Exam SC-200 topic 3 question 54 discussion

A) Yes -- AccountCustomEntity = Username B) No -- Watchlists can be updated C) No -- IPCustomEntity != IPList

The Answer is: Yes No No

Yes No No

No - AccountCustomEntity= Usersname not AccountEntity No - Watchlist can be updated No - IPcustoeEntity - IPlist

Username Field is set as AccountCustomEntity in the query so the answer to the question should be NO

Correct Option

Yes, Yes, no

Yes no yes

Yes, No, Yes is correct

The account entity is set as the username not the opposite The username is not set as the account entity it's the opposite 1 should be no the watchlist can be updated so https://learn.microsoft.com/en-us/azure/sentinel/watchlists-manage#edit-a-watchlist-item 2 should be No IPList var refers to the entity type Ip Address yes https://learn.microsoft.com/en-us/azure/sentinel/entities-reference#entity-types-and-identifiers 3 should be Yes So my guess N,N,Y

"The watchlist can not be updated after it is created" should be "No". This here are docs explaining how to edit them https://learn.microsoft.com/en-us/azure/sentinel/watchlists-manage#edit-a-watchlist-item