The answer is to use an ingestion-time or event-time exclusion window in the query. This is correct because it allows the scheduled rule to filter out events that have already triggered an alert within a specific time range, effectively preventing duplicate alerts in Sentinel without shortening the 5-minute run interval or the 1-hour lookback period. By incorporating a deduplication key based on timestamps, the query can skip previously processed events while still catching late-arriving logs that fall within the lookback window. On the Microsoft Azure Security Engineer Associate AZ-500 exam, this scenario tests your understanding of how to balance detection coverage with alert fatigue—a common trap is to reduce the lookback period, which would miss delayed data. Instead, remember the memory tip: “Look back wide, but exclude inside.” This means keep the long lookback for late logs, but use an exclusion window to skip duplicates already alerted.
AZ-500 Manage identity and access Practice Question
This AZ-500 practice question tests your understanding of manage identity and access. Read the scenario carefully and evaluate each option against the stated constraints before committing to an answer. A key principle to apply: sentinel scheduled rules can have overlapping lookback periods.. Once you have made your selection, read the full explanation to reinforce the concept and understand why each distractor is designed to mislead on exam day.
A Sentinel scheduled rule runs every 5 minutes and looks back 1 hour. Analysts see repeated alerts for the same event. Which change best prevents duplicate detections without missing late-arriving logs?
Clue words in this question
Noticing these words before you look at the options changes how you read each choice.
Clue: "best"
Why it matters: Signals that multiple options may be partially correct. Choose the option that most directly solves the exact problem described, not the one that sounds most complete.
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use an ingestion-time or event-time exclusion window in the query
Option B is correct because using an ingestion-time or event-time exclusion window in the query allows the rule to skip events that have already generated an alert within a specific time range, preventing duplicate detections while still accommodating late-arriving logs. This approach leverages the query logic to filter out duplicates based on a time-based deduplication key, ensuring that only new or unique events trigger alerts without altering the lookback period.
Key principle: Sentinel scheduled rules can have overlapping lookback periods.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
✗
Reduce the query lookback to 1 minute
Why it's wrong here
This does not meet the stated requirement as directly as the correct option.
✓
Use an ingestion-time or event-time exclusion window in the query
Why this is correct
Correct for the stated requirement.
Clue confirmation
The clue word "best" in the question point toward this answer.
Related concept
Sentinel scheduled rules can have overlapping lookback periods.
✗
Disable alert grouping
Why it's wrong here
This does not meet the stated requirement as directly as the correct option.
✗
Change the workspace retention period
Why it's wrong here
This does not meet the stated requirement as directly as the correct option.
Common exam traps
Common exam trap: answer the scenario, not the keyword
The trap here is that candidates often confuse reducing the lookback period (Option A) as a quick fix, not realizing it will miss late-arriving logs, while the correct solution uses a query-level exclusion window that preserves the lookback for completeness.
Detailed technical explanation
How to think about this question
In Azure Sentinel (now Microsoft Sentinel), scheduled rules use Kusto Query Language (KQL) to query logs. By adding a condition like `| where TimeGenerated > ago(5m)` or using `ingestion_time()` to exclude events already processed, the rule can effectively deduplicate based on event time rather than ingestion time. This is critical in environments with log latency, where events may arrive minutes after occurrence; the exclusion window must be carefully tuned (e.g., 5-10 minutes) to balance deduplication and completeness.
KKey Concepts to Remember
Sentinel scheduled rules can have overlapping lookback periods.
Exclusion windows prevent duplicate alerts for the same event.
KQL `TimeGenerated` or `_IngestionTime` are used for exclusion windows.
Exclusion windows accommodate late-arriving logs without re-alerting.
TExam Day Tips
→Watch for words such as best, first, most likely and least administrative effort.
→Review why wrong options are wrong, not only why the correct option is correct.
Key takeaway
Sentinel scheduled rules can have overlapping lookback periods.
Real-world example
How this comes up in practice
A cloud solutions architect for a retail company is evaluating services for a new workload. The correct answer here reflects best practice for the specific scenario described — not a general cloud recommendation. Sentinel scheduled rules can have overlapping lookback periods. Cloud exam questions reward reading the constraint carefully: the same technology can be right or wrong depending on the use case.
Related glossary terms
Concepts from this question explained
These glossary pages explain the core terms tested in this AZ-500 question in full detail.
Review sentinel scheduled rules can have overlapping lookback periods., then practise related AZ-500 questions on the same topic to reinforce the concept.
Manage identity and access — This question tests Manage identity and access — Sentinel scheduled rules can have overlapping lookback periods..
What is the correct answer to this question?
The correct answer is: Use an ingestion-time or event-time exclusion window in the query — Option B is correct because using an ingestion-time or event-time exclusion window in the query allows the rule to skip events that have already generated an alert within a specific time range, preventing duplicate detections while still accommodating late-arriving logs. This approach leverages the query logic to filter out duplicates based on a time-based deduplication key, ensuring that only new or unique events trigger alerts without altering the lookback period.
What should I do if I get this AZ-500 question wrong?
Review sentinel scheduled rules can have overlapping lookback periods., then practise related AZ-500 questions on the same topic to reinforce the concept.
Are there clue words in this question I should notice?
Yes — watch for: "best". Signals that multiple options may be partially correct. Choose the option that most directly solves the exact problem described, not the one that sounds most complete.
What is the key concept behind this question?
Sentinel scheduled rules can have overlapping lookback periods.
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
This AZ-500 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-500 exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.