AZ-500 Practice Question: Secure Azure using Microsoft Defender for Cloud and Microsoft Sentinel
Your organization uses Microsoft Sentinel to detect threats across multiple Azure subscriptions. Security analysts need to query threat intelligence data from Microsoft Defender Threat Intelligence (MDTI) directly within Sentinel. However, analysts report that MDTI indicators are not appearing in ThreatIntelligenceIndicator table. What is the most likely cause?
⚠ Common exam trap
Many exam-takers assume cross-subscription or cross-tenant configurations (like Azure Lighthouse or Defender for Cloud onboarding) are required for data ingestion, when in fact the missing connector is the direct and most likely cause.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The MDTI data connector is not enabled in Microsoft Sentinel.
The most likely cause is that the MDTI data connector is not enabled in Microsoft Sentinel. Without enabling this connector, threat intelligence indicators from Microsoft Defender Threat Intelligence will not be ingested into the ThreatIntelligenceIndicator table, regardless of other configurations. The connector must be explicitly installed and configured to pull MDTI data into the workspace.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
The MDTI data connector is not enabled in Microsoft Sentinel.
Why this is correct
The Microsoft Defender Threat Intelligence (MDTI) data connector is the explicit integration point that imports threat indicators — malicious domains, IP addresses, and other observables — into the Log Analytics workspace's ThreatIntelligenceIndicator table. Without this connector enabled in the Sentinel Content hub and properly authenticated via Microsoft Graph, no MDTI indicators will be ingested, so any analytics rules that depend on those indicators will produce no alerts. This directly explains the absence of MDTI-derived detections regardless of the workspace region, subscription posture, or management architecture.
- ✗
The Sentinel workspace is located in a region where MDTI is not supported.
Why it's wrong here
Microsoft Defender Threat Intelligence is a globally-available service, and its Sentinel data connector is supported in all Azure public regions where Microsoft Sentinel itself is offered. The connector calls the Microsoft Graph threat intelligence API, which is region-independent, so the workspace's home region does not influence whether indicators are pulled into the ThreatIntelligenceIndicator table. Therefore, a regional unsupported claim would only hold for a sovereign cloud (e.g., Government or China) if specifically not deployed there, not for a normal Azure region.
- ✗
The subscriptions are not onboarded to Microsoft Defender for Cloud.
Why it's wrong here
Onboarding subscriptions to Microsoft Defender for Cloud is completely separate from MDTI data ingestion in Microsoft Sentinel. The MDTI connector relies on an Microsoft Entra ID application or user identity with the ThreatIntelligence.Read delegated or application permission, not on Defender for Cloud's plan status or the lifting of any cloud security posture management capabilities. Sentinel uses the same workspace for all connected subscriptions, but enabling the MDTI data source is a per-workspace action that does not require Defender for Cloud to be enabled on any subscription.
- ✗
The Sentinel workspace is not using Azure Lighthouse for cross-subscription management.
Why it's wrong here
Azure Lighthouse is designed for cross-tenant, delegated resource management, whereas the MDTI connector operates entirely within the tenant that owns the Sentinel workspace and does not require cross-tenant delegation. Even when managing multiple subscriptions, those subscriptions simply need to be connected to the Sentinel workspace (e.g., via the Microsoft Sentinel connector for subscription-level data) to have their logs collected; that is unrelated to the threat intelligence feed. Not using Lighthouse has no effect on whether the MDTI connector can authenticate to Microsoft Graph and write indicators into the workspace.
Go deeper
Related to this question
About these practice questions
This AZ-500 question is part of Courseiva's 617-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-500 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-500 exam.