Hotspot Question On Monday, you configure an email notification in Azure Security Center to email notifications to [email protected]. On Tuesday, Security Center generates the security alerts shown…

Question

Exhibits

Answer Area

• Total number of Security Center email notifications about an RDP brute force attack on Tuesday:
  1234
• Total number of Security Center email notifications on Tuesday:
  346911

Explanation

This question tests knowledge of Azure Security Center's email notification throttling behavior, specifically how many alert emails are sent per severity level per day.

Approach. Azure Security Center throttles email notifications to prevent alert fatigue. For High severity alerts, only ONE email is sent per day regardless of how many high-severity alerts are generated. For Medium severity alerts, one email is sent per day, and for Low severity alerts, one email per day as well. So if the table shows multiple alerts of the same severity on Tuesday, the user will still only receive ONE email per severity tier that day, not one email per individual alert. The total count depends on how many distinct severity levels are represented in the alerts table.

Concept tested. Azure Security Center email notification throttling - Security Center limits email notifications to one email per alert severity level per day (for the same subscription) to avoid overwhelming recipients. This means even if 5 High severity alerts fire on the same day, [email protected] receives only 1 High severity notification email. The total emails received equals the number of distinct severity levels that triggered alerts that day, not the total number of individual alerts.

Reference. https://docs.microsoft.com/en-us/azure/security-center/security-center-provide-security-contact-details - Azure Security Center email notification documentation describes per-day, per-severity throttling behavior.

No community discussion yet for this question.