Free SC-200 Web TestEngine Demo

Q45 Multiple choice

Your company stores the data of every project in a different Azure subscription. All the subscriptions use the same Microsoft Entra tenant.

Every project consists of multiple Azure virtual machines that run Windows Server. The Windows events of the virtual machines are stored in a Log Analytics workspace in each machine's respective subscription.

You deploy Microsoft Sentinel to a new Azure subscription.

You need to perform hunting queries in Microsoft Sentinel to search across all the Log Analytics workspaces of all the subscriptions.

Which two actions should you perform? Each correct answer presents part of the solution. NOTE: Each correct selection is worth one point.

Select all that apply.

A
Create a query that uses the resource expression and the alias operator.
B
Use the alias statement.
C
Add the Microsoft Sentinel solution to each workspace.
D
Create a query that uses the workspace expression and the union operator.
E
Add the Security Events connector to the Microsoft Sentinel workspace.

SC-200 Web TestEngine demo