Microsoft · SC-200
Identities and apps
SC-200 · Lesson 10 of 14 · 1:06:07
YouTube loads only after you press play. This chapter opens at its timestamp in the full course. Watch on YouTube ↗
In this lesson
Prepare for the SC-200 exam (Microsoft Certified: Security Operations Analyst Associate). In this lesson: Defender for Cloud Apps anomaly detection (impossible travel, risky OAuth apps), Microsoft Entra ID Protection (risk-based policies, dismissing or confirming risk, least privileged roles), Defender for Identity alerts and remediation through domain controller sensors, and Sentinel incidents with entity pages and UEBA anomalies. Includes three original practice questions.
Preview the topics
- A user cannot complete multifactor authentication, so the risk-based policy blocks every sign-in. The risk turns out to be a false positive. What should a Security Operator do?
- An analyst disables a compromised on-premises account from the Defender portal. Which component actually performs the action?
- During a Sentinel incident, an analyst wants to see whether the involved user behaved unusually over the past month. What must be enabled?