SC-200 Exam Prep Free – 50 Practice Questions to Get You Ready for Exam Day
Getting ready for the SC-200 certification? Our SC-200 Exam Prep Free resource includes 50 exam-style questions designed to help you practice effectively and feel confident on test day
Effective SC-200 exam prep free is the key to success. With our free practice questions, you can:
- Get familiar with exam format and question style
- Identify which topics you’ve mastered—and which need more review
- Boost your confidence and reduce exam anxiety
Below, you will find 50 realistic SC-200 Exam Prep Free questions that cover key exam topics. These questions are designed to reflect the structure and challenge level of the actual exam, making them perfect for your study routine.
HOTSPOT - You have a Microsoft 365 E5 subscription that uses Microsoft Defender 365. Your network contains an on-premises Active Directory Domain Services (AD DS) domain that syncs with Azure AD. You need to identify LDAP requests by AD DS users to enumerate AD DS objects. How should you complete the KQL query? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.
Your company deploys the following services: ✑ Microsoft Defender for Identity ✑ Microsoft Defender for Endpoint ✑ Microsoft Defender for Office 365 You need to provide a security analyst with the ability to use the Microsoft 365 security center. The analyst must be able to approve and reject pending actions generated by Microsoft Defender for Endpoint. The solution must use the principle of least privilege. Which two roles should assign to the analyst? Each correct answer presents part of the solution. NOTE: Each correct selection is worth one point.
A. the Compliance Data Administrator in Azure Active Directory (Azure AD)
B. the Active remediation actions role in Microsoft Defender for Endpoint
C. the Security Administrator role in Azure Active Directory (Azure AD)
D. the Security Reader role in Azure Active Directory (Azure AD)
You have an Azure subscription that contains a user named User1. User1 is assigned an Azure Active Directory Premium Plan 2 license. You need to identify whether the identity of User1 was compromised during the last 90 days. What should you use?
A. the risk detections report
B. the risky users report
C. Identity Secure Score recommendations
D. the risky sign-ins report
After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen. You are configuring Azure Sentinel. You need to create an incident in Azure Sentinel when a sign-in to an Azure virtual machine from a malicious IP address is detected. Solution: You create a Microsoft incident creation rule for a data connector. Does this meet the goal?
A. Yes
B. No
HOTSPOT - You have a Microsoft Sentinel workspace that has User and Entity Behavior Analytics (UEBA) enabled. You need to identify all the log entries that relate to security-sensitive user actions performed on a server named Server1. The solution must meet the following requirements: • Only include security-sensitive actions by users that are NOT members of the IT department. • Minimize the number of false positives. How should you complete the query? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.
After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen. You are configuring Azure Sentinel. You need to create an incident in Azure Sentinel when a sign-in to an Azure virtual machine from a malicious IP address is detected. Solution: You create a hunting bookmark. Does this meet the goal?
A. Yes
B. No
HOTSPOT - You have an Azure subscription that contains a guest user named User1 and a Microsoft Sentinel workspace named workspace1. You need to ensure that User1 can triage Microsoft Sentinel incidents in workspace1. The solution must use the principle of least privilege. Which roles should you assign to User1? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.
HOTSPOT - You need to create a query for a workbook. The query must meet the following requirements: ✑ List all incidents by incident number. ✑ Only include the most recent log for each incident. How should you complete the query? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point. Hot Area:
After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen. You are configuring Azure Sentinel. You need to create an incident in Azure Sentinel when a sign-in to an Azure virtual machine from a malicious IP address is detected. Solution: You create a scheduled query rule for a data connector. Does this meet the goal?
A. Yes
B. No
You have an Azure subscription that uses Microsoft Sentinel. You detect a new threat by using a hunting query. You need to ensure that Microsoft Sentinel automatically detects the threat. The solution must minimize administrative effort. What should you do?
A. Create an analytics rule.
B. Add the query to a workbook.
C. Create a watchlist.
D. Create a playbook.
You have a Microsoft 365 subscription that uses Microsoft Defender for Endpoint Plan 2 and contains a macOS device named Device1. You need to investigate a Defender for Endpoint agent alert on Device1. The solution must meet the following requirements: • Identify all the active network connections on Device1. • Identify all the running processes on Device1. • Retrieve the login history of Device1. • Minimize administrative effort. What should you do first from the Microsoft Defender portal?
A. From Devices, click Collect investigation package for Device1.
B. From Advanced features in Endpoints, enable Live Response unsigned script execution.
C. From Devices, initiate a live response session on Device1.
D. From Advanced features in Endpoints, disable Authenticated telemetry.
DRAG DROP - You have an Azure Functions app that generates thousands of alerts in Azure Security Center each day for normal activity. You need to hide the alerts automatically in Security Center. Which three actions should you perform in sequence in Security Center? Each correct answer presents part of the solution. NOTE: Each correct selection is worth one point. Select and Place:
HOTSPOT - You have a Microsoft 365 subscription that uses Microsoft Defender for Endpoint Plan 2 and contains a Windows device named Device1. You initiated a live response session on Device1. You need to run a command that will download a 250-MB file named File1.exe from the live response library to Device1. The solution must ensure that File1.exe is downloaded as a background process. How should you complete the live response command? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.
You create a hunting query in Azure Sentinel. You need to receive a notification in the Azure portal as soon as the hunting query detects a match on the query. The solution must minimize effort. What should you use?
A. a playbook
B. a notebook
C. a livestream
D. a bookmark
Overview - Fabrikam, Inc. is a financial services company. The company has branch offices in New York, London, and Singapore. Fabrikam has remote users located across the globe. The remote users access company resources, including cloud resources, by using a VPN connection to a branch office. Existing Environment - Identity Environment - The network contains an Active Directory Domain Services (AD DS) forest named fabrikam.com that syncs with an Azure AD tenant named fabrikam.com. To sync the forest, Fabrikam uses Azure AD Connect with pass-through authentication enabled and password hash synchronization disabled. The fabrikam.com forest contains two global groups named Group1 and Group2. Microsoft 365 Environment - All the users at Fabrikam are assigned a Microsoft 365 E5 license and an Azure Active Directory Premium Plan 2 license. Fabrikam implements Microsoft Defender for Identity and Microsoft Defender for Cloud Apps and enables log collectors. Azure Environment - Fabrikam has an Azure subscription that contains the resources shown in the following table.Amazon Web Services (AWS) Environment Fabrikam has an Amazon Web Services (AWS) account named Account1. Account1 contains 100 Amazon Elastic Compute Cloud (EC2) instances that run a custom Windows Server 2022. The image includes Microsoft SQL Server 2019 and does NOT have any agents installed. Current Issues - When the users use the VPN connections, Microsoft 365 Defender raises a high volume of impossible travel alerts that are false positives. Defender for Identity raises a high volume of Suspected DCSync attack alerts that are false positives. Requirements - Planned changes - Fabrikam plans to implement the following services: • Microsoft Defender for Cloud • Microsoft Sentinel Business Requirements - Fabrikam identifies the following business requirements: • Use the principle of least privilege, whenever possible. • Minimize administrative effort. Microsoft Defender for Cloud Apps Requirements Fabrikam identifies the following Microsoft Defender for Cloud Apps requirements: • Ensure that impossible travel alert policies are based on the previous activities of each user. • Reduce the amount of impossible travel alerts that are false positives. Microsoft Defender for Identity Requirements Minimize the administrative effort required to investigate the false positive alerts. Microsoft Defender for Cloud Requirements Fabrikam identifies the following Microsoft Defender for Cloud requirements: • Ensure that the members of Group2 can modify security policies. • Ensure that the members of Group1 can assign regulatory compliance policy initiatives at the Azure subscription level. • Automate the deployment of the Azure Connected Machine agent for Azure Arc-enabled servers to the existing and future resources of Account1. • Minimize the administrative effort required to investigate the false positive alerts. Microsoft Sentinel Requirements - Fabrikam identifies the following Microsoft Sentinel requirements: • Query for NXDOMAIN DNS requests from the last seven days by using built-in Advanced Security Information Model (ASIM) unifying parsers. • From AWS EC2 instances, collect Windows Security event log entries that include local group membership changes. • Identify anomalous activities of Azure AD users by using User and Entity Behavior Analytics (UEBA). • Evaluate the potential impact of compromised Azure AD user credentials by using UEBA. • Ensure that App1 is available for use in Microsoft Sentinel automation rules. • Identify the mean time to triage for incidents generated during the last 30 days. • Identify the mean time to close incidents generated during the last 30 days. • Ensure that the members of Group1 can create and run playbooks. • Ensure that the members of Group1 can manage analytics rules. • Run hunting queries on Pool1 by using Jupyter notebooks. • Ensure that the members of Group2 can manage incidents. • Maximize the performance of data queries. • Minimize the amount of collected data. You need to deploy the native cloud connector to Account 1 to meet the Microsoft Defender for Cloud requirements. What should you do in Account1 first?
A. Create an AWS user for Defender for Cloud.
B. Configure AWS Security Hub.
C. Deploy the AWS Systems Manager (SSM) agent.
D. Create an Access control (IAM) role for Defender for Cloud.
You provision Azure Sentinel for a new Azure subscription. You are configuring the Security Events connector. While creating a new rule from a template in the connector, you decide to generate a new alert for every event. You create the following rule query.By which two components can you group alerts into incidents? Each correct answer presents a complete solution. NOTE: Each correct selection is worth one point.
A. user
B. resource group
C. IP address
D. computer
You create a custom analytics rule to detect threats in Azure Sentinel. You discover that the rule fails intermittently. What are two possible causes of the failures? Each correct answer presents part of the solution. NOTE: Each correct selection is worth one point.
A. The rule query takes too long to run and times out.
B. The target workspace was deleted.
C. Permissions to the data sources of the rule query were modified.
D. There are connectivity issues between the data sources and Log Analytics
You have an Azure subscription that has Microsoft Defender for Cloud enabled. You have a virtual machine named Server1 that runs Windows Server 2022 and is hosted in Amazon Web Services (AWS). You need to collect logs and resolve vulnerabilities for Server1 by using Defender for Cloud. What should you install first on Server1?
A. the Microsoft Monitoring Agent
B. the Azure Monitor agent
C. the Azure Arc agent
D. the Azure Pipelines agent
You have an Azure subscription that contains an Azure logic app named app1 and a Microsoft Sentinel workspace that has an Azure Active Directory (Azure AD) connector. You need to ensure that app1 launches when Microsoft Sentinel detects an Azure AD-generated alert. What should you create first?
A. a repository connection
B. a watchlist
C. an analytics rule
D. an automation rule
You use Azure Security Center. You receive a security alert in Security Center. You need to view recommendations to resolve the alert in Security Center. What should you do?
A. From Security alerts, select the alert, select Take Action, and then expand the Prevent future attacks section.
B. From Security alerts, select Take Action, and then expand the Mitigate the threat section.
C. From Regulatory compliance, download the report.
D. From Recommendations, download the CSV report.
A security administrator receives email alerts from Azure Defender for activities such as potential malware uploaded to a storage account and potential successful brute force attacks. The security administrator does NOT receive email alerts for activities such as antimalware action failed and suspicious network activity. The alerts appear in Azure Security Center. You need to ensure that the security administrator receives email alerts for all the activities. What should you configure in the Security Center settings?
A. the severity level of email notifications
B. a cloud connector
C. the Azure Defender plans
D. the integration settings for Threat detection
After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen. You have Linux virtual machines on Amazon Web Services (AWS). You deploy Azure Defender and enable auto-provisioning. You need to monitor the virtual machines by using Azure Defender. Solution: You enable Azure Arc and onboard the virtual machines to Azure Arc. Does this meet the goal?
A. Yes
B. No
HOTSPOT - You need to recommend remediation actions for the Azure Defender alerts for Fabrikam. What should you recommend for each threat? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point. Hot Area:
You have a Microsoft 365 E5 subscription that contains 100 Windows 10 devices. You onboard the devices to Microsoft Defender 365. You need to ensure that you can initiate remote shell connections to the onboarded devices from the Microsoft 365 Defender portal. What should you do first?
A. Modify the permissions for Microsoft 365 Defender.
B. Create a device group.
C. From Advanced features in the Endpoints settings of the Microsoft 365 Defender portal, enable automated investigation.
D. Configure role-based access control (RBAC).
You need to visualize Microsoft Sentinel data and enrich the data by using third-party data sources to identify indicators of compromise (IoC). What should you use?
A. notebooks in Microsoft Sentinel
B. Microsoft Defender for Cloud Apps
C. Azure Monitor
HOTSPOT - Overview - Adatum Corporation is a United States-based financial services company that has regional offices in New York, Chicago, and San Francisco. Existing Environment - Identity Environment - The on-premises network contains an Active Directory Domain Services (AD DS) forest named corp.adatum.com that syncs with an Azure AD tenant named adatum.com. All user and group management tasks are performed in corp.adatum.com. The corp.adatum.com domain contains a group named Group1 that syncs with adatum.com. Licensing Status - All the users at Adatum are assigned a Microsoft 365 ES license and an Azure Active Directory Premium P2 license. Cloud Environment - The cloud environment contains a Microsoft 365 subscription, an Azure subscription linked to the adatum.com tenant, and the resources shown in the following table.On-premises Environment - The on-premises network contains the resources shown in the following table.
Requirements - Planned changes - Adatum plans to perform the following changes: • Implement a query named rulequery1 that will include the following KQL query.
• Implement a Microsoft Sentinel scheduled rule that generates incidents based on rulequery1. Microsoft Defender for Cloud Requirements Adatum identifies the following Microsoft Defender for Cloud requirements: • The members of Group1 must be able to enable Defender for Cloud plans and apply regulatory compliance initiatives. • Microsoft Defender for Servers Plan 2 must be enabled on all the Azure virtual machines. • Server2 must be excluded from agentless scanning. Microsoft Sentinel Requirements Adatum identifies the following Microsoft Sentinel requirements: • Implement an Advanced Security Information Model (ASIM) query that will return a count of DNS requests that results in an NXDOMAIN response from Infoblox1. • Ensure that multiple alerts generated by rulequery1 in response to a single user launching Azure Cloud Shell multiple times are consolidated as a single incident. • Implement the Windows Security Events via AMA connector for Microsoft Sentinel and configure it to monitor the Security event log of Server1. • Ensure that incidents generated by rulequery1 are closed automatically if Azure Cloud Shell is launched by the company’s SecOps team. • Implement a custom Microsoft Sentinel workbook named Workbook1 that will include a query to dynamically retrieve data from Webapp1. • Implement a Microsoft Sentinel near-real-time (NRT) analytics rule that detects sign-ins to a designated break glass account. • Ensure that HuntingQuery1 runs automatically when the Hunting page of Microsoft Sentinel in the Azure portal is accessed. • Ensure that higher than normal volumes of password resets for corp.adatum.com user accounts are detected. • Minimize the overhead associated with queries that use ASIM parsers. • Ensure that the Group1 members can create and edit playbooks. • Use built-in ASIM parsers whenever possible. Business Requirements - Adatum identifies the following business requirements: • Follow the principle of least privilege whenever possible. • Minimize administrative effort whenever possible. You need to implement the Microsoft Sentinel NRT rule for monitoring the designated break glass account. The solution must meet the Microsoft Sentinel requirements. How should you complete the query? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.
After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen. You use Azure Security Center. You receive a security alert in Security Center. You need to view recommendations to resolve the alert in Security Center. Solution: From Security alerts, you select the alert, select Take Action, and then expand the Prevent future attacks section. Does this meet the goal?
A. Yes
B. No
HOTSPOT - Overview - Adatum Corporation is a United States-based financial services company that has regional offices in New York, Chicago, and San Francisco. Existing Environment - Identity Environment - The on-premises network contains an Active Directory Domain Services (AD DS) forest named corp.adatum.com that syncs with an Azure AD tenant named adatum.com. All user and group management tasks are performed in corp.adatum.com. The corp.adatum.com domain contains a group named Group1 that syncs with adatum.com. Licensing Status - All the users at Adatum are assigned a Microsoft 365 ES license and an Azure Active Directory Premium P2 license. Cloud Environment - The cloud environment contains a Microsoft 365 subscription, an Azure subscription linked to the adatum.com tenant, and the resources shown in the following table.
HOTSPOT - You have the resources shown in the following table.You have an Azure subscription that uses Microsoft Defender for Cloud. You need to use Defender for Cloud to protect VM1 and Server1. The solution must meet the following requirements: • Support Advanced Threat Protection and vulnerability assessment. • Register each SQL Server 2022 instance as a SQL virtual machine. • Minimize implementation and administrative effort. What should you deploy to each server? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.
HOTSPOT - You have a Microsoft Sentinel workspace named sws1. You need to create a hunting query to identify users that list storage keys of multiple Azure Storage accounts. The solution must exclude users that list storage keys for a single storage account. How should you complete the query? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point. Hot Area:
After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen. You have an Azure subscription that uses Microsoft Defender XDR. From the Microsoft Defender portal, you perform an audit search and export the results as a file named File1.csv that contains 10,000 rows. You use Microsoft Excel to perform Get & Transform Data operations to parse the AuditData column from File1.csv. The operations fail to generate columns for specific JSON properties. You need to ensure that Excel generates columns for the specific JSON properties in the audit search results. Solution: From Defender, you modify the search criteria of the audit search to reduce the number of returned records, and then you export the results. From Excel, you perform the Get & Transform Data operations by using the new export. Does this meet the requirement?
A. Yes
B. No
You have an Azure subscription that contains a Log Analytics workspace. You need to enable just-in-time (JIT) VM access and network detections for Azure resources. Where should you enable Azure Defender?
A. at the subscription level
B. at the workspace level
C. at the resource level
HOTSPOT - You have an Azure Storage account that will be accessed by multiple Azure Function apps during the development of an application. You need to hide Azure Defender alerts for the storage account. Which entity type and field should you use in a suppression rule? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point. Hot Area:
You have 500 on-premises devices. You have a Microsoft 365 E5 subscription that uses Microsoft Defender 365. You onboard 100 devices to Microsoft Defender 365. You need to identify any unmanaged on-premises devices. The solution must ensure that only specific onboarded devices perform the discovery. What should you do first?
A. Create a device group.
B. Create an exclusion.
C. Set Discovery mode to Basic.
D. Create a tag.
You have an existing Azure logic app that is used to block Azure Active Directory (Azure AD) users. The logic app is triggered manually. You deploy Azure Sentinel. You need to use the existing logic app as a playbook in Azure Sentinel. What should you do first?
A. And a new scheduled query rule.
B. Add a data connector to Azure Sentinel.
C. Configure a custom Threat Intelligence connector in Azure Sentinel.
D. Modify the trigger in the logic app.
HOTSPOT - You have a Microsoft 365 subscription that uses Microsoft Defender for Endpoint Plan 2 and contains a Windows device named Device1. You initiate a live response session on Device1 and launch an executable file named File1.exe in the background. You need to perform the following actions: • Identify the command ID of File1.exe. • Interact with File1.exe. Which live response command should you run for each action? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.
HOTSPOT - You have a Microsoft Sentinel workspace. You need to create a KQL query that will identify successful sign-ins from multiple countries during the last three hours. How should you complete the query? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.
You have a Microsoft 365 E5 subscription that uses Microsoft Defender 365. You need to ensure that you can investigate threats by using data in the unified audit log of Microsoft Defender for Cloud Apps. What should you configure first?
A. the User enrichment settings
B. the Azure connector
C. the Office 365 connector
D. the Automatic log upload settings
HOTSPOT - You have an Azure subscription that contains a Log Analytics workspace named Workspace1. You configure Azure activity logs and Microsoft Entra ID logs to be forwarded to Workspace1. You need to identify which Azure resources have been queried or modified by risky users. How should you complete the KQL query? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.
HOTSPOT - You have a Microsoft 365 E5 subscription that uses Microsoft Defender and an Azure subscription that uses Azure Sentinel. You need to identify all the devices that contain files in emails sent by a known malicious email sender. The query will be based on the match of the SHA256 hash. How should you complete the query? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point. Hot Area:
DRAG DROP - You create a new Azure subscription and start collecting logs for Azure Monitor. You need to configure Azure Security Center to detect possible threats related to sign-ins from suspicious IP addresses to Azure virtual machines. The solution must validate the configuration. Which three actions should you perform in a sequence? To answer, move the appropriate actions from the list of action to the answer area and arrange them in the correct order. Select and Place:
You have an Azure subscription that contains a Microsoft Sentinel workspace. You need to create a playbook that will run automatically in response to a Microsoft Sentinel alert. What should you create first?
A. a hunting query in Microsoft Sentinel
B. an Azure logic app
C. an automation rule in Microsoft Sentinel
D. a trigger in Azure Functions
HOTSPOT - You are informed of an increase in malicious email being received by users. You need to create an advanced hunting query in Microsoft 365 Defender to identify whether the accounts of the email recipients were compromised. The query must return the most recent 20 sign-ins performed by the recipients within an hour of receiving the known malicious email. How should you complete the query? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point. Hot Area:
You have a Microsoft 365 subscription that uses Microsoft Defender for Endpoint Plan 2 and contains 1,000 Windows devices. You have a PowerShell script named Script1.ps1 that is signed digitally. You need to ensure that you can run Script1.ps1 in a live response session on one of the devices. What should you do first from the live response session?
A. Run the library command.
B. Upload Script1.ps1 to the library.
C. Run the putfile command.
D. Modify the PowerShell execution policy of the device.
You are configuring Azure Sentinel. You need to send a Microsoft Teams message to a channel whenever an incident representing a sign-in risk event is activated in Azure Sentinel. Which two actions should you perform in Azure Sentinel? Each correct answer presents part of the solution. NOTE: Each correct selection is worth one point.
A. Enable Entity behavior analytics.
B. Associate a playbook to the analytics rule that triggered the incident.
C. Enable the Fusion rule.
D. Add a playbook.
E. Create a workbook.
HOTSPOT - You have an Azure subscription that contains a user named User1 and a Microsoft Sentinel workspace named WS1. You need to ensure that User1 can enable User and Entity Behavior Analytics (UEBA) for WS1. The solution must follow the principle of least privilege. Which roles should you assign to User1? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.
You need to receive a security alert when a user attempts to sign in from a location that was never used by the other users in your organization to sign in. Which anomaly detection policy should you use?
A. Impossible travel
B. Activity from anonymous IP addresses
C. Activity from infrequent country
D. Malware detection
HOTSPOT - You have a Microsoft 365 E5 subscription that uses Microsoft Defender for Endpoint. You have the on-premises devices shown in the following table.You are preparing an incident response plan for devices infected by malware. You need to recommend response actions that meet the following requirements: • Block malware from communicating with and infecting managed devices. • Do NOT affect the ability to control managed devices. Which actions should you use for each device? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.
You have a Microsoft Sentinel workspace. You have a query named Query1 as shown in the following exhibit.You plan to create a custom parser named Parser1. You need to use Query1 in Parser1. What should you do first?
A. Remove line 5.
B. Remove line 2.
C. In line 3, replace the !contains operator with the !has operator.
D. In line 4, remove the TimeGenerated predicate.
You have an Azure Sentinel deployment in the East US Azure region. You create a Log Analytics workspace named LogsWest in the West US Azure region. You need to ensure that you can use scheduled analytics rules in the existing Azure Sentinel deployment to generate alerts based on queries to LogsWest. What should you do first?
A. Deploy Azure Data Catalog to the West US Azure region.
B. Modify the workspace settings of the existing Azure Sentinel deployment.
C. Add Azure Sentinel to a workspace.
D. Create a data connector in Azure Sentinel.
Access Full SC-200 Exam Prep Free
Want to go beyond these 50 questions? Click here to unlock a full set of SC-200 exam prep free questions covering every domain tested on the exam.
We continuously update our content to ensure you have the most current and effective prep materials.
Good luck with your SC-200 certification journey!