AZ-500 Manage identity and access Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✓

  Enable the integrated vulnerability assessment solution (Qualys) in Defender for Cloud

  Why this is correct

  The integrated vulnerability assessment (VA) solution in Defender for Cloud uses Qualys as the built-in scanner, and it is available at no additional cost for both Azure VMs and Arc-enabled on-premises servers. When you enable it, Defender for Cloud deploys the Qualys agent and automatically performs continuous OS vulnerability scanning, mapping findings to CVEs and security misconfigurations. This is the native, first-party path that does not require a separate Qualys license, making it the correct way to meet the monitoring requirement.

• ✗

  Enable Microsoft Defender for Endpoint and integrate it with Defender for Cloud

  Why it's wrong here

  Integrating Microsoft Defender for Endpoint (MDE) with Defender for Cloud provides threat and vulnerability management (TVM) governed by Microsoft's threat intelligence, but it requires a separate MDE license, typically Microsoft 365 E5 or a standalone add-on. While it can replace the built-in Qualys scanner once properly onboarded, it is not the no-extra-cost, automatically deployed solution the question implies. Additionally, MDE is primarily an endpoint detection and response platform, so relying on it here would be a licensing and architecture decision, not the default integrated VA solution.

• ✗

  Configure Azure Update Management to assess missing patches

  Why it's wrong here

  Azure Update Management (currently Update Management Center) is a patch management service that reports missing OS updates and installs them, but it does not assess a machine's full security posture, such as CVE-level vulnerabilities, misconfigured services, or unsupported software versions. It only addresses the 'missing patches' vector and lacks the vulnerability detection database and interactive risk scoring that a dedicated VA scanner like Qualys provides. Thus, it would leave configuration weaknesses and application-level vulnerabilities undiscovered, which is why it is not an adequate replacement for the integrated VA solution.

• ✗

  Use Azure Policy to deploy the Log Analytics agent and manually enable scanning

  Why it's wrong here

  Assigning an Azure Policy initiative to deploy the Log Analytics agent on your VMs only installs the common telemetry agent; it does not deploy a vulnerability scanner or trigger any security assessment. The integrated Qualys VA solution depends on the Log Analytics agent as a prerequisite but also requires an explicit enabled VA solution and the associated Qualys extension to be configured. Manually 'enabling scanning' is not an automated capability of policy alone; without the VA extension and provider registration, no CVE or configuration data is collected, so this option falls short.

Go deeper

Related to this question