SC-200 · Question #68
You create a custom analytics rule to detect threats in Azure Sentinel. You discover that the rule fails intermittently. What are two possible causes of the failures? Each correct answer presents…
The correct answer is A. The rule query takes too long to run and times out. D. There are connectivity issues between the data sources and Log Analytics. Two intermittent failure causes for a custom Azure Sentinel analytics rule are: (A) Query timeout - if a KQL query is complex or scans large datasets, it may exceed the allowed execution time limit and fail only when data volume or query complexity peaks, causing intermittent…
Question
You create a custom analytics rule to detect threats in Azure Sentinel. You discover that the rule fails intermittently. What are two possible causes of the failures? Each correct answer presents part of the solution. NOTE: Each correct selection is worth one point.
Options
- AThe rule query takes too long to run and times out.
- BThe target workspace was deleted.
- CPermissions to the data sources of the rule query were modified.
- DThere are connectivity issues between the data sources and Log Analytics
How the community answered
(29 responses)- A79% (23)
- B7% (2)
- C14% (4)
Explanation
Two intermittent failure causes for a custom Azure Sentinel analytics rule are: (A) Query timeout - if a KQL query is complex or scans large datasets, it may exceed the allowed execution time limit and fail only when data volume or query complexity peaks, causing intermittent failures. (D) Connectivity issues between data sources and Log Analytics - if the pipeline ingesting data into the workspace is temporarily disrupted, the rule may fail because expected data is absent or incomplete. Option B (workspace deleted) would cause permanent failure, not intermittent. Option C (permissions modified) would also cause consistent, repeatable failures rather than intermittent ones.
Topics
Community Discussion
No community discussion yet for this question.