Exam SC-200 topic 3 question 91 discussion

The correct answer is C. a UEBA activity template.

Answer is A) scheduled alert query You perform a query that looks for this activity in the BehaviorAnalytics and IdentityInfo tables It's not UEBA activity template because once you create a user-defined activity using the template, UEBA will stop using all the other out-of-the box activities it's already running. This means that if you use a template for one specific activity, you would have to recreate all the other activites/detections you want for UEBA.

I'll go for Answer A. You can create a scheduled query rule & use the BehaviorAnalytics table to detect the failed sign-ins. Ref: https://learn.microsoft.com/en-us/azure/sentinel/anomalies-reference#anomalous-failed-sign-in I've never heard of "UEBA activity template" in Sentinel. There are indeed "Rule templates", that can be used to create analytics rule. The users who votes for "UEBA activity template", can please provide any reference to Sentinel official documentation?

The question says "minimize effort" so I go for a template

Answer ist C, UEBA

UEBA activity templates in Microsoft Sentinel offer pre-built detection logic specifically designed for security scenarios like failed sign-ins.

Scheduled alert query

Tested in the portal. If you go to Microsoft Sentinel | content hub and search for UEBA you will find it. there are built-in queries inside it

correct

a scheduled alert query

The given answer A is correct because the word DETECT implies using queries.

I think it is C, there is a template called "User Accounts - Sign in Failure due to CA Spikes" with the description: "Identifies spike in failed sign-ins from user accounts due to conditional access policied. Spike is determined based on Time series anomaly which will look at historical baseline values. Ref : https://docs.microsoft.com/azure/active-directory/fundamentals/security-operations-user-accounts#monitoring-for-failed-unusual-sign-ins This query has also been updated to include UEBA logs IdentityInfo and BehaviorAnalytics for contextual information around the results."

scheduled query alert

Correct option

Going for A. B: Data connector for subscription log activties. Doesn't seem relevant. C: Not a thing?? D: Would work I guess but we would have to run manually and not meeting the ask to minmise admin effort.