Microsoft Azure Security Engineer Associate AZ-500 Practice Question

Enabling Microsoft Defender for Containers with the AKS plan activates runtime threat detection for the cluster. The service automatically deploys a Defender sensor as a DaemonSet on every node, which monitors container and host activities and raises alerts such as "Suspicious kubectl exec activity detected" and "Suspicious Kubernetes secrets enumeration." The sensor is managed by Microsoft, so you do not manually maintain node-level agents. After enabling Defender for Containers, you can configure the Microsoft Defender for Cloud data connector in Microsoft Sentinel to ingest the generated security alerts. Azure Monitor Container insights focuses on performance metrics, the Azure Policy add-on enforces configuration compliance, and Azure RBAC integration governs access; none of these provide native runtime threat detection for AKS workloads.