AZ-500 Question 268
Single answerYou are a security analyst at an organization that has connected multiple data sources (including Azure Active Directory sign-in logs) to Microsoft Sentinel. You want to enable an analytics rule that detects multiple failed sign-ins from different IP addresses within a short period. Which step is crucial to properly enable this rule so it starts generating alerts and incidents?
- A
Use the 'Create' button in the Analytics blade and select the 'Failed sign-ins from multiple countries' template, then configure and enable the rule.
- B
Add the analytics rule JSON template directly to your resource group using Azure Resource Manager templates without modifying the default rule settings.
- C
Create a Logic App that polls sign-in logs and manually configure a connector to populate alerts in Microsoft Sentinel.
- D
Enable the default Azure AD Conditional Access Policy for risk-based sign-ins to ensure analytic rules are triggered.
Show answer and explanation
Correct answer: A
Explanation
To properly enable an analytics rule in Microsoft Sentinel, you must configure and enable it within the Analytics blade, specifying its detection logic, schedule, and incident settings. Adding or updating templates via other methods (such as Azure Resource Manager) or using Conditional Access alone does not ensure the rule is active. Refer to Microsoft Sentinel documentation (https://learn.microsoft.com/azure/sentinel/alerts-overview) for detailed best practices on creating, enabling, and managing your analytics rules.
- A. Correct.
Correct: Selecting the built-in template in the Microsoft Sentinel Analytics blade, configuring relevant settings (such as the schedule, query parameters, and incident creation), and then enabling the rule is the primary way to ensure it starts generating alerts and incidents. This step properly sets up the rule to run periodically and monitors the required log data.
- B. Incorrect.
Incorrect: Simply adding the rule template JSON via an ARM template without configuring or enabling it inside Sentinel won't automatically activate alerts. You must explicitly enable and configure the rule within Sentinel for it to start triggering incidents.
- C. Incorrect.
Incorrect: While Logic Apps can automate responses to Sentinel alerts, creating a Logic App alone does not enable an analytics rule. You still need to configure an analytics rule in Sentinel that triggers or leverages the Logic App.
- D. Incorrect.
Incorrect: Turning on a Conditional Access Policy in Azure AD helps reduce risky sign-ins but does not automatically configure or enable analytics rules in Sentinel. You still must set up and enable the actual analytics rule in the Sentinel portal.