Exam SC-200 topic 6 question 31 discussion

Actual exam question from Microsoft's SC-200

Question #: 31
Topic #: 6

You have a Microsoft Sentinel workspace.

You are investigating an incident that involves the following entities:

• A host named Host1
• A user account named User1
• An IP address of 175.45.176.99

You need to update the threat intelligence list to include the entities.

Which entities can you add on the Incident page?

A. 175.45.176.99 only
B. Host1 only
C. User1 only
D. 175.45.176.99 and Host1 only
E. Host1 and User1 only
F. 175.45.176.99, Host1, and User1

Show Suggested Answer

Suggested Answer: A 🗳️

by 54c341a at March 7, 2025, 9:57 p.m.

Comments

Submit Cancel

a_kto_to

1 week ago

Selected Answer: A

"Indicator Domain name, URL, IPv4 address, IPv6 address, and File hashes" -> https://learn.microsoft.com/en-us/azure/sentinel/understand-threat-intelligence

upvoted 1 times

...

54c341a

1 week, 1 day ago

Selected Answer: A

Add only the following types of entities as threat indicators: Domain name IP address (IPv4 and IPv6) URL File (hash) https://learn.microsoft.com/en-us/defender-endpoint/live-response

upvoted 2 times

54c341a

1 week, 1 day ago

Wrong link. Correct link: https://learn.microsoft.com/en-us/azure/sentinel/add-entity-to-threat-intelligence?tabs=incidents#add-an-entity-to-your-threat-intelligence

upvoted 2 times

...

Exam SC-200 All Questions

View all questions & answers for the SC-200 exam

Exam SC-200 topic 6 question 31 discussion

Comments

a_kto_to

54c341a

54c341a

SY0-701