Secure Azure using Microsoft Defender for Cloud and Microsoft Sentinel →hardMultiple ChoiceObjective-mapped
AZ-500 Practice Question: Secure Azure using Microsoft Defender for Cloud and Microsoft Sentinel
You are a security architect for a large enterprise with 500 Azure subscriptions organized into a management group hierarchy. The company uses Microsoft Defender for Cloud to assess security posture. The CISO wants a single dashboard view of the secure score across all subscriptions, but with the ability to drill down into individual management groups. You need to recommend a solution that provides this capability with minimal administrative overhead. The company already has Log Analytics workspaces deployed per region. Which approach should you take?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use the Microsoft Defender for Cloud dashboard in the Azure portal, selecting the root management group to view aggregated score
The Microsoft Defender for Cloud dashboard in the Azure portal naturally aggregates secure scores at the management group level when you select the root management group. This provides a single dashboard view with drill-down capability into individual management groups without any additional configuration, minimizing administrative overhead. Option A is incorrect because exporting to a Log Analytics workspace and creating a custom workbook adds unnecessary complexity and overhead for a simple aggregated view. Option B is incorrect because integrating with Power BI requires additional setup and licensing, and is not the simplest approach. Option D is incorrect because building a custom dashboard using the REST API requires development effort and maintenance, which is more overhead than using the built-in dashboard.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Export the secure score to a Log Analytics workspace and create a custom workbook
Why it's wrong here
Exporting the secure score to a Log Analytics workspace requires configuring continuous export settings or a policy to push the score data, and then building a custom workbook that queries the data and renders visualizations. This approach incurs additional data ingestion costs and requires maintaining the workbook's KQL queries and layout over time. It duplicates functionality that the Defender for Cloud dashboard already provides natively, making it a higher-overhead solution than simply opening the portal and selecting the root management group.
- ✗
Integrate Defender for Cloud with Microsoft Power BI and create a report
Why it's wrong here
Integrating Defender for Cloud with Power BI requires exporting the secure score data via continuous export or the REST API, then authoring a Power BI report to model and visualize it. This approach adds a separate dependency on Power BI licensing, dataset refresh schedules, and report development, none of which are necessary when the Azure portal already provides a native drill-down view. For a quick assessment of the aggregated score across a management group, this is over-engineered and introduces unnecessary complexity.
- ✓
Use the Microsoft Defender for Cloud dashboard in the Azure portal, selecting the root management group to view aggregated score
Why this is correct
The Defender for Cloud dashboard in the Azure portal provides built-in aggregation at the management group level, allowing you to view the secure score for the root management group and drill down. This is the simplest approach with minimal overhead.
- ✗
Use the Microsoft Defender for Cloud REST API to retrieve the secure score and build a custom dashboard
Why it's wrong here
Using the Defender for Cloud REST API to retrieve secure scores requires writing code to authenticate (e.g., via Azure AD tokens), paginate through management group and subscription results, and then designing a custom front-end dashboard to display the score. This involves ongoing development, deployment, and maintenance efforts to handle API versioning, permissions, and error handling. For a single consolidated view, the built-in dashboard's built-in aggregation and drill-down capability is the minimal-overhead choice, as it avoids all custom coding.
Go deeper
Related to this question
About these practice questions
This AZ-500 question is part of Courseiva's 194-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-500 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-500 exam.