SC-200 Practice Question 3832
Exam: SC-200
Domain: Perform threat hunting
Difficulty: easy
You are hunting for compromised user accounts that exhibit impossible travel between physical locations. Which table in Microsoft Sentinel stores user interactive and non-interactive sign-in logs with geographic IP details?
Answer Options
A
The SigninLogs table
B
The Perf table
C
The Syslog table
D
The CommonSecurityLog table
Correct Answer
A: The SigninLogs table
Explanation
The SigninLogs table records user authentication telemetry, including LocationDetails (country, state, city) and IP addresses.