AZ-500 Practice Question: Secure Azure using Microsoft Defender for Cloud and Microsoft Sentinel
Exhibit
Refer to the exhibit.
```powershell
$parameters = @{
ResourceGroupName = 'RG-Security'
Name = 'ws-law'
Sku = @{ name = 'PerGB2018' }
RetentionInDays = 365
}
New-AzOperationalInsightsWorkspace @parameters
```You run the PowerShell command shown in the exhibit. After execution, you check the Log Analytics workspace in the Azure portal. The workspace is created successfully. However, when you try to onboard the workspace to Microsoft Sentinel, you receive an error that Sentinel cannot be enabled on this workspace. What is the most likely cause?
⚠ Common exam trap
Test-takers frequently assume any Log Analytics workspace can be onboarded to Sentinel as long as it is created successfully, overlooking the critical regional restriction that Sentinel is not globally available in all Azure regions.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The workspace is in a region that does not support Microsoft Sentinel.
Microsoft Sentinel is not available in all Azure regions. The error 'Sentinel cannot be enabled on this workspace' most commonly occurs when the Log Analytics workspace is deployed in a region that does not support Sentinel. Even though the workspace is created successfully, Sentinel requires specific regional availability, and if the workspace region is not in the supported list, onboarding will fail.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The SKU is set to PerGB2018, which is not compatible with Sentinel.
Why it's wrong here
The PerGB2018 SKU is actually the standard pay-as-you-go pricing tier for Log Analytics workspaces and is fully compatible with Microsoft Sentinel. When you enable Sentinel on a workspace, it automatically uses (or can be set to) this billing model. Therefore, this setting would not prevent Sentinel from being enabled, making this option incorrect.
- ✗
The resource group location is different from the workspace location.
Why it's wrong here
The resource group location is only the region where the resource group's metadata is stored; it does not constrain where individual resources inside it can be deployed. A Log Analytics workspace can be hosted in a region different from its resource group without any functional impact. Sentinel's availability is determined solely by the workspace's actual region, not the resource group's location, so this cannot be the cause of the failure.
- ✓
The workspace is in a region that does not support Microsoft Sentinel.
Why this is correct
Microsoft Sentinel is not available in every Azure region. The Log Analytics workspace must reside in a region where the Sentinel solution (Microsoft.SecurityInsights) is supported. If the workspace is in an unsupported region, enabling Sentinel will fail with a region-specific error. This is the only listed condition that directly and necessarily blocks Sentinel deployment, making it the correct answer.
- ✗
The retention period is set to 365 days, which exceeds the maximum for Sentinel.
Why it's wrong here
The maximum interactive retention period for a Log Analytics workspace is 730 days (two years), and Microsoft Sentinel inherits this limit. Setting a retention period of 365 days is well within the allowed range and does not exceed any Sentinel-specific constraint. Therefore, this configuration would not cause an error and is not the reason for the deployment issue.
Go deeper
Related to this question
About these practice questions
Courseiva writes every AZ-500 question from scratch — 617 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-500 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-500 exam.