SC-200 Certification Practice Question #100

Question

From Azure Sentinel, you open the Investigation pane for a high-severity incident as shown in the following exhibit.

Use the drop-down menus to select the answer choice that completes each statement based on the information presented in the graphic.
NOTE: Each correct selection is worth one point.
Hot Area:

Accepted Answer

The exhibit shows the investigation graph with the vm1 host node connected to a "New processes ob[served]" exploration result — the running-processes exploration query you get by hovering the VM, which fixes Row 1. For Row 2, MS Learn states the Entities widget/tab lists "all the entities... the objects that played a role in the incident" and lets you select them to navigate to their full details, and the heavily upvoted comments (Haz56 👍24, plus several practitioners testing in production) converge unanimously on Entities. Confidence is held at 88 rather than higher because no formal Suggested/Most-Voted marker was captured and a small minority floated Info/Timeline for Row 2.

More SC-200 practice questions