nerdexam
Microsoft

AZ-500 · Question #207

You have an Azure subscription that contains several Azure SQL databases and an Azure Sentinel workspace. You need to create a saved query in the workspace to find events reported by Advanced Threat…

The correct answer is C. From the Azure Sentinel workspace, create a Kusto Query Language query. To find Advanced Threat Protection events for Azure SQL Database within an Azure Sentinel workspace, you must create a Kusto Query Language (KQL) query directly within the Sentinel workspace.

Submitted by femi9· Mar 6, 2026Implement an instrumentation strategy

Question

You have an Azure subscription that contains several Azure SQL databases and an Azure Sentinel workspace. You need to create a saved query in the workspace to find events reported by Advanced Threat Protection for Azure SQL Database. What should you do?

Options

  • AFrom Azure CLI run the Get-AzOperationalInsightsworkspace cmdlet.
  • BFrom the Azure SQL Database query editor, create a Transact-SQL query.
  • CFrom the Azure Sentinel workspace, create a Kusto Query Language query.
  • DFrom Microsoft SQL Server Management Studio (SSMS), create a Transact-SQL query.

How the community answered

(25 responses)
  • A
    4% (1)
  • B
    8% (2)
  • C
    76% (19)
  • D
    12% (3)

Why each option

To find Advanced Threat Protection events for Azure SQL Database within an Azure Sentinel workspace, you must create a Kusto Query Language (KQL) query directly within the Sentinel workspace.

AFrom Azure CLI run the Get-AzOperationalInsightsworkspace cmdlet.

Get-AzOperationalInsightsworkspace is an Azure PowerShell cmdlet used to retrieve workspace properties, not to create or run queries.

BFrom the Azure SQL Database query editor, create a Transact-SQL query.

The Azure SQL Database query editor is used to run Transact-SQL (T-SQL) queries against the SQL database itself, not to query logs stored in an Azure Sentinel workspace.

CFrom the Azure Sentinel workspace, create a Kusto Query Language query.Correct

Azure Sentinel workspaces utilize Azure Log Analytics, which is powered by Kusto Query Language (KQL) for querying collected logs and events. Advanced Threat Protection events for Azure SQL Database, when integrated with Sentinel, are ingested into the Log Analytics workspace and can be queried using KQL.

DFrom Microsoft SQL Server Management Studio (SSMS), create a Transact-SQL query.

SQL Server Management Studio (SSMS) is used for managing and querying SQL Server instances (on-premises or Azure SQL) using Transact-SQL, not for querying logs in Azure Sentinel.

Concept tested: KQL queries in Azure Sentinel

Source: https://learn.microsoft.com/en-us/azure/sentinel/get-started-queries

Topics

#Azure Sentinel#KQL#Advanced Threat Protection#saved queries

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full AZ-500 Practice