AZ-500 Manage identity and access Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Create an alert rule in Azure Monitor that triggers an email when a security alert is raised.

  Why it's wrong here

  Creating an alert rule in Azure Monitor is not the direct mechanism for receiving email notifications for security alerts generated by Microsoft Defender for Cloud. Defender for Cloud has dedicated email notification settings within its own portal, specifically designed to configure recipients for high-severity security alerts. Azure Monitor alert rules are primarily used for monitoring resource metrics, activity logs, or custom log queries in Log Analytics workspaces, making them suitable for alerting on broader operational issues or security events *exported* to Log Analytics, rather than native Defender for Cloud alerts.

• ✓

  Configure email notifications in the Defender for Cloud settings under 'Notifications'.

  Why this is correct

  Configuring email notifications directly in Microsoft Defender for Cloud is the native, built-in mechanism for receiving security alert emails. In the Defender for Cloud portal, you navigate to Environment Settings, select the relevant subscription, and under 'Notifications' you can specify recipient email addresses and the severity levels (e.g., High, Medium, Low) that trigger emails. This setting is managed within Defender for Cloud itself, so it does not require external services like Azure Monitor, Logic Apps, or a separate SIEM, and it is the exact option designed for this scenario.

• ✗

  Use a Logic Apps playbook to send an email when a new alert is generated.

  Why it's wrong here

  Using a Logic Apps playbook is incorrect because Defender for Cloud provides a native 'Email notifications' setting specifically for sending email alerts based on severity. Logic Apps are designed for orchestrating automated responses, such as triggering remediation actions or integrating with external systems like a SIEM or ticketing platform, rather than configuring basic alert notifications directly. It is tempting as Logic Apps can send emails, but they are for custom, automated workflows beyond simple, built-in alerting.

• ✗

  Set up a workflow automation rule in Microsoft Sentinel to forward alerts to email.

  Why it's wrong here

  Setting up a workflow automation rule in Microsoft Sentinel is not the correct way to receive email notifications for Defender for Cloud alerts because Sentinel is a separate, cloud-native SIEM platform, not the alerting engine for Defender for Cloud. Workflow automation rules in Sentinel are used to automate incident response tasks, such as creating tickets or triggering playbooks, and they require Defender for Cloud to be connected as a data source via the continuous export or connector, which is an additional, indirect integration. In contrast, Defender for Cloud has its own 'Email notifications' configuration under the portal's Settings/Notifications section, which directly sends alert emails based on severity without relying on Sentinel's separate automation framework.

Go deeper

Related to this question