AZ-500 Manage identity and access Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Security Alerts from Microsoft Defender for Cloud

  Why it's wrong here

  Security alerts in Microsoft Defender for Cloud are triggered by detected threats such as suspicious sign-ins, malware, or anomalous resource behavior. They are not triggered by changes in regulatory compliance assessments, which are based on Azure Policy definitions and reflect control status like "Failed" or "Passed." Therefore, security alerts cannot be used to proactively notify an administrator when a compliance control fails. To receive such notifications, you need a mechanism specifically tied to assessment changes, not threat detections.

• ✗

  Regulatory Compliance dashboard with continuous export

  Why it's wrong here

  The Regulatory Compliance dashboard provides a visual summary of your compliance posture against standards like CIS or PCI DSS, but it does not emit notifications when an assessment changes. Continuous export can stream assessment data to a Log Analytics workspace or Event Hubs, yet it only moves data; it does not generate email or SMS alerts directly. To trigger notifications from the exported data, you would need to layer Azure Monitor alert rules or an external automation solution on top. Thus, continuous export alone is not a notification mechanism for compliance violations.

• ✓

  Workflow automation based on regulatory compliance assessment changes

  Why this is correct

  Workflow automation in Microsoft Defender for Cloud is the native mechanism to react to changes in regulatory compliance assessments. You configure an automation rule to watch for a specific assessment status change (e.g., a control failing) and then invoke a Logic App or Power Automate flow to send an email, post to Teams, or create a ticket. This provides the proactive notification (e.g., email) required by the scenario. It is the only built-in way to directly trigger external actions based on compliance assessment changes.

• ✗

  Custom recommendations in Microsoft Defender for Cloud

  Why it's wrong here

  Custom recommendations allow you to define your own security best practices and assessments within Defender for Cloud, extending the built-in recommendations. However, they are only visible in the recommendations list and do not have any native notification capability on their own. If a custom recommendation's assessment changes, it does not trigger an email unless you explicitly attach a workflow automation rule to it. Therefore, custom recommendations are for defining rules, not for delivering alerts when standards are violated.

Go deeper

Related to this question