Configure and Manage Security Monitoring and Automation Solutions AZ-500 Practice Questions (Page 6)

Questions 26–30

1. 26application · medium

   A security analyst wants to receive an email notification whenever a specific analytics rule in Sentinel detects a threat. They also want to automatically create a Microsoft Teams message. What should they configure?

   • AA data connector that sends notifications
   • BAn automation rule that triggers on alert creation and runs a playbook that sends email and Teams messages
   • CAn analytics rule that has email notifications built in
   • DA workflow automation in Defender for Cloud that sends email
   Reveal Solution Discussion Select an answer first
2. 27foundation · easy

   In Microsoft Sentinel, what is the primary function of an analytics rule?

   • ATo automate responses to incidents
   • BTo visualize security data in dashboards
   • CTo detect threats by analyzing data and generating alerts
   • DTo collect data from external sources
   Reveal Solution Discussion Select an answer first
4. 28expert · hard

   A company has Defender for Cloud enabled on multiple subscriptions. They want to automate the response to high-severity alerts by creating a ticket in ServiceNow and notifying the on-call engineer. However, they have a requirement that alerts from the 'Production' subscription must be handled differently: they should also trigger a Logic App that isolates the affected VM. They want to minimize administrative overhead. What should you do?

   • ACreate one workflow automation at the management group level that triggers on high-severity alerts, with actions to create a ticket and send an email, and a second workflow automation scoped to the Production subscription that also runs the isolation Logic App.
   • BCreate a single workflow automation at the management group level that triggers on high-severity alerts and includes both the ticket/email and the isolation Logic App for all subscriptions.
   • CUse Azure Policy to assign the workflow automation to all subscriptions and then modify the Logic App to check the subscription name.
   • DCreate a workflow automation for each subscription with the same actions, and a separate one for Production with the isolation action.
   Reveal Solution Discussion Select an answer first
5. 29expert · hard

   A global company uses Microsoft Sentinel in a single workspace in the US. They need to ingest Azure Activity logs from multiple subscriptions, including subscriptions in the EU. They also want to create analytics rules that detect suspicious Azure resource changes. Compliance requires that EU data not leave the EU. What should they do?

   • ACreate a second Sentinel workspace in the EU, enable the Azure Activity connector for EU subscriptions there, and use cross-workspace queries for analysis
   • BEnable the Azure Activity connector for all subscriptions in the US workspace
   • CUse a data collection rule to route EU activity logs to the US workspace
   • DCreate analytics rules in the US workspace that query EU activity logs via API
   Reveal Solution Discussion Select an answer first
6. 30application · medium

   A company uses Azure Monitor to collect network performance counters from Windows VMs. They now want to send selected network security events (Event ID 5156 and 5157) from those VMs to a Log Analytics workspace. They already have the Azure Monitor Agent installed. What should you configure to collect only those events?

   • AA Microsoft Sentinel data connector for Windows Security Events
   • BA diagnostic setting on the VM to stream Security event logs
   • CA data collection rule (DCR) with a Windows Event Logs data source that filters for event IDs 5156 and 5157
   • DA network security group flow log and a traffic analytics solution
   Reveal Solution Discussion Select an answer first