Microsoft Exam SC-900 Topic 9 Question 23 Discussion

Actual exam question for Microsoft's SC-900 exam

Question #: 23
Topic #: 9

[All SC-900 Questions]

You have an Azure subscription that contains a Log Analytics workspace.

You need to onboard Microsoft Sentinel.

What should you do first?

ACreate a hunting query.

BCorrelate alerts into incidents.

CConnect to your security sources.

DCreate a custom detection rule.

Show Suggested Answer

Suggested Answer: D

by Marti at Feb 05, 2023, 07:14 PM

Limited Time Offer

25%

Off

Get Premium SC-900 Questions as Interactive Web-Based Practice Test or PDF

Contribute your Thoughts:

Submit Cancel

Janessa

4 days ago

A) Create a hunting query? I'm not a bloodhound, I'm just trying to pass this exam!

upvoted 0 times

...

Ettie

7 days ago

B) Correlate alerts into incidents? What is this, a detective agency?

upvoted 0 times

...

Golda

8 days ago

C) Connect to your security sources. Duh, you gotta get the data in before you can do anything else!

upvoted 0 times

...

Aliza

17 days ago

I believe creating a custom detection rule might be the best option to start with.

upvoted 0 times

...

Lachelle

18 days ago

I agree with Tomoko, connecting to security sources is the first step to onboard Microsoft Sentinel.

upvoted 0 times

...

Tomoko

20 days ago

I think we should connect to our security sources first.

upvoted 0 times

...