Microsoft SC-200 Exam - Topic 1 Question 38 Discussion

Actual exam question for Microsoft's SC-200 exam

Question #: 38
Topic #: 1

Your company stores the data for every project in a different Azure subscription. All the subscriptions use the same Azure Active Directory (Azure AD) tenant.

Every project consists of multiple Azure virtual machines that run Windows Server. The Windows events of the virtual machines are stored in a Log Analytics workspace in each machine's respective subscription.

You deploy Azure Sentinel to a new Azure subscription.

You need to perform hunting queries in Azure Sentinel to search across all the Log Analytics workspaces of all the subscriptions.

Which two actions should you perform? Each correct answer presents part of the solution.

NOTE: Each correct selection is worth one point.

AAdd the Security Events connector to the Azure Sentinel workspace.

BCreate a query that uses the workspace expression and the union operator.

CUse the alias statement.

DCreate a query that uses the resource expression and the alias operator.

EAdd the Azure Sentinel solution to each workspace.

Show Suggested Answer

Suggested Answer: B, E

https://docs.microsoft.com/en-us/azure/sentinel/extend-sentinel-across-workspaces-tenants

by Annabelle at Jun 26, 2022, 04:45 AM

Limited Time Offer

25%

Off

Get Premium SC-200 Questions as Interactive Web-Based Practice Test or PDF

Contribute your Thoughts:

Submit Cancel

Izetta

4 months ago

I think adding Azure Sentinel to each workspace is overkill.

upvoted 0 times

...

Buddy

4 months ago

Adding the Security Events connector is a must!

upvoted 0 times

...

Lashawna

4 months ago

Wait, can you really query across subscriptions like that?

upvoted 0 times

...

Karl

4 months ago

Totally agree, the workspace expression is key here!

upvoted 0 times

...

Reyes

5 months ago

You need to use the union operator for multiple workspaces.

upvoted 0 times

...

Olive

5 months ago

I feel like we need to add the Azure Sentinel solution to each workspace, but I'm not 100% confident about that being the right step.

upvoted 0 times

...

Regenia

5 months ago

I practiced a similar question where we had to use the workspace expression, but I can't recall if it was specifically for Azure Sentinel.

upvoted 0 times

...

Tawna

5 months ago

I think we might need to add the Security Events connector to pull in the data from those workspaces. That sounds familiar.

upvoted 0 times

...

Dulce

5 months ago

I remember something about using the union operator for queries, but I'm not entirely sure how it applies here.

upvoted 0 times

...

Glenn

5 months ago

Okay, let me think this through. The agent is entering the contact information in an OmniScript, so they'll need a way to generate the PDF from that data. I'm guessing the OmniStudio Action would be the best option to handle that.

upvoted 0 times

...

Elroy

5 months ago

Ah, I've seen questions like this before. I believe the answer is B - payroll and expense reimbursement schemes. The perpetrators create false documents like fake invoices or time sheets to make the company think they need to disburse funds, when it's actually a fraudulent request.

upvoted 0 times

...

Mauricio

5 months ago

I remember discussing the need for extra diligence with foreign jurisdictions, but Iâ€™m not entirely sure if it's one of the answers here.

upvoted 0 times

...

Leah

5 months ago

Hmm, I'm a bit unsure about how to approach this. I'll need to figure out the total machine set-up cost and then allocate it to the two products based on their machine hours.

upvoted 0 times

...

Lindsay

5 months ago

I think the answer is Monitor and Control Project Work. That process is all about monitoring project performance and updating the plan as necessary, which would include providing revised cost and schedule forecasts.

upvoted 0 times

...

Ludivina

5 months ago

This seems like a straightforward question. I'd go with option A - admitting I don't know the answer in a professional manner. That's the best way to handle it.

upvoted 0 times

...