You use Azure Sentinel. You need to receive an immediate alert whenever Azure Storage account keys are enumerated. Which two actions should you perform?Each correct answer presents part of the…

The correct answer is A. Create a livestream D. Create a hunting query. To receive immediate alerts when Azure Storage account keys are enumerated, you need two things. First, Create a hunting query (D) - write a KQL query that detects the ListKeys operation on Azure Storage accounts (sourced from Azure Activity logs). Second, Create a livestream…

Submitted by kim_seoul· Apr 18, 2026Perform threat hunting

Question

You use Azure Sentinel. You need to receive an immediate alert whenever Azure Storage account keys are enumerated. Which two actions should you perform?Each correct answer presents part of the solution. NOTE: Each correct selection is worth one point.

Options

ACreate a livestream
BAdd a data connector
CCreate an analytics rule
DCreate a hunting query.
ECreate a bookmark.

How the community answered

(67 responses)

A
75% (50)
B
4% (3)
C
13% (9)
E
7% (5)

Explanation

To receive immediate alerts when Azure Storage account keys are enumerated, you need two things. First, Create a hunting query (D) - write a KQL query that detects the ListKeys operation on Azure Storage accounts (sourced from Azure Activity logs). Second, Create a livestream (A) - livestream runs your hunting query continuously in near-real-time and generates an alert the moment a match is found, providing immediacy. Adding a data connector (B) is a prerequisite but not sufficient alone. Creating an analytics rule (C) would also generate alerts, but the pairing of hunting query + livestream is the specific Sentinel workflow the question is testing. Bookmarks (E) are used to save notable events during investigation, not to trigger alerts.

Topics

#Azure Sentinel#Threat Hunting#Real-time Monitoring#KQL

Community Discussion

No community discussion yet for this question.

Full SC-200 Practice