagnostic settings and event ingestion table.
B:Having a Sentinel solution enabled does not automatically collect every Azure service's audit records. Disable source diagnostic settings and rely only on workbook visualizations.
D:Having a Sentinel solution enabled does not automatically collect every Azure service's audit records.
Question 1167
A security operations team expects Entra sign-in events in Sentinel but the relevant connector or diagnostic source is missing. What evidence most directly confirms the intended security behavior?
- In this security review, examine a historical Secure Score screenshot without the relevant resource-level finding.
- In this security review, examine Sentinel connector health, permissions, source diagnostic settings and event ingestion table.
- In this security review, examine an incident title without its actual source telemetry and detection results.
- In this security review, examine an inventory item list from a different subscription or connected cloud account.
Explanation
Correct Answer
B:These records test the actual Sentinel data connector enablement behavior rather than an unrelated dashboard state. The intended action is: Enable the supported Sentinel connector and validate its destination and event prerequisites.
Incorrect Answers
A:On its own, that evidence does not prove the specified security control works. In the given case, a security operations team expects Entra sign-in events in Sentinel but the relevant connector or diagnostic source is missing.
C:Sentinel requires configured source connectors to ingest supported security signals into the workspace.
D:The more relevant observations are: Sentinel connector health, permissions, source diagnostic settings and event ingestion table.
Question 1168
A security operations team expects Entra sign-in events in Sentinel but the relevant connector or diagnostic source is missing. Which security principle best explains the intended decision?
- The applicable security principle is that turning off an alert source is equivalent to remediating the underlying threat.
- The applicable security principle is that a published security standard alone grants managed identities permission to change resources.
- The applicable security principle is that Sentinel requires configured source connectors to ingest supported security signals into the workspace.
- The applicable security principle is that a high Secure Score certifies that every relevant cloud resource is secure.
Explanation
Correct Answer
C:This principle supports the security response: Enable the supported Sentinel connector and validate its destination and event prerequisites.
Incorrect Answers
A:Turning off an alert source is equivalent to remediating the underlying threat. This is an incorrect assumption for Sentinel data connector enablement. The relevant security behavior is: Sentinel requires configured source connectors to ingest supported security signals into the workspace. Check evidence such as Sentinel connector health, permissions, source diagnostic settings and event ingestion table.
B:A published security standard alone grants managed identities permission to change resources. This is an incorrect assumption for Sentinel data connector enablement. The relevant security behavior is: Sentinel requires configured source connectors to ingest supported security signals into the workspace. Check evidence such as Sentinel connector health, permissions, source diagnostic settings and event ingestion table.
D:A high Secure Score certifies that every relevant cloud resource is secure. This is an incorrect assumption for Sentinel data connector enablement. The relevant security behavior is: Sentinel requires configured source connectors to ingest supported security signals into the workspace. Check evidence such as Sentinel connector health, permissions, source diagnostic settings and event ingestion table.
Question 1169
A security operations team expects Entra sign-in events in Sentinel but the relevant connector or diagnostic source is missing. Suppose the operator instead follows this unsafe shortcut: Use a firewall application rule as a substitute for Sentinel data connector setup. Which resulting risk or fault should the reviewer identify?
- The resulting security weakness is that documenting an approved policy assignment is the cause of its earlier absence.
- The resulting security weakness is that preserving a security alert audit trail is what caused the risky configuration.
- The resulting security weakness is that a successful remediation test was the original reason the plan was disabled.
- The resulting security weakness is that having a Sentinel solution enabled does not automatically collect every Azure service's audit records.
Explanation
Correct Answer
D:The suitable control is: Enable the supported Sentinel connector and validate its destination and event prerequisites. This is a material consequence of the incorrect shortcut.
Incorrect Answers
A:This does not explain the real Sentinel data connector enablement weakness after the shortcut. In the given case, a security operations team expects Entra sign-in events in Sentinel but the relevant connector or diagnostic source is missing.
B:This does not explain the real Sentinel data connector enablement weakness after the shortcut. Preserving a security alert audit trail is what caused the risky configuration.
C:This does not explain the real Sentinel data connector enablement weakness after the shortcut. A successful remediation test was the original reason the plan was disabled.
Question 1170
A security operations team expects Entra sign-in events in Sentinel but the relevant connector or diagnostic source is missing. A review identifies this consequence: Having a Sentinel solution enabled does not automatically collect every Azure service's audit records. Which remediation most directly restores the intended behavior?
- The controlled remediation is to disable source diagnostic settings and rely only on workbook visualizations.
- The controlled remediation is to use a firewall application rule as a substitute for Sentinel data connector setup.
- The controlled remediation is to assume installing a Sentinel content solution automatically grants all tenant audit permissions.
- The controlled remediation is to configure the intended connector and verify fresh events appear in the correct table.
Explanation
Correct Answer
D:Test using these records: Sentinel connector health, permissions, source diagnostic settings and event ingestion table. Sentinel requires configured source connectors to ingest supported security signals into the workspace.
Incorrect Answers
A:Disable source diagnostic settings and rely only on workbook visualizations. This would not reliably restore the intended security boundary. Having a Sentinel solution enabled does not automatically collect every Azure service's audit records. The appropriate controlled recovery is: Configure the intended connector and verify fresh events appear in the correct table.
B:Use a firewall application rule as a substitute for Sentinel data connector setup. This would not reliably restore the intended security boundary. Having a Sentinel solution enabled does not automatically collect every Azure service's audit records. The appropriate controlled recovery is: Configure the intended connector and verify fresh events appear in the correct table.
C:Assume installing a Sentinel content solution automatically grants all tenant audit permissions. This would not reliably restore the intended security boundary. Having a Sentinel solution enabled does not automatically collect every Azure service's audit records. The appropriate controlled recovery is: Configure the intended connector and verify fresh events appear in the correct table.
