Microsoft AZ-500 Practice Test 120
Question 1190
A low-severity incident is automatically closed by a broad rule that unintentionally matches more alerts than planned. A review identifies this consequence: An overbroad rule can alter or close incidents that should have received human investigation. Which recovery action addresses the underlying technical fault?
- The controlled remediation is to give automation full tenant administration without reviewing incident-specific actions.
- The controlled remediation is to automatically close every high-severity incident to save analyst time.
- The controlled remediation is to assume a KQL hunting query alone assigns all new incidents.
- The controlled remediation is to narrow the rule conditions and test against representative incidents before enforcement.
Explanation
Correct Answer
D:Test using these records: Automation rule order, matched incident fields, run history and assigned owner or incident state. Sentinel automation rules act on matching incidents under explicit trigger and condition settings.
Incorrect Answers
A:Give automation full tenant administration without reviewing incident-specific actions. This would not reliably restore the intended security boundary. An overbroad rule can alter or close incidents that should have received human investigation. The appropriate controlled recovery is: Narrow the rule conditions and test against representative incidents before enforcement.
B:Automatically close every high-severity incident to save analyst time. This would not reliably restore the intended security boundary. An overbroad rule can alter or close incidents that should have received human investigation. The appropriate controlled recovery is: Narrow the rule conditions and test against representative incidents before enforcement.
C:Assume a KQL hunting query alone assigns all new incidents. This would not reliably restore the intended security boundary. An overbroad rule can alter or close incidents that should have received human investigation. The appropriate controlled recovery is: Narrow the rule conditions and test against representative incidents before enforcement.
Question 1191
A Sentinel automation rule calls a Logic App playbook but receives an authorization error when trying to update an incident. What is the most defensible Azure security action?
- Grant only the required Microsoft Sentinel and Logic App resource permissions and validate the playbook connection.
- Assign Global Administrator to all Logic Apps so incident updates never fail.
- Assume a successful Logic App deployment automatically grants Sentinel incident modification rights.
- Disable Sentinel diagnostic logs to hide authorization failures.
Explanation
Correct Answer
A:Confirm the change against these records: Sentinel playbook role assignment, Logic App managed identity, run history and resulting incident update. This directly addresses Sentinel playbook permissions and Logic Apps.
Incorrect Answers
B:A configured trigger can fail at action time if the playbook lacks the required role. In the given case, a Sentinel automation rule calls a Logic App playbook but receives an authorization error when trying to update an incident.
C:That option would assume a successful Logic App deployment automatically grants Sentinel incident modification rights, but it addresses a different concern. Confirm the change against these records: Sentinel playbook role assignment, Logic App managed identity, run history and resulting incident update.
D:A configured trigger can fail at action time if the playbook lacks the required role. The intended action is: Grant only the required Microsoft Sentinel and Logic App resource permissions and validate the playbook connection.
Question 1192
A Sentinel automation rule calls a Logic App playbook but receives an authorization error when trying to update an incident. Which diagnostic record would most strongly confirm the result?
- An inventory item list from a different subscription or connected cloud account.
- A historical Secure Score screenshot without the relevant resource-level finding.
- An incident title without its actual source telemetry and detection results.
- Sentinel playbook role assignment, Logic App managed identity, run history and resulting incident update.
Explanation
Correct Answer
D:These records test the actual Sentinel playbook permissions and Logic Apps behavior rather than an unrelated dashboard state. The intended action is: Grant only the required Microsoft Sentinel and Logic App resource permissions and validate the playbook connection.
Incorrect Answers
A:On its own, that evidence does not prove the specified security control works. The more relevant observations are: Sentinel playbook role assignment, Logic App managed identity, run history and resulting incident update.
B:On its own, that evidence does not prove the specified security control works. Sentinel playbooks execute Logic App workflows with resource and incident access controlled by permissions.
C:On its own, that evidence does not prove the specified security control works. In the given case, a Sentinel automation rule calls a Logic App playbook but receives an authorization error when trying to update an incident.
Question 1193
A Sentinel automation rule calls a Logic App playbook but receives an authorization error when trying to update an incident. Which platform concept should guide the engineer’s assessment?
- Sentinel playbooks execute Logic App workflows with resource and incident access controlled by permissions.
- A high Secure Score certifies that every relevant cloud resource is secure.
- Turning off an alert source is equivalent to remediating the underlying threat.
- A published security standard alone grants managed identities permission to change resources.
Explanation
Correct Answer
A:This principle supports the security response: Grant only the required Microsoft Sentinel and Logic App resource permissions and validate the playbook connection. Confirmation depends on Sentinel playbook role assignment, Logic App managed identity, run history and resulting incident update.
Incorrect Answers
B:A high Secure Score certifies that every relevant cloud resource is secure. This is an incorrect assumption for Sentinel playbook permissions and Logic Apps. The relevant security behavior is: Sentinel playbooks execute Logic App workflows with resource and incident access controlled by permissions. Check evidence such as Sentinel playbook role assignment, Logic App managed identity, run history and resulting incident update.
C:Turning off an alert source is equivalent to remediating the underlying threat. This is an incorrect assumption for Sentinel playbook permissions and Logic Apps. The relevant security behavior is: Sentinel playbooks execute Logic App workflows with resource and incident access controlled by permissions. Check evidence such as Sentinel playbook role assignment, Logic App managed identity, run history and resulting incident update.
D:A published security standard alone grants managed identities permission to change resources. This is an incorrect assumption for Sentinel playbook permissions and Logic Apps. The relevant security behavior is: Sentinel playbooks execute Logic App workflows with resource and incident access controlled by permissions. Check evidence such as Sentinel playbook role assignment, Logic App managed identity, run history and resulting incident update.
Question 1194
A Sentinel automation rule calls a Logic App playbook but receives an authorization error when trying to update an incident. Suppose the operator instead follows this unsafe shortcut: Assign Global Administrator to all Logic Apps so incident updates never fail. Which root-cause observation follows from that incorrect change?
- A successful remediation test was the original reason the plan was disabled.
- Documenting an approved policy assignment is the cause of its earlier absence.
- A configured trigger can fail at action time if the playbook lacks the required role.
- Preserving a security alert audit trail is what caused the risky configuration.
Explanation
Correct Answer
C:The suitable control is: Grant only the required Microsoft Sentinel and Logic App resource permissions and validate the playbook connection. This is a material consequence of the incorrect shortcut.
Incorrect Answers
A:This does not explain the real Sentinel playbook permissions and Logic Apps weakness after the shortcut. The material failure is: A configured trigger can fail at action time if the playbook lacks the required role.
B:This does not explain the real Sentinel playbook permissions and Logic Apps weakness after the shortcut. Inspect evidence such as Sentinel playbook role assignment, Logic App managed identity, run history and resulting incident update.
D:This does not explain the real Sentinel playbook permissions and Logic Apps weakness after the shortcut. In the given case, a Sentinel automation rule calls a Logic App playbook but receives an authorization error when trying to update an incident.
Question 1195
A Sentinel automation rule calls a Logic App playbook but receives an authorization error when trying to update an incident. A review identifies this consequence: A configured trigger can fail at action time if the playbook lacks the required role. Which recovery action addresses the underlying technical fault?
- Assume a successful Logic App deployment automatically grants Sentinel incident modification rights.
- Repair scoped permissions and verify a safe incident update end to end.
- Disable Sentinel diagnostic logs to hide authorization failures.
- Assign Global Administrator to all Logic Apps so incident updates never fail.
Explanation
Correct Answer
B:Test using these records: Sentinel playbook role assignment, Logic App managed identity, run history and resulting incident update. This addresses the observed security problem while providing a verifiable outcome.
Incorrect Answers
A:Assume a successful Logic App deployment automatically grants Sentinel incident modification rights. This would not reliably restore the intended security boundary. A configured trigger can fail at action time if the playbook lacks the required role. The appropriate controlled recovery is: Repair scoped permissions and verify a safe incident update end to end.
C:Disable Sentinel diagnostic logs to hide authorization failures. This would not reliably restore the intended security boundary. A configured trigger can fail at action time if the playbook lacks the required role. The appropriate controlled recovery is: Repair scoped permissions and verify a safe incident update end to end.
D:Assign Global Administrator to all Logic Apps so incident updates never fail. This would not reliably restore the intended security boundary. A configured trigger can fail at action time if the playbook lacks the required role. The appropriate controlled recovery is: Repair scoped permissions and verify a safe incident update end to end.
Question 1196
A response playbook posts alerts to an external system but lacks permissions to read the necessary Sentinel incident details. What is the BEST supported implementation or corrective action?
- For this Azure workload, the team should grant only the required Microsoft Sentinel and Logic App resource permissions and validate the playbook connection.
- For this Azure workload, the team should assume a successful Logic App deployment automatically grants Sentinel incident modification rights.
- For this Azure workload, the team should disable Sentinel diagnostic logs to hide authorization failures.
- For this Azure workload, the team should assign Global Administrator to all Logic Apps so incident updates never fail.
Explanation
Correct Answer
A:Confirm the change against these records: Sentinel playbook role assignment, Logic App managed identity, run history and resulting incident update. Sentinel playbooks execute Logic App workflows with resource and incident access controlled by permissions.
Incorrect Answers
B:Assume a successful Logic App deployment automatically grants Sentinel incident modification rights. The proposed change targets the wrong mechanism or lacks essential validation. Sentinel playbooks execute Logic App workflows with resource and incident access controlled by permissions. Relevant evidence is Sentinel playbook role assignment, Logic App managed identity, run history and resulting incident update.
C:A configured trigger can fail at action time if the playbook lacks the required role. In the given case, a response playbook posts alerts to an external system but lacks permissions to read the necessary Sentinel incident details.
D:A configured trigger can fail at action time if the playbook lacks the required role. Assign Global Administrator to all Logic Apps so incident updates never fail.
Question 1197
A response playbook posts alerts to an external system but lacks permissions to read the necessary Sentinel incident details. Which evidence BEST verifies the intended technical behavior?
- In this security review, examine a planned Azure Policy assignment without evaluated compliance or deployment evidence.
- In this security review, examine an inventory item list from a different subscription or connected cloud account.
- In this security review, examine a historical Secure Score screenshot without the relevant resource-level finding.
- In this security review, examine Sentinel playbook role assignment, Logic App managed identity, run history and resulting incident update.
Explanation
Correct Answer
D:These records test the actual Sentinel playbook permissions and Logic Apps behavior rather than an unrelated dashboard state. Sentinel playbooks execute Logic App workflows with resource and incident access controlled by permissions.
Incorrect Answers
A:On its own, that evidence does not prove the specified security control works. In the given case, a response playbook posts alerts to an external system but lacks permissions to read the necessary Sentinel incident details.
B:The more relevant observations are: Sentinel playbook role assignment, Logic App managed identity, run history and resulting incident update.
C:Sentinel playbooks execute Logic App workflows with resource and incident access controlled by permissions.
Question 1198
A response playbook posts alerts to an external system but lacks permissions to read the necessary Sentinel incident details. Which principle BEST explains why the recommended solution is appropriate?
- The applicable security principle is that a published security standard alone grants managed identities permission to change resources.
- The applicable security principle is that a high Secure Score certifies that every relevant cloud resource is secure.
- The applicable security principle is that Sentinel playbooks execute Logic App workflows with resource and incident access controlled by permissions.
- The applicable security principle is that assigning a policy automatically remediates all existing resources under every effect.
Explanation
Correct Answer
C:This principle supports the security response: Grant only the required Microsoft Sentinel and Logic App resource permissions and validate the playbook connection.
Incorrect Answers
A:A published security standard alone grants managed identities permission to change resources. This is an incorrect assumption for Sentinel playbook permissions and Logic Apps. The relevant security behavior is: Sentinel playbooks execute Logic App workflows with resource and incident access controlled by permissions. Check evidence such as Sentinel playbook role assignment, Logic App managed identity, run history and resulting incident update.
B:A high Secure Score certifies that every relevant cloud resource is secure. This is an incorrect assumption for Sentinel playbook permissions and Logic Apps. The relevant security behavior is: Sentinel playbooks execute Logic App workflows with resource and incident access controlled by permissions. Check evidence such as Sentinel playbook role assignment, Logic App managed identity, run history and resulting incident update.
D:Assigning a policy automatically remediates all existing resources under every effect. This is an incorrect assumption for Sentinel playbook permissions and Logic Apps. The relevant security behavior is: Sentinel playbooks execute Logic App workflows with resource and incident access controlled by permissions. Check evidence such as Sentinel playbook role assignment, Logic App managed identity, run history and resulting incident update.
Question 1199
A response playbook posts alerts to an external system but lacks permissions to read the necessary Sentinel incident details. Suppose the operator instead follows this unsafe shortcut: Assign Global Administrator to all Logic Apps so incident updates never fail. What is the MOST significant failure introduced by that shortcut?
- The resulting security weakness is that preserving a security alert audit trail is what caused the risky configuration.
- The resulting security weakness is that running a scoped compliance assessment automatically deletes protected resources.
- The resulting security weakness is that a configured trigger can fail at action time if the playbook lacks the required role.
- The resulting security weakness is that documenting an approved policy assignment is the cause of its earlier absence.
Explanation
Correct Answer
C:The suitable control is: Grant only the required Microsoft Sentinel and Logic App resource permissions and validate the playbook connection. Sentinel playbooks execute Logic App workflows with resource and incident access controlled by permissions.
Incorrect Answers
A:This does not explain the real Sentinel playbook permissions and Logic Apps weakness after the shortcut. In the given case, a response playbook posts alerts to an external system but lacks permissions to read the necessary Sentinel incident details.
B:This does not explain the real Sentinel playbook permissions and Logic Apps weakness after the shortcut. Running a scoped compliance assessment automatically deletes protected resources.
D:This does not explain the real Sentinel playbook permissions and Logic Apps weakness after the shortcut. Documenting an approved policy assignment is the cause of its earlier absence.
Question 1200
A response playbook posts alerts to an external system but lacks permissions to read the necessary Sentinel incident details. A review identifies this consequence: A configured trigger can fail at action time if the playbook lacks the required role. What is the BEST controlled recovery once this failure is recognized?
- The controlled remediation is to disable Sentinel diagnostic logs to hide authorization failures.
- The controlled remediation is to repair scoped permissions and verify a safe incident update end to end.
- The controlled remediation is to assign Global Administrator to all Logic Apps so incident updates never fail.
- The controlled remediation is to assume a successful Logic App deployment automatically grants Sentinel incident modification rights.
Explanation
Correct Answer
B:Test using these records: Sentinel playbook role assignment, Logic App managed identity, run history and resulting incident update. Sentinel playbooks execute Logic App workflows with resource and incident access controlled by permissions.
Incorrect Answers
A:Disable Sentinel diagnostic logs to hide authorization failures. This would not reliably restore the intended security boundary. A configured trigger can fail at action time if the playbook lacks the required role. The appropriate controlled recovery is: Repair scoped permissions and verify a safe incident update end to end.
C:Assign Global Administrator to all Logic Apps so incident updates never fail. This would not reliably restore the intended security boundary. A configured trigger can fail at action time if the playbook lacks the required role. The appropriate controlled recovery is: Repair scoped permissions and verify a safe incident update end to end.
D:Assume a successful Logic App deployment automatically grants Sentinel incident modification rights. This would not reliably restore the intended security boundary. A configured trigger can fail at action time if the playbook lacks the required role. The appropriate controlled recovery is: Repair scoped permissions and verify a safe incident update end to end.
