AZ-305 Design infrastructure solutions Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Azure Log Analytics

  Why it's wrong here

  Azure Log Analytics is a query engine and data store within Azure Monitor that ingests and analyzes logs, but it is not a full SIEM because it lacks security-specific capabilities such as incident management, threat intelligence correlation, entity behavior analytics, and automated response workflows. Although you can write KQL queries to detect suspicious activity, you must build all correlation logic manually and manage every alert lifecycle yourself, whereas a SIEM like Microsoft Sentinel provides those features natively on top of the same Log Analytics workspace. Thus, Log Analytics alone is only a component of a SIEM, not a complete monitoring and security analysis solution.

• ✗

  Microsoft Defender for Cloud

  Why it's wrong here

  Microsoft Defender for Cloud is a cloud security posture management (CSPM) and cloud workload protection platform (CWPP) that generates security recommendations, assesses regulatory compliance, and detects threats on Azure workloads, but it is not designed for centralized log management or custom security event analysis. It pulls security findings into your environment, and it can stream those alerts to Sentinel, but it does not give you a unified SIEM interface to query arbitrary logs from all sources, build custom detection rules, or manage incident response across your entire hybrid estate. Therefore, Defender for Cloud answers 'how secure is my posture?' rather than 'what did these logs mean?' and is not a replacement for Sentinel.

• ✗

  Azure Monitor

  Why it's wrong here

  Azure Monitor provides broad observability—collecting platform metrics, resource logs, and application telemetry and enabling dashboards, alerts, and workbook visualizations—but it is not a SIEM because it lacks the forensic analysis, correlation of security signals, entity and user-behavior analytics, and built-in threat response playbooks expected from a security information and event management platform. Azure Monitor's alerts are operational or based on simple queries, and it does not integrate with external threat intelligence feeds to enrich security events or automatically open incident tracks. It is the infrastructure under a SIEM, not the SIEM itself, which is why you would need Sentinel to perform security event analysis and custom alerting beyond basic monitoring.

• ✓

  Microsoft Sentinel

  Why this is correct

  Microsoft Sentinel is a cloud-native, scalable SIEM (Security Information and Event Management) solution that builds on Azure Log Analytics to provide centralized log management, analysis, and custom alerting across your entire digital estate. It ingests data from hundreds of sources—Microsoft services, third-party firewalls, cloud workloads, and on-premises systems—then uses KQL queries, analytics rules, and machine learning to detect threats, and its SOAR capabilities automate incident response. Sentinel also offers entity behavior analytics and integrated threat intelligence, making it the only option listed that meets the stated requirement for a monitoring solution that includes log management, security analysis, and custom alerts.

Go deeper

Related to this question