AZ-500 Manage identity and access Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✓

  Enable the 'Weekly email summary' option in the Defender for Cloud email notifications settings.

  Why this is correct

  Defender for Cloud email notifications settings include 'Weekly email summary' that sends a personalized overview of Secure Score, top recommendations, and alerts to specified recipients. It's a native, built-in reporting feature that can be enabled directly from the environment settings without any external integration or compute. Ensure the email is configured to be sent weekly by checking the 'Weekly email summary' checkbox and setting the recipient email address(es) in the Defender for Cloud email notifications pane.

• ✗

  Configure continuous export to export all security data to a Log Analytics workspace and use a workbook to create a summary.

  Why it's wrong here

  Continuous export to a Log Analytics workspace is a data streaming mechanism that sends security events, alerts, and recommendations to a workspace for retention and querying. A workbook can visualize that data, but it requires building a custom visualization and does not proactively send a formatted email summary on a schedule. Additionally, exporting all security data generates ongoing data ingestion costs and the workbook reflects near-real-time data only as long as the Log Analytics workspace is configured, whereas the weekly email summary is purpose-built for automated delivery.

• ✗

  Create a workflow automation that triggers on a schedule and uses a Logic App to send an email summary.

  Why it's wrong here

  Workflow automations with Logic Apps are designed for custom, event-driven responses to specific security events or for processing data, not for generating the pre-formatted, high-level weekly Secure Score and recommendations summary. That comprehensive summary is a built-in reporting feature within Defender for Cloud. This option is tempting because Logic Apps can send emails and automate tasks, making them ideal for custom automation, such as triggering actions when a *specific alert* is raised, like creating a service desk ticket or notifying a team channel.

• ✗

  Enable the 'Security Policy' default initiative to automatically send reports.

  Why it's wrong here

  The Security Policy default initiative (like the Microsoft cloud security benchmark) is a set of compliance and security baselines applied to assess your environment; it does not send emails or generate scheduled reports. Policies only audit or enforce configuration standards, and compliance information is shown in the Defender for Cloud compliance blade. For automated email reporting, you would need either the built-in weekly email summary or a custom Logic App automation, but the initiative itself is just a definition package.

Go deeper

Related to this question