A city evaluates Azure OpenAI-assisted incident summarization inside Sentinel with private networking. What AI-assisted IR design is that?
Select an answer to reveal the explanation.
Short Explanation
You'll want AI to summarize Sentinel incidents on the city's private network path. Routing exports for SOAR playbook remediation, drafting custom KQL hunting queries, or summarizing threat intel reports in notebooks isn't that incident summarization design. Private assist, human judgment.
Full Explanation
Evaluating Azure OpenAI-assisted incident summarization inside Sentinel with private networking is AI-assisted IR under civic network controls. The city keeps summarization traffic on private endpoints / private network paths so incident text and entities are not exposed across the public Internet to convenience endpoints. AI assists analysts by compressing noisy incident timelines into actionable summaries while network and identity controls remain appropriate for citizen-impacting cases.
Routing Sentinel incident exports to Azure OpenAI via private endpoint for civic SOAR playbook remediation workflows is not the evaluated design; it applies private networking to automated remediation actions rather than AI-assisted incident summarization inside Sentinel, so it does not match the evaluated IR design. Connecting Sentinel automation rules to Azure OpenAI via private networking to draft custom KQL threat hunting queries is not the evaluated design; it shifts AI assist from private-networked incident summarization to proactive threat-hunting query generation, so it does not match the evaluated IR design. Using Azure OpenAI in Sentinel notebooks under civic private networking to summarize city threat intelligence reports is a threat intelligence reporting pattern, not AI-assisted incident summarization inside Sentinel workflows, so it does not match the evaluated IR design.
Exam caveat: Private networking for Azure AI must be paired with RBAC, data-loss prevention patterns, and clear data-handling rules (what fields may be sent to the model). Private Link does not automatically redact PII. Also clarify whether prompts/responses are logged and where.
Operational check: Deploy Azure OpenAI (or approved AI assist) with private endpoints reachable from the Sentinel/SOC network path; block public access where policy requires; pilot summarization on redacted sample incidents; require analyst confirmation before status changes; and document the AI data flow in the city's privacy impact assessment.
Prefer to study offline? Printable PDF study book + test engine ($7.50, unofficial). These questions stay free here.