Exam SC-200 topic 3 question 49 discussion

The fact that I'm paying contributor access to have these easy questions with a wrong answer really triggers me... This being said, the answer is clearly A.

Please somebody fixes the answer.

Answer is A. Use the KQL code from the Hunting query & create an analytics rule. The analytics rule will run & scan the logs to detect threats. Workbook is a sort of reporting dashboards. Watchlist is for adding data/entites (IP, account names etc.) by uploading a CSV file to Sentinel. Later you can use the watchlist in your KQL. Playbook is used in the automation rules for automated response. It uses azure logic apps.

Could you please change this question to the right answer or at least give a statment? Its obviously wrong

Opton A

Option A

https://learn.microsoft.com/en-us/azure/sentinel/detect-threats-custom

frustratingly and obviously wrong

We have sent a message to [email protected] asking for the change.

A. Create an analytics rule. Creating an analytics rule in Microsoft Sentinel is the best way to ensure that the system automatically detects the threat with minimal administrative effort. Analytics rules allow you to create custom detections based on specific events or patterns that you want to monitor.

https://learn.microsoft.com/en-us/azure/sentinel/detect-threats-built-in