You have a Microsoft Sentinel workspace.
You investigate an incident that has the following entities:
•	A user account named User1
•	An IP address of 192.168.10.200
•	An Azure virtual machine named VM1
•	An on-premises server named Server1
You need to label an entity as an indicator of compromise (IoC) directly by using the incidents page.
Which entity can you label?

A. 192.168.10.200

B. VM1

C. Server1

D. User1








 

Suggested Answer: A



This question is in SC-200 Exam
For getting Microsoft Security Operations Analyst Associate Certificate


Disclaimers:
The website is not related to, affiliated with, endorsed or authorized by Microsoft. 
The website does not contain actual questions and answers from Microsoft's Certification Exams.
Trademarks, certification & product names are used for reference only and belong to Microsoft.