MENU
You are configuring Azure Sentinel.
You need to send a Microsoft Teams message to a channel whenever a sign-in from a suspicious IP address is detected.
Which two actions should you perform in Azure Sentinel? Each correct answer presents part of the solution.
NOTE: Each correct selection is worth one point.
Suggested Answer: D
Get Premium SC-200 Questions
as Interactive Web-Based Practice Test or PDF
Real Exam Format
Detailed Explanations
Instant Access
Get Your Practice Test
31 comments · newest first
NA
Naomi
11 months ago
Fusion rule? I thought that was for something else!
KA
Karan
11 months ago
Not sure about enabling Entity behavior analytics for this.
HE
Herminia
11 months ago
Wait, can you really send Teams messages like that? Sounds cool!
GE
Geoffrey
11 months ago
I think associating a playbook to an incident is key too.
ME
Merlyn
12 months ago
Definitely need to add a playbook for that!
WE
Wei
12 months ago
Creating a workbook seems unrelated to sending notifications, but I could see how enabling the Fusion rule might help with identifying threats.
LA
Lawana
1 year ago
I’m a bit confused about the options. I thought enabling Entity behavior analytics was important for detecting suspicious activity, but I’m not sure it directly relates to sending messages.
LE
Lea
1 year ago
I remember practicing a similar question where we had to set up alerts in Sentinel, and I feel like associating a playbook to an incident was part of that.
RA
Rasheeda
1 year ago
I think we definitely need to add a playbook for the Teams notification, but I'm not sure if we also need to associate it to an incident or just have it standalone.
ME
Meghan
1 year ago
This seems straightforward - AWS Guard Duty doesn't automatically enforce its findings, so the answer must be False.
WE
Weldon
1 year ago
Hmm, I'm a bit unsure about this one. I know Exploratory Testing is more unstructured, but I can't remember the specific term for the testing done without planning. Let me think this through...
AI
Ailene
1 year ago
C and D? Sounds like we're building a fancy Azure Sentinel dashboard rather than automating the response. I think I'll stick with A and B for this one.
YU
Yuki
1 year ago
C and D? Sounds like we're building a fancy Azure Sentinel dashboard rather than automating the response. I think I'll stick with A and B for this one.
MA
Makeda
1 year ago
B) Associate a playbook to an incident.
VE
Verona
1 year ago
A) Add a playbook.
YU
Yuette
1 year ago
Hmm, I'm not sure about this one. Maybe we should call in the Azure Sentinel support team - they seem to have a good sense of humor and can probably crack this case wide open!
GR
Gregoria
1 year ago
I would go with A and E. The Fusion rule can help detect suspicious activity, and a playbook can automate the response.
GL
Glennis
1 year ago
Yes, having a playbook and Fusion rule in place will definitely improve our incident response process.
SA
Sage
1 year ago
I think adding a playbook and enabling the Fusion rule will help us automate the response to suspicious activity.
AL
Alesia
1 year ago
I agree, setting up a playbook and enabling the Fusion rule is a good idea.
EV
Evelynn
1 year ago
A and B are the correct answers. You need to create a playbook to send the Teams message, and then associate that playbook with an incident.
CA
Carmelina
1 year ago
Yes, creating a playbook and associating it with an incident will allow you to send a Teams message when a suspicious sign-in is detected.
KA
Karma
1 year ago
Great, those are the correct actions to take.
LI
Linette
1 year ago
B) Associate a playbook to an incident.
SA
Sabina
1 year ago
A) Add a playbook.
GI
Gilma
1 year ago
Then associate that playbook with an incident.
VE
Venita
1 year ago
You need to create a playbook to send the Teams message.
BR
Brett
1 year ago
A and B are the correct answers.
TA
Tashia
2 years ago
Creating a workbook might be useful for tracking and analyzing the data related to the sign-ins.
AN
Anissa
2 years ago
I agree with Alyssa. Enabling the Fusion rule could also help in detecting suspicious IP addresses.
AL
Alyssa
2 years ago
I think we should add a playbook and associate it to an incident.