sc-900 Practice Question 1798
Exam: sc-900
Domain: Describe the capabilities of Microsoft security solutions
Topic: Describe Microsoft Defender and Sentinel
Difficulty: medium
At Contoso Ltd, you have been tasked with creating a new Microsoft Sentinel Analytics rule to detect potential insider threats. The rule should identify unusual activity within the organization’s network. Which of the following approaches would you recommend for creating this rule? Explain your choice and why the other options are not suitable.
Answer Options
A
Use pre-built insider threat detection rules provided by Microsoft Sentinel.
B
Create a custom KQL query to analyze network traffic and apply anomaly detection logic.
C
Deploy machine learning models to automatically detect insider threats.
D
Manually monitor network traffic for unusual activity.
Correct Answer
B: Create a custom KQL query to analyze network traffic and apply anomaly detection logic.
Explanation
The correct answer is B. Create a custom query in KQL (Kusto Query Language) to analyze network traffic and identify anomalies. This can be done by querying the Network Watcher logs or other relevant data sources in Azure Monitor and applying anomaly detection logic. Option A is incorrect because it suggests using pre-built rules which may not capture the specific insider threat behavior. Option C is incorrect as it refers to using machine learning models without first defining the query criteria. Option D is incorrect as it suggests using manual monitoring which is not scalable and time-consuming.