Microsoft AZ-500 Practice Test 119
Question 1180
An analytics rule generates false incidents because its query uses a wrong time window and entity mapping. A review identifies this consequence: A connected log source alone does not guarantee that an actionable analytic or incident is created. Which recovery action restores the intended control and validates its effect?
- The controlled remediation is to disable incident generation to avoid false positives rather than tuning query logic.
- The controlled remediation is to correct KQL, thresholds and entity mapping and test an expected detection with low false positives.
- The controlled remediation is to assume a workbook chart is automatically a scheduled Sentinel analytic rule.
- The controlled remediation is to enable an analytics rule with no relevant input table and claim it detects sign-ins.
Explanation
Correct Answer
B:Test using these records: KQL query results, rule execution schedule, incident generation and entity extraction. Sentinel analytics rules correlate ingested telemetry to generate security detections under defined schedules.
Incorrect Answers
A:Disable incident generation to avoid false positives rather than tuning query logic. This would not reliably restore the intended security boundary. A connected log source alone does not guarantee that an actionable analytic or incident is created. The appropriate controlled recovery is: Correct KQL, thresholds and entity mapping and test an expected detection with low false positives.
C:Assume a workbook chart is automatically a scheduled Sentinel analytic rule. This would not reliably restore the intended security boundary. A connected log source alone does not guarantee that an actionable analytic or incident is created. The appropriate controlled recovery is: Correct KQL, thresholds and entity mapping and test an expected detection with low false positives.
D:Enable an analytics rule with no relevant input table and claim it detects sign-ins. This would not reliably restore the intended security boundary. A connected log source alone does not guarantee that an actionable analytic or incident is created. The appropriate controlled recovery is: Correct KQL, thresholds and entity mapping and test an expected detection with low false positives.
Question 1181
A Sentinel incident should be assigned to the SOC queue but remains unassigned because an automation rule is disabled. Which operator action best meets this technical requirement?
- Automatically close every high-severity incident to save analyst time.
- Create controlled Sentinel automation rules with intended triggers, conditions and action priority.
- Assume a KQL hunting query alone assigns all new incidents.
- Give automation full tenant administration without reviewing incident-specific actions.
Explanation
Correct Answer
B:Confirm the change against these records: Automation rule order, matched incident fields, run history and assigned owner or incident state. Sentinel automation rules act on matching incidents under explicit trigger and condition settings.
Incorrect Answers
A:An overbroad rule can alter or close incidents that should have received human investigation. In the given case, a Sentinel incident should be assigned to the SOC queue but remains unassigned because an automation rule is disabled.
C:Assume a KQL hunting query alone assigns all new incidents. The proposed change targets the wrong mechanism or lacks essential validation. Sentinel automation rules act on matching incidents under explicit trigger and condition settings. Relevant evidence is automation rule order, matched incident fields, run history and assigned owner or incident state.
D:An overbroad rule can alter or close incidents that should have received human investigation. The intended action is: Create controlled Sentinel automation rules with intended triggers, conditions and action priority.
Question 1182
A Sentinel incident should be assigned to the SOC queue but remains unassigned because an automation rule is disabled. Which collection of observations most directly tests the suspected cause?
- Automation rule order, matched incident fields, run history and assigned owner or incident state.
- A connected agent indicator without a matching data collection rule or event record.
- An incident title without its actual source telemetry and detection results.
- A planned Azure Policy assignment without evaluated compliance or deployment evidence.
Explanation
Correct Answer
A:These records test the actual Sentinel automation rules incident handling behavior rather than an unrelated dashboard state. The intended action is: Create controlled Sentinel automation rules with intended triggers, conditions and action priority.
Incorrect Answers
B:On its own, that evidence does not prove the specified security control works. The more relevant observations are: Automation rule order, matched incident fields, run history and assigned owner or incident state.
C:On its own, that evidence does not prove the specified security control works. Sentinel automation rules act on matching incidents under explicit trigger and condition settings.
D:On its own, that evidence does not prove the specified security control works. In the given case, a Sentinel incident should be assigned to the SOC queue but remains unassigned because an automation rule is disabled.
Question 1183
A Sentinel incident should be assigned to the SOC queue but remains unassigned because an automation rule is disabled. Which statement most accurately explains this scenario?
- Turning off an alert source is equivalent to remediating the underlying threat.
- Sentinel automation rules act on matching incidents under explicit trigger and condition settings.
- Assigning a policy automatically remediates all existing resources under every effect.
- A subscribed cloud asset automatically sends all possible security logs to Microsoft Sentinel.
Explanation
Correct Answer
B:This principle supports the security response: Create controlled Sentinel automation rules with intended triggers, conditions and action priority. Confirmation depends on Automation rule order, matched incident fields, run history and assigned owner or incident state.
Incorrect Answers
A:Turning off an alert source is equivalent to remediating the underlying threat. This is an incorrect assumption for Sentinel automation rules incident handling. The relevant security behavior is: Sentinel automation rules act on matching incidents under explicit trigger and condition settings. Check evidence such as automation rule order, matched incident fields, run history and assigned owner or incident state.
C:Assigning a policy automatically remediates all existing resources under every effect. This is an incorrect assumption for Sentinel automation rules incident handling. The relevant security behavior is: Sentinel automation rules act on matching incidents under explicit trigger and condition settings. Check evidence such as automation rule order, matched incident fields, run history and assigned owner or incident state.
D:A subscribed cloud asset automatically sends all possible security logs to Microsoft Sentinel. This is an incorrect assumption for Sentinel automation rules incident handling. The relevant security behavior is: Sentinel automation rules act on matching incidents under explicit trigger and condition settings. Check evidence such as automation rule order, matched incident fields, run history and assigned owner or incident state.
Question 1184
A Sentinel incident should be assigned to the SOC queue but remains unassigned because an automation rule is disabled. Suppose the operator instead follows this unsafe shortcut: Automatically close every high-severity incident to save analyst time. What is the principal technical consequence of the mistaken choice?
- Running a scoped compliance assessment automatically deletes protected resources.
- Maintaining the required incident log is itself the unauthorized API request.
- A successful remediation test was the original reason the plan was disabled.
- An overbroad rule can alter or close incidents that should have received human investigation.
Explanation
Correct Answer
D:The suitable control is: Create controlled Sentinel automation rules with intended triggers, conditions and action priority. This is a material consequence of the incorrect shortcut.
Incorrect Answers
A:This does not explain the real Sentinel automation rules incident handling weakness after the shortcut. The material failure is: An overbroad rule can alter or close incidents that should have received human investigation.
B:This does not explain the real Sentinel automation rules incident handling weakness after the shortcut. Inspect evidence such as automation rule order, matched incident fields, run history and assigned owner or incident state.
C:This does not explain the real Sentinel automation rules incident handling weakness after the shortcut. In the given case, a Sentinel incident should be assigned to the SOC queue but remains unassigned because an automation rule is disabled.
Question 1185
A Sentinel incident should be assigned to the SOC queue but remains unassigned because an automation rule is disabled. A review identifies this consequence: An overbroad rule can alter or close incidents that should have received human investigation. Which recovery action restores the intended control and validates its effect?
- Assume a KQL hunting query alone assigns all new incidents.
- Give automation full tenant administration without reviewing incident-specific actions.
- Automatically close every high-severity incident to save analyst time.
- Narrow the rule conditions and test against representative incidents before enforcement.
Explanation
Correct Answer
D:Test using these records: Automation rule order, matched incident fields, run history and assigned owner or incident state. This addresses the observed security problem while providing a verifiable outcome.
Incorrect Answers
A:Assume a KQL hunting query alone assigns all new incidents. This would not reliably restore the intended security boundary. An overbroad rule can alter or close incidents that should have received human investigation. The appropriate controlled recovery is: Narrow the rule conditions and test against representative incidents before enforcement.
B:Give automation full tenant administration without reviewing incident-specific actions. This would not reliably restore the intended security boundary. An overbroad rule can alter or close incidents that should have received human investigation. The appropriate controlled recovery is: Narrow the rule conditions and test against representative incidents before enforcement.
C:Automatically close every high-severity incident to save analyst time. This would not reliably restore the intended security boundary. An overbroad rule can alter or close incidents that should have received human investigation. The appropriate controlled recovery is: Narrow the rule conditions and test against representative incidents before enforcement.
Question 1186
A low-severity incident is automatically closed by a broad rule that unintentionally matches more alerts than planned. What is the most defensible Azure security action?
- For this Azure workload, the team should assume a KQL hunting query alone assigns all new incidents.
- For this Azure workload, the team should create controlled Sentinel automation rules with intended triggers, conditions and action priority.
- For this Azure workload, the team should give automation full tenant administration without reviewing incident-specific actions.
- For this Azure workload, the team should automatically close every high-severity incident to save analyst time.
Explanation
Correct Answer
B:Confirm the change against these records: Automation rule order, matched incident fields, run history and assigned owner or incident state.
Incorrect Answers
A:Assume a KQL hunting query alone assigns all new incidents. The proposed change targets the wrong mechanism or lacks essential validation. Sentinel automation rules act on matching incidents under explicit trigger and condition settings. Relevant evidence is automation rule order, matched incident fields, run history and assigned owner or incident state.
C:An overbroad rule can alter or close incidents that should have received human investigation. Give automation full tenant administration without reviewing incident-specific actions.
D:An overbroad rule can alter or close incidents that should have received human investigation. In the given case, a low-severity incident is automatically closed by a broad rule that unintentionally matches more alerts than planned.
Question 1187
A low-severity incident is automatically closed by a broad rule that unintentionally matches more alerts than planned. Which diagnostic record would most strongly confirm the result?
- In this security review, examine an inventory item list from a different subscription or connected cloud account.
- In this security review, examine a connected agent indicator without a matching data collection rule or event record.
- In this security review, examine an incident title without its actual source telemetry and detection results.
- In this security review, examine automation rule order, matched incident fields, run history and assigned owner or incident state.
Explanation
Correct Answer
D:These records test the actual Sentinel automation rules incident handling behavior rather than an unrelated dashboard state. Sentinel automation rules act on matching incidents under explicit trigger and condition settings.
Incorrect Answers
A:On its own, that evidence does not prove the specified security control works. In the given case, a low-severity incident is automatically closed by a broad rule that unintentionally matches more alerts than planned.
B:The more relevant observations are: Automation rule order, matched incident fields, run history and assigned owner or incident state.
C:Sentinel automation rules act on matching incidents under explicit trigger and condition settings.
Question 1188
A low-severity incident is automatically closed by a broad rule that unintentionally matches more alerts than planned. Which platform concept should guide the engineer’s assessment?
- The applicable security principle is that Sentinel automation rules act on matching incidents under explicit trigger and condition settings.
- The applicable security principle is that a subscribed cloud asset automatically sends all possible security logs to Microsoft Sentinel.
- The applicable security principle is that turning off an alert source is equivalent to remediating the underlying threat.
- The applicable security principle is that a published security standard alone grants managed identities permission to change resources.
Explanation
Correct Answer
A:This principle supports the security response: Create controlled Sentinel automation rules with intended triggers, conditions and action priority.
Incorrect Answers
B:A subscribed cloud asset automatically sends all possible security logs to Microsoft Sentinel. This is an incorrect assumption for Sentinel automation rules incident handling. The relevant security behavior is: Sentinel automation rules act on matching incidents under explicit trigger and condition settings. Check evidence such as automation rule order, matched incident fields, run history and assigned owner or incident state.
C:Turning off an alert source is equivalent to remediating the underlying threat. This is an incorrect assumption for Sentinel automation rules incident handling. The relevant security behavior is: Sentinel automation rules act on matching incidents under explicit trigger and condition settings. Check evidence such as automation rule order, matched incident fields, run history and assigned owner or incident state.
D:A published security standard alone grants managed identities permission to change resources. This is an incorrect assumption for Sentinel automation rules incident handling. The relevant security behavior is: Sentinel automation rules act on matching incidents under explicit trigger and condition settings. Check evidence such as automation rule order, matched incident fields, run history and assigned owner or incident state.
Question 1189
A low-severity incident is automatically closed by a broad rule that unintentionally matches more alerts than planned. Suppose the operator instead follows this unsafe shortcut: Automatically close every high-severity incident to save analyst time. Which root-cause observation follows from that incorrect change?
- The resulting security weakness is that a successful remediation test was the original reason the plan was disabled.
- The resulting security weakness is that documenting an approved policy assignment is the cause of its earlier absence.
- The resulting security weakness is that an overbroad rule can alter or close incidents that should have received human investigation.
- The resulting security weakness is that maintaining the required incident log is itself the unauthorized API request.
Explanation
Correct Answer
C:The suitable control is: Create controlled Sentinel automation rules with intended triggers, conditions and action priority. Sentinel automation rules act on matching incidents under explicit trigger and condition settings.
Incorrect Answers
A:This does not explain the real Sentinel automation rules incident handling weakness after the shortcut. In the given case, a low-severity incident is automatically closed by a broad rule that unintentionally matches more alerts than planned.
B:This does not explain the real Sentinel automation rules incident handling weakness after the shortcut. Documenting an approved policy assignment is the cause of its earlier absence.
D:This does not explain the real Sentinel automation rules incident handling weakness after the shortcut. Maintaining the required incident log is itself the unauthorized API request.
Question 1190
A low-severity incident is automatically closed by a broad rule that unintentionally matches more alerts than planned. A review identifies this consequence: An overbroad rule can alter or close incidents that should have received human investigation. Which recovery action addresses the underlying technical fault?
- The controlled remediation is to give automation full tenant administration without reviewing incident-specific actions.
- The controlled remediation is to automatically close every high-severity incident to save analyst time.
- The controlled remediation is to assume a KQL hunting query alone assigns all new incidents.
- The controlled remediation is to narrow the rule conditions and test against representative incidents before enforcement.
Explanation
Correct Answer
D:Test using these records: Automation rule order, matched incident fields, run history and assigned owner or incident state. Sentinel automation rules act on matching incidents under explicit trigger and condition settings.
Incorrect Answers
A:Give automation full tenant administration without reviewing incident-specific actions. This would not reliably restore the intended security boundary. An overbroad rule can alter or close incidents that should have received human investigation. The appropriate controlled recovery is: Narrow the rule conditions and test against representative incidents before enforcement.
B:Automatically close every high-severity incident to save analyst time. This would not reliably restore the intended security boundary. An overbroad rule can alter or close incidents that should have received human investigation. The appropriate controlled recovery is: Narrow the rule conditions and test against representative incidents before enforcement.
C:Assume a KQL hunting query alone assigns all new incidents. This would not reliably restore the intended security boundary. An overbroad rule can alter or close incidents that should have received human investigation. The appropriate controlled recovery is: Narrow the rule conditions and test against representative incidents before enforcement.
