AZ-500 Manage identity and access Practice Question
A cloud security team wants Defender for Cloud to assess AWS accounts and GCP projects from the same portal used for Azure posture management. What should they configure?
⚠ Common exam trap
Watch out — candidates often confuse Defender for Cloud's multicloud posture assessment with Microsoft Sentinel's SIEM data connectors, assuming any cloud integration must go through Sentinel, when in fact Defender for Cloud has its own dedicated multicloud connector for posture management.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Environment settings with multicloud connectors
Defender for Cloud's multicloud connectors allow you to onboard AWS accounts and GCP projects directly into the Azure portal, enabling unified security posture management across all three cloud environments. This feature integrates with AWS Security Hub and GCP Security Command Center to aggregate findings and assessments into a single dashboard, without requiring any migration of workloads.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Environment settings with multicloud connectors
Why this is correct
Environment settings in Microsoft Defender for Cloud provide the multicloud connectors that onboard AWS accounts at the subscription level, enabling continuous security posture management (CSPM), asset inventory, and regulatory compliance scoring across AWS services. The connector integrates with AWS Security Hub and CloudTrail to aggregate findings, and without creating this connector, Defender for Cloud cannot assess the AWS environment. This is the only option that directly fulfills the stated requirement for cloud security assessment.
- ✗
Azure Arc-enabled Kubernetes only
Why it's wrong here
Azure Arc-enabled Kubernetes extends Azure management and policy governance to Kubernetes clusters running in AWS EKS, but it only covers those clusters and does not assess the broader AWS environment such as EC2 instances, S3 buckets, IAM roles, or AWS Security Hub findings. Defender for Cloud's multicloud connector operates at the AWS account level to pull comprehensive security and compliance data, so Arc alone is insufficient and does not meet the requirement.
- ✗
Microsoft Sentinel data connector for AWS CloudTrail only
Why it's wrong here
The Microsoft Sentinel data connector for AWS CloudTrail is a SIEM ingestion path that collects CloudTrail log data for detection, hunting, and incident response in Sentinel, but it does not perform continuous security posture assessment or compliance monitoring of AWS resources. Defender for Cloud's multicloud connector uses AWS Security Hub and CloudTrail to provide CSPM and threat protection, not just log collection. Therefore, this connector alone cannot fulfill the assessment requirement.
- ✗
Azure Lighthouse delegation
Why it's wrong here
Azure Lighthouse is a cross-tenant management service for Azure resources that lets service providers manage subscriptions or resource groups across multiple Azure tenants using delegated access. It has no capability to connect to or assess AWS environments, as the multicloud integration in Defender for Cloud relies on AWS-native APIs and the Security Hub/CloudTrail connectors. Consequently, this option is irrelevant to the stated requirement and cannot meet it.
Go deeper
Related to this question
About these practice questions
One of 617 original AZ-500 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-500 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-500 exam.