Describe Capabilities of Microsoft Sentinel SC-900 Practice Questions (Page 4)

Questions 16–20

1. 16foundation · easy

   How does Microsoft Sentinel use SOAR capabilities to respond to threats?

   • ABy encrypting all communication between security tools
   • BBy manually requiring analysts to write custom scripts for every incident
   • CBy automatically executing playbooks that perform response actions like blocking an IP address
   • DBy providing a dashboard to view alerts but not taking any automated action
   Reveal Solution Discussion Select an answer first
2. 17application · medium

   A security team wants to automatically create a support ticket in their ticketing system whenever a high-severity incident is created in Sentinel. They also want to notify the on-call engineer via email. What should they use?

   • AA data connector for the ticketing system
   • BAn automation rule that triggers a playbook to create a ticket and send email
   • CA hunting query that runs on a schedule
   • DA workbook that displays the incident
   Reveal Solution Discussion Select an answer first
4. 18application · medium

   During an incident, an analyst wants to block a malicious IP address at the firewall and also notify the security manager. The analyst wants to do this with a single action. What should they use in Microsoft Sentinel?

   • AA playbook that includes multiple steps
   • BA hunting query that finds the IP
   • CA workbook that shows the IP
   • DAn analytics rule that creates an alert
   Reveal Solution Discussion Select an answer first
5. 19application · medium

   A security analyst wants to respond to a phishing incident by blocking the sender's email address and resetting the affected user's password. They want to do this directly from the incident in Sentinel. What should they use?

   • AA hunting query that identifies the phishing email
   • BA workbook that shows the email details
   • CA playbook that performs both actions
   • DA data connector for email logs
   Reveal Solution Discussion Select an answer first
6. 20application · medium

   An organization wants to detect unusual sign-in patterns that might indicate compromised accounts, such as impossible travel or anomalous locations. They need a solution that uses built-in intelligence rather than custom rule writing. What should you use in Microsoft Sentinel?

   • AWatchlists
   • BHunting queries
   • CCustom scheduled query rules
   • DFusion analytics rules
   Reveal Solution Discussion Select an answer first