Planning and Administering Microsoft Azure for SAP Workloads — Question 70

You have an Azure subscription named Sub1 that contains a Microsoft Sentinel workspace named Workspace1.

You have an SAP RISE managed workload that is integrated with Sub1.

You implement the Microsoft Sentinel solution for SAP applications in Workspace1.

You need to designate specific users in the managed workload as sensitive. The solution must minimize administrative effort.

What should you use?

Answer options

• A. an analytics rule
• B. a watchlist
• C. a threat intelligence indicator
• D. a hunting query

Correct answer: B

Explanation

Using a watchlist is the most efficient way to designate specific users as sensitive since it allows for easy management and updates with minimal administrative effort. The other options, such as analytics rules and hunting queries, do not provide a straightforward method for marking users, and threat intelligence indicators are typically used for external threats rather than internal user classification.