AZ-204 Implement Azure security Practice Question
Your company uses Microsoft Sentinel for security information and event management (SIEM). You need to detect and automatically respond to a potential credential theft attack where an anomalous number of failed logins are followed by a successful login from a different geographic location. Which Microsoft Sentinel feature should you use?
⚠ Common exam trap
Watch out — candidates often confuse 'playbooks' (the automation component) with the complete detection-and-response feature, forgetting that an analytics rule is required to trigger the playbook and that the rule itself can include an automated response directly.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
An analytics rule with an automated response
An analytics rule in Microsoft Sentinel can be configured to detect patterns like anomalous failed logins followed by a successful login from a different geography. The rule can then trigger an automated response, such as running a playbook or creating an incident, to remediate the threat in near real-time. This combines detection and automated action within a single rule, making it the correct choice for this scenario.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Microsoft Sentinel Data Connectors
Why it's wrong here
Microsoft Sentinel Data Connectors are fundamental components responsible solely for ingesting security logs and events from various sources into the Sentinel workspace. While crucial for populating the underlying data store, they do not inherently perform threat detection or automated response actions. Their function is limited to data collection, making them a prerequisite for, but not the mechanism of, active threat identification or mitigation. Therefore, relying solely on data connectors would not achieve the goal of detecting and responding to threats.
- ✓
An analytics rule with an automated response
Why this is correct
An analytics rule in Microsoft Sentinel is designed to detect specific threat patterns or anomalies within the ingested data using Kusto Query Language (KQL). When an analytics rule's query condition is met, it can automatically generate an incident, signaling a potential security threat. Crucially, these rules can be configured to trigger an automated response directly, such as running a playbook to disable a user account or isolate a compromised host, thereby combining detection with immediate mitigation. This integrated approach directly addresses both the identification and remediation aspects of threat management.
- ✗
Microsoft Defender for Identity
Why it's wrong here
Microsoft Defender for Identity is a specialized cloud-based security solution primarily focused on protecting on-premises Active Directory environments from advanced threats and compromised identities. While it provides robust identity-based threat detection, it operates as a distinct product from Microsoft Sentinel, with its own sensors and detection logic. It is not the native mechanism within Sentinel itself for defining custom detection logic or orchestrating automated responses across a broader range of data sources ingested into Sentinel. Therefore, it's not the correct tool for implementing a Sentinel-based detection and response strategy.
- ✗
Microsoft Sentinel playbooks
Why it's wrong here
Microsoft Sentinel playbooks, built on Azure Logic Apps, are powerful tools for orchestrating automated responses to security incidents or alerts. However, playbooks are reactive by nature; they require a trigger to initiate their execution. They do not perform the initial threat detection themselves, nor do they define the conditions under which a threat is identified. An analytics rule or a manual action is necessary to trigger a playbook, meaning playbooks alone cannot fulfill both the detection and response requirements.
Go deeper
Related to this question
About these practice questions
Courseiva writes every AZ-204 question from scratch — 881 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-204 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-204 exam.