MENU
You have a Microsoft Sentinel workspace that contains the following incident.
Brute force attack against Azure Portal analytics rule has been triggered.
You need to identify the geolocation information that corresponds to the incident.
What should you do?
Suggested Answer: A
Get Premium SC-200 Questions
as Interactive Web-Based Practice Test or PDF
Real Exam Format
Detailed Explanations
Instant Access
Get Your Practice Test
Potential malicious events: When traffic is detected from sources that are known to be malicious, Microsoft Sentinel alerts you on the map. If you see orange, it is inbound traffic: someone is trying to access your organization from a known malicious IP address. If you see Outbound (red) activity, it means that data from your network is being streamed out of your organization to a known malicious IP address.
13 comments · newest first
PE
Pedro
11 months ago
Totally agree with B, that's where the details are!
DE
Deeanna
11 months ago
Wait, can you really get geolocation from B? Sounds off.
SH
Shawn
12 months ago
A seems like a quick way to see potential threats.
CA
Candra
12 months ago
I think D might be better for insights overall.
GL
Glory
1 year ago
Option B is the way to go for geolocation info.
JO
Johna
1 year ago
I’m a bit confused about the AccouncCuscomEntity; I don’t recall it being relevant for geolocation, but maybe I’m missing something.
MI
Mindy
1 year ago
I'm leaning towards option D, but I feel like I need to double-check what insights we can actually get from the incident entity.
PA
Paulene
1 year ago
I remember practicing a question similar to this, and I think the Potential malicious events map could show us the geolocation information.
AL
Alyce
1 year ago
I think we might need to check the iPCustomEntity for geolocation details, but I'm not entirely sure if that's the right choice.
FI
Fidelia
1 year ago
I think the transparency principle is most directly related to the right to be informed. The transparency principle is about ensuring that individuals are aware of how their personal data is being used, so the right to be informed seems like the most relevant option.
TR
Tracey
1 year ago
I'm a little unsure about this one. I know we need to ensure privacy and message integrity, but I'm not 100% sure which pattern would be the best fit. I'll review the concepts and try to narrow it down.
RI
Ricarda
1 year ago
I feel like there was a practice question that mentioned this. Was it saying we can address controls even if fraud isn't found?
AV
Avery
1 year ago
Hmm, tricky question. Need to consider the investment duration, expected returns, and matching expenses for two different marriages.