MENU
You have an Azure subscription named Sub1 and a Microsoft 365 subscription. Sub1 is linked to an Azure Active Directory (Azure AD) tenant named contoso.com.
You create an Azure Sentinel workspace named workspace1. In workspace1, you activate an Azure AD connector for contoso.com and an Office 365 connector for the Microsoft 365 subscription.
You need to use the Fusion rule to detect multi-staged attacks that include suspicious sign-ins to contoso.com followed by anomalous Microsoft Office 365 activity.
Which two actions should you perform? Each correct answer present part of the solution.
NOTE: Each correct selection is worth one point.
Suggested Answer: A, B
Get Premium SC-200 Questions
as Interactive Web-Based Practice Test or PDF
Real Exam Format
Detailed Explanations
Instant Access
Get Your Practice Test
11 comments · newest first
MA
Malcom
12 months ago
Agreed, A is a must for this scenario!
LA
Lakeesha
1 year ago
Wait, why would we need a Cloud App Security connector?
LA
Laine
1 year ago
Definitely A, but I’m skeptical about D.
AL
Alecia
1 year ago
I think B could also be useful, but not sure.
RE
Regenia
1 year ago
A and D are the right moves here.
MA
Maurine
1 year ago
I vaguely recall that creating a Microsoft incident creation rule based on Azure Security Center might not be directly related to the Fusion rule. It seems like it’s more about general security management.
GE
Gerry
1 year ago
I'm a bit confused about the Azure AD Identity Protection connector. I know it relates to sign-ins, but does it really tie into the Fusion rule for multi-staged attacks?
EL
Elliott
1 year ago
I think we practiced a similar question where we had to set up rules for detecting suspicious activities. I feel like creating a custom rule based on the Office 365 connector templates could be a good option.
IN
In
1 year ago
I remember we discussed the importance of connectors in Azure Sentinel, but I'm not sure if the Microsoft Cloud App Security connector is the right choice here.
TH
Theron
1 year ago
Okay, I've got a strategy for this. First, I'll carefully examine the code snippet and look for any clues or patterns that might indicate the type of language. Then, I'll compare that to the answer choices and select the one that best matches what I've observed.
AD
Adolph
1 year ago
Hmm, I'm not sure about this one. I'll need to think it through carefully to make sure I select the right 3 options.