Question 30

Question

DRAG DROP You have an Azure Sentinel deployment. You need to query for all suspicious credential access activities. Which three actions should you perform in sequence? To answer, move the appropriate actions from the list of actions to the answer area and arrange them in the correct order. https://kxbjsyuhceggsyvxdkof.supabase.co/storage/v1/object/public/file-images/SC-200/page_76_img_1.jpg

Anita · Answer

That matches what I've seen in the official guide and some practice test walkthroughs. You start with Hunting in Azure Sentinel, then filter by tactics (to narrow to credential access), then hit Run All Queries for the results:From Azure Sentinel, select HuntingFilter by tacticsSelect Run All QueriesI think this is the most straightforward path but let me know if anyone's seen something different in live labs.

CalmArchitect1731 · Answer

From Azure Sentinel, select Hunting → Filter by tactics → Select Run All Queries. That's the sequence for quickly spotting suspicious credential access. Pretty sure that's what Microsoft expects but open to corrections if anyone's seen it differently in practice.

Avery N. · Answer

From Azure Sentinel, select Hunting → Filter by tactics → Select Run All Queries. That's the order for efficient threat searching here.

Daniel S. · Answer

Not convinced it's that order. Looks like it'd be: From Azure Sentinel, select Hunting → Select New Query → Filter by tactics. Feels like the filter comes after starting a new query, trap is skipping that step maybe.

HelpfulNeteng9334 · Answer

Looks like most exam reports point this way: start at Hunting, then filter by tactics, and finally Run All Queries. That's what Microsoft training and the official guide say too.From Azure Sentinel, select HuntingFilter by tacticsSelect Run All Queries

Microsoft SC-200 Security Operations Analyst Real Exam Questions [October 2026 Update] Quiz

Premium Access Includes