SC-200 Certification Practice Question #143

Question

You have a Microsoft Sentinel workspace.

You enable User and Entity Behavior Analytics (UEBA) by using Audit Logs and Signin Logs.

The following entities are detected in the Azure AD tenant:

•	App name: App1
•	IP address: 192.168.1.2
•	Computer name: Device1
•	Used client app: Microsoft Edge
•	Email address: user1@company.com
•	Sign-in URL: https://www.company.com

Which entities can be investigated by using UEBA?

Accepted Answer

Both the official Suggested Answer and the community Most Voted (9 votes, plus `Highly Voted` donathon) select B, and MS Learn confirms UEBA profiles users, hosts, IP addresses, and applications — covering app name, computer name (host), IP address, email address (account), and used client app, while the Sign-in URL is excluded. The dissenting view (A) is well-reasoned: because the scenario enables UEBA using only Audit Logs and Sign-in Logs, those two sources realistically surface IP and email, and the other entities would normally arrive via additional connectors. This is a genuine exam-wording ambiguity (capability of UEBA entity types vs. what these two specific log sources populate), so confidence is held at 78 — B is the answer the exam key and majority back, but the minority objection is legitimate and the question is contested.

More SC-200 practice questions