Secure Azure using Microsoft Defender for Cloud and Microsoft Sentinel →mediumMultiple SelectObjective-mapped
AZ-500 Practice Question: Secure Azure using Microsoft Defender for Cloud and Microsoft Sentinel
Your company uses Microsoft Defender for Cloud to protect Azure resources. You want to enable the 'Defender for Containers' plan to secure AKS clusters. Which two configurations are necessary? (Choose two.)
⚠ Common exam trap
Test-takers frequently confuse the Log Analytics agent requirement with the actual data collection mechanism, mistakenly thinking it must be installed on each node, whereas Defender for Containers uses its own dedicated Defender profile and relies on audit log streaming instead.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Enable the 'Defender for Containers' plan in Microsoft Defender for Cloud.
Enabling the 'Defender for Containers' plan in Microsoft Defender for Cloud is the primary configuration required to activate threat detection and security monitoring for AKS clusters. Option E is correct because audit logs must be enabled and streamed to a Log Analytics workspace to provide the necessary data for Defender for Containers to analyze Kubernetes audit events and detect suspicious activities.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Assign the 'Kubernetes cluster should be accessible only through private endpoint' Azure Policy.
Why it's wrong here
Assigning the 'Kubernetes cluster should be accessible only through private endpoint' policy enforces network-level isolation of the API server, which is a compliance and security control, but it does not activate any Defender for Cloud monitoring. Defender for Containers can operate on a cluster with public or private endpoints; the plan must be enabled independently. Therefore, this action is not a prerequisite and would not satisfy the requirement to protect the AKS cluster with Defender for Containers.
- ✗
Connect the AKS cluster to Azure Arc.
Why it's wrong here
Connecting the AKS cluster to Azure Arc is intended for managing Kubernetes clusters running outside Azure by projecting them as Azure resources. An AKS cluster is already a first-class Azure resource, so Azure Arc does not apply and does not influence Defender for Cloud. Enabling Defender for Containers is a subscription-level plan activation, not a hybrid-management task, making this step irrelevant for the scenario.
- ✓
Enable the 'Defender for Containers' plan in Microsoft Defender for Cloud.
Why this is correct
Enabling the 'Defender for Containers' plan in Microsoft Defender for Cloud is the fundamental step that activates threat detection, vulnerability assessment, and security recommendations for AKS clusters. This plan must be turned on for the subscription that contains the cluster; once enabled, Defender automatically deploys the necessary components to collect and analyze security signals. Without this plan, no amount of audit logging or agent installation will produce Defender's container-specific protection.
- ✗
Install the Log Analytics agent on each AKS node.
Why it's wrong here
The Log Analytics agent (OMS agent) on each node is a legacy approach for collecting VM performance and syslog data; it is not the mechanism used by Defender for Containers. Defender for Containers instead uses Kubernetes audit logs and a dedicated host/control-plane data collection pipeline, including Azure Policy for Kubernetes, to detect threats. Installing the Log Analytics agent is therefore both unnecessary and insufficient for this plan.
- ✓
Ensure the AKS cluster's audit logs are enabled and streamed to a Log Analytics workspace.
Why this is correct
Streaming Kubernetes audit logs to a Log Analytics workspace is indeed a correct and required configuration for Defender for Containers, because these logs provide the control-plane activity that threat detection analyzes. However, this must follow the initial enabling of the Defender for Containers plan, which is the primary prerequisite. The audit logs alone are not a substitute for the plan, but they are an essential data source once the plan is active.
Go deeper
Related to this question
About these practice questions
This AZ-500 question is part of Courseiva's 194-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-500 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-500 exam.