Discuss Microsoft SC-200 Exam Topic 8 Question 36

You have a custom analytics rule to detect threats in Azure Sentinel.

You discover that the analytics rule stopped running. The rule was disabled, and the rule name has a prefix of AUTO DISABLED.

What is a possible cause of the issue?

AThere are connectivity issues between the data sources and Log Analytics.

BThe number of alerts exceeded 10,000 within two minutes.

CThe rule query takes too long to run and times out.

DPermissions to one of the data sources of the rule query were modified.

Suggested Answer: D

https://docs.microsoft.com/en-us/azure/sentinel/tutorial-detect-threats-custom

Get Premium SC-200 Questions as Interactive Web-Based Practice Test or PDF Real Exam Format Detailed Explanations Instant Access Get Your Practice Test

13 comments · newest first

Katie 11 months ago

Could be connectivity issues, but I’m not convinced.

Yasuko 11 months ago

Nah, I doubt it's permissions. That seems unlikely.

Edda 12 months ago

AUTO DISABLED? That's a red flag for sure!

Marisha 12 months ago

I think it's more about the alert limit being hit.

Della 1 year ago

Sounds like a classic timeout issue.

Britt 1 year ago

I feel like permissions issues could also be a factor. If something changed with the data sources, it might lead to the rule being disabled.

Denise 1 year ago

I’m a bit uncertain about the timeout issue. Could the query taking too long really cause the rule to disable? That sounds plausible.

Stevie 1 year ago

I think I practiced a question similar to this, and I recall that exceeding alert thresholds can trigger auto-disable. So, B might be the right answer.

Alfred 1 year ago

I remember something about AUTO DISABLED rules, but I'm not sure if it's always due to alert limits or if there are other factors involved.

Coral 1 year ago

The key here is that the population is assumed to follow a normal distribution. That means we can use a parametric test like the t-test. I'm pretty confident that option D, the one-sample t-test, is the correct answer.

Gertude 1 year ago

I'm pretty sure the Automatic Replies command is available in Exchange Server accounts, but I'll double-check the other options just to be sure.

Felix 1 year ago

This is a tricky one. I'm not entirely confident in my understanding of Universal Directory's capabilities when it comes to data sources. I'll have to review my notes and try to reason through the options.

Camellia 1 year ago

My gut says model regularization might help, but I'm really leaning towards data normalization to balance those features.

Microsoft SC-200 Exam - Topic 8 Question 36 Discussion