Exam SC-100 topic 2 question 61 discussion

Actual exam question from Microsoft's SC-100

Question #: 61
Topic #: 2

HOTSPOT
-

You have four Azure subscriptions named Sub1, Sub2, Sub3, and Sub4. Each subscription has a unique Microsoft Entra tenant that is linked to a Microsoft 365 subscription. Sub1 contains a user named User1.

You plan to implement Microsoft Sentinel.

You need to ensure that User1 can monitor Microsoft Entra ID events and Microsoft 365 events for Sub2, Sub3, and Sub4 by using Microsoft Sentinel. The solution must minimize administrative effort.

What is the minimum number of Microsoft Sentinel workspaces you should create, and which Azure service should you use? To answer, select the appropriate options in the answer area.

NOTE: Each correct selection is worth one point.

Show Suggested Answer

Suggested Answer:

by 676ae1a at Jan. 29, 2025, 2:55 p.m.

Comments

Submit Cancel

ca7859c

3 weeks ago

1 Workspace is enough Lighthouse

upvoted 1 times

...

SnowmanPapi

2 months ago

1 workspace and Azure Lighthouse. As the questions says, this is a single Entra ID tenant which means only a single workspace is needed, as you would integrate Microsoft XDR to Sentinel. All the subscriptions are tied to the same Entra ID tenant.

upvoted 1 times

SnowmanPapi

1 month, 3 weeks ago

Correction. It is 3 workspaces. Each sub has a unique tenant.

upvoted 1 times

...

6c0ca3d

2 months, 1 week ago

To centralize management, you can use Azure Lighthouse to monitor multiple Sentinel workspaces from a single SOC environment. 1 workspace services: lighthouse

upvoted 1 times

...

Sails71

3 months ago

A single workspace can be used to monitor events across multiple subscriptions and tenants, reducing administrative effort - 1 Workspace & Azure Lighthouse.

upvoted 2 times

Luweho

1 week ago

"Microsoft Sentinel supports data collection from Microsoft and Azure SaaS resources only within its own Microsoft Entra tenant boundary. Therefore, each Microsoft Entra tenant requires a separate workspace." https://learn.microsoft.com/en-us/azure/sentinel/prepare-multiple-workspaces

upvoted 1 times

...