AZ-500 Secure compute, storage, and databases Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✓

  1. Enable Azure Defender for SQL on the database. 2. Configure a storage account for vulnerability assessment scans. 3. Set up email notifications for security alerts.

  Why this is correct

  This is the correct order because Azure Defender for SQL must be enabled first to activate security monitoring, then you configure storage to store vulnerability assessment results, and finally you may set up email notifications for alerts as a post-configuration step.

• ✗

  1. Configure a storage account for vulnerability assessment scans. 2. Enable Azure Defender for SQL on the database. 3. Set up email notifications for security alerts.

  Why it's wrong here

  The sequence is invalid because the vulnerability assessment component of Azure Defender for SQL requires the Defender plan to be activated on the database first; only then does the 'Storage account' setting for scan results become available and linked correctly. If you pre-create a storage account and attempt to configure it for scans before enabling Defender, you are simply creating an orphaned resource that cannot be attached to the Defender vulnerability assessment settings, since the assessment provider is not yet registered on the database. Additionally, the Azure portal's workflow for enabling Defender for SQL prompts for the vulnerability assessment storage account as part of the enablement flow, so reversing these steps breaks the dependency chain. Therefore, you must enable Defender first to establish the security monitoring and assessment engine before pointing it to a storage location.

• ✗

  1. Enable Azure Defender for SQL on the database. 2. Set up email notifications for security alerts. 3. Configure a storage account for vulnerability assessment scans.

  Why it's wrong here

  This is incorrect because configuring storage for vulnerability assessment scans should be done before setting up email notifications; the storage is required for scan results to be stored and analyzed, while notifications are optional and usually configured after the main setup.

• ✗

  1. Set up email notifications for security alerts. 2. Enable Azure Defender for SQL on the database. 3. Configure a storage account for vulnerability assessment scans.

  Why it's wrong here

  This is incorrect because you cannot set up email notifications before enabling Azure Defender for SQL, as alerts are generated only after Defender is active. Additionally, storage configuration should occur after enabling but before or alongside notifications.

Go deeper

Related to this question