MENU
You have an Azure subscription that contains a Log Analytics workspace.
You need to onboard Microsoft Sentinel.
What should you do first?
Suggested Answer: D
Get Premium SC-900 Questions
as Interactive Web-Based Practice Test or PDF
Real Exam Format
Detailed Explanations
Instant Access
Get Your Practice Test
31 comments · newest first
TA
Tasia
11 months ago
Correlating alerts into incidents sounds important too, but not first!
DO
Doyle
11 months ago
Seems like a no-brainer, but I’m not sure about this one.
MA
Madalyn
12 months ago
Wait, I thought creating a hunting query was the first step?
MI
Micaela
12 months ago
Totally agree, option C is the way to go.
CO
Cora
1 year ago
You need to connect to your security sources first!
BA
Bambi
1 year ago
I vaguely recall that connecting to security sources is crucial before anything else, but I could be mixing it up with another topic.
NG
Ngoc
1 year ago
I’m leaning towards correlating alerts into incidents, but that seems more like something you'd do after setting things up.
HE
Hermila
1 year ago
I remember practicing a question about onboarding Sentinel, and I feel like creating a hunting query was mentioned as a later step.
PH
Phung
1 year ago
I think the first step might be to connect to security sources, but I'm not entirely sure.
JO
Jolene
1 year ago
I'm a bit confused on the right approach here. Should I just ask the developer to revert the change or is there more to it?
AR
Arlene
1 year ago
I have a feeling ITD might not be it, but I saw it come up in some practice questions. Wish I had paid more attention!
FR
Freeman
1 year ago
I got this! The answer is B, a prima facie case. That's when the evidence presented is sufficient to establish a case, even if it's later rebutted. Nailed it.
WE
Weldon
1 year ago
I think providing physicians with coding guidelines is definitely important, but I'm not sure if that alone is enough.
KI
Kiley
1 year ago
The key here is understanding what "velocity" means in the context of Big Data. I think A is the correct answer, but I'll double-check my understanding.
RA
Rasheeda
1 year ago
E) Summon a mystical Azure genie to onboard Sentinel for me. Abracadabra, Sentinel is now onboarded!
SH
Sharmaine
1 year ago
D) Create a custom detection rule.
PA
Pansy
1 year ago
B) Correlate alerts into incidents.
DA
Danica
1 year ago
C) Connect to your security sources.
GE
German
1 year ago
D) Create a custom detection rule? Good luck finding a rule that can detect my lack of study time.
CH
Charisse
1 year ago
D) Create a custom detection rule.
FR
Frederick
1 year ago
B) Correlate alerts into incidents.
ST
Stevie
1 year ago
C) Connect to your security sources.
JA
Janessa
1 year ago
A) Create a hunting query? I'm not a bloodhound, I'm just trying to pass this exam!
ET
Ettie
1 year ago
D) Create a custom detection rule.
BE
Beckie
1 year ago
B) Correlate alerts into incidents.
LI
Lilli
1 year ago
C) Connect to your security sources.
ET
Ettie
1 year ago
B) Correlate alerts into incidents? What is this, a detective agency?
GO
Golda
1 year ago
C) Connect to your security sources. Duh, you gotta get the data in before you can do anything else!
AL
Aliza
1 year ago
I believe creating a custom detection rule might be the best option to start with.
LA
Lachelle
2 years ago
I agree with Tomoko, connecting to security sources is the first step to onboard Microsoft Sentinel.
TO
Tomoko
2 years ago
I think we should connect to our security sources first.