SC-200 Certification Practice Question #264

Question

You need to add notes to the events to meet the Azure Sentinel requirements.
Which three actions should you perform in sequence? To answer, move the appropriate actions from the list of action to the answer area and arrange them in the correct order.
Select and Place:

Accepted Answer

Adding notes to Sentinel events is done through hunting **bookmarks**. MS Learn's bookmarks procedure is an exact match for the three-step order: first run the query from within the Microsoft Sentinel (Azure Sentinel) workspace — not from Azure Monitor, because the docs explicitly state "You can't create bookmarks when the Logs pane is opened from another location, such as directly from Azure Monitor"; then select the query result row(s) you find interesting via the checkboxes; finally add the bookmark and map at least one entity (required to view it in the investigation graph and to record notes). The distractor tiles ("From Azure Monitor..." and "Add the query to favorites") are eliminated by that same documentation. The Highly Voted comment (15 👍) endorses the suggested answer and cites the exact Sentinel bookmarks article, giving strong agreement; confidence sits at 86% (no answer image, sequence inferred from Suggested Answer + docs).

More SC-200 practice questions