Microsoft Security Operations Analyst: SC-200

DRAG DROP

You are investigating an incident by using Microsoft 365 Defender.

You need to create an advanced hunting query to count failed sign-in authentications on three devices named CFOLaptop, CEOLaptop, and COOLaptop.

How should you complete the query? To answer, select the appropriate options in the answer area.

NOTE: Each correct selection is worth one point.

Select and Place:

You plan to create a custom Azure Sentinel query that will provide a visual representation of the security alerts generated by Azure Security Center.

You need to create a query that will be used to display a bar graph.

What should you include in the query?

A. extend

B. bin

C. count

D. workspace

You need to meet the Microsoft Sentinel requirements for App1. What should you configure for App1?

A. a trigger

B. a connector

C. authorization

D. an API connection