SC-200 Practice Question 3778
Exam: SC-200
Domain: Respond to security incidents
Difficulty: easy
What is the role of an entity in Microsoft Sentinel incident management?
Answer Options
A
Real-world assets (accounts, hosts, IPs, URLs) used to map and correlate threats
B
Hardware rack mounts in a physical data center
C
Software licenses purchased from Microsoft
D
Billing invoices generated by telecom providers
Correct Answer
A: Real-world assets (accounts, hosts, IPs, URLs) used to map and correlate threats
Explanation
Entities represent fundamental real-world assets (accounts, hosts, IP addresses, URLs, and file hashes) that Sentinel uses to map, correlate, and graph incident timelines.