SC-100 Certification Practice Question #81

Question

You have a Microsoft 365 subscription that is protected by using Microsoft 365 Defender.

You are designing a security operations strategy that will use Microsoft Sentinel to monitor events from Microsoft 365 and Microsoft 365 Defender.

You need to recommend a solution to meet the following requirements:

•	Integrate Microsoft Sentinel with a third-party security vendor to access information about known malware.
•	Automatically generate incidents when the IP address of a command-and-control server is detected in the events.

What should you configure in Microsoft Sentinel to meet each requirement? To answer, select the appropriate options in the answer area.

NOTE: Each correct selection is worth one point.

Accepted Answer

Requirement 1 is to integrate Sentinel with a third-party vendor to access known-malware intelligence — that is the job of a threat intelligence (data) connector, which imports indicators from external TI platforms/feeds, per MS Learn. Requirement 2 is to automatically generate incidents when a command-and-control IP is seen in events — that is an indicator-based analytics / threat detection rule (e.g. "TI map IP entity to..."), which matches ingested IP indicators against event data and, on a match, raises an alert that in turn generates an incident. The dominant 27-👍 Highly Voted answer, the Most Recent comment, and MS Learn all agree. The minority "playbook" view is correctly discounted because playbooks perform automated response (SOAR) after an incident exists, not feed ingestion or detection. Confidence is set at HOTSPOT-confident (89) rather than higher because there is no official Suggested Answer in the file and a small dissent exists.

More SC-100 practice questions