AZ-500 Manage identity and access Practice Question
This AZ-500 practice question tests your understanding of manage identity and access. This is a configuration task: choose the command set that satisfies every stated requirement. Small differences — like 'secret' vs 'password' or 'transport input ssh' vs 'all' — change whether the answer is correct. A key principle to apply: auto-provisioning automatically deploys agents for security monitoring.. Once you have made your selection, read the full explanation to reinforce the concept and understand why each distractor is designed to mislead on exam day.
A security team uses Microsoft Defender for Cloud to monitor the security posture of their Azure subscription. They want to ensure that whenever a new virtual machine is created, the Log Analytics agent is automatically installed to collect security events. Which feature should they configure in Defender for Cloud?
Why wrong: Automation rules in Defender for Cloud trigger actions like creating tickets or running playbooks in response to alerts, not for agent installation.
B
Auto-provisioning settings
Correct. Auto-provisioning is designed to automatically deploy the Log Analytics agent on Azure VMs (and other supported resources) to enable security monitoring.
C
Security contacts
Why wrong: Security contacts define whom to notify about alerts and are not related to agent installation.
D
Workflow automation
Why wrong: Workflow automation automates responses to security alerts and recommendations but does not handle the initial deployment of agents.
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Auto-provisioning settings
Auto-provisioning settings in Microsoft Defender for Cloud automatically deploy the Log Analytics agent to all supported Azure VMs and new ones as they are created. This ensures that security events are collected without manual intervention, directly addressing the requirement for automatic installation on new VMs.
Key principle: Auto-provisioning automatically deploys agents for security monitoring.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
✗
Automation rules
Why it's wrong here
Automation rules in Defender for Cloud trigger actions like creating tickets or running playbooks in response to alerts, not for agent installation.
✓
Auto-provisioning settings
Why this is correct
Correct. Auto-provisioning is designed to automatically deploy the Log Analytics agent on Azure VMs (and other supported resources) to enable security monitoring.
Related concept
Auto-provisioning automatically deploys agents for security monitoring.
✗
Security contacts
Why it's wrong here
Security contacts define whom to notify about alerts and are not related to agent installation.
✗
Workflow automation
Why it's wrong here
Workflow automation automates responses to security alerts and recommendations but does not handle the initial deployment of agents.
Common exam traps
Common exam trap: answer the scenario, not the keyword
The trap here is confusing 'Auto-provisioning settings' (which installs the agent) with 'Automation rules' (which automate responses in Sentinel), leading candidates to pick a feature from a different service.
Detailed technical explanation
How to think about this question
Auto-provisioning works by enabling the Log Analytics agent extension on VMs via the Azure VM agent, which then connects to a designated Log Analytics workspace. This setting can be scoped to specific management groups or subscriptions, and it supports both Windows and Linux VMs. In a real-world scenario, if auto-provisioning is disabled, new VMs will not have the agent installed, leading to gaps in security event collection and compliance violations.
KKey Concepts to Remember
Auto-provisioning automatically deploys agents for security monitoring.
It ensures Log Analytics agent (or Azure Monitor agent) installation on supported resources.
Auto-provisioning is a foundational step for Defender for Cloud's capabilities.
It applies to new and existing VMs, SQL databases, and other resources.
TExam Day Tips
→Watch for words such as best, first, most likely and least administrative effort.
→Review why wrong options are wrong, not only why the correct option is correct.
Key takeaway
Auto-provisioning automatically deploys agents for security monitoring.
Real-world example
How this comes up in practice
An e-commerce site experiences heavy traffic on Black Friday and near-zero traffic during off-peak weeks. Rather than provisioning permanent large VMs, the team uses auto-scaling groups that add capacity automatically under load and reduce it overnight. Questions like this test whether you understand elasticity, availability zones, and cloud compute scaling patterns.
Related glossary terms
Concepts from this question explained
These glossary pages explain the core terms tested in this AZ-500 question in full detail.
Review auto-provisioning automatically deploys agents for security monitoring., then practise related AZ-500 questions on the same topic to reinforce the concept.
Manage identity and access — This question tests Manage identity and access — Auto-provisioning automatically deploys agents for security monitoring..
What is the correct answer to this question?
The correct answer is: Auto-provisioning settings — Auto-provisioning settings in Microsoft Defender for Cloud automatically deploy the Log Analytics agent to all supported Azure VMs and new ones as they are created. This ensures that security events are collected without manual intervention, directly addressing the requirement for automatic installation on new VMs.
What should I do if I get this AZ-500 question wrong?
Review auto-provisioning automatically deploys agents for security monitoring., then practise related AZ-500 questions on the same topic to reinforce the concept.
What is the key concept behind this question?
Auto-provisioning automatically deploys agents for security monitoring.
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
This AZ-500 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-500 exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.