Microsoft Azure Security Engineer Associate AZ-500 Practice Question

Microsoft Defender for Containers provides built-in Kubernetes runtime threat detection for AKS. When the plan is enabled at the subscription (or resource) level in Microsoft Defender for Cloud, the necessary sensor is deployed automatically to each node as an extension, so no manual DaemonSet management is required. Defender for Containers generates near real-time security alerts for actions such as attempts to exec into a container.

Container insights focuses on performance and health monitoring, not runtime threat detection. The Azure Policy add-on prevents non-compliant deployments at admission time but does not monitor runtime actions. Streaming audit logs to Log Analytics can record events but does not automatically analyze them or raise security alerts in near real time.