Detect threats by using the Microsoft Sentinel platform
5 practice questions under this official exam objective (SC-200) — each with the community-verified answer, a full option-by-option explanation and instant feedback.
How Do You Add a Defender for Cloud Apps Alert to a Sentinel Incident?
This SC-200 question tests how Microsoft Sentinel incident investigation exposes related Microsoft 365 Defender alerts through the entity timeline. Th
Which KQL Table and Status Code Show Unauthorized Requests?
This SC-200 hotspot asks you to complete a KQL query in a Log Analytics workspace to find failed Microsoft Graph requests. The correct table is Micros
Creating a Microsoft Sentinel bookmark from the Hunting page to support an incident investigation
While investigating a multi-alert Sentinel incident, you create a bookmark with minimal effort; bookmarks are created and added to incidents from the
How do you check if AzureActivity exists in each Sentinel workspace?
This hotspot asks you to complete a cross-workspace KQL query for a Microsoft Sentinel workbook that must report whether the AzureActivity table exist
How to Identify MITRE ATT&CK Phases in Microsoft Sentinel?
This SC-200 question tests how to identify MITRE ATT&CK tactics and techniques used in a Microsoft Sentinel attack investigation. The correct path is