StudyByteLearn
← SC-100: Microsoft Cybersecurity Architect
SC-100 · Security operations detection and response

Practice question 82 of 498 · hard

A Sentinel query against DeviceTvmSoftwareVulnerabilities returns no rows although Defender advanced hunting has results and incident synchronization works. What should the architect verify first?

Choose the single best answer.

  1. A.Whether selecting the table in the query editor alone enables its data collection
  2. B.Whether incident synchronization alone guarantees that every Defender advanced-hunting table is copied
  3. C.Whether increasing retention populates every table displayed in the schema
  4. D.Whether that raw table is supported for Sentinel ingestion
Show the answer and explanation

✓ Correct answer

  • Whether that raw table is supported for Sentinel ingestion

Verify supported raw-table ingestion first: TVM tables can appear in the Sentinel schema without ingested data. Incident synchronization does not copy every advanced-hunting table, selecting a schema table does not enable collection, and longer retention cannot create unsupported or uncollected data.

Read the source reference

Read and review here, or open the app to practise and save your results on this device.

Practise in the app

Unofficial study material. Not affiliated with or endorsed by Microsoft. These are original learning questions, not actual exam questions. Product capabilities and exam objectives can change; verify current Microsoft documentation. Practice scores do not predict or guarantee an exam result.