SC-200 무료 덤프문제 온라인 액세스

You have a Microsoft Sentinel workspace that uses the Microsoft 365 Defender data connector.
From Microsoft Sentinel, you investigate a Microsoft 365 incident.
You need to update the incident to include an alert generated by Microsoft Defender for Cloud Apps.
What should you use?

• A.the Alerts page in the Microsoft 365 Defender portal
• B.the Timeline tab on the Incidents page of Microsoft Sentinel
• C.the entity side panel of the Timeline card in Microsoft Sentinel
• D.the investigation graph on the Incidents page of Microsoft Sentinel

You have a Microsoft Sentinel workspace named Workspaces
You need to exclude a built-in. source-specific Advanced Security Information Model (ASIM) parser from a built-in unified ASIM parser.
What should you create in Workspace1?

• A.a watchlist
• B.a hunting query
• C.a workbook
• D.an analytic rule

You have an Azure subscription that contains two users named User1 and User2 and a Microsoft Sentinel workspace named workspace1. You need to ensure that the users can perform the following tasks in workspace1:
* User1 must be able to dismiss incidents and assign incidents to users.
* User2 must be able to modify analytics rules.
The solution must use the principle of least privilege.
Which role should you assign to each user? To answer, drag the appropriate roles to the correct users. Each role may be used once, more than once, or not at all. You may need to drag the split bar between panes or scroll to view content.
NOTE: Each correct selection is worth one point.

정답:

Explanation:

In Microsoft Sentinel, different built-in roles provide access at varying levels of capability, following the principle of least privilege.
Microsoft Sentinel Responder
Purpose: Designed for SOC analysts responsible for handling and responding to incidents.
Capabilities:
View and investigate incidents.
Assign incidents, dismiss incidents, and change incident statuses.
Respond to alerts but cannot modify Sentinel configuration or analytics rules.
# This matches the requirements for User1, who needs to dismiss and assign incidents.
Microsoft Sentinel Contributor
Purpose: Intended for security engineers or Sentinel administrators.
Capabilities:
Create, edit, and delete analytics rules, workbooks, hunting queries, and automation rules.
Manage data connectors and configuration.
Cannot assign permissions but can change Sentinel resources.
# This matches the requirements for User2, who must be able to modify analytics rules.
Other roles for reference:
Microsoft Sentinel Reader: View-only permissions.
Microsoft Sentinel Automation Contributor: Allows playbook and automation editing.
Contributor/Reader: General Azure roles, not Sentinel-specific.

You need to send a Microsoft Teams message to a channel whenever a sign-in from a suspicious IP address is detected.
Which two actions should you perform in Azure Sentinel? Each correct answer presents part of the solution.
NOTE: Each correct selection is worth one point.

• A.Enable Entity behavior analytics.
• B.Create a workbook.
• C.Enable the Fusion rule.
• D.Associate a playbook to an incident.
• E.Add a playbook.

You are investigating an incident in Azure Sentinel that contains more than 127 alerts.
You discover eight alerts in the incident that require further investigation.
You need to escalate the alerts to another Azure Sentinel administrator.
What should you do to provide the alerts to the administrator?

• A.Assign the incident
• B.Share the incident URL
• C.Create a Microsoft incident creation rule
• D.Create a scheduled query rule