A SOC uses Defender for Cloud and Sentinel. They receive a large number of alerts from Defender for Cloud, but only some are relevant. They want to automatically create Sentinel incidents only for alerts that match specific tactics (e.g., credential access) and suppress others. They also want to notify the SOC manager for high-severity incidents. What should they do?

Use a Sentinel automation rule that triggers on all Defender alerts and creates incidents

Configure a diagnostic setting on Defender for Cloud to stream all alerts to Sentinel and then use a playbook to filter

Create an analytics rule in Sentinel that queries Defender alerts and creates incidents

Use a workflow automation rule in Defender for Cloud that triggers on alerts with the desired tactics and runs a Logic App to create a Sentinel incident; use a Sentinel automation rule to notify the manager

Your SOC uses Microsoft Sentinel. Whenever a high-severity incident is created, you want to automatically assign it to the Tier 1 team and add a tag 'high-priority'. What should you configure?

An analytics rule that creates incidents with a custom owner

An automation rule that triggers when an incident is created, with conditions on severity and actions to assign owner and add tags

A workflow automation in Defender for Cloud that assigns the incident owner

A playbook that runs on a schedule and checks for new incidents

What is the purpose of enabling a scheduled analytics rule in Microsoft Sentinel?

To automatically remediate security incidents

To create a visual dashboard of security events

To connect to external data sources

To run a query at regular intervals to detect potential threats

A security analyst wants to detect multiple failed sign-ins followed by a successful sign-in from the same user within 10 minutes. They have sign-in logs in Sentinel. What should they create to generate an incident for this pattern?

A Sentinel automation rule that runs on incident creation

A Microsoft Defender for Cloud workflow automation rule

A scheduled analytics rule with a KQL query that looks for the pattern and an alert grouping by user

A data collection rule that filters sign-in events

In Microsoft Sentinel, what is the purpose of a data connector?

To automate responses to security incidents

To define detection rules for threats

To connect Sentinel to external data sources and ingest their logs

To create visualizations of security data

Microsoft Certified:Azure Security Engineer Associate

Domain 4Objective 4

Configure and Manage Security Monitoring and Automation Solutions AZ-500 Practice Questions (Page 1)

Part of the Secure Azure using Microsoft Defender for Cloud and Microsoft Sentinel domain, which accounts for 30–35% of the AZ-500 exam. Microsoft does not publish an official question count, but from its 100-minute exam (~40–65 total, ~12–23 in this domain), expect 3–6 from this objective — we provide 37 practice questions to prepare you well beyond it. (estimate)

37questions here

8free pages

6concepts

30–35%of the exam

Questions 1–5

1expert · hard
A SOC uses Defender for Cloud and Sentinel. They receive a large number of alerts from Defender for Cloud, but only some are relevant. They want to automatically create Sentinel incidents only for alerts that match specific tactics (e.g., credential access) and suppress others. They also want to notify the SOC manager for high-severity incidents. What should they do?
Select an answer first
2application · medium
Your SOC uses Microsoft Sentinel. Whenever a high-severity incident is created, you want to automatically assign it to the Tier 1 team and add a tag 'high-priority'. What should you configure?
Select an answer first
3foundation · easy
What is the purpose of enabling a scheduled analytics rule in Microsoft Sentinel?
Select an answer first
4application · medium
A security analyst wants to detect multiple failed sign-ins followed by a successful sign-in from the same user within 10 minutes. They have sign-in logs in Sentinel. What should they create to generate an incident for this pattern?
Select an answer first
5foundation · easy
In Microsoft Sentinel, what is the purpose of a data connector?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to AZ-500

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Microsoft. “AZ-500” is a trademark of its owner, used for identification only.