Fundamental
Prepare and test your skills
Fundamental
Prepare and test your skills
Integrating Defender for Cloud with Microsoft Sentinel
Free sample question, answered and explained below. The AZ-900 Microsoft Azure Fundamentals Exam practice bank has 688 more like it. Try 10 free: instant score, no account.
An organization is designing a unified security operations strategy across its cloud and on-premises environments. The security team uses Microsoft Defender for Cloud to evaluate workload security posture, identify vulnerabilities, and detect active threats across their resources.
To centralize enterprise-wide security data, the team must stream alerts and telemetry from Defender for Cloud into a native cloud service that delivers Security Information and Event Management (SIEM), advanced threat intelligence, and automated incident correlation.
Which Azure service should the organization integrate with Microsoft Defender for Cloud to meet this requirement?
Explanations
Azure App Configuration
Azure App Configuration
What Azure App Configuration Is
Azure App Configuration is a managed cloud service that provides centralized storage and management of application settings, feature flags, and configuration properties. It is designed to help developers separate operational configurations from application code across multiple environments.
Why It Doesn't Meet the Requirement
Azure App Configuration has no security monitoring, log aggregation, or threat management capabilities. It cannot ingest alerts from Microsoft Defender for Cloud, nor does it possess tools for analyzing security events, detecting cyber threats, or managing incidents.
Key Characteristics and Limitations
- Key-Value Store: Acts as a centralized store for dynamic parameters, key-value pairs, and feature toggles used by cloud applications.
- Developer Utility: Intended for software development workflows, microservices architectures, and deployment pipelines to manage runtime variables.
- Absence of Security Telemetry: Does not process telemetry logs, security baselines, or threat intelligence feeds.
This Answer Would Be Correct If
The organization needed a centralized, scalable service to manage feature flags and application configuration keys across distributed microservices.
Additional Context
Securing applications often involves tools like Azure App Configuration and Azure Key Vault, but neither serves as a SIEM or security event correlation platform.
Azure Policy
Azure Policy
What Azure Policy Is
Azure Policy is a governance service that enables organizations to define, assign, and enforce technical guardrails and standards across Azure resources. It evaluates resource configurations against organizational compliance rules to prevent unapproved configurations or audit existing deployments for non-compliance.
Why It Doesn't Meet the Requirement
Azure Policy is a governance and compliance enforcement tool, not an analytics or SIEM platform. It does not ingest real-time security event logs, track active security incidents, correlate security alerts, or provide threat intelligence hunting tools.
Key Characteristics and Limitations
- Declarative Enforcement: Uses policy definitions to audit or prevent the creation of non-compliant resources (such as blocking unencrypted storage accounts).
- Control Plane Evaluation: Operates at the Azure Resource Manager (ARM) management level rather than analyzing real-time network traffic or host-level security logs.
- Integration Role: Defender for Cloud utilizes underlying Azure Policy definitions to evaluate configuration baselines, but Policy itself cannot serve as an event management and correlation platform.
This Answer Would Be Correct If
The scenario required automated governance rules to mandate that all virtual machines automatically enable vulnerability assessment extensions upon deployment.
Additional Context
While Azure Policy helps maintain consistent security baselines across subscriptions, it does not analyze runtime security telemetry or correlate multi-source security events.
Microsoft Sentinel
Microsoft Sentinel
What Microsoft Sentinel Is
Microsoft Sentinel is a cloud-native Security Information and Event Management (SIEM) and Security Orchestration, Automation, and Response (SOAR) solution. Built directly on top of the Azure Monitor Logs and Log Analytics foundation, Sentinel ingests, correlates, and analyzes massive volumes of telemetry from diverse enterprise sources across multicloud, on-premises, and hybrid infrastructures.
How It Meets the Requirement
Microsoft Sentinel natively integrates with Microsoft Defender for Cloud via built-in data connectors. When connected:
- Defender for Cloud acts as the cloud security posture management (CSPM) and cloud workload protection platform (CWPP) engine, generating granular security alerts and vulnerability findings.
- Microsoft Sentinel ingests these alerts and events, correlating them with signals from identity providers, network firewalls, endpoints, and third-party applications to construct a holistic timeline of complex security incidents.
Key Advantages and Capabilities
- Intelligent Analytics: Leverages advanced machine learning and Microsoft threat intelligence to detect sophisticated multi-stage cyber attacks.
- Single Pane of Glass: Aggregates security telemetry across multicloud environments into unified dashboards and investigation workbooks.
- Automated Incident Response: Executes automated playbooks using Azure Logic Apps to remediate threats rapidly upon alert detection.
- Deep Investigation Tools: Enables security operations center (SOC) analysts to hunt for active threats and track lateral movement using interactive graphs.
Why This Is Optimal
While Microsoft Defender for Cloud focuses on resource-level security posture and workload-specific threat detection, Microsoft Sentinel provides the enterprise-scale correlation, broad event aggregation, and threat hunting necessary for a modern security operations center.
Azure Monitor
Azure Monitor
What Azure Monitor Is
Azure Monitor is a comprehensive platform service designed for collecting, analyzing, and acting on operational telemetry and performance metrics from cloud, hybrid, and on-premises environments. It provides essential insights into application health, resource availability, infrastructure utilization, and system operational logs.
Why It Doesn't Meet the Requirement
Although Azure Monitor provides the underlying log ingestion pipeline and Log Analytics workspace infrastructure used by security services, it is not a dedicated SIEM solution. It does not provide built-in threat intelligence matching, cyber attack kill-chain correlation, or security incident management workflows out of the box.
Key Characteristics and Limitations
- Operational Focus: Specializes in performance diagnostics, application availability tracking (Application Insights), and infrastructure metrics.
- Data Store Foundation: Collects data from diagnostic logs, activity logs, and metric streams for general querying rather than automated security threat correlation.
- Alerting Model: Focuses primarily on metric thresholds, operational status alerts, and resource availability disruptions.
This Answer Would Be Correct If
The organization needed a solution specifically to monitor virtual machine CPU utilization, track application performance degradation, or store diagnostic logs in a centralized repository.
Additional Context
Microsoft Sentinel builds directly upon the Azure Monitor data platform, but it is Sentinel itself that supplies the specialized SIEM and threat intelligence capabilities.
Try 10 interactive questions like this one, free
Answer them yourself and get your score the moment you finish. No account needed.
Full access includes
- 688 practice questions across all 3 exam domains
- Every answer explained: why it is right, and why the others are not
- Scout, an AI tutor that answers your follow-up questions
- Readiness tracking by domain, so you know when to book the exam
Related questions
Keep the momentum going with these hand-picked practice scenarios
FundamentalAZ-900 Microsoft Azure Fundamentals Exam
Microsoft Defender for Cloud Capabilities
Describe the purpose of Microsoft Defender for Cloud
FundamentalAZ-900 Microsoft Azure Fundamentals Exam
Microsoft Defender for Cloud Regulatory Compliance Dashboard
Describe the purpose of Microsoft Defender for Cloud
FundamentalAZ-900 Microsoft Azure Fundamentals Exam
Microsoft Defender for Cloud CSPM
Describe the purpose of Microsoft Defender for Cloud
FundamentalAZ-900 Microsoft Azure Fundamentals Exam
Microsoft Defender for Cloud Threat Detection
Describe the purpose of Microsoft Defender for Cloud
FundamentalAZ-900 Microsoft Azure Fundamentals Exam
Availability Zones Cost vs Resiliency Trade-off
Describe availability zones
ExpertAZ-500 Microsoft Azure Security Technologies Exam
Application Permissions vs Delegated Permissions
Configure app registration permission scopes
Last updated Validated