Microsoft SC-200 Exam Questions & Answers

Correct Answer: D

Permanent failure - rule auto-disable due to the following reasons

The target workspace (on which the rule query operated) has been deleted.

The target table (on which the rule query operated) has been deleted.

Microsoft Sentinel had been removed from the target workspace.

A function used by the rule query is no longer valid; it has been either modified or removed.

Permissions to one of the data sources of the rule query were changed.

One of the data sources of the rule query was deleted or disconnected.

Reference:

https://docs.microsoft.com/en-us/azure/sentinel/tutorial-detect-threats-custom

Correct Answer:

Box 1: Turn on Live Response

Live response is a capability that gives you instantaneous access to a device by using a remote shell connection. This gives you the power to do in-depth investigative work and take immediate response actions.

Box: 2 : Add a network assessment job

Network assessment jobs allow you to choose network devices to be scanned regularly and added to the device inventory.

Correct Answer:

Box 1: Log Analytics agent

Collect data in custom log formats to Microsoft Sentinel with the Log Analytics agent.

Many applications log data to text files instead of standard logging services like Windows Event log or Syslog. You can use the Log Analytics agent to collect data in text files of nonstandard formats from both Windows and Linux computers.

Once collected, you can either parse the data into individual fields in your queries or extract the data during collection to individual fields.

Box 2 Data connectors page of Microsoft Sentinel

Configure the logs to be collected

Many device types have their own data connectors appearing in the Data connectors page in Microsoft Sentinel. Some of these connectors require special additional instructions to properly set up log collection in Microsoft Sentinel. These

instructions can include the implementation of a parser based on a Kusto function.

All connectors listed in Microsoft Sentinel will display any specific instructions on their respective connector pages in the portal, as well as in their sections of the Microsoft Sentinel data connectors reference page.

If your product is not listed in the Data connectors page, consult your vendor's documentation for instructions on configuring logging for your device.

Reference:

https://learn.microsoft.com/en-us/azure/sentinel/connect-custom-logs