AZ-305 Design infrastructure solutions Practice Question
You are designing a solution to monitor and analyze security events across your Azure environment. Which TWO Azure services should you include in your design to provide centralized logging and threat detection? (Choose two.)
⚠ Common exam trap
Many candidates confuse Azure Firewall (a network security appliance) or Azure Network Watcher (a diagnostic tool) with logging and threat detection services, when in fact they are not designed for centralized log analysis or SIEM functionality.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Azure Log Analytics
B is correct because Azure Log Analytics is the central repository for log data in Azure Monitor, enabling you to collect, correlate, and query security events from multiple sources using Kusto Query Language (KQL). C is correct because Microsoft Sentinel is a cloud-native SIEM and SOAR solution that ingests logs from Log Analytics and provides advanced threat detection, investigation, and automated response. Together, they form the foundation for centralized logging and threat detection in Azure.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Azure Firewall
Why it's wrong here
Azure Firewall is a managed, stateful network security service that filters both inbound and outbound traffic based on allowed/denied rules, but it is not a logging or analytics platform. Even though it emits application and network rule logs, those logs are raw diagnostic artifacts that require a separate service like Azure Log Analytics to collect, query, and analyze. Therefore, it cannot directly fulfill the requirement to monitor and analyze security events across your environment.
- ✓
Azure Log Analytics
Why this is correct
Azure Log Analytics is the core data-collection and querying service within Azure Monitor, ingesting log data from virtually all Azure resources, virtual machines, and applications into a centralized workspace. It supports Kusto Query Language (KQL) queries that let you correlate security events, identify patterns, and troubleshoot incidents from a single pane of glass. This makes it the correct foundational service for monitoring and analyzing security-related logs, especially before layering on more advanced analytics like Sentinel.
- ✓
Microsoft Sentinel
Why this is correct
Microsoft Sentinel is a cloud-native SIEM (Security Information and Event Management) tool that provides intelligent security analytics, threat intelligence, and automated response (SOAR) across your environment. It uses machine learning behavioral analytics and built-in detection rules to identify suspicious activity, and it relies on a Log Analytics workspace as its underlying data store for all ingested telemetry. As a correct answer, it is valid for security analysis, but it is not the platform that actually stores and queries raw log data—it consumes Log Analytics to do that.
- ✗
Azure Policy
Why it's wrong here
Azure Policy is an Azure governance service that applies and enforces compliance rules across resources, such as evaluating whether deployments are in the right region or have required tags. It can help maintain a security baseline by flagging non-compliant resources, but it does not collect, store, or analyze log data for security-related monitoring. An Azure Policy evaluation is a point-in-time configuration check rather than a continuous analysis of security signals.
- ✗
Azure Network Watcher
Why it's wrong here
Azure Network Watcher is a network-level monitoring and diagnostic service that includes tools like packet capture, connection monitor, and IP flow verify to help troubleshoot connectivity and performance issues. It can be enabled to send NSG flow logs to a storage account or a Log Analytics workspace, but the service itself does not analyze those logs or detect security threats. As a platform, it is oriented toward network diagnosis rather than broad security event monitoring and analysis.
Go deeper
Related to this question
About these practice questions
One of 212 original AZ-305 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-305 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-305 exam.