AZ-500 Practice Question: Secure Azure using Microsoft Defender for Cloud and Microsoft Sentinel
You are a security analyst using Microsoft Defender for Cloud. You need to ensure that any new Azure subscription added to your management group automatically receives the default security policy assignments and that security recommendations are continuously assessed. What should you enable?
⚠ Common exam trap
The trap here is assuming that enabling auto-provisioning or onboarding to Sentinel will automatically apply security policies; those features handle data collection and threat detection, not policy assignment.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Azure Policy initiative assignment at the management group scope.
To ensure that new subscriptions automatically receive security policy assignments and continuous assessment, you should assign the appropriate Azure Policy initiative (such as the Microsoft cloud security benchmark) at the management group level. Subscriptions within that management group inherit the policy, and Defender for Cloud continuously evaluates resources against the policy, providing recommendations. This centralized approach simplifies governance and ensures compliance across all subscriptions without manual intervention.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Azure Policy initiative assignment at the management group scope.
Why this is correct
Assigning the Azure Security Benchmark or default Microsoft Defender for Cloud policy initiative at the management group scope ensures that all subscriptions within that management group inherit the policy assignments. This enables continuous assessment and automatic application of security policies to new subscriptions. It is the recommended approach for centralized governance and meets the requirement for automatic policy application.
- ✗
Azure Arc enrollment for all servers in the subscriptions.
Why it's wrong here
Azure Arc extends Azure management to on-premises and multi-cloud servers, but it does not assign security policies to subscriptions or enable continuous assessment by Defender for Cloud. While Arc can help with monitoring, it is not the mechanism for policy inheritance. The requirement is specifically about policy assignment and assessment at scale, which is achieved through Azure Policy at the management group scope.
- ✗
Microsoft Sentinel workspace onboarding for each subscription.
Why it's wrong here
Microsoft Sentinel is a SIEM/SOAR solution and does not automatically assign security policies or perform continuous assessment of subscriptions for Defender for Cloud. Onboarding subscriptions to Sentinel is for log ingestion and threat detection, not for policy management. This would not fulfill the requirement of automatic policy assignment and assessment.
- ✗
Microsoft Defender for Cloud auto-provisioning of the Log Analytics agent.
Why it's wrong here
Auto-provisioning of the Log Analytics agent is used to collect security data from virtual machines, but it does not assign security policies or ensure continuous assessment of subscriptions. While it is part of Defender for Cloud, it addresses data collection, not policy assignment. The requirement is about policy inheritance and assessment, which is handled by Azure Policy, not agent provisioning.
Go deeper
Related to this question
About these practice questions
Courseiva writes every AZ-500 question from scratch — 617 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Microsoft exam blueprint
This AZ-500 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-500 exam.