Configure and Manage Security Monitoring and Automation Solutions AZ-500 Practice Questions (Page 5)

Questions 21–25

1. 21application · medium

   A security analyst wants to automatically close low-severity incidents in Microsoft Sentinel that are generated by a specific analytics rule and are false positives. They also want to be notified via email when this happens. What should you configure?

   • AModify the analytics rule to automatically close incidents and send an email when it fires.
   • BCreate an automation rule that triggers on incidents from that rule, with a condition for low severity, and add actions to close the incident and send an email.
   • CCreate a playbook and attach it directly to the analytics rule as an incident automation.
   • DUse a Logic App to monitor the Sentinel incidents API and close incidents with that rule name.
   Reveal Solution Discussion Select an answer first
2. 22application · medium

   Your organization uses Microsoft Sentinel. You need to ingest DNS query logs from your on-premises DNS servers. You have installed the Log Analytics agent on the DNS servers. What should you configure in Sentinel to start collecting the DNS logs?

   • AEnable the DNS data connector in Sentinel
   • BConfigure a workflow automation rule to collect DNS logs
   • CCreate a data collection rule that collects DNS logs
   • DCreate a scheduled analytics rule that queries the DNS table
   Reveal Solution Discussion Select an answer first
4. 23application · medium

   A security operations center (SOC) wants to automatically assign incidents in Microsoft Sentinel to the appropriate analyst based on the incident title. For example, incidents containing 'Ransomware' should be assigned to the 'Threat Team'. What should you configure?

   • AUse a Logic App to monitor the incident creation API and assign ownership based on the title.
   • BCreate a playbook that is triggered manually by analysts when they see the incident title.
   • CCreate an automation rule that triggers on incident creation and uses a condition on the title, with an action to assign the incident to the team.
   • DModify the analytics rule that generates the incident to include an owner assignment.
   Reveal Solution Discussion Select an answer first
5. 24expert · hard

   A company uses Microsoft Sentinel. They have multiple data connectors enabled, including Azure AD and Azure Activity. They want to create an analytics rule that detects when a user is added to a privileged role and then performs a suspicious Azure action within 5 minutes. They also want to automatically disable the user if the rule triggers. What should they do?

   • AUse a workflow automation in Defender for Cloud to detect the pattern
   • BCreate a scheduled analytics rule that joins the AuditLogs and AzureActivity tables, and an automation rule that runs a playbook to disable the user
   • CCreate a playbook that runs on a schedule and queries both tables
   • DCreate an analytics rule that uses the Azure AD connector only
   Reveal Solution Discussion Select an answer first
6. 25expert · hard

   A security team has a scheduled analytics rule in Microsoft Sentinel that runs every 5 minutes and queries the SigninLogs table for failed logons. The rule is generating a high number of low-severity incidents, overwhelming the SOC. They want to reduce noise while still detecting genuine brute-force attacks. They also want to automatically suppress incidents for known benign IP addresses. What should you do?

   • AChange the analytics rule to alert only on high-severity incidents by modifying the incident severity.
   • BCreate a playbook that automatically closes all low-severity incidents.
   • CDisable the analytics rule and create a new one that queries every hour.
   • DModify the analytics rule to increase the query frequency to 15 minutes and add a condition to filter out known benign IP addresses, and create an automation rule to close incidents from those IPs.
   Reveal Solution Discussion Select an answer first