SC-200 practice questions 391–392

1. Question 391 · 392 in bank

   Which rule setting should you configure to meet the Azure Sentinel requirements?

   • AFrom Set rule logic, turn off suppression.
   • BFrom Analytics rule details, configure the tactics.
   • CFrom Set rule logic, map the entities.
   • DFrom Analytics rule details, configure the severity.

   Show answer

   Answer: C

   Explanation

   Correct answer. Check any analytics rules, after you map the entities under the "Set rule logic" tab, then you can enable the "Alert grouping" under "Incident settings" by selecting "Enabled", then select "Grouping alerts into a single incident if the selected entity types and details match:" and select the entities from the drop down menu. If you don't map entities, you can't group alerts under "Incident settings" becuase the drop down menu will show "no available items".

   Source: Adapted from community discussion — Lion007

   References

   • Microsoft Learn

   Next question

2. Question 392 · 392 in bank

   HOTSPOT - You need to create the analytics rule to meet the Azure Sentinel requirements. What should you do? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point. Hot Area:

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   Reference: https://docs.microsoft.com/en-us/azure/sentinel/tutorial-detect-threats-custom#set-automated-responses-and-create-the-rule https://docs.microsoft.com/en-us/azure/sentinel/tutorial-respond-threats-playbook

   Source: Adapted from community discussion — yoton

   

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

SC-200 practice, question 391. 392 questions available.