SC-100 Certification Practice Question #119

Question

You have a Microsoft 365 subscription that is protected by using Microsoft 365 Defender.

You are designing a security operations strategy that will use Microsoft Sentinel to monitor events from Microsoft 365 and Microsoft 365 Defender.

You need to recommend a solution to meet the following requirements:

•	Integrate Microsoft Sentinel with a third-party security vendor to access information about known malware.
•	Automatically generate incidents when the IP address of a command-and-control server is detected in the events.

What should you configure in Microsoft Sentinel to meet each requirement? To answer, select the appropriate options in the answer area.

NOTE: Each correct selection is worth one point.

Accepted Answer

Two requirements map to two Sentinel features. To access a third-party vendor's known-malware intelligence, you enable a Threat Intelligence (data) connector — MS Learn lists the Threat Intelligence/TAXII connectors as the mechanism that imports indicators from external feeds. To automatically raise an incident when a known command-and-control IP appears in events, you build a scheduled query (analytics) rule of the "TI map IP entity" form: MS Learn states these scheduled rules match IP-type indicators against ingested events and, on a match, generate an alert and a corresponding incident. The Highly Voted comment (10 👍) names exactly this pair and explicitly rejects playbooks (which automate response, not incident creation). The only dissent swaps the scheduled rule for a playbook, which is mechanically wrong for the "automatically generate incidents" requirement. Confidence is 88% (HOTSPOT confidently resolved with strong community + MS Learn agreement and only a weak minority dissent).

More SC-100 practice questions