SC-200 Certification Practice Question #109

Question

You create a custom analytics rule to detect threats in Azure Sentinel.
You discover that the rule fails intermittently.
What are two possible causes of the failures? Each correct answer presents part of the solution.
NOTE: Each correct selection is worth one point.

Accepted Answer

The keyword is "intermittently." MS Learn's troubleshooting article classifies analytics-rule failures as either *transient* (temporary, the rule succeeds on a later attempt) or *permanent* (auto-disables the rule until human intervention). The two transient examples called out by the documentation are a rule query that "takes too long to run and times out" (A) and "connectivity issues between data sources and Log Analytics" (D) — both produce the described intermittent behavior. By contrast, a deleted target workspace (B) and changed permissions to a data source (C) are explicitly listed as permanent failures that disable the rule entirely, not intermittently. The official Suggested Answer (D), the unanimous community Most Voted (AD), and two high-vote comments all align with the MS Learn list.

More SC-200 practice questions