You are configuring Azure Sentinel.
You need to send a Microsoft Teams message to a channel whenever a sign-in from a
suspicious IP address is detected.
Which two actions should you perform in Azure Sentinel? Each correct answer presents
part of the solution.
NOTE: Each correct selection is worth one point.

Note: This question is part of a series of questions that present the same scenario.
Each question in the series contains a unique solution that might meet the stated
goals. Some question sets might have more than one correct solution, while others
might not have a correct solution.
After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.
You are configuring Azure Sentinel.
You need to create an incident in Azure Sentinel when a sign-in to an Azure virtual
machine from a malicious IP address is detected.
Solution: You create a scheduled query rule for a data connector.
Does this meet the goal?

You have a Microsoft 365 E5 subscription that uses Microsoft 365 Defender.
You need to review new attack techniques discovered by Microsoft and identify vulnerable
resources in the subscription. The solution must minimize administrative effort
Which blade should you use in the Microsoft 365 Defender portal?

You have a Microsoft Sentinel workspace.
You need to create a KQL query that will identify successful sign-ins from multiple countries
during the last three hours.
How should you complete the query? To answer, select the appropriate options in the
answer area. 
NOTE Each correct selection is worth one point

You have resources in Azure and Google cloud.
You need to ingest Google Cloud Platform (GCP) data into Azure Defender.
In which order should you perform the actions? To answer, move all actions from the list of
actions to the answer area and arrange them in the correct order.

Your company has a single office in Istanbul and a Microsoft 365 subscription.
The company plans to use conditional access policies to enforce multi-factor authentication
(MFA).
You need to enforce MFA for all users who work remotely.
What should you include in the solution?

You have a Microsoft subscription that has Microsoft Defender for Cloud enabled You
configure the Azure logic apps shown in the following table.

You have a Microsoft 365 subscription that uses Microsoft Defender for Endpoint.
You need to add threat indicators for all the IP addresses in a range of 171.23.3432-
171.2334.63. The solution must minimize administrative effort.
What should you do in the Microsoft 365 Defender portal?