Microsoft Exam SC-900 Topic 9 Question 23 Discussion

Actual exam question for Microsoft's SC-900 exam

Question #: 23
Topic #: 9

[All SC-900 Questions]

You have an Azure subscription that contains a Log Analytics workspace.

You need to onboard Microsoft Sentinel.

What should you do first?

ACreate a hunting query.

BCorrelate alerts into incidents.

CConnect to your security sources.

DCreate a custom detection rule.

Show Suggested Answer

Suggested Answer: D

by Marti at Feb 05, 2023, 07:14 PM

Limited Time Offer

25%

Off

Get Premium SC-900 Questions as Interactive Web-Based Practice Test or PDF

Contribute your Thoughts:

Submit Cancel

Rasheeda

27 days ago

E) Summon a mystical Azure genie to onboard Sentinel for me. Abracadabra, Sentinel is now onboarded!

upvoted 0 times

Danica

7 days ago

C) Connect to your security sources.

upvoted 0 times

...

German

1 months ago

D) Create a custom detection rule? Good luck finding a rule that can detect my lack of study time.

upvoted 0 times

Charisse

2 days ago

D) Create a custom detection rule.

upvoted 0 times

...

Frederick

5 days ago

B) Correlate alerts into incidents.

upvoted 0 times

...

Stevie

28 days ago

C) Connect to your security sources.

upvoted 0 times

...

Janessa

1 months ago

A) Create a hunting query? I'm not a bloodhound, I'm just trying to pass this exam!

upvoted 0 times

Ettie

29 days ago

D) Create a custom detection rule.

upvoted 0 times

...

Beckie

30 days ago

B) Correlate alerts into incidents.

upvoted 0 times

...

Lilli

1 months ago

C) Connect to your security sources.

upvoted 0 times

...

Ettie

1 months ago

B) Correlate alerts into incidents? What is this, a detective agency?

upvoted 0 times

...

Golda

1 months ago

C) Connect to your security sources. Duh, you gotta get the data in before you can do anything else!

upvoted 0 times

...

Aliza

2 months ago

I believe creating a custom detection rule might be the best option to start with.

upvoted 0 times

...

Lachelle

2 months ago

I agree with Tomoko, connecting to security sources is the first step to onboard Microsoft Sentinel.

upvoted 0 times

...

Tomoko

2 months ago

I think we should connect to our security sources first.

upvoted 0 times

...