SC-200 Practice Question 3668
Exam: SC-200
Domain: Manage a security operations environment
Difficulty: easy
You are deploying Microsoft Sentinel. What is the fundamental Azure underlying architecture component required to host a Microsoft Sentinel instance?
Answer Options
A
An Azure Log Analytics workspace
B
An Azure SQL Managed Instance
C
An on-premises Active Directory Domain Services forest
D
An Azure Data Lake Storage Gen2 account
Correct Answer
A: An Azure Log Analytics workspace
Explanation
Microsoft Sentinel is a cloud-native SIEM/SOAR platform built on top of an Azure Log Analytics workspace, which provides the underlying data store, indexing, and KQL query engine.