Microsoft Certified: Security Operations Analyst Associate SC-200 Book

You need to restrict cloud apps running on CUENT1 to meet the Microsoft Defender for Endpoint requirements. Which two configurations should you modify? Each correct answer presents part of the solution. NOTE: Each correct selection is worth one point.

You need to assign a role-based access control (RBAC) role to admin1 to meet the Azure Sentinel requirements and the business requirements.

Which role should you assign?

You need to modify the anomaly detection policy settings to meet the Cloud App Security requirements. Which policy should you modify?

You have a Microsoft Sentinel workspace named SW1.

In SW1, you investigate an incident that is associated with the following entities:

• Host

• IP address

• User account

• Malware name

Which entity can be labeled as an indicator of compromise (loC) directly from the incident s page?