MENU
You have a Microsoft Sentinel workspace that has user and Entity Behavior Analytics (UEBA) enabled for Signin Logs.
You need to ensure that failed interactive sign-ins are detected.
The solution must minimize administrative effort.
What should you use?
Suggested Answer: B
Get Premium SC-200 Questions
as Interactive Web-Based Practice Test or PDF
Real Exam Format
Detailed Explanations
Instant Access
Get Your Practice Test
18 comments · newest first
BE
Berry
11 months ago
Wait, can a hunting query really detect failed sign-ins? That seems off.
RU
Ruth
11 months ago
I agree, B seems to minimize effort while catching those sign-ins.
RE
Reuben
11 months ago
I’m not sure about C, isn’t that more for general logging?
SH
Sheldon
12 months ago
A scheduled alert query sounds like a solid plan too.
CH
Charlesetta
12 months ago
I think option B is the best choice for UEBA.
VI
Vincent
1 year ago
A hunting query sounds familiar, but I’m not convinced it’s the best choice for this scenario since it usually requires more manual effort.
AL
Alex
1 year ago
I feel like the Activity Log data connector could be relevant, but it seems more focused on general logging rather than specific sign-in failures.
CH
Chantell
1 year ago
I’m not entirely sure, but I remember something about scheduled alert queries being useful for monitoring specific events.
MA
Malcolm
1 year ago
I think we might need to use a UEBA activity template since it’s designed to detect anomalies like failed sign-ins.
AL
Aliza
1 year ago
The Activity Log data connector might be an option, but I'm not sure if that would be the most efficient approach. I'll need to look into the capabilities and limitations of that solution.
RO
Rochell
1 year ago
Hmm, I'm not sure if a UEBA activity template is the right choice. I'll need to double-check the details on how that works to be sure it can detect failed interactive sign-ins.
RU
Rutha
1 year ago
I think a scheduled alert query would be the way to go here. It seems like the most straightforward solution that meets the requirements.
EL
Ellen
1 year ago
A hunting query could be an interesting approach, but it might require more administrative effort than the other options. I'll need to weigh the pros and cons of that approach.
SH
Sheron
1 year ago
Option A seems like the most logical choice to me. Reducing the number of snapshots should help resolve the issue, as the task is having trouble fetching a large number of them.
KA
Kara
1 year ago
I'm a bit confused on the differences between the options here. I'll have to review my notes on quality function deployment to make sure I understand it properly.
JO
Jospeh
1 year ago
Hmm, I remember a practice question about gaining system access, but that doesn't seem like direct user interaction.
EM
Emerson
1 year ago
Okay, I've got this. Based on the IIA guidance, the most important steps are determining if previous incidents have been reported and managed, and assessing the level of transparency in reporting. I'll make sure to focus on those key areas in my response.
RA
Rashad
1 year ago
Okay, I've got a strategy here. I'll carefully read through the options and think about how each one relates to the benefits of external spam quarantine.