Exam SC-200 topic 3 question 3 discussion

Actual exam question from Microsoft's SC-200

Question #: 3
Topic #: 3

DRAG DROP -
You have an Azure Sentinel deployment.
You need to query for all suspicious credential access activities.
Which three actions should you perform in sequence? To answer, move the appropriate actions from the list of actions to the answer area and arrange them in the correct order.
Select and Place:

Show Suggested Answer

Suggested Answer:

Reference:
https://davemccollough.com/2020/11/28/threat-hunting-with-azure-sentinel/

by Sik4nd4r at June 12, 2021, noon

Comments

Submit Cancel

examkid

Highly Voted 2 years, 10 months ago

Correct, in the hunting dashboard you can select the 'Credential Access' tactic

upvoted 20 times

...

rdy4u

Highly Voted 2 years, 1 month ago

Microsoft Sentinel -> Hunting -> Add filter “Tactics”, select “Credential Access” -> Run All Queries

upvoted 12 times

...

chepeerick

Most Recent 7 months, 2 weeks ago

Correct

upvoted 1 times

...

Marchiano

11 months ago

Sentinel -> Hunting [1] -> Queries -> Credential Access (filter by tactics) [2] -> Run all queries [3]

upvoted 3 times

...

Lapatiser

2 years, 2 months ago

This is not correct. Its supposed to be select hunting -> select new query -> filter by tactics. If you "filter by tactics" after "selecting hunting", the option available will be to "run selected queries" not "run all queries"

upvoted 2 times

StaxJaxson

2 years ago

Microsoft Sentinel -> Hunting -> Add filter “Tactics”, select “Credential Access” -> Run All Queries I have Sentinel and I'm looking at it now. This is exactly correct.

upvoted 15 times

...

Sik4nd4r

2 years, 12 months ago

Correct answer

upvoted 3 times

...