Detect threats by using the Microsoft Sentinel platform
5 practice questions under this official exam objective (SC-200), each with the answer key, an option-by-option explanation and instant feedback.
Questions under this objective
5 total · page 1 of 1How Do You Add a Defender for Cloud Apps Alert to a Sentinel Incident?
This SC-200 question tests how Microsoft Sentinel incident investigation exposes related Microsoft 365 Defender alerts through the entity timeline. Th
Which KQL Table and Status Code Show Unauthorized Requests?
This SC-200 hotspot asks you to complete a KQL query in a Log Analytics workspace to find failed Microsoft Graph requests. The correct table is Micros
Creating a Microsoft Sentinel bookmark from the Hunting page to support an incident invest
While investigating a multi-alert Sentinel incident, you create a bookmark with minimal effort; bookmarks are created and added to incidents from the
How do you check if AzureActivity exists in each Sentinel workspace?
This hotspot asks you to complete a cross-workspace KQL query for a Microsoft Sentinel workbook that must report whether the AzureActivity table exist
How to Identify MITRE ATT&CK Phases in Microsoft Sentinel?
This SC-200 question tests how to identify MITRE ATT&CK tactics and techniques used in a Microsoft Sentinel attack investigation. The correct path is