SC-100 Certification Practice Question #139

Question

You have Microsoft Defender for Cloud assigned to Azure management groups.
You have a Microsoft Sentinel deployment.
During the triage of alerts, you require additional information about the security events, including suggestions for remediation.
Which two components can you use to achieve the goal? Each correct answer presents a complete solution.
NOTE: Each correct selection is worth one point.

Accepted Answer

MS Learn states almost verbatim that Defender for Cloud's threat intelligence report gives "information regarding the event, including suggestions for remediation," which directly satisfies the requirement, locking in C (and matching the official Suggested Answer). For the second component, Sentinel threat intelligence workbooks surface additional context about the security events/indicators during triage, making A a "complete solution" alongside C — this is the established community answer (Most Voted AC, 13 votes, backed by both Highly Voted comments). Notebooks (B) and workload protections (D) appear in low-vote minority picks but neither natively delivers remediation suggestions the way C does, so AC wins. Confidence is held at 84 rather than higher because the official Suggested Answer lists only C and there is a genuine, if weaker, community split toward B/D.

More SC-100 practice questions