AZ-500 Manage identity and access Practice Question
This AZ-500 practice question tests your understanding of manage identity and access. Match the stated requirement to the specific cloud service, access model, or configuration option — many options are valid in isolation but not for this scenario. A key principle to apply: workflow automation triggers Logic Apps based on Defender for Cloud events.. Once you have made your selection, read the full explanation to reinforce the concept and understand why each distractor is designed to mislead on exam day.
A security analyst uses Microsoft Defender for Cloud. They need to automatically apply a specific remediation action (e.g., enable audit logging) to a set of Azure SQL servers that are found to be non-compliant with a security policy. Which Defender for Cloud feature should they use?
Correct. Workflow automation can automatically trigger a Logic App in response to a security recommendation being generated, enabling automated remediation.
B
Continuous export
Why wrong: Continuous export sends security alerts and recommendations to a Log Analytics workspace or Event Hub for external consumption, but it does not perform automated remediation.
C
Alert suppression rules
Why wrong: Alert suppression rules hide specific alerts, but they do not take remediation actions. They are used to reduce noise.
D
Regulatory compliance dashboard
Why wrong: The regulatory compliance dashboard shows the compliance status against standards but does not provide automated remediation actions.
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Workflow automation
Workflow automation in Microsoft Defender for Cloud allows you to trigger Logic Apps based on security alerts or policy compliance changes. By configuring a workflow automation rule that triggers on the 'Non-compliant resource' condition for the specific Azure SQL servers, you can automatically invoke a remediation action, such as enabling audit logging, without manual intervention.
Key principle: Workflow automation triggers Logic Apps based on Defender for Cloud events.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
✓
Workflow automation
Why this is correct
Correct. Workflow automation can automatically trigger a Logic App in response to a security recommendation being generated, enabling automated remediation.
Related concept
Workflow automation triggers Logic Apps based on Defender for Cloud events.
✗
Continuous export
Why it's wrong here
Continuous export sends security alerts and recommendations to a Log Analytics workspace or Event Hub for external consumption, but it does not perform automated remediation.
✗
Alert suppression rules
Why it's wrong here
Alert suppression rules hide specific alerts, but they do not take remediation actions. They are used to reduce noise.
✗
Regulatory compliance dashboard
Why it's wrong here
The regulatory compliance dashboard shows the compliance status against standards but does not provide automated remediation actions.
Common exam traps
Common exam trap: answer the scenario, not the keyword
The trap here is that candidates often confuse 'Continuous export' with automation, thinking exporting data to a Log Analytics workspace can trigger remediation, but it only provides raw data for downstream processing, not direct action.
Trap categories for this question
Command / output trap
The regulatory compliance dashboard shows the compliance status against standards but does not provide automated remediation actions.
Detailed technical explanation
How to think about this question
Workflow automation leverages Azure Logic Apps, which can contain connectors to Azure SQL Server to execute T-SQL commands like ALTER DATABASE SET AUDIT ON. The trigger condition uses a Kusto query-like filter on the 'Non-compliant resource' event, and the Logic App can be scoped to specific resource groups or subscriptions. A real-world scenario is automatically enabling Advanced Data Security on SQL servers flagged by the 'SQL auditing should be enabled' recommendation, reducing manual security operations overhead.
KKey Concepts to Remember
Workflow automation triggers Logic Apps based on Defender for Cloud events.
It enables automated remediation of security recommendations.
Common triggers include new recommendations, security alerts, or compliance changes.
Logic Apps can perform actions like API calls to fix non-compliant resources.
TExam Day Tips
→Watch for words such as best, first, most likely and least administrative effort.
→Review why wrong options are wrong, not only why the correct option is correct.
Key takeaway
Workflow automation triggers Logic Apps based on Defender for Cloud events.
Real-world example
How this comes up in practice
A cloud solutions architect for a retail company is evaluating services for a new workload. The correct answer here reflects best practice for the specific scenario described — not a general cloud recommendation. Workflow automation triggers Logic Apps based on Defender for Cloud events. Cloud exam questions reward reading the constraint carefully: the same technology can be right or wrong depending on the use case.
Related glossary terms
Concepts from this question explained
These glossary pages explain the core terms tested in this AZ-500 question in full detail.
Review workflow automation triggers Logic Apps based on Defender for Cloud events., then practise related AZ-500 questions on the same topic to reinforce the concept.
Manage identity and access — This question tests Manage identity and access — Workflow automation triggers Logic Apps based on Defender for Cloud events..
What is the correct answer to this question?
The correct answer is: Workflow automation — Workflow automation in Microsoft Defender for Cloud allows you to trigger Logic Apps based on security alerts or policy compliance changes. By configuring a workflow automation rule that triggers on the 'Non-compliant resource' condition for the specific Azure SQL servers, you can automatically invoke a remediation action, such as enabling audit logging, without manual intervention.
What should I do if I get this AZ-500 question wrong?
Review workflow automation triggers Logic Apps based on Defender for Cloud events., then practise related AZ-500 questions on the same topic to reinforce the concept.
What is the key concept behind this question?
Workflow automation triggers Logic Apps based on Defender for Cloud events.
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
This AZ-500 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-500 exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.