AZ-500 Manage identity and access Practice Question
A security analyst uses Microsoft Sentinel. They want to create a scheduled analytics rule that runs every hour and queries Azure Activity logs to detect deployment of VMs in non-approved regions. They want to generate an incident automatically when suspicious activity is found. Which configuration is required to automatically create an incident?
⚠ Common exam trap
Watch out — candidates often confuse the 'Alert details' configuration (which only sets alert metadata) with the incident creation toggle, assuming that defining severity and description automatically generates an incident, when in fact a separate explicit setting is required.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Enable 'Create incident from alerts triggered by this rule' in the Incident settings
The 'Create incident from alerts triggered by this rule' setting in the Incident settings tab is the specific toggle that instructs Microsoft Sentinel to automatically generate a security incident whenever the scheduled analytics rule fires an alert. Without this setting enabled, the rule will only produce raw alerts that must be manually triaged or routed through a separate automation rule to become incidents. This is the direct configuration required for automatic incident creation from a scheduled query rule.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Enable 'Create incident from alerts triggered by this rule' in the Incident settings
Why this is correct
The 'Create incident from alerts triggered by this rule' toggle resides in the Incident settings tab of the analytics rule wizard in Microsoft Sentinel. When enabled, every alert generated by the rule is automatically fed into the incident creation pipeline, where alert grouping rules determine whether alerts are merged into a single incident or create separate ones. This is the definitive switch that controls whether the rule produces incidents at all; without it, alerts are stored in the Sentinel alerts table but no incident is created.
- ✗
Configure the 'Alert details' section with the appropriate severity and description
Why it's wrong here
The Alert details section configures metadata that is attached to the alert itself, such as severity, description, and MITRE ATT&CK tactics. These fields are useful for context and filtering, but they do not influence the automatic creation of incidents. Incident creation is governed solely by the Incident settings tab, so even an alert with rich, well-defined details will not become an incident unless the 'Create incident from alerts triggered by this rule' toggle is enabled.
- ✗
Define entity mapping in the 'Entity mapping' tab
Why it's wrong here
Entity mapping in the Entity mapping tab is used to identify specific entities (accounts, hosts, IP addresses, URLs, etc.) from the query results and associate them with the alert or incident for enrichment and investigation. This mapping improves entity pages, threat hunting, and correlation across data sources, but it is not a trigger for incident creation. An entity-mapped alert still requires the Incident settings toggle to be enabled before an incident is generated.
- ✗
Connect Azure Activity log to Sentinel via Event Hub
Why it's wrong here
Connecting Azure Activity log to Sentinel via Event Hub is a data connector configuration step that brings Activity log events into the Log Analytics workspace. This is a prerequisite for having Activity log data available for queries, but it is unrelated to the specific incident-creation behavior of an analytics rule. Even without this connection, you can create an analytics rule and enable 'Create incident from alerts triggered by this rule'; the setting that controls incident creation is always in the Incident settings tab, not in data connector configuration.
Go deeper
Related to this question
About these practice questions
One of 194 original AZ-500 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-500 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-500 exam.