- A
Configure the 'Email notifications' setting in Defender for Cloud to send alerts to the required email addresses.
This is correct. Defender for Cloud can be configured to email security alerts to a list of recipients based on severity.
- B
Create a workflow automation in Defender for Cloud that sends an email when a high-severity alert is generated.
Why wrong: Workflow automations require additional integration (e.g., Logic Apps) and are not the built-in email notification method.
- C
Enable continuous export to stream all security alerts to a Log Analytics workspace and create an alert rule to send email.
Why wrong: Continuous export moves data to a workspace, but does not directly send email notifications. It is more complex than the built-in option.
- D
Enable the 'Send email alerts' option in the Azure Monitor activity log alert rule.
Why wrong: Activity log alerts are separate from Defender for Cloud security alerts and do not cover the same scope.
Quick Answer
The correct answer is to configure the 'Email notifications' setting in Microsoft Defender for Cloud to send alerts to the required email addresses. This built-in feature directly addresses the need for email notifications for high-severity security alerts by allowing administrators to specify one or more recipients who will receive an email whenever a high-severity alert is triggered for any resource in the subscription, without requiring additional logic apps or automation rules. On the AZ-500 exam, this tests your understanding of Defender for Cloud’s native notification capabilities versus more complex solutions like Azure Monitor action groups or custom playbooks—a common trap is to over-engineer the answer by selecting an automation rule when the simple, direct email notification setting is sufficient. A useful memory tip: think of it as the "fire alarm" setting—it’s the one place you flip a switch to get a direct call, not a chain of automated responses.
AZ-500 Manage identity and access Practice Question
This AZ-500 practice question tests your understanding of manage identity and access. This is a configuration task: choose the command set that satisfies every stated requirement. Small differences — like 'secret' vs 'password' or 'transport input ssh' vs 'all' — change whether the answer is correct. A key principle to apply: defender for Cloud's 'Email notifications' is a built-in feature.. Once you have made your selection, read the full explanation to reinforce the concept and understand why each distractor is designed to mislead on exam day.
A company uses Microsoft Defender for Cloud. They want to receive email notifications when a high-severity security alert is generated for any resource in the subscription. Which configuration should they make in Defender for Cloud?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
Configure the 'Email notifications' setting in Defender for Cloud to send alerts to the required email addresses.
Option A is correct because the 'Email notifications' setting in Microsoft Defender for Cloud allows you to directly configure email recipients to receive notifications for high-severity alerts. This built-in feature sends emails to specified addresses whenever a high-severity security alert is triggered for any resource in the subscription, without requiring additional automation or external tools.
Key principle: Defender for Cloud's 'Email notifications' is a built-in feature.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Configure the 'Email notifications' setting in Defender for Cloud to send alerts to the required email addresses.
Why this is correct
This is correct. Defender for Cloud can be configured to email security alerts to a list of recipients based on severity.
Related concept
Defender for Cloud's 'Email notifications' is a built-in feature.
- ✗
Create a workflow automation in Defender for Cloud that sends an email when a high-severity alert is generated.
Why it's wrong here
Workflow automations require additional integration (e.g., Logic Apps) and are not the built-in email notification method.
- ✗
Enable continuous export to stream all security alerts to a Log Analytics workspace and create an alert rule to send email.
Why it's wrong here
Continuous export moves data to a workspace, but does not directly send email notifications. It is more complex than the built-in option.
- ✗
Enable the 'Send email alerts' option in the Azure Monitor activity log alert rule.
Why it's wrong here
Activity log alerts are separate from Defender for Cloud security alerts and do not cover the same scope.
Common exam traps
Common exam trap: answer the scenario, not the keyword
The trap here is that candidates often confuse workflow automation (Option B) as the primary method for email notifications, but Microsoft Defender for Cloud has a dedicated 'Email notifications' setting specifically for this purpose, making it the simplest and correct configuration.
Detailed technical explanation
How to think about this question
The 'Email notifications' setting in Defender for Cloud uses the Azure Resource Manager-based security alert pipeline to send SMTP-based emails directly from the Defender for Cloud service. This setting supports multiple email addresses and can be scoped to subscription or management group level, ensuring that all high-severity alerts (severity level 'High') trigger an email without additional overhead. In a real-world scenario, this is ideal for security operations teams that need immediate, out-of-band notifications without relying on complex automation or log ingestion delays.
KKey Concepts to Remember
- Defender for Cloud's 'Email notifications' is a built-in feature.
- It allows specifying recipient email addresses for security alerts.
- Notifications can be filtered by minimum alert severity (e.g., High, Medium, Low).
- This setting applies to all resources within the configured subscription.
TExam Day Tips
- Watch for words such as best, first, most likely and least administrative effort.
- Review why wrong options are wrong, not only why the correct option is correct.
Key takeaway
Defender for Cloud's 'Email notifications' is a built-in feature.
Real-world example
How this comes up in practice
A cloud solutions architect for a retail company is evaluating services for a new workload. The correct answer here reflects best practice for the specific scenario described — not a general cloud recommendation. Defender for Cloud's 'Email notifications' is a built-in feature. Cloud exam questions reward reading the constraint carefully: the same technology can be right or wrong depending on the use case.
What to study next
Got this wrong? Here's your next step.
Review defender for Cloud's 'Email notifications' is a built-in feature., then practise related AZ-500 questions on the same topic to reinforce the concept.
- →
Manage identity and access — study guide chapter
Learn the concepts, then practise the questions
- →
Manage identity and access practice questions
Targeted practice on this topic area only
- →
All AZ-500 questions
1,000 questions across all exam domains
- →
Microsoft Azure Security Engineer Associate AZ-500 study guide
Full concept coverage aligned to exam objectives
- →
AZ-500 practice test guide
How to use practice tests most effectively before exam day
Related practice questions
Related AZ-500 practice-question pages
Use these pages to review the topic behind this question. This is how one missed question becomes focused revision.
Secure identity and access practice questions
Practise AZ-500 questions linked to Secure identity and access.
Secure compute, storage, and databases practice questions
Practise AZ-500 questions linked to Secure compute, storage, and databases.
Secure Azure using Microsoft Defender for Cloud and Microsoft Sentinel practice questions
Practise AZ-500 questions linked to Secure Azure using Microsoft Defender for Cloud and Microsoft Sentinel.
Manage identity and access practice questions
Practise AZ-500 questions linked to Manage identity and access.
Secure networking practice questions
Practise AZ-500 questions linked to Secure networking.
AZ-500 fundamentals practice questions
Practise AZ-500 questions linked to AZ-500 fundamentals.
AZ-500 scenario practice questions
Practise AZ-500 questions linked to AZ-500 scenario.
AZ-500 troubleshooting practice questions
Practise AZ-500 questions linked to AZ-500 troubleshooting.
Practice this exam
Start a free AZ-500 practice session
Short sessions build daily habit. Longer sessions build exam-day stamina. Try a timed session to simulate real conditions.
FAQ
Questions learners often ask
What does this AZ-500 question test?
Manage identity and access — This question tests Manage identity and access — Defender for Cloud's 'Email notifications' is a built-in feature..
What is the correct answer to this question?
The correct answer is: Configure the 'Email notifications' setting in Defender for Cloud to send alerts to the required email addresses. — Option A is correct because the 'Email notifications' setting in Microsoft Defender for Cloud allows you to directly configure email recipients to receive notifications for high-severity alerts. This built-in feature sends emails to specified addresses whenever a high-severity security alert is triggered for any resource in the subscription, without requiring additional automation or external tools.
What should I do if I get this AZ-500 question wrong?
Review defender for Cloud's 'Email notifications' is a built-in feature., then practise related AZ-500 questions on the same topic to reinforce the concept.
What is the key concept behind this question?
Defender for Cloud's 'Email notifications' is a built-in feature.
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
Last reviewed: Jun 11, 2026
This AZ-500 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-500 exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.