AZ-500 Practice Question: Secure Azure using Microsoft Defender for Cloud and Microsoft Sentinel
Which TWO of the following data connectors are available by default in Microsoft Sentinel?
⚠ Common exam trap
Many exam-takers assume any popular third-party service (like Palo Alto Networks or AWS) is a default connector because of its common use in security monitoring, but Microsoft Sentinel only includes first-party Microsoft services as default connectors, while all third-party integrations require manual setup.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Microsoft Entra ID
Microsoft Entra ID (Option C) is a default data connector in Microsoft Sentinel because it provides native integration for streaming Microsoft Entra ID audit logs and sign-in logs directly into Sentinel without requiring additional licensing or configuration beyond enabling the connector. This is a core Microsoft source that is automatically available in the Sentinel data connector gallery.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Palo Alto Networks
Why it's wrong here
The Palo Alto Networks connector is classified as premium for Microsoft Sentinel and cannot be enabled by default. It depends on forwarding Common Event Format (CEF) logs from your Palo Alto firewall through a syslog/Log Analytics forwarder, which requires extra agent deployment and often a separate Palo Alto or Sentinel premium license. This third-party dependency and additional infrastructure make it a non-default connector.
- ✗
ServiceNow
Why it's wrong here
The ServiceNow connector is a premium data connector that ingests IT Service Management (ITSM) incidents and audit records through the ServiceNow REST API. To use it, you must configure an instance, create API credentials, and often purchase the Sentinel solution or a ServiceNow integration license, so it is not available by default. The setup is entirely SaaS-to-SaaS with external authentication, unlike Microsoft's built-in Azure Activity or Microsoft Entra ID connectors.
- ✓
Microsoft Entra ID
Why this is correct
The Microsoft Entra ID connector, like the Azure Activity connector, is available by default in Microsoft Sentinel because it ingests sign-in logs, audit logs, and provisioning logs directly from the Microsoft cloud platform. You still need to enable it and possess the appropriate Microsoft Entra ID P1/P2 or relevant role permissions, but there is no extra licensing for the connector itself; it is considered a built-in, non-premium connector.
- ✓
Azure Activity
Why this is correct
The Azure Activity connector is a built-in data connector in Microsoft Sentinel that streams subscription-level audit logs (control plane events) directly without requiring additional licensing, third-party infrastructure, or a premium solution. It is enabled from the Data connectors blade using your existing Azure permissions, which is why it is considered available by default.
- ✗
Amazon Web Services (AWS)
Why it's wrong here
The Amazon Web Services (AWS) connector is a premium offering, not a default connector, because it requires integration with external cloud infrastructure such as S3 buckets, CloudTrail logs, and often Kinesis or a Security Hub role. This cross-cloud setup involves configuration outside Microsoft Sentinel and typically requires purchasing or licensing the solution through the Sentinel content hub, unlike the out-of-the-box Azure connectors.
Go deeper
Related to this question
About these practice questions
This AZ-500 question is part of Courseiva's 617-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-500 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-500 exam.