SC-200 Practice Question 3826
Exam: SC-200
Domain: Perform threat hunting
Difficulty: easy
How are Microsoft Sentinel pre-built hunting queries mapped to industry-standard adversary tactics and techniques?
Answer Options
A
Mapped directly to the MITRE ATT&CK framework matrix
B
Organized alphabetically by analyst first name
C
Sorted by the file size of the query text
D
Ranked according to Azure subscription billing costs
Correct Answer
A: Mapped directly to the MITRE ATT&CK framework matrix
Explanation
Pre-built hunting queries are mapped directly to the MITRE ATT&CK framework matrix, allowing analysts to filter hunting hypotheses by specific tactics (e.g., Persistence, Lateral Movement).