SC-200 試験問題を無料オンラインアクセス

You have a Microsoft Sentinel workspace that contains the following incident.
Brute force attack against Azure Portal analytics rule has been triggered.
You need to identify the geolocation information that corresponds to the incident.
What should you do?

• A.From Incidents, review the details of the iPCustomEntity entity associated with the incident.
• B.From Incidents, review the details of the AccouncCuscomEntity entity associated with the incident.
• C.From Overview, review the Potential malicious events map.
• D.From Investigation, review insights on the incident entity.

You have a Microsoft Sentinel workspace that contains the following incident Brute force attack against Azure Portal analytics rule has been triggered. You need to identify the geolocation information that corresponds to the incident. What should you do?

• A.From Incidents, review the details of the AccountCustomEntity entity associated with the incident.
• B.From Incidents, review the details of the iPCustomEntity entity associated with the incident.
• C.From Overview, review the Potential malicious events map.
• D.From Investigation, review insights on the incident entity

You have a Microsoft Sentinel workspace named Workspaces1.
The AzureActivity table in Workspace! has the following retention periods:
* Interactive: 180 days
* Total:180days
You need to modify the retention periods to meet the following requirements:
* Minimize the costs associated with storing data in the table.
* Maximize the period during which the table data remains available.
How should you configure each retention period? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.

正解：

Explanation:

In Microsoft Sentinel (Log Analytics), table retention uses two tiers: Interactive retention (hot, immediately queryable) and Archive (cold, queryable via Search/Restore). Sentinel includes up to 90 days of interactive retention at no additional cost; extending interactive retention beyond 90 days incurs standard Log Analytics retention charges. To minimize cost, you should keep the interactive period at 90 days (the free tier).
For longer-term availability of data while still controlling costs, you set a higher Total retention so that, after the interactive window, data is moved to Archive storage at a significantly lower price per GB. Archived data remains available to analysts using Search jobs or temporary Restore to hot for detailed queries. Therefore, to maximize the period during which the table data remains available at the lowest cost, select the longest offered total retention, 2 years, which keeps older data in Archive instead of deleting it.
Thus, the optimal cost/availability configuration is Interactive = 90 days and Total = 2 years.

You have a playbook in Azure Sentinel.
When you trigger the playbook, it sends an email to a distribution group.
You need to modify the playbook to send the email to the owner of the resource instead of the distribution group.
What should you do?

• A.Add a custom data connector and modify the trigger.
• B.Add a condition and modify the action.
• C.Add a parameter and modify the trigger.
• D.Add a parameter and modify the action.

You have a Microsoft 365 subscription that contains 1,000 Windows 11 devices.
The devices have Microsoft 365 Apps installed and are onboarded to Microsoft Defender for Endpoint.
You need to mitigate the following device threats:
* Microsoft Excel macros that download scripts from untrusted websites
* Users that open executable attachments in Microsoft Outlook
* Outlook rules and forms exploits
What should you use?

• A.Windows Defender Firewall rules
• B.antivirus exclusions of Microsoft Defender for Endpoint
• C.attack surface reduction rules of Microsoft Defender for Endpoint
• D.adaptive application control in Microsoft Defender for Cloud