SC-200 Certification Practice Question #103

Question

Your company uses Azure Sentinel to manage alerts from more than 10,000 IoT devices.
A security manager at the company reports that tracking security threats is increasingly difficult due to the large number of incidents.
You need to recommend a solution to provide a custom visualization to simplify the investigation of threats and to infer threats by using machine learning.
What should you include in the recommendation?

Accepted Answer

The scenario asks for a *custom visualization* to simplify threat investigation **and** to *infer threats using machine learning*. Microsoft Sentinel notebooks (Jupyter on Azure Machine Learning) are the only feature that delivers both: they bundle Python libraries such as Matplotlib/Plotly for visualization and scikit-learn/TensorFlow for machine learning, letting analysts build bespoke timelines, process trees, and ML-based detections that aren't available out of the box. Built-in queries and livestream surface data but add no ML or custom visuals, and bookmarks merely flag interesting records during hunting. The unanimous community vote, the official suggested answer, and MS Learn all converge on notebooks.

More SC-200 practice questions