Free SC-200 Exam Braindumps
Microsoft Security Operations Analyst Questions 177–184 (page: 24)

HOTSPOT (Drag and Drop is not supported)
You deploy Microsoft Sentinel.
You need to implement connectors in Microsoft Sentinel to monitor Microsoft Teams and Linux virtual machines in Azure. The solution must minimize administrative effort.
Which data connector type should you use for each workload? To answer, select the appropriate options in the answer area.
Note: Each correct selection is worth one point.
Hot Area:

You are investigating an incident in Microsoft Sentinel that contains more than 127 alerts.
You discover eight alerts in the incident that require further investigation.
You need to escalate the alerts to another Microsoft Sentinel administrator.
What should you do to provide the alerts to the administrator?

You are configuring Microsoft Sentinel.
You need to send a Microsoft Teams message to a channel whenever an incident representing a sign-in risk event is activated in Microsoft Sentinel.
Which two actions should you perform in Microsoft Sentinel? Each correct answer presents part of the solution.
Note: Each correct selection is worth one point.

DRAG DROP (Drag and Drop is not supported)
You need to use an Microsoft Sentinel analytics rule to search for specific criteria in Amazon Web Services (AWS) logs and to generate incidents.
Which three actions should you perform in sequence? To answer, move the appropriate actions from the list of actions to the answer area and arrange them in the correct order.
Select and Place:

You have the following environment:
-Microsoft Sentinel
-A Microsoft 365 subscription
-Microsoft Defender for Identity
-A Microsoft Entra tenant
You configure Microsoft Sentinel to collect security logs from all the Active Directory member servers and domain controllers.
You deploy Microsoft Defender for Identity by using standalone sensors.
You need to ensure that you can detect when sensitive groups are modified in Active Directory.
Which two actions should you perform? Each correct answer presents part of the solution.
Note: Each correct selection is worth one point.

You use Microsoft Sentinel.
You need to use a built-in role to provide a security analyst with the ability to edit the queries of custom Microsoft Sentinel workbooks. The solution must use the principle of least privilege.
Which role should you assign to the analyst?

You create a hunting query in Microsoft Sentinel.
You need to receive a notification as soon as the hunting query detects a match on the query. The solution must minimize effort.
What should you use?

You have an Azure subscription named Sub1 and a Microsoft 365 subscription. Sub1 is linked to a Microsoft Entra tenant named contoso.com.
You create a Microsoft Sentinel workspace named workspace1. In workspace1, you deploy a Microsoft Entra connector for contoso.com and a Microsoft 365 connector for the Microsoft 365 subscription.
You need to use the Fusion rule to detect multi-staged attacks that include suspicious sign-ins to contoso.com followed by anomalous Microsoft 365 activity.
Which two actions should you perform? Each correct answer presents part of the solution.
Note: Each correct selection is worth one point.