AZ-500 Manage identity and access Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Continuous export to a Log Analytics workspace

  Why it's wrong here

  Continuous export to a Log Analytics workspace streams all security alerts and recommendations in near real time, allowing custom KQL queries, workbooks, and long-term retention. It is a data pipeline, not a messaging service, so it has no native mechanism to compose and deliver a human-readable emailed digest on a weekly cadence. While you could build an Azure Logic App on top of the workspace to schedule email, that would be a custom addition rather than the built-in capability described.

• ✓

  Email notifications for weekly digest

  Why this is correct

  Within Microsoft Defender for Cloud's 'Email notifications' settings, the 'Send weekly digest' checkbox enables an automatic email containing your Secure Score, top recommendations, and number of healthy resources. This digest can be addressed to all users with specific roles or to a custom list of email addresses, and it is delivered once per week without any additional Logic App or export configuration. It is the only first-party feature that matches the security team's requirement for a weekly email summary.

• ✗

  Automation rules to trigger a Logic App on a schedule

  Why it's wrong here

  Automation rules in Defender for Cloud are event-driven triggers that execute Logic Apps or other actions only when a security alert or recommendation is created, fired, or changes state. They have no time-based trigger component, so a rule cannot be configured to run on a fixed schedule such as every Monday at a specific time for a periodic digest. Achieving that schedule would require a standalone Logic App with a Recurrence trigger, which is outside the scope of a Defender automation rule.

• ✗

  Workflow automation to export data daily

  Why it's wrong here

  Workflow automation (the former name for automation rules) is also event-driven: each time a relevant security event occurs, the defined actions run immediately, but no mechanism exists to queue an action for a specific time of day. A 'daily export' cannot be set at this layer because the feature lacks a scheduler; if multiple alerts occur on the same day, actions run repeatedly, which is not a consolidated daily email. Like automation rules, it is strictly a reactive integration, not a scheduled delivery channel.

Go deeper

Related to this question