You have a Microsoft Sentinel workspace named SW1.
In SW1, you investigate an incident that is associated with the following entities:
•	Host
•	IP address
•	User account
•	Malware name
Which entity can be labeled as an indicator of compromise (IoC) directly from the incident's page?

A. malware name

B. host

C. user account

D. IP address








 

Suggested Answer: D



This question is in SC-200 Exam
For getting Microsoft Security Operations Analyst Associate Certificate


Disclaimers:
The website is not related to, affiliated with, endorsed or authorized by Microsoft. 
The website does not contain actual questions and answers from Microsoft's Certification Exams.
Trademarks, certification & product names are used for reference only and belong to Microsoft.