Exam SC-200 topic 6 question 31 discussion

Actual exam question from Microsoft's SC-200

Question #: 31
Topic #: 6

You have a Microsoft Sentinel workspace.

You are investigating an incident that involves the following entities:

• A host named Host1
• A user account named User1
• An IP address of 175.45.176.99

You need to update the threat intelligence list to include the entities.

Which entities can you add on the Incident page?

A. 175.45.176.99 only
B. Host1 only
C. User1 only
D. 175.45.176.99 and Host1 only
E. Host1 and User1 only
F. 175.45.176.99, Host1, and User1

Show Suggested Answer

Suggested Answer: A 🗳️

by 54c341a at March 7, 2025, 9:57 p.m.

Comments

Submit Cancel

0d0dde7

1 month ago

Selected Answer: F

chatgpt

upvoted 1 times

...

a_kto_to

3 months, 1 week ago

Selected Answer: A

"Indicator Domain name, URL, IPv4 address, IPv6 address, and File hashes" -> https://learn.microsoft.com/en-us/azure/sentinel/understand-threat-intelligence

upvoted 3 times

...

54c341a

3 months, 1 week ago

Selected Answer: A

Add only the following types of entities as threat indicators: Domain name IP address (IPv4 and IPv6) URL File (hash) https://learn.microsoft.com/en-us/defender-endpoint/live-response

upvoted 3 times

54c341a

3 months, 1 week ago

Wrong link. Correct link: https://learn.microsoft.com/en-us/azure/sentinel/add-entity-to-threat-intelligence?tabs=incidents#add-an-entity-to-your-threat-intelligence

upvoted 2 times

...