SC-200 Certification Practice Question #107

Question

You have a custom analytics rule to detect threats in Azure Sentinel.
You discover that the analytics rule stopped running. The rule was disabled, and the rule name has a prefix of AUTO DISABLED.
What is a possible cause of the issue?

Accepted Answer

The "AUTO DISABLED" prefix is applied only on permanent failures, and MS Learn's troubleshooting article explicitly states "A rule is never autodisabled due to a transient failure." A query timing out (C) and connectivity issues (A) are both enumerated as transient, so neither produces the AUTO DISABLED state; B is unrelated. "Permissions to one of the data sources of the rule query were changed" is enumerated directly under the permanent-failure list, matching option D. Suggested Answer, Most Voted (16), and the documentation all converge on D; the C dissent is well-meaning but contradicted by the explicit transient/permanent classification, so it is discounted. Confidence is high but a few points below 90 due to the recurring C votes.

More SC-200 practice questions