HOTSPOT - You have an Azure subscription that contains a Microsoft Sentinel workspace. You need to create a hunting query using Kusto Query Language (KQL) that meets the following requirements: • Identifies an anomalous number of changes to the rules of a network security group (NSG) made by the same security principal. • Automatically associates the security principal with a Microsoft Sentinel entity. How should you complete the query? To...

Questions › Category: SC-200 › HOTSPOT – You have an Azure subscription that contains a Microsoft Sentinel workspace. You need to create a hunting query using Kusto Query Language (KQL) that meets the following requirements: • Identifies an anomalous number of changes to the rules of a network security group (NSG) made by the same security principal. • Automatically associates the security principal with a Microsoft Sentinel entity. How should you complete the query? To…

0 Vote Up Vote Down

Admin Staff asked 4 months ago

HOTSPOT
-
You have an Azure subscription that contains a Microsoft Sentinel workspace.
You need to create a hunting query using Kusto Query Language (KQL) that meets the following requirements:
•	Identifies an anomalous number of changes to the rules of a network security group (NSG) made by the same security principal.
•	Automatically associates the security principal with a Microsoft Sentinel entity.
How should you complete the query? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
 
















 

Suggested Answer: 
    



This question is in SC-200 Exam
For getting Microsoft Security Operations Analyst Associate Certificate


Disclaimers:
The website is not related to, affiliated with, endorsed or authorized by Microsoft. 
The website does not contain actual questions and answers from Microsoft's Certification Exams.
Trademarks, certification & product names are used for reference only and belong to Microsoft.