Deal of The Day! Hurry Up, Grab the Special Discount - Save 25% - Ends In 00:00:00 Coupon code: SAVE25
Welcome to Pass4Success

- Free Preparation Discussions
Mail Us support@pass4success.com
Location US
Mob_nav_barsMENU

Microsoft SC-200 Exam - Topic 8 Question 36 Discussion

You have a custom analytics rule to detect threats in Azure Sentinel.You discover that the analytics rule stopped running. The rule was disabled, and the rule name has a prefix of AUTO DISABLED.What is a possible cause of the issue?
D) Permissions to one of the data sources of the rule query were modified.
A) There are connectivity issues between the data sources and Log Analytics.
B) The number of alerts exceeded 10,000 within two minutes.
C) The rule query takes too long to run and times out.

Microsoft SC-200 Exam - Topic 8 Question 36 Discussion

Actual exam question for Microsoft's SC-200 exam
Question #: 36
Topic #: 8
[All SC-200 Questions]

You have a custom analytics rule to detect threats in Azure Sentinel.

You discover that the analytics rule stopped running. The rule was disabled, and the rule name has a prefix of AUTO DISABLED.

What is a possible cause of the issue?

Show Suggested Answer Hide Answer
Suggested Answer: D

https://docs.microsoft.com/en-us/azure/sentinel/tutorial-detect-threats-custom

by Markus at May 26, 2022, 05:11 AM

Limited Time Offer

25%

Off

Get Premium SC-200 Questions as Interactive Web-Based Practice Test or PDF

Contribute your Thoughts:

0/2000 characters
Submit Cancel
Katie
7 months ago
Could be connectivity issues, but I’m not convinced.
upvoted 0 times
...
Yasuko
7 months ago
Nah, I doubt it's permissions. That seems unlikely.
upvoted 0 times
...
Edda
7 months ago
AUTO DISABLED? That's a red flag for sure!
upvoted 0 times
...
Marisha
8 months ago
I think it's more about the alert limit being hit.
upvoted 0 times
...
Della
8 months ago
Sounds like a classic timeout issue.
upvoted 0 times
...
Britt
8 months ago
I feel like permissions issues could also be a factor. If something changed with the data sources, it might lead to the rule being disabled.
upvoted 0 times
...
Denise
8 months ago
I’m a bit uncertain about the timeout issue. Could the query taking too long really cause the rule to disable? That sounds plausible.
upvoted 0 times
...
Stevie
8 months ago
I think I practiced a question similar to this, and I recall that exceeding alert thresholds can trigger auto-disable. So, B might be the right answer.
upvoted 0 times
...
Alfred
8 months ago
I remember something about AUTO DISABLED rules, but I'm not sure if it's always due to alert limits or if there are other factors involved.
upvoted 0 times
...
Coral
8 months ago
The key here is that the population is assumed to follow a normal distribution. That means we can use a parametric test like the t-test. I'm pretty confident that option D, the one-sample t-test, is the correct answer.
upvoted 0 times
...
Gertude
8 months ago
I'm pretty sure the Automatic Replies command is available in Exchange Server accounts, but I'll double-check the other options just to be sure.
upvoted 0 times
...
Felix
8 months ago
This is a tricky one. I'm not entirely confident in my understanding of Universal Directory's capabilities when it comes to data sources. I'll have to review my notes and try to reason through the options.
upvoted 0 times
...
Camellia
8 months ago
My gut says model regularization might help, but I'm really leaning towards data normalization to balance those features.
upvoted 0 times
...

Save Cancel