Microsoft · SC-500
Microsoft Sentinel
SC-500 · Lesson 14 of 15 · 1:31:54
YouTube loads only after you press play. This chapter opens at its timestamp in the full course. Watch on YouTube ↗
In this lesson
Prepare for the SC-500 exam (Microsoft Certified: Cloud and AI Security Engineer Associate). In this lesson: workspaces and roles, Azure, Syslog, CEF, and Windows event collection with data collection rules, custom tables and retention tiers, and automation rules and playbooks. Includes three original practice questions.
Preview the topics
- A team forwards domain controller events with Windows Event Forwarding, but the built-in rules that query SecurityEvent find nothing. Why?
- Firewall logs are huge, rarely queried, and must be kept for seven years for compliance. Where should they go?
- Every new high-severity incident about an executive must be assigned to the senior analyst automatically, and a Teams message sent. What should the team build?