QUESTION: 14

A company uses Azure Sentinel.
You need to create an automated threat response.
What should you use?

a data connector
a playbook
a workbook
a Microsoft incident creation rule

Answer(s): B

Reference:

https://docs.microsoft.com/en-us/azure/sentinel/tutorial-respond-threats-playbook

HOTSPOT
-
You have a Microsoft 365 subscription that uses Microsoft Defender for Endpoint Plan 2 and contains a Windows device named Device1.
Twenty files on Device1 are quarantined by custom indicators as part of an investigation.
You need to release the 20 files from quarantine.
How should you complete the command? To answer, select the appropriate options in the answer area.
Note: Each correct selection is worth one point.

See Explanation section for answer.

Answer(s): A

Explanation:

Reveal Solution Next Question

QUESTION: 15

You have an Azure subscription that contains a Microsoft Sentinel workspace named WS1.
You create a hunting query that detects a new attack vector. The attack vector maps to a tactic listed in the MITRE ATT&CK database.
You need to ensure that an incident is created in WS1 when the new attack vector is detected.
What should you configure?

a hunting livestream session
a query bookmark
a scheduled query rule
a Fusion rule

Answer(s): C

Reveal Solution Next Question

QUESTION: 15

You have an Azure subscription that contains a Log Analytics workspace.
You need to enable just-in-time (JIT) VM access and network detections for Azure resources.
Where should you enable Azure Defender?

at the subscription level
at the workspace level
at the resource level

Answer(s): A

Reference:

https://docs.microsoft.com/en-us/azure/security-center/enable-azure-defender

Reveal Solution Next Question

Free SC-200 Exam Braindumps (page: 30)

QUESTION: 14

Reference:

QUESTION: 15

Explanation:

QUESTION: 15

QUESTION: 15

Reference:

SC-200 Discussions & Posts