SC-200 Practice Question 3820
Exam: SC-200
Domain: Perform threat hunting
Difficulty: medium
In Microsoft Sentinel, what is the primary purpose of creating a Hunting Bookmark during an active threat hunting session?
Answer Options
A
Preserves KQL results, attaches notes/tags, and can be promoted to an incident
B
Saves websites in the Google Chrome favorites bar
C
Deletes matching records from Log Analytics
D
Encrypts user local documents with a password
Correct Answer
A: Preserves KQL results, attaches notes/tags, and can be promoted to an incident
Explanation
Hunting Bookmarks preserve interesting KQL query results, attach notes and tags, map entities, and allow analysts to promote the bookmark directly into a new or existing incident.