Azure Security Technologies (AZ-500) Practice Questions

Sample question 1 — Manage security operations

A security operations center needs to ingest logs from many Azure and on-premises sources into a single tool, detect suspicious sign-in patterns with a scheduled query, and automatically open an incident for analysts to investigate. Which Microsoft service should the team use?

1. A. Azure Log Analytics with a saved query that analysts run manually each morning.
2. B. Azure Monitor with metric alerts, which notifies operators but does not create security incidents.
3. C. Microsoft Sentinel with data connectors, an analytics rule, and incident creation for the detected
4. D. Microsoft Defender for Cloud with only the secure score feature enabled and no alerts.

Answer: C. Option C is correct. Microsoft Sentinel ingests logs through data connectors, runs an analytics rule on a schedule to detect suspicious sign-ins, and creates an incident so analysts can investigate in one tool. Option B is incorrect because metric alerts notify operators but do not create security incidents. Option D is incorrect because secure score alone does not ingest logs or detect sign-in patterns. Option A is incorrect because a saved query that analysts run manually does not create incidents automatically.