SC-200 Certification Practice Question #113

Question

You need to visualize Azure Sentinel data and enrich the data by using third-party data sources to identify indicators of compromise (IoC).
What should you use?

Accepted Answer

The question pairs two requirements — visualize Sentinel data and enrich it with third-party sources to identify IoCs. Jupyter notebooks are the one Sentinel feature that does both: they reach beyond the workspace to integrate external/on-prem and threat-intelligence data, and they bring Python's full visualization and ML stack (pandas, matplotlib, MSTICPy). MS Learn explicitly lists "integrate data sources outside of Microsoft Sentinel" including "threat intelligence sources" and rich custom visualizations as the reasons to use notebooks. Suggested answer, unanimous community vote, and MS Learn all agree, so confidence is high.

More SC-200 practice questions