ExamTopics Logo
Mail Us[email protected]
Menu
Microsoft Discussions
exam questions

Exam SC-200 All Questions

View all questions & answers for the SC-200 exam
Go to Exam

Exam SC-200 topic 6 question 2 discussion

Actual exam question from Microsoft's SC-200
Question #: 2
Topic #: 6
[All SC-200 Questions]

HOTSPOT
-

You have an Azure subscription that contains a Microsoft Sentinel workspace named WS1.

You need to ensure that the incidents in WS1 include a list of actions that must be performed. The solution must meet the following requirements:

• Ensure that you can build a tailored list of actions for each type of incident.
• Minimize administrative effort.

What should you do? To answer, select the appropriate options in the answer area.

NOTE: Each correct selection is worth one point.

Show Suggested Answer Hide Answer
Suggested Answer:
by renrenren at March 11, 2024, 12:06 p.m.

Comments

Chosen Answer:
This is a voting comment (?). It is better to Upvote an existing comment if you don't have anything to add.
Switch to a voting comment New
Submit Cancel
renrenren
Highly Voted 1 year, 1 month ago
Answer for 1st Q should be Task https://learn.microsoft.com/en-us/azure/sentinel/incident-tasks#use-cases
upvoted 17 times
Tuitor01
4 months, 4 weeks ago
Tag don't document anything, Comments do, but within the context of an incident. They can be used to fetch data from eternal sources to enrich the context of an investigation by the analyst, but they are not "actionable" , tasks however can be added directly to an incident, to an automation rule or to a playbook. Add tasks to automation rules for non complex cases that don't require interactivity and to playbooks for more advanced cases like the ones that require interaction or contain tasks with integrated automated actions.
upvoted 1 times
Tuitor01
4 months, 4 weeks ago
So it should be Answer 1: Task Answer 2: Automated Action
upvoted 2 times
...
...
akamex
1 year ago
I agree, first answer should be task. "Use the Add task action in automation rules to automatically furnish all incidents with a checklist of tasks for your analysts."
upvoted 2 times
...
...
g_man_rap
Highly Voted 8 months, 1 week ago
Document the actions by configuring: Tasks Tasks are used in Microsoft Sentinel to document the specific actions that need to be taken when responding to an incident. This allows you to create a checklist or playbook of actions, ensuring that all steps are followed according to the defined procedures. Build the list of actions by selecting: Incident settings Incident settings allow you to define how incidents are managed, including specifying the actions that need to be taken. This configuration helps in customizing the response process for different types of incidents, ensuring a tailored approach while minimizing the administrative burden.
upvoted 5 times
...
Edindude
Most Recent 2 months, 2 weeks ago
Document the actions by Configuring: *Tasks Build the list of actions by selecting: **Incident settings
upvoted 2 times
...
smanzana
9 months ago
Tasks Automated response
upvoted 2 times
...
Community vote distribution
A (35%)
C (25%)
B (20%)
Other
Most Voted
A voting comment increases the vote count for the chosen answer by one.

Upvoting a comment with a selected answer will also increase the vote count towards that answer by one. So if you see a comment that you already agree with, you can upvote it instead of posting a new comment.

SaveCancel
exam
Someone Bought Contributor Access for:
SY0-701
London, 1 minute ago