Absolute Free SC-200 Exam Practice for Comprehensive Preparation 

You need to ensure that you can run hunting queries to meet the Microsoft Sentinel requirements. Which type of workspace should you create?

You have a Microsoft Sentinel workspace named SW1. In SW1, you investigate an incident that is associated with the following entities: Host IP address User account Malware name Which entity can be labeled as an indicator of compromise (loC) directly from the incident s page?

You have a Microsoft 365 E5 subscription that contains a device named Device 1. Device 1 is enrolled in Microsoft Defender for End point. Device1 reports an incident that includes a file named File1 exe as evidence. You initiate the Collect Investigation Package action and download the ZIP file. You need to identify the first and last time File1.exe was executed. What should you review in the investigation package? 

You need to assign a role-based access control (RBAC) role to admin1 to meet the Azure Sentinel requirements and the business requirements. Which role should you assign?