AZ-500 Practice Question: Secure Azure using Microsoft Defender for Cloud and Microsoft Sentinel

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Create a playbook that forwards alerts to the SIEM

  Why it's wrong here

  Playbooks in Microsoft Defender for Cloud are Azure Logic Apps workflows that execute in response to an alert, typically to run remediation or investigation actions. They are fundamentally event-driven and designed for per-alert response, not for guaranteeing continuous, reliable, high-volume telemetry export. Forwarding alerts to a SIEM via a playbook would require an alert to trigger a Logic App each time, introducing latency and a single point of failure, and any missed trigger would silently drop an alert. This approach cannot serve as a systematic export pipeline because it lacks buffering, retries, and streaming throughput.

• ✗

  Configure diagnostic settings for the subscription

  Why it's wrong here

  Diagnostic settings are an Azure Monitor feature that exports resource diagnostic logs and the Azure Activity Log to destinations like Log Analytics, Storage, or Event Hubs. They are designed for telemetry generated by Azure resources (e.g., VM logs, NSG flow logs, control-plane operations), not for security findings produced by Microsoft Defender for Cloud. While the Activity Log includes some subscription-level security administrative events, it does not include Defender for Cloud's security alerts, which are dynamic detection results tied to threats and vulnerabilities. Enabling diagnostic settings on the subscription therefore fails to capture security alerts and is not the intended export mechanism.

• ✗

  Assign an Azure Policy to export alerts

  Why it's wrong here

  Azure Policy is a governance service that enforces rules on resource configurations and audits compliance, using effects like Deny, Append, or DeployIfNotExists. It does not have any data-movement or export capabilities—policies can only evaluate and remediate resource settings, not stream runtime security findings. Even if a policy were assigned to 'deploy continuous export' on all subscriptions, the policy itself is not performing the alert export; it would merely be automating the configuration of the actual export service. Assigning Azure Policy alone produces no alert data flowing to a SIEM, so this option is fundamentally incorrect.

• ✓

  Enable continuous export to Event Hubs

  Why this is correct

  Continuous export is a native Microsoft Defender for Cloud feature that streams security alerts and recommendations to an Event Hubs namespace or a Log Analytics workspace in near real time. This is the officially supported integration path for sending security alerts to an external SIEM, because Event Hubs serves as a high-throughput, durable ingestion endpoint that downstream tools like Splunk or QRadar can consume. You enable it per subscription or configure it centrally with Azure Policy, and it guarantees ongoing delivery without per-alert manual action. This satisfies the requirement of ensuring security alerts reach the SIEM continuously.

Go deeper

Related to this question