SC-200 Certification Practice Question #101

Question

You have an Azure Sentinel deployment.
You need to query for all suspicious credential access activities.
Which three actions should you perform in sequence? To answer, move the appropriate actions from the list of actions to the answer area and arrange them in the correct order.
Select and Place:

Accepted Answer

MS Learn's hunting documentation describes exactly this flow: open Hunting, the built-in queries are grouped by MITRE ATT&CK tactic and can be filtered by tactic, then "Run all queries" to see how they apply to your environment. To find all suspicious credential-access activities you filter the tactic to Credential Access and run all queries — no custom "New Query" is needed. The two highest-voted comments (👍21 and the StaxJaxson 👍16 / rdy4u 👍15 pair) state this verbatim from live Sentinel. Lapatiser's "New Query" objection is a low-vote minority and is contradicted by practitioners testing in production, so confidence sits at 90.

More SC-200 practice questions