Microsoft Exam MS-500 Topic 3 Question 20 Discussion

Actual exam question for Microsoft's MS-500 exam

Question #: 20
Topic #: 3

You create an Azure Sentinel workspace.

You configure Azure Sentinel to ingest data from Azure Active Directory (Azure AD).

In the Azure Active Directory admin center, you discover Azure AD Identity Protection alerts. The Azure Sentinel workspace shows the status as shown in the following exhibit.

In Azure Log Analytics, you can see Azure AD data in the Azure Sentinel workspace.

What should you configure in Azure Sentinel to ensure that incidents are created for detected threats?

Adata connectors

Brules

Cworkbooks

Dhunting queries

Show Suggested Answer

Suggested Answer: B

https://docs.microsoft.com/en-us/azure/sentinel/detect-threats-custom

by Dottie at May 06, 2022, 02:55 AM

Limited Time Offer

25%

Off

Get Premium MS-500 Questions as Interactive Web-Based Practice Test or PDF

Contribute your Thoughts:

Submit Cancel

Currently there are no comments in this discussion, be the first to comment!