Configure the Microsoft Sentinel SIEM and platform
12 practice questions under this official exam objective (SC-200), each with the answer key, an option-by-option explanation and instant feedback.
Questions under this objective
12 total · page 1 of 1How do you enable Sentinel UEBA and collect on-premises AD DS events?
Enabling UEBA in Microsoft Sentinel for an on-premises Active Directory domain requires Microsoft Defender for Identity as the identity data source, n
Assigning Workbook Contributor so a user can deploy and customize Sentinel workbook templa
To let User1 deploy and customize Microsoft Sentinel workbook templates on RG1 under least privilege, assign the Workbook Contributor (Azure Monitor)
Assigning the Microsoft Sentinel Responder role so a user can investigate incidents under
User1 must investigate Sentinel incidents with least privilege; the Microsoft Sentinel Responder role grants view, status-update, and comment rights o
Choosing the Azure Activity workbook to analyze subscription-level administrative actions
After deploying the Microsoft Entra solution to a Sentinel workspace, you need to analyze actions performed by users with administrative privileges to
How Do You Run a KQL Query as a Sentinel Search Job?
Running a KQL query as a Microsoft Sentinel search job stores results in a new destination table; the five-step portal sequence starts with Search and
Adding a query to a Sentinel workbook to build a timechart of SecurityEvent counts by day
To show the count of SecurityEvent rows ingested over the past week as a daily timechart in a Sentinel workbook, add a query that filters by time, agg
Querying Sentinel Watchlists via Azure Resource Graph
Learn how to list all watchlists in a Microsoft Sentinel workspace by configuring an Azure Resource Graph data source in a workbook.
How do you join two Sentinel auxiliary tables for six months of data?
Microsoft Sentinel auxiliary tables restrict queries to a single table, so a JOIN between Table1 and Table2 requires two search jobs to create _SRCH A
How should a scheduled KQL job write to an existing Sentinel data lake table?
Microsoft Sentinel data lake scheduled KQL jobs can write query results to an existing table, but Job1's output must align with Table1's schema. This
What retention period should you set for the AzureActivity table?
This SC-200 item tests how to set Microsoft Sentinel table retention for the AzureActivity table so that interactive queries stay available as long as
Which least-privilege role enables the Microsoft Sentinel plugin in Copilot for Security?
Microsoft Copilot for Security's Sentinel plug-in queries Sentinel data, so User1 needs a Sentinel workspace role in addition to Copilot access. Micro
How do you check if AzureActivity exists in each Sentinel workspace?
This hotspot asks you to complete a cross-workspace KQL query for a Microsoft Sentinel workbook that must report whether the AzureActivity table exist