Free Access to Microsoft.SC-200.v2024-04-20.q155 with Valid Practice Test (Page 23)

Question 106

You need to configure the Azure Sentinel integration to meet the Azure Sentinel requirements.
What should you do? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.

Question 107

You have an Azure subscription named Sub1 and a Microsoft 365 subscription. Sub1 is linked to an Azure Active Directory (Azure AD) tenant named contoso.com.
You create an Azure Sentinel workspace named workspace1. In workspace1, you activate an Azure AD connector for contoso.com and an Office 365 connector for the Microsoft 365 subscription.
You need to use the Fusion rule to detect multi-staged attacks that include suspicious sign-ins to contoso.com followed by anomalous Microsoft Office 365 activity.
Which two actions should you perform? Each correct answer present part of the solution NOTE: Each correct selection is worth one point.

A.Create custom rule based on the Office 365 connector templates.
B.Create a Microsoft incident creation rule based on Microsoft Defender for Cloud.
C.Create a Microsoft Cloud App Security connector.
D.Create an Azure AD Identity Protection connector.

Question 108

You have a Microsoft Sentinel workspace.
You have a query named Query1 as shown in the following exhibit.

You plan to create a custom parser named Parser 1. You need to use Query1 in Parser1. What should you do first?

A.Remove line 2.
B.In line 4. remove the TimeGenerated predicate.
C.Remove line 5.
D.In line 3, replace the 'contains operator with the !has operator.

Question 109

You need to assign a role-based access control (RBAC) role to admin1 to meet the Azure Sentinel requirements and the business requirements.
Which role should you assign?

A.Automation Operator
B.Automation Runbook Operator
C.Azure Sentinel Contributor
D.Logic App Contributor

Question 110