ExamTopics Logo
Mail Us[email protected]
Menu
Microsoft Discussions
exam questions

Exam SC-200 All Questions

View all questions & answers for the SC-200 exam
Go to Exam

Exam SC-200 topic 6 question 22 discussion

Actual exam question from Microsoft's SC-200
Question #: 22
Topic #: 6
[All SC-200 Questions]

You have a Microsoft Sentinel workspace named SW1.

In SW1, you investigate an incident that is associated with the following entities:

• Host
• IP address
• User account
• Malware name

Which entity can be labeled as an indicator of compromise (IoC) directly from the incident's page?

  • A. malware name
  • B. host
  • C. user account
  • D. IP address
Show Suggested Answer Hide Answer
Suggested Answer: D 🗳️
by 90158a0 at July 10, 2024, 1:06 a.m.

Comments

Chosen Answer:
This is a voting comment (?). It is better to Upvote an existing comment if you don't have anything to add.
Switch to a voting comment New
Submit Cancel
a_kto_to
5 months, 1 week ago
Selected Answer: D
"Add only the following types of entities as threat indicators: Domain name IP address (IPv4 and IPv6) URL File (hash) "
upvoted 2 times
...
sapphire
9 months ago
Selected Answer: D
Correct answer is IP
upvoted 1 times
...
f6ba8a1
9 months, 2 weeks ago
I think Hash can be labeled as IoC
upvoted 1 times
...
Studytime2023
12 months ago
Selected Answer: D
Correct https://learn.microsoft.com/en-us/azure/sentinel/add-entity-to-threat-intelligence?tabs=incidents#add-an-entity-to-your-threat-intelligence
upvoted 2 times
...
90158a0
1 year, 1 month ago
Selected Answer: D
IP Address
upvoted 1 times
...
Community vote distribution
A (35%)
C (25%)
B (20%)
Other
Most Voted
A voting comment increases the vote count for the chosen answer by one.

Upvoting a comment with a selected answer will also increase the vote count towards that answer by one. So if you see a comment that you already agree with, you can upvote it instead of posting a new comment.

SaveCancel