Exam MS-500 topic 2 question 43 discussion

Actual exam question from Microsoft's MS-500

Question #: 43
Topic #: 2

DRAG DROP -
You have an Azure subscription and a Microsoft 365 subscription.
You need to perform the following actions:
✑ Deploy Microsoft Sentinel.
✑ Collect the Office 365 activity log by using Microsoft Sentinel.
Which three actions should you perform in sequence? To answer, move the appropriate actions from the list of actions to the answer area and arrange them in the correct order.
Select and Place:

Show Suggested Answer

Suggested Answer:

Reference:
https://docs.microsoft.com/en-us/azure/sentinel/quickstart-onboard https://docs.microsoft.com/en-us/azure/sentinel/connect-office-365

by billo79152718 at Sept. 16, 2022, 11:53 a.m.

Comments

Submit Cancel

RomanV

2 years, 2 months ago

Given answers are correct. A prereq for Sentinel is Log Analytics. "A Log Analytics workspace is required to house all of the data that Microsoft Sentinel will be ingesting and using for its detections, analytics, and other features. For more information, see Microsoft Sentinel workspace architecture best practices. Microsoft Sentinel doesn't support Log Analytics workspaces with a resource lock applied." Source: https://learn.microsoft.com/en-us/azure/sentinel/prerequisites Ps: If you don't pass the exam I will never talk to you again. I put time and brains in the comments to educate you in order for you to pass the d*mn exam. Success!

upvoted 3 times

...

examdog

2 years, 6 months ago

When you add Sentinal, you have to add it to a log analytics workspace. So the answer is correct.

upvoted 3 times

...

Just2a

2 years, 7 months ago

Answer is Add Sentinel Create workspace Add connector The question didnt see pre-requisite. So i think this is the other that needs to be done

upvoted 2 times

Tanasi

2 years, 1 month ago

you add Sentinel on a Workspace. But you can directly create Workspace when you want to create a Sentinel; I guess you are right too :D

upvoted 1 times

...

EzeQ

2 years, 8 months ago

from my reading of the referenced source, the only thing needed after installing Sentinel is to turn on the connector, but if you need to have 3 actions the Microsoft graph activation is the one that makes sense (as step 2). Sentinel requires a Log Analytics workspace, but it does not appear in the options.

upvoted 1 times

...

pete26

2 years, 8 months ago

Answer is correct!

upvoted 2 times

pete26

2 years, 8 months ago

It is a re-worded question with the new terminology: https://www.examtopics.com/discussions/microsoft/view/10311-exam-ms-500-topic-2-question-20-discussion/

upvoted 2 times

...

billo79152718

2 years, 9 months ago

correct!

upvoted 2 times

emon8972

2 years, 8 months ago

How many questions repeated from here?

upvoted 1 times

...