AZ-500 Manage identity and access Practice Question
A security team uses Microsoft Defender for Cloud. They want to ensure that all Azure virtual machines have the guest configuration extension installed to apply a security baseline automatically. They need to remediate non-compliant VMs without manual intervention. Which Defender for Cloud feature should be configured?
⚠ Common exam trap
Many exam-takers confuse automatic provisioning of the Log Analytics agent (which collects logs) with the guest configuration extension (which applies baselines), or they assume that Automation rules or scheduled tasks can proactively deploy extensions, when only a DeployIfNotExists policy can enforce deployment without manual steps or external triggers.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Assign a security policy (built-in initiative) that includes a policy with DeployIfNotExists effect
The guest configuration extension is deployed automatically via a DeployIfNotExists policy effect within a built-in initiative (such as the Azure Security Benchmark). This effect evaluates VMs for the extension and, if missing, deploys it without manual intervention, ensuring the security baseline is applied. Defender for Cloud uses this policy-driven approach to remediate non-compliant resources at scale.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Assign a security policy (built-in initiative) that includes a policy with DeployIfNotExists effect
Why this is correct
The built-in Microsoft Defender for Cloud initiative (such as the default Azure Security Benchmark) includes policy definitions with the DeployIfNotExists effect, for example 'Deploy prerequisites to enable Guest Configuration policies on Windows VMs.' When assigned, this policy evaluates each VM and, if the Guest Configuration extension is missing, automatically deploys it using a managed identity and nested ARM template. This provides continuous, at-scale remediation without manual intervention, making it the correct choice.
- ✗
Enable automatic provisioning of the Log Analytics agent
Why it's wrong here
Enabling automatic provisioning of the Log Analytics agent only configures the agent for collecting security data such as event logs and performance counters. It does not install the Guest Configuration extension, which is the component that actually applies and audits machine configuration baselines. This setting is purely for data collection, so it cannot automatically remediate the missing extension or satisfy the guest configuration prerequisite.
- ✗
Create an Automation rule that triggers a runbook when a recommendation appears
Why it's wrong here
An Automation rule that triggers a runbook when a recommendation appears is event-driven and requires you to author and maintain a custom Azure Automation runbook (PowerShell or Python) to perform the remediation. It is not a built-in template-driven remediation path, and it only reacts after Defender for Cloud has already detected the issue rather than continuously enforcing compliance. This approach adds unnecessary complexity and manual effort compared with assigning a policy with DeployIfNotExists.
- ✗
Configure a workflow automation scheduled task
Why it's wrong here
Workflow automation in Microsoft Defender for Cloud is event-driven; it responds to triggers such as a recommendation being created or an alert being generated, and it is not designed to run on a schedule. Configuring a scheduled task would require custom Logic Apps or Azure Automation runbooks and would not automatically deploy the Guest Configuration extension. Therefore, it does not provide the built-in, at-scale remediation that the DeployIfNotExists policy effect offers.
Go deeper
Related to this question
About these practice questions
Courseiva writes every AZ-500 question from scratch — 617 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-500 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-500 exam.