Exam Name: | Microsoft Security Operations Analyst | ||
Exam Code: | SC-200 Dumps | ||
Vendor: | Microsoft | Certification: | Microsoft Certified: Security Operations Analyst Associate |
Questions: | 280 Q&A's | Shared By: | cali |
You need to implement the scheduled rule for incident generation based on rulequery1.
What should you configure first?
You have an Azure subscription that contains an Microsoft Sentinel workspace.
You need to create a playbook that will run automatically in response to an Microsoft Sentinel alert.
What should you create first?
You create an Azure subscription.
You enable Azure Defender for the subscription.
You need to use Azure Defender to protect on-premises computers.
What should you do on the on-premises computers?
You have an Azure subscription that contains an Azure logic app named app1 and a Microsoft Sentinel workspace that has an Azure AD connector. You need to ensure that app1 launches when Microsoft Sentinel detects an Azure AD-generated alert. What should you create first?