Practice Sentinel Questions Now
Start a timed practice session focusing on Microsoft Sentinel topics from the AZ-500 question bank.
Start AZ-500 Practice Quiz →AZ-500 Sentinel Question Bank (11 Questions)
Browse all 11 practice questions covering Microsoft Sentinel for the AZ-500 certification exam. Answers are intentionally hidden on this page so you can self-test first before checking results in quiz mode.
- Question 1Secure Azure using Microsoft Defender for Cloud and Microsoft Sentinel
A Sentinel Analytics rule fires an alert. An automated Playbook (Logic App) then creates a ticket in ServiceNow. What Sentinel feature triggers the Logic App?
Answer hidden for practice.
Use the interactive quiz to reveal the correct answer and explanation.
Start AZ-500 Quiz - Question 2Secure Azure using Microsoft Defender for Cloud and Microsoft Sentinel
A Sentinel playbook is triggered when a phishing email alert fires. The playbook must delete the email from all mailboxes in the organization. Which connector in Logic Apps provides this action?
Answer hidden for practice.
Use the interactive quiz to reveal the correct answer and explanation.
Start AZ-500 Quiz - Question 3Secure Azure using Microsoft Defender for Cloud and Microsoft Sentinel
Which Microsoft Sentinel content type provides out-of-the-box analytics rules, hunting queries, workbooks, and playbooks packaged together for a specific data source?
Answer hidden for practice.
Use the interactive quiz to reveal the correct answer and explanation.
Start AZ-500 Quiz - Question 4Secure Azure using Microsoft Defender for Cloud and Microsoft Sentinel
A Microsoft Sentinel alert fires for anomalous Azure resource deletion. The playbook must capture VM snapshots before potential destruction. Which Logic App action should be first in the playbook?
Answer hidden for practice.
Use the interactive quiz to reveal the correct answer and explanation.
Start AZ-500 Quiz - Question 5Secure Azure using Microsoft Defender for Cloud and Microsoft Sentinel
A security analyst wants to ingest firewall logs from an on-premises Palo Alto firewall into Microsoft Sentinel. Which data connector type typically handles vendor-specific security appliance logs?
Answer hidden for practice.
Use the interactive quiz to reveal the correct answer and explanation.
Start AZ-500 Quiz - Question 6Secure Azure using Microsoft Defender for Cloud and Microsoft Sentinel
A Sentinel playbook must automatically block a user account in Azure AD when a high-severity incident is created. Which Azure service provides the automation logic?
Answer hidden for practice.
Use the interactive quiz to reveal the correct answer and explanation.
Start AZ-500 Quiz - Question 7Secure Azure using Microsoft Defender for Cloud and Microsoft Sentinel
Sentinel data connector for Azure Activity logs is enabled. Which Azure activities are captured?
Answer hidden for practice.
Use the interactive quiz to reveal the correct answer and explanation.
Start AZ-500 Quiz - Question 8Secure Azure using Microsoft Defender for Cloud and Microsoft Sentinel
Sentinel must alert when a user account is added to the Azure AD Global Administrator role. Which data connector provides the event that triggers this rule?
Answer hidden for practice.
Use the interactive quiz to reveal the correct answer and explanation.
Start AZ-500 Quiz - Question 9Secure Azure using Microsoft Defender for Cloud and Microsoft Sentinel
A Sentinel automation rule is set to run a playbook when an incident severity is 'High' and entity type is 'Account'. What is a limitation of automation rules compared to analytics rule alert actions?
Answer hidden for practice.
Use the interactive quiz to reveal the correct answer and explanation.
Start AZ-500 Quiz - Question 10Secure Azure using Microsoft Defender for Cloud and Microsoft Sentinel
A Sentinel analytics rule uses the SecurityEvent table. The rule must alert when a user performs more than 10 failed logins (EventID 4625) in 5 minutes from the same IP. Which KQL element implements the count threshold?
Answer hidden for practice.
Use the interactive quiz to reveal the correct answer and explanation.
Start AZ-500 Quiz - Question 11Secure Azure using Microsoft Defender for Cloud and Microsoft Sentinel
Which Azure service is a cloud-native SIEM and SOAR solution that collects security data across the enterprise for threat detection and automated response?
Answer hidden for practice.
Use the interactive quiz to reveal the correct answer and explanation.
Start AZ-500 Quiz
Key Sentinel Concepts for AZ-500
AZ-500 Sentinel Exam Tips
Microsoft Sentinel questions in AZ-500 are typically scenario-based. Focus on identity protection, platform hardening, data security, and security operations. Priority concepts: sentinel, siem, soar, data connector, analytic rule, workbook.
What AZ-500 Expects
- Anchor your answer in choose controls that reduce exposure while preserving least-privilege access.
- Sentinel scenarios for AZ-500 are frequently mapped to Domain 4 (25-30%), so read the objective carefully before picking controls or architecture.
- Expect multi-topic scenarios where Sentinel interacts with identity, networking, governance, or monitoring patterns rather than appearing as an isolated question.
- When two options are both technically valid, prefer the choice that best aligns with the exam's operational scope (Associate) and vendor best practices.
High-Value Sentinel Concepts
- Know the core Sentinel building blocks cold: sentinel, siem, soar, data connector.
- Review the edge-case features and limits for analytic rule, workbook; these details are commonly used to differentiate answer choices.
- Practice service-integration reasoning: how Sentinel pairs with Security Operations, Defender in real deployment patterns.
- For AZ-500, explain why the chosen Sentinel design meets reliability, security, and cost expectations better than the alternatives.
Common AZ-500 Traps
- Watch for identity controls that are too broad for the requested scope.
- Questions in Manage Security Operations often include distractors that look correct for Sentinel but violate least-privilege, compliance, or availability requirements.
- Avoid picking options purely by feature name; validate data path, failure handling, and governance impact before answering.
- If the prompt hints at automation or repeatability, eliminate manual-only operational answers first.
Fast Review Checklist
- Can you compare at least two Sentinel implementation paths and justify which one best fits the scenario?
- Can you map the chosen answer back to Manage Security Operations (25-30%) outcomes for AZ-500?
- Can you explain security and access boundaries for Sentinel without relying on default-open assumptions?
- Can you describe how Sentinel integrates with Security Operations and Defender during failure, scaling, and monitoring events?