A Fully Updated 2026 SC-200 Exam Dumps - PDF Questions and Testing Engine
Easy Success Microsoft SC-200 Exam in First Try
Microsoft SC-200 certification is an excellent way for cybersecurity professionals to demonstrate their expertise in managing and responding to security incidents. Microsoft Security Operations Analyst certification covers a broad range of security topics and validates the candidate's ability to use Microsoft security technologies to maintain a secure network environment. Microsoft Security Operations Analyst certification is ideal for individuals who want to advance their careers in the cybersecurity industry and demonstrate their expertise in Microsoft security technologies.
Microsoft SC-200 or Microsoft Security Operations Analyst is a globally recognized certification that validates a candidate's knowledge and skills in security operations center (SOC) operations, threat intelligence, monitoring and response, and security investigations. Microsoft Security Operations Analyst certification exam is designed for security analysts who want to demonstrate their expertise in managing and responding to security threats and incidents. The Microsoft SC-200 exam is a perfect choice for those who want to start a career in cybersecurity or those who want to validate their existing skills and knowledge.
NEW QUESTION # 99
You are informed of an increase in malicious email being received by users.
You need to create an advanced hunting query in Microsoft 365 Defender to identify whether the accounts of the email recipients were compromised. The query must return the most recent 20 sign-ins performed by the recipients within an hour of receiving the known malicious email.
How should you complete the query? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Answer:
Explanation:
Reference:
https://docs.microsoft.com/en-us/microsoft-365/security/defender/advanced-hunting-query-emails-devices?view=o365-worldwide
NEW QUESTION # 100
You have a Microsoft 365 B5 subscription that contains two groups named Group! and Group2 and uses Microsoft Copilot for Security. You need to configure Copilot for Security role assignments to meet the following requirements:
* Ensure that members of Group1 can run prompts and respond to Microsoft Defender XDR security incidents.
* Ensure that members of Group2 can run prompts.
* Follow the principle of least privilege.
You remove Everyone from the Copilot Contributor role.
Which two actions should you perform next? Each correct answer presents part of the solution. NOTE: Each correct selection is worth one point.
- A. Assign the Copilot Owner role to Group1.
- B. Assign the Security Operator role to Group1.
- C. Assign the Copilot Contributor role to Group2.
- D. Assign the Security Operator role to Group2.
- E. Assign the Copilot Owner role to Group2.
Answer: B,C
Explanation:
To satisfy the two requirements while following least privilege: (1) members of Group1 must be able to run Copilot prompts and respond to Defender XDR incidents; (2) members of Group2 must only be able to run Copilot prompts. The Copilot Contributor role grants the ability to run and interact with Copilot features (create/run prompts, view Copilot outputs) without broad security admin rights, so assigning Copilot Contributor to Group2 satisfies the "run prompts" requirement with minimal privilege. For Group1, which must additionally respond to incidents, add a security role that allows incident handling - for Defender XDR that responsibility aligns with Security Operator (or equivalent Defender security operator) privileges: the Security Operator role provides permissions to triage, investigate, take responder actions, and perform incident operations but does not grant owner-level or configuration-level permissions. Combining Copilot Contributor behavior (if needed) with Security Operator ensures Group1 can both run prompts and act on incidents. Assigning Copilot Owner or Global elevated roles would violate least privilege; assigning Security Operator to Group2 would grant incident-handling capability that Group2 does not require. Therefore the minimal, correct two actions are: assign Copilot Contributor to Group2 and assign Security Operator to Group1.
NEW QUESTION # 101
You have a Microsoft 365 E5 subscription that is linked to a Microsoft Entra tenant named contoso.com.
You need to query Microsoft Graph activity logs to identify changes to the roles in contoso.com.
How should you complete the KQL query? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Answer:
Explanation:
Explanation:
Dropdown/Step
Value to Select
where ResponseStatusCode in (...)
("204")
split([dropdown], "/")[-3]
RequestUri
To detect Microsoft Graph operations that change role membership, you target POST requests to the directoryRoles ... /members/$ref endpoint. Adding a member to a role via Microsoft Graph is performed with POST /directoryRoles/{role-id}/members/$ref and, on success, Graph returns HTTP 204 No Content.
Therefore, filtering ResponseStatusCode to 204 isolates successful role-assignment events while excluding errors like 401/403 and non-mutating redirects such as 302.
The RequestUri contains the role identifier in the path. For URIs like:
https://graph.microsoft.com/v1.0/directoryRoles/{role-id}/members/$ref
splitting on "/" yields: [https:, , graph.microsoft.com, v1.0, directoryRoles, {role-id}, members, $ref]. The element at index -3 is the {role-id}. Hence, extend Role = tostring(split(RequestUri, "/")[-3]) correctly extracts the role GUID for reporting.
Putting it together, a concise query is:
MicrosoftGraphActivityLogs
| where RequestUri has_all ("https://graph.microsoft.com/", "/directoryRoles", "members/$ref")
| where RequestMethod == "POST"
| where ResponseStatusCode in ("204")
| extend Role = tostring(split(RequestUri, "/")[-3])
| project TimeGenerated, IPAddress, ResponseStatusCode, Role
This returns the timestamp, source IP, success code, and the affected role ID for each successful role- membership addition in your tenant.
NEW QUESTION # 102
You have a Microsoft Sentinel workspace that has user and Entity Behavior Analytics (UEBA) enabled for Signin Logs.
You need to ensure that failed interactive sign-ins are detected.
The solution must minimize administrative effort.
What should you use?
- A. a UEBA activity template
- B. the Activity Log data connector
- C. a scheduled alert query
- D. a hunting query
Answer: A
Explanation:
When User and Entity Behavior Analytics (UEBA) is enabled in Microsoft Sentinel, it automatically monitors Azure AD Sign-in Logs and provides activity templates for detecting common risky behaviors, such as failed sign-in attempts, impossible travel, or infrequent country logins.
To detect failed interactive sign-ins with minimal administrative effort, you can simply enable the UEBA activity template for sign-in failures rather than building a custom scheduled alert or hunting query.
# answer: B. a UEBA activity template
NEW QUESTION # 103
You use Azure Sentinel to monitor irregular Azure activity.
You create custom analytics rules to detect threats as shown in the following exhibit.
You do NOT define any incident settings as part of the rule definition.
Use the drop-down menus to select the answer choice that completes each statement based on the information presented in the graphic.
NOTE: Each correct selection is worth one point.
Answer:
Explanation:
Reference:
https://docs.microsoft.com/en-us/azure/sentinel/tutorial-detect-threats-custom
NEW QUESTION # 104
You have a Microsoft Sentinel workspace.
You need to create a KQL query that will identify successful sign-ins from multiple countries during the last three hours.
How should you complete the query? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point
Answer:
Explanation:
Explanation:
Below is the completed KQL that meets the requirement (successful sign-ins from multiple countries in the last 3 hours), using the ASIM authentication schema commonly used in Microsoft Sentinel:
let timeframe = ago(3h);
let threshold = 5;
imAuthentication
| where TimeGenerated > timeframe
| where EventType == "Logon" and EventResult == "Success"
| where isnotempty(SrcGeoCountry)
| summarize
StartTime = min(TimeGenerated),
EndTime = max(TimeGenerated),
Vendors = make_set(EventVendor),
Products = make_set(EventProduct),
NumOfCountries = dcount(SrcGeoCountry)
by TargetUserId, TargetUserPrincipalName, TargetUserType
| where NumOfCountries > threshold
* Blade/source: imAuthentication (ASIM parser) normalizes authentication data across sources in Sentinel, letting you query sign-ins consistently.
* Filters: EventType == "Logon" and EventResult == "Success" restrict to successful logons.
* Geo dimension: SrcGeoCountry is the normalized source country field for the sign-in.
* Logic: We look back 3 hours, count distinct countries per user with dcount(SrcGeoCountry), and keep only users exceeding a chosen threshold (e.g., > 5).
This delivers exactly "successful sign-ins from multiple countries during the last three hours," ready for use in a hunting query or to form a scheduled analytics rule.
NEW QUESTION # 105
You have a Microsoft Sentinel workbook that contains the following KQL query.
You need to create a visual that will change the color of the errCount column based on the value returned.
How should you configure the visual? To answer, select the appropriate options in the answer area. NOTE:
Each correct selection is worth one point.
Answer:
Explanation:
Explanation:
In Microsoft Sentinel workbooks, when you want to display query results in a tabular format and visually emphasize numeric values through color intensity (such as counts or frequencies), you use the Grid visualization type combined with the Heatmap column renderer.
In this scenario, the query aggregates failed sign-in events from SigninLogs and AADNonInteractiveUserSignInLogs, summarizing them by ErrorCode, FailureReason, and Category with a calculated count (errCount). The errCount column holds numeric data that indicates how many times each unique failure pattern occurred.
To visually represent the severity or frequency of these counts, you configure:
* Visualization = Grid - Displays tabular data in a workbook. It's the standard view type for showing multiple columns of query output (such as error codes and counts).
* Column renderer = Heatmap - Applies a gradient color scheme to the selected numeric column (errCount) so that higher values are highlighted with darker or more intense colors, making patterns or anomalies easier to spot.
Microsoft Sentinel workbook documentation explains:
"Heatmap rendering can be applied to numerical columns in Grid visualizations to provide color-coded representation of value ranges." Alternative renderers like Text or Big number do not provide dynamic color intensity, and Thresholds are used for conditional formatting rather than continuous color gradients.
# Final configuration:
* Visualization: Grid
* Column renderer: Heatmap
NEW QUESTION # 106
You are informed of a new common vulnerabilities and exposures (CVE) vulnerability that affects your environment.
You need to use the Microsoft Defender portal to request remediation from the team responsible for the affected systems if there is a documented active exploit available.
Which three actions should you perform in sequence? To answer, move the appropriate actions from the list of actions to the answer area and arrange them in the correct order.
Answer:
Explanation:
Explanation:
* From Vulnerability Management, select Weaknesses, and search for and select the CVE.
* Select Go to related security recommendations.
* Create the remediation request.
According to Microsoft Defender Vulnerability Management documentation, the correct workflow for responding to a new CVE in your organization-especially when there is an active exploit-is to begin your investigation within the Vulnerability Management section of the Microsoft Defender portal.
* From Vulnerability Management, select Weaknesses -Microsoft explains that all known CVEs are listed under Weaknesses in the Defender portal. You search by CVE ID (for example, CVE-2024-xxxx) to view its details, exploitability data, and the devices affected.
* Select Go to related security recommendations -After opening the CVE details, the portal shows associated security recommendations that describe how to remediate the issue (such as updating software, removing an at-risk version, or applying a patch). Selecting Go to related security recommendations links the CVE directly to actionable remediation guidance.
* Create the remediation request -Finally, Microsoft Defender for Endpoint allows security teams to formally request remediation from IT administrators or system owners. You can create a remediation request directly from the recommendation page, assigning it to the responsible group and specifying a due date.
This sequence aligns with Microsoft's recommended remediation workflow for CVEs as described in Defender Vulnerability Management documentation and ensures that remediation actions are tracked and executed efficiently through the portal.
# Therefore, the correct order is:
(1) From Vulnerability Management # Weaknesses # search CVE # (2) Go to related security recommendations # (3) Create remediation request.
NEW QUESTION # 107
You create a new Azure subscription and start collecting logs for Azure Monitor.
You need to validate that Microsoft Defender for Cloud will trigger an alert when a malicious file is present on an Azure virtual machine running Windows Server.
Which three actions should you perform in a sequence? To answer, move the appropriate actions from the list of action to the answer area and arrange them in the correct order.
NOTE: More than one order of answer choices is correct. You will receive credit for any of the correct orders you select.
Answer:
Explanation:
Explanation:
To validate that Microsoft Defender for Cloud will trigger an alert when a malicious file is present on an Azure virtual machine running Windows Server, you should perform the following three actions in sequence:
* Copy an executable file on a virtual machine and rename the file as ASC_AlertTest_662jfi039N.exe
* Run the executable file and specify the appropriate arguments
* Enable Microsoft Defender for Cloud's enhanced security features for the subscription.
These actions will simulate a malicious activity on the virtual machine and generate an alert in Defender for Cloud. You can then verify the alert details and response recommendations in the Azure portal. For more information, see Alert validation - Microsoft Defender for Cloud.
NEW QUESTION # 108
You have a Microsoft Sentinel workspace named SW1.
In SW1. you enable User and Entity Behavior Analytics (UEBA).
You need to use KQL to perform the following tasks:
* View the entity data that has fields for each type of entity.
* Assess the quality of rules by analyzing how well a rule performs.
Which table should you use in KQL for each task? To answer, drag the appropriate tables to the correct tasks.
Each table may be used once, more than once, or not at all. You may need to drag the split bar between panes or scroll to view content.
NOTE: Each correct selection is worth one point.
Answer:
Explanation:
Explanation:
NEW QUESTION # 109
You open the Cloud App Security portal as shown in the following exhibit.
You need to remediate the risk for the Launchpad app.
Which four actions should you perform in sequence? To answer, move the appropriate actions from the list of actions to the answer area and arrange them in the correct order.
Answer:
Explanation:
1 - Select the app.
2 - Tag the app as Unsanctioned.
3 - Generate a block script.
4 - Run the script on the source appliance.
Reference:
https://docs.microsoft.com/en-us/cloud-app-security/governance-discovery
NEW QUESTION # 110
You have two Azure subscriptions that use Microsoft Defender for Cloud.
You need to ensure that specific Defender for Cloud security alerts are suppressed at the root management group level. The solution must minimize administrative effort.
What should you do in the Azure portal?
- A. Create an alert rule in Azure Monitor.
- B. Create an Azure Policy assignment.
- C. Modify the Workload protections settings in Defender for Cloud.
- D. Modify the alert settings in Defender for Cloud.
Answer: D
Explanation:
Explanation
You can use alerts suppression rules to suppress false positives or other unwanted security alerts from Defender for Cloud.
Note: To create a rule directly in the Azure portal:
1. From Defender for Cloud's security alerts page:
Select the specific alert you don't want to see anymore, and from the details pane, select Take action.
Or, select the suppression rules link at the top of the page, and from the suppression rules page select Create new suppression rule:
2. In the new suppression rule pane, enter the details of your new rule.
Your rule can dismiss the alert on all resources so you don't get any alerts like this one in the future.
Your rule can dismiss the alert on specific criteria - when it relates to a specific IP address, process name, user account, Azure resource, or location.
3. Enter details of the rule.
4. Save the rule.
Reference: https://docs.microsoft.com/en-us/azure/defender-for-cloud/alerts-suppression-rules
NEW QUESTION # 111
You have an Azure subscription that uses resource type for Cloud. You need to filter the security alerts view to show the following alerts:
* Unusual user accessed a key vault
* Log on from an unusual location
* Impossible travel activity
Which severity should you use?
- A. Low
- B. High
- C. Informational
- D. Medium
Answer: D
Explanation:
In Microsoft Defender for Cloud (and by extension Microsoft Defender XDR), each security alert is assigned a severity level based on the assessed risk, confidence, and potential impact. The severity levels are:
* High - Indicates a confirmed or severe threat (e.g., active malware, data exfiltration, privilege escalation).
* Medium - Indicates suspicious or anomalous activity that may require investigation but is not confirmed malicious.
* Low - Indicates benign or informational activity with minimal risk.
* Informational - Alerts that provide context or enrichment but are not threats.
The alerts listed in the question -
* Unusual user accessed a key vault
* Log on from an unusual location
* Impossible travel activity -
are all behavioral anomaly detections generated by Defender for Cloud and Defender for Cloud Apps using machine learning and user behavior analytics (UEBA). Microsoft classifies such anomaly-based detections as Medium severity by default, because they represent potentially risky activity that might indicate compromise but are not confirmed attacks.
According to Microsoft's official documentation for Defender for Cloud alert severity classification:
"Medium severity alerts indicate suspicious activities that might represent legitimate anomalies or early stages of a potential attack, such as impossible travel, unusual sign-in location, or abnormal resource access." Thus, when filtering the Security Alerts view to include those specific anomaly-based alerts, the correct severity filter to use is:
# Medium
NEW QUESTION # 112
Your company uses Azure Sentinel.
A new security analyst reports that she cannot assign and dismiss incidents in Azure Sentinel. You need to resolve the issue for the analyst. The solution must use the principle of least privilege. Which role should you assign to the analyst?
- A. Azure Sentinel Contributor
- B. Logic App Contributor
- C. Azure Sentinel Responder
- D. Azure Sentinel Reader
Answer: C
NEW QUESTION # 113
You need to deploy the native cloud connector to Account! to meet the Microsoft Defender for Cloud requirements. What should you do in Account! first?
- A. Deploy the AWS Systems Manager (SSM) agent
- B. Create an AWS user for Defender for Cloud.
- C. Configure AWS Security Hub.
- D. Create an Access control (1AM) role for Defender for Cloud.
Answer: B
NEW QUESTION # 114
Your company deploys the following services:
* Microsoft Defender for Identity
* Microsoft Defender for Endpoint
* Microsoft Defender for Office 365
You need to provide a security analyst with the ability to use the Microsoft 365 security center. The analyst must be able to approve and reject pending actions generated by Microsoft Defender for Endpoint. The solution must use the principle of least privilege.
Which two roles should assign to the analyst? Each correct answer presents part of the solution.
NOTE: Each correct selection is worth one point.
- A. the Security Reader role in Azure Active Directory (Azure AD)
- B. the Compliance Data Administrator in Azure Active Directory (Azure AD)
- C. the Active remediation actions role in Microsoft Defender for Endpoint
- D. the Security Administrator role in Azure Active Directory (Azure AD)
Answer: A,C
Explanation:
Section: [none]
Explanation/Reference:
https://docs.microsoft.com/en-us/microsoft-365/security/defender-endpoint/rbac?view=o365-worldwide
NEW QUESTION # 115
You need to configure the Azure Sentinel integration to meet the Azure Sentinel requirements.
What should you do? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Answer:
Explanation:
Reference:
https://docs.microsoft.com/en-us/cloud-app-security/siem-sentinel
NEW QUESTION # 116
You have a Microsoft 365 E5 subscription that uses Microsoft Defender XDR.
You have a Microsoft Sentinel workspace.
Microsoft Sentinel connectors are configured as shown in the following table.
You use Microsoft Sentinel to investigate suspicious Microsoft Graph API activity related to Conditional Access policies. You need to search for the following activities:
* Downloads of the Conditional Access policies by using PowerShell
* Updates to the Conditional Access policies by using the Microsoft Entra admin center Which tables should you query for each activity? lo answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Answer:
Explanation:
Explanation:
NEW QUESTION # 117
Your on-premises network contains 100 servers that run Windows Server.
You have an Azure subscription that uses Microsoft Sentinel.
You need to upload custom logs from the on-premises servers to Microsoft Sentinel.
What should you do? To answer, select the appropriate options m the answer area.
Answer:
Explanation:
Topic 2, Contoso Ltd
Overview
This is a case study. Case studies are not timed separately. You can use as much exam time as you would like to complete each case. However, there may be additional case studies and sections on this exam. You must manage your time to ensure that you are able to complete all questions included on this exam in the time provided.
To answer the questions included in a case study, you will need to reference information that is provided in the case study. Case studies might contain exhibits and other resources that provide more information about the scenario that is described in the case study. Each question is independent of the other questions in this case study.
At the end of this case study, a review screen will appear. This screen allows you to review your answers and to make changes before you move to the next section of the exam. After you begin a new section, you cannot return to this section.
To start the case study
To display the first question in this case study, click the Next button. Use the buttons in the left pane to explore the content of the case study before you answer the questions. Clicking these buttons displays information such as business requirements, existing environment, and problem statements. If the case study has an All Information tab, note that the information displayed is identical to the information displayed on the subsequent tabs. When you are ready to answer a question, click the Question button to return to the question.
Overview
A company named Contoso Ltd. has a main office and five branch offices located throughout North Americ a. The main office is in Seattle. The branch offices are in Toronto, Miami, Houston, Los Angeles, and Vancouver.
Contoso has a subsidiary named Fabrikam, Ltd. that has offices in New York and San Francisco.
Existing Environment
End-User Environment
All users at Contoso use Windows 10 devices. Each user is licensed for Microsoft 365. In addition, iOS devices are distributed to the members of the sales team at Contoso.
Cloud and Hybrid Infrastructure
All Contoso applications are deployed to Azure.
You enable Microsoft Cloud App Security.
Contoso and Fabrikam have different Azure Active Directory (Azure AD) tenants. Fabrikam recently purchased an Azure subscription and enabled Azure Defender for all supported resource types.
Current Problems
The security team at Contoso receives a large number of cybersecurity alerts. The security team spends too much time identifying which cybersecurity alerts are legitimate threats, and which are not.
The Contoso sales team uses only iOS devices. The sales team members exchange files with customers by using a variety of third-party tools. In the past, the sales team experienced various attacks on their devices.
The marketing team at Contoso has several Microsoft SharePoint Online sites for collaborating with external vendors. The marketing team has had several incidents in which vendors uploaded files that contain malware.
The executive team at Contoso suspects a security breach. The executive team requests that you identify which files had more than five activities during the past 48 hours, including data access, download, or deletion for Microsoft Cloud App Security-protected applications.
Requirements
Planned Changes
Contoso plans to integrate the security operations of both companies and manage all security operations centrally.
Technical Requirements
Contoso identifies the following technical requirements:
Receive alerts if an Azure virtual machine is under brute force attack.
Use Azure Sentinel to reduce organizational risk by rapidly remediating active attacks on the environment.
Implement Azure Sentinel queries that correlate data across the Azure AD tenants of Contoso and Fabrikam.
Develop a procedure to remediate Azure Defender for Key Vault alerts for Fabrikam in case of external attackers and a potential compromise of its own Azure AD applications.
Identify all cases of users who failed to sign in to an Azure resource for the first time from a given country. A junior security administrator provides you with the following incomplete query.
BehaviorAnalytics
| where ActivityType == "FailedLogOn"
| where ________ == True
NEW QUESTION # 118
Your company uses Azure Sentinel.
A new security analyst reports that she cannot assign and dismiss incidents in Azure Sentinel. You need to resolve the issue for the analyst. The solution must use the principle of least privilege. Which role should you assign to the analyst?
- A. Azure Sentinel Contributor
- B. Logic App Contributor
- C. Azure Sentinel Responder
- D. Azure Sentinel Reader
Answer: C
Explanation:
Reference:
https://docs.microsoft.com/en-us/azure/sentinel/roles
Topic 2, Contoso Ltd
Existing Environment
End-User Environment
All users at Contoso use Windows 10 devices. Each user is licensed for Microsoft 365. In addition, iOS devices are distributed to the members of the sales team at Contoso.
Cloud and Hybrid Infrastructure
All Contoso applications are deployed to Azure.
You enable Microsoft Cloud App Security.
Contoso and Fabrikam have different Azure Active Directory (Azure AD) tenants. Fabrikam recently purchased an Azure subscription and enabled Azure Defender for all supported resource types.
Current Problems
The security team at Contoso receives a large number of cybersecurity alerts. The security team spends too much time identifying which cybersecurity alerts are legitimate threats, and which are not.
The Contoso sales team uses only iOS devices. The sales team members exchange files with customers by using a variety of third-party tools. In the past, the sales team experienced various attacks on their devices.
The marketing team at Contoso has several Microsoft SharePoint Online sites for collaborating with external vendors. The marketing team has had several incidents in which vendors uploaded files that contain malware.
The executive team at Contoso suspects a security breach. The executive team requests that you identify which files had more than five activities during the past 48 hours, including data access, download, or deletion for Microsoft Cloud App Security-protected applications.
Requirements
Planned Changes
Contoso plans to integrate the security operations of both companies and manage all security operations centrally.
Technical Requirements
Contoso identifies the following technical requirements:
Receive alerts if an Azure virtual machine is under brute force attack.
Use Azure Sentinel to reduce organizational risk by rapidly remediating active attacks on the environment.
Implement Azure Sentinel queries that correlate data across the Azure AD tenants of Contoso and Fabrikam.
Develop a procedure to remediate Azure Defender for Key Vault alerts for Fabrikam in case of external attackers and a potential compromise of its own Azure AD applications.
Identify all cases of users who failed to sign in to an Azure resource for the first time from a given country. A junior security administrator provides you with the following incomplete query.
BehaviorAnalytics
| where ActivityType == "FailedLogOn"
| where ________ == True
NEW QUESTION # 119
You need to ensure that you can run hunting queries to meet the Microsoft Sentinel requirements. Which type of workspace should you create?
- A. Azure Machine Learning
- B. Azure Synapse AnarytKS
- C. LogAnalytics
- D. AzureDalabricks
Answer: C
Explanation:
Microsoft Sentinel is built on top of Azure Monitor Log Analytics. All Sentinel data - including security alerts, incidents, and telemetry from connected sources - is stored and queried through a Log Analytics workspace. Sentinel's hunting feature uses Kusto Query Language (KQL), which runs directly against the Log Analytics workspace data.
Official Sentinel documentation specifies:
"Microsoft Sentinel uses an Azure Monitor Log Analytics workspace as its foundation. All data collected by Sentinel is stored in that workspace, and hunting queries run on this data." Other workspace types such as Azure Synapse, Azure Databricks, or Azure Machine Learning are for analytics, data science, and modeling - not security log collection or KQL-based hunting.
# Therefore, to run hunting queries in Microsoft Sentinel, you must create a Log Analytics workspace.
NEW QUESTION # 120
You plan to connect an external solution that will send Common Event Format (CEF) messages to Azure Sentinel.
You need to deploy the log forwarder.
Which three actions should you perform in sequence? To answer, move the appropriate actions form the list of actions to the answer area and arrange them in the correct order.
Answer:
Explanation:
1 - Download and install the Log Analytics agent.
2 - Set the Log Analytics agent to listen on port 25226 and forward the CEF messages to A zure Sentinel.
3 - Configure the syslog daemon.Restart the syslog daemon and the Log Analytics agent.
Reference:
https://docs.microsoft.com/en-us/azure/sentinel/connect-cef-agent?tabs=rsyslog
NEW QUESTION # 121
......
Microsoft SC-200 exam focuses on various areas, including threat management, vulnerability management, incident response, governance, and compliance. SC-200 exam is designed to test the candidate's abilities to identify and respond to security threats, manage security operations, and implement security solutions. It also covers the latest trends and technologies in the field of security operations, making it an essential certification for professionals who want to stay up-to-date with the latest security practices.
SC-200 Study Material, Preparation Guide and PDF Download: https://certblaster.lead2passed.com/Microsoft/SC-200-practice-exam-dumps.html
