Courseiva
← AZ-500
Full test
Secure Azure using Microsoft Defender for Cloud and Microsoft Sentinel →hardMultiple ChoiceObjective-mapped

Using Fusion Rules for Multi-Signal Incident Correlation in Microsoft Sentinel

Your company uses Microsoft Sentinel to correlate data from multiple sources. You need to create an analytics rule that triggers an incident when a user signs in from an unfamiliar location and then performs a high-risk action in Azure. What is the best approach?

Quick Answer

The answer is to create a Fusion analytics rule. This is the correct approach because Fusion rules use Microsoft Sentinel’s machine learning models to automatically correlate multiple signals—such as an unfamiliar sign-in followed by a high-risk Azure action—into a single, multi-stage incident, without requiring you to write complex KQL queries. On the Microsoft Azure Security Engineer Associate AZ-500 exam, this scenario tests your understanding of how Fusion simplifies multi-signal correlation compared to scheduled query rules, which demand manual KQL logic, or near-real-time (NRT) rules, which handle only single events. A common trap is assuming you must write a custom query for every correlation; instead, remember that Fusion is purpose-built for detecting attack chains across different data sources. Memory tip: think “Fusion fuses signals” to recall that it combines disparate alerts into one coherent incident.

⚠ Common exam trap

A common mix-up: candidates choose a Scheduled or NRT rule because they think they need to write a custom KQL query to join logs, but they overlook that Fusion is specifically designed for multi-stage correlation across Microsoft security products without requiring any manual query writing.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Create a Fusion analytics rule

The Fusion analytics rule is designed to correlate alerts from multiple Microsoft security products (e.g., Microsoft Defender for Identity, Microsoft Defender for Cloud Apps) to detect multi-stage attacks. In this scenario, the rule automatically matches a sign-in from an unfamiliar location (detected by Microsoft Defender for Identity) with a subsequent high-risk action in Azure (detected by Microsoft Defender for Cloud Apps) to create a single incident, reducing alert fatigue and providing context.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

  • ✗

    Run a custom anomaly detection job

    Why it's wrong here

    Anomaly detection is for baseline deviations, not explicit correlation.

  • ✗

    Create a Scheduled analytics rule with a KQL query

    Why it's wrong here

    Creating a Scheduled analytics rule with a KQL query is unsuitable because it primarily focuses on detecting patterns or thresholds within a single query execution over a defined time window, not on tracking a user's state across sequential, distinct events. The scenario requires correlating an initial unfamiliar sign-in with a subsequent high-risk action, which demands a more stateful or behavioural detection mechanism. This option is tempting as scheduled rules are the most common type, ideal for identifying specific known patterns, aggregations, or anomalies that can be captured by a single KQL query run at regular intervals, such as detecting multiple failed sign-ins from a single IP address.

  • ✗

    Create a Near-Real-Time (NRT) analytics rule

    Why it's wrong here

    NRT rules are for single event types.

  • ✓

    Create a Fusion analytics rule

    Why this is correct

    Fusion rules correlate multiple alerts from different sources.

About these practice questions

Courseiva writes every AZ-500 question from scratch — 194 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →

How Courseiva writes practice questions · Editorial policy

Same concept, more angles

1 more way this is tested on AZ-500

These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.

Variation 1. A financial services company uses Microsoft Sentinel to detect ransomware activity. They want to correlate alerts from multiple sources to reduce false positives. They have enabled Microsoft Defender for Cloud, Microsoft Defender XDR, and Azure Firewall logs. Which Sentinel feature should they use to create a single alert from multiple signals?

hard
  • A.Near-real-time (NRT) rules
  • ✓ B.Fusion (machine learning) rules
  • C.Anomaly detection rules
  • D.Scheduled query rules

Why B: Fusion (machine learning) rules in Microsoft Sentinel are specifically designed to correlate alerts from multiple sources—such as Microsoft Defender for Cloud, Microsoft Defender XDR, and Azure Firewall logs—by using machine learning models to identify multi-stage attack patterns and reduce false positives. This makes Fusion the correct choice for creating a single alert from multiple signals, as it automatically combines related alerts into a single, high-fidelity incident.

JA

Written by Johnson Ajibi, MSc IT Security

Senior Network & Security Engineer · founder of Courseiva

This AZ-500 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-500 exam.