Azure Security Operations and Monitoring Flashcards
6 cards from real Microsoft Azure Security Engineer Certification practice questions. Tap to flip, then mark Knew It or Still Learning — missed cards come back until you master them.
Read the first 6 Azure Security Operations and Monitoring flashcards as text
Which Microsoft Sentinel capability uses ML to correlate multiple lower-fidelity alerts from different sources into a single high-fidelity incident representing a multi-stage attack?
Answer: Fusion detection
Fusion detection correlates signals across Microsoft products to identify multi-stage attack patterns like credential compromise followed by exfiltration.
What is the best practice for reducing false positives in a Microsoft Sentinel scheduled analytics rule?
Answer: Tune the KQL query with additional where clauses and adjusted thresholds
Adding KQL filters to exclude known-good activity and adjusting alert thresholds reduces noise while preserving detection coverage.
Which Microsoft Defender for Cloud plan scans container images in Azure Container Registry for vulnerabilities?
Answer: Defender for Containers
Microsoft Defender for Containers triggers vulnerability assessment for images pushed to or pulled from ACR and surfaces findings in Defender for Cloud.
How do you configure Microsoft Sentinel to automatically run a playbook whenever a new incident is created?
Answer: Create a Sentinel automation rule with a playbook action on incident creation
Sentinel automation rules evaluate trigger conditions such as incident creation and run the specified Logic App playbook automatically.
What is the default hot data retention period for a Microsoft Sentinel Log Analytics workspace?
Answer: 90 days
Sentinel stores data in Log Analytics with a default interactive retention of 90 days before moving older data to lower-cost archive storage.
Which Microsoft Defender for Cloud recommendation alerts you when a subscription has no security contact email configured?
Answer: Provide security contact details for your subscription
Defender for Cloud recommends configuring a security contact so Microsoft can notify your organization directly during a security incident.
How this page was made: written with AI tools and published by Nathan Beja, founder of Practice Test Geeks, who is responsible for its content. Exam facts are checked against the official sources listed below. Not reviewed by a subject-matter expert. Editorial policy
Sources & references
Exam facts on this page (fees, format, dates, passing scores) are checked against these official sources; the date is our last check. Editorial policy
- learn.microsoft.com — Test delivery, retake policy, time limit, score validity, eligibility, renewal, exam information · verified Nov 2026