Unit 5: Data Collection Rule (DCR) - Practice Quiz

1 What is the primary purpose of an Azure Log Analytics workspace?

2 Which Azure service is commonly used to query data in a Log Analytics workspace?

3 Which query language is used to analyze data in a Log Analytics workspace?

4 Which information must be selected when creating a Log Analytics workspace?

5 How can a Data Collection Rule use a Log Analytics workspace?

6 What is an Azure Storage account used for?

7 Which Azure Storage service is designed for unstructured object data?

8 Which naming rule applies to an Azure Storage account?

9 Which redundancy option keeps multiple copies of data within one Azure region?

10 Which characters are allowed in an Azure Storage account name?

11 What is the main purpose of Microsoft Defender for Cloud?

12 What does Secure Score in Microsoft Defender for Cloud represent?

13 What does Microsoft Defender for Cloud provide when it identifies a security weakness?

14 Where can Defender plans be enabled for an Azure subscription?

15 Which type of resource can Microsoft Defender for Cloud help protect?

16 What type of service is Microsoft Sentinel?

17 What does Microsoft Sentinel use to bring data from external services into the platform?

18 Which Azure resource is used to store Microsoft Sentinel log data?

19 What is the purpose of an analytics rule in Microsoft Sentinel?

20 What is a playbook in Microsoft Sentinel used for?

21 An organization operates resources in two Azure regions and wants centralized monitoring. What is the most appropriate design for a Log Analytics workspace?

22 A security team needs to retain sign-in logs for 180 days, while application logs should be retained for only 30 days. Which approach best meets this requirement?

23 A Log Analytics workspace must be created for production monitoring. Which configuration should be selected to support access control based on Azure resource permissions?

24 An administrator creates a Log Analytics workspace but cannot find diagnostic logs from a virtual network resource. What should be checked first?

25 A company wants to control Log Analytics costs while keeping frequently queried security data available. Which action is most suitable?

26 An application stores frequently accessed transaction files and requires high availability within a region. Which redundancy option is generally the best starting choice?

27 A storage account contains sensitive audit exports. The security team wants to prevent access through public endpoints. Which configuration best supports this requirement?

28 A company must prevent audit blobs from being modified or deleted during a required retention period. Which Azure Storage capability should be used?

29 A security engineer needs to grant an automation process access to one blob container without distributing account keys. Which method is most appropriate?

30 An organization wants old log files moved to a cooler storage tier after 30 days and deleted after one year. Which feature should be configured?

31 A security team wants Defender for Cloud to identify missing operating system updates and insecure configurations across virtual machines. Which capability should be enabled?

32 After enabling a Defender for Cloud plan, an administrator wants to prioritize the most important security improvements. Which feature should be used?

33 A company wants to receive alerts when a storage account shows suspicious access patterns. Which Defender for Cloud plan is most directly relevant?

34 A regulatory requirement states that all newly created resources must be evaluated against approved security settings. Which Defender for Cloud feature supports this goal?

35 A security operations team wants Defender for Cloud alerts to be investigated in Microsoft Sentinel. What integration should be configured?

36 Microsoft Sentinel is deployed for a subscription, but no sign-in data appears in its queries. What is the most likely missing configuration?

37 An analyst wants Sentinel to create an incident when multiple failed sign-ins are followed by a successful sign-in from an unusual location. Which Sentinel feature should be configured?

38 A security team wants a visual view of incident trends, alert sources, and investigation metrics. Which Sentinel feature is most suitable?

39 When a high-severity incident is created, the organization wants to notify the on-call team and create a service ticket automatically. Which Sentinel capability should be used?

40 An organization wants to identify whether a suspicious IP address appears across firewall, identity, and endpoint logs. Which Sentinel capability best supports this investigation?

41 A company must keep security logs within Germany. Its virtual machines run in several Azure regions, and Microsoft Sentinel will analyze all collected logs centrally. Which workspace design best satisfies the residency requirement?

42 A central SOC needs access to all workspace data, while application teams must query only logs generated by Azure resources they manage. Which access model best supports both requirements?

43 A workspace has a default retention period of 30 days, but the SecurityEvent table has a table-level retention setting of 180 days. Assuming no archive configuration changes the result, how long are rows in SecurityEvent retained?

44 A DCR transformation renames Computer to HostName, but the destination custom table contains a Computer column and no HostName column. Ingestion fails schema validation. What is the correct remediation?

45 After migrating servers to Azure Monitor Agent, the SOC observes two nearly identical copies of each Windows security event in the same workspace. Each server is associated with two DCRs that collect the same event stream. What is the most appropriate correction?

46 A diagnostic setting for a regional Azure resource is configured to archive logs to a storage account, but deployment validation rejects the destination. The account is in a different Azure region, while its firewall and permissions are correctly configured. What is the likely cause?

47 Security logs are stored in an immutable container with a locked 365-day time-based retention policy. A lifecycle rule attempts to delete the blobs after 90 days. What will happen?

48 An archive must remain available after a zonal failure and must provide read access from a secondary Azure region if the primary region becomes unavailable. Which redundancy option best satisfies both requirements?

49 A lifecycle rule moves diagnostic log blobs to the Cool tier 30 days after creation. Some blobs are unexpectedly moved later because a metadata operation changed their last-modified time. Which lifecycle behavior explains this?

50 An ADLS Gen2 storage account is reachable only through private endpoints. Blob API operations succeed, but analytics clients using hierarchical namespace operations fail DNS resolution for the Data Lake endpoint. What should be added?

51 A security team needs attack-path analysis, cloud security explorer capabilities, and risk-prioritized recommendations across Azure resources. Enabling only the foundational Defender for Cloud posture features does not provide them. Which plan is required?

52 Defender for Servers Plan 2 is enabled on one subscription. Virtual machines in another subscription under the same management group remain uncovered. What is the most scalable correction?

53 A legacy system temporarily cannot satisfy a Defender for Cloud recommendation. The security team must document the accepted risk, identify an owner, and automatically revisit the decision after 60 days. What should it configure?

54 Administrators must access management ports on Azure virtual machines only after an approved request, and the ports should remain closed outside the approved interval. Which Defender capability directly addresses this requirement?

55 Defender for Cloud reports vulnerabilities discovered through agentless scanning, but no corresponding raw vulnerability records appear in a custom Log Analytics table populated by an Azure Monitor Agent DCR. What is the best interpretation?

56 A SOC needs an analytics rule that evaluates events approximately once per minute and minimizes detection delay without using a custom continuous polling service. Which Sentinel rule type is most appropriate?

57 A large Sentinel watchlist contains malicious IP addresses. A scheduled rule must efficiently compare SigninLogs.IPAddress with the watchlist. Which design is most appropriate?

58 A DCR transformation discards all successful sign-in events before they reach the Sentinel workspace. Investigators later need those events to establish a user's normal sign-in locations. Which statement is correct?

59 A detection must work across authentication data from several vendors whose native tables use different column names and schemas. Which Sentinel approach minimizes vendor-specific query logic?

60 A central SOC must investigate Sentinel data in several customer tenants while each customer retains its own workspace and billing boundary. Which architecture best supports delegated cross-tenant operations?