Microsoft Security Operations Analyst — Question 8

You have an Azure subscription that uses Microsoft Sentinel.

You need to create a custom report that will visualise sign-in information over time.

What should you create first?

Answer options

• A. a hunting query
• B. a workbook
• C. a notebook
• D. a playbook

Correct answer: B

Explanation

The correct answer is B, a workbook, as it is specifically designed for visualizing and analyzing data over time in Microsoft Sentinel. The other options, such as hunting queries, notebooks, and playbooks, serve different purposes and are not intended for creating custom visual reports.