SC-200 Sentinel Practice Questions

You need to implement Azure Sentinel queries for Contoso and Fabrikam to meet the technical requirements. What should you include in the solution? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.

Match each item to its target.

Correct answer: Minimum number of Log Analytics workspaces required in the Azure subscription of Fabrikam = 1; Query element required to correlate data between tenants = workspace

You need to add notes to the events to meet the Azure Sentinel requirements. Which three actions should you perform in sequence? To answer, move the appropriate actions from the list of action to the answer area and arrange them in the correct order.

Match each item to its target.

Correct answer: 1 = From the Azure Sentinel workspace, run a Log Analytics query.; 2 = Select a query result.; 3 = Add a bookmark and map an entity.

You need to configure the Microsoft Sentinel integration to meet the Microsoft Sentinel requirements. What should you do? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.

Match each item to its target.

Correct answer: In the Microsoft Defender for Cloud Apps portal = Add a security extension; From Microsoft Sentinel in the Azure portal = Add a data connector