HOTSPOT (Drag and Drop is not supported)From Microsoft Sentinel, you open the Investigation pane for a high-severity incident as shown in the following exhibit.Use the drop-down menus to select the answer choice that completes each statement based on the information presented in the graphic.Note: Each correct selection is worth one point.Hot Area:
Answer(s): A
https://docs.microsoft.com/en-us/azure/sentinel/tutorial-investigate-cases#use-the-investigation-graph-to-deep-dive
DRAG DROP (Drag and Drop is not supported)You have an Microsoft Sentinel deployment.You need to query for all suspicious credential access activities.Which three actions should you perform in sequence? To answer, move the appropriate actions from the list of actions to the answer area and arrange them in the correct order.Select and Place:
https://davemccollough.com/2020/11/28/threat-hunting-with-azure-sentinel/
You have an existing Azure logic app that is used to block Azure Active Directory (Azure AD) users. The logic app is triggered manually.You deploy Microsoft Sentinel.You need to use the existing logic app as a playbook in Microsoft Sentinel.What should you do first?
Answer(s): D
Your company uses Microsoft Sentinel to manage alerts from more than 10,000 IoT devices.A security manager at the company reports that tracking security threats is increasingly difficult due to the large number of incidents.You need to recommend a solution to provide a custom visualization to simplify the investigation of threats and to infer threats by using machine learning.What should you include in the recommendation?
Answer(s): C
https://docs.microsoft.com/en-us/azure/sentinel/notebooks
You have a playbook in Microsoft Sentinel.When you trigger the playbook, it sends an email to a distribution group.You need to modify the playbook to send the email to the owner of the resource instead of the distribution group.What should you do?
You provision Microsoft Sentinel for a new Azure subscription.You are configuring the Security Events connector.While creating a new rule from a template in the connector, you decide to generate a new alert for every event.You create the following rule query.By which two components can you group alerts into incidents? Each correct answer presents a complete solution.Note: Each correct selection is worth one point.
Answer(s): A,D
Your company stores the data of every project in a different Azure subscription. All the subscriptions use the same Microsoft Entra tenant.Every project consists of multiple Azure virtual machines that run Windows Server. The Windows events of the virtual machines are stored in a Log Analytics workspace in each machine’s respective subscription.You deploy Microsoft Sentinel to a new Azure subscription.You need to perform hunting queries in Microsoft Sentinel to search across all the Log Analytics workspaces of all the subscriptions.Which two actions should you perform? Each correct answer presents part of the solution.Note: Each correct selection is worth one point.
Answer(s): B,E
https://docs.microsoft.com/en-us/azure/sentinel/extend-sentinel-across-workspaces-tenants
You have a Microsoft Sentinel workspace.You need to test a playbook manually in the Azure portal.From where can you run the test in Microsoft Sentinel?
https://docs.microsoft.com/en-us/azure/sentinel/tutorial-respond-threats-playbook#run-a-playbook-on-demand
Post your Comments and Discuss Microsoft SC-200 exam prep with other Community members:
Our website is free, but we have to fight against AI bots and content theft. We're sorry for the inconvenience caused by these security measures. You can access the rest of the SC-200 content, but please register or login to continue.