Discuss Microsoft SC-200 Exam Topic 1 Question 23

You create a hunting query in Azure Sentinel.

You need to receive a notification in the Azure portal as soon as the hunting query detects a match on the query. The solution must minimize effort.

What should you use?

Aa playbook

Ba notebook

Ca livestream

Da bookmark

Suggested Answer: C

Use livestream to run a specific query constantly, presenting results as they come in.

https://docs.microsoft.com/en-us/azure/sentinel/hunting

Get Premium SC-200 Questions as Interactive Web-Based Practice Test or PDF Real Exam Format Detailed Explanations Instant Access Get Your Practice Test

12 comments · newest first

Katheryn 12 months ago

I agree, playbooks are super efficient for this!

Asuncion 1 year ago

Wait, can a playbook really automate notifications? Sounds too easy.

Avery 1 year ago

Definitely not a notebook, that’s too manual.

Kenneth 1 year ago

I think a livestream could work too, but not sure.

Domitila 1 year ago

A playbook is the way to go!

Magdalene 1 year ago

I’m confused about the difference between a notebook and a playbook in this context. I need to double-check which one is more efficient for notifications.

Oretha 1 year ago

I’m leaning towards a playbook too, but I wonder if a bookmark could somehow help in tracking the results of the query.

Edward 1 year ago

I remember practicing a similar question, and I believe a livestream could be useful for real-time alerts, but it might not be the best fit here.

Dudley 1 year ago

I think we might need to use a playbook for notifications, but I'm not entirely sure how it integrates with hunting queries.

Gaynell 1 year ago

I'm a bit unsure about this one. I'm not super familiar with reading data from a URL and creating features in ArcGIS. I might need to do some research on the specific tools and methods to use.

Shayne 1 year ago

I'm a bit confused here. The options include 10.2.3.2, 10.2.3.1, 192.168.2.0, and 10.1.1.1. I'm not sure which one is the correct next-hop for the default route on CR1. I'll need to double-check the network diagram and think this through.

Sharmaine 1 year ago

I think business process to capability mapping could be key here, but I'm not entirely sure if it's the best fit for SOA services.

Microsoft SC-200 Exam - Topic 1 Question 23 Discussion