正解:C
To identify which anomaly rules are enabled in a Microsoft Sen tinel workspace (here, SW1), you look at the Sentinel analytics configuration in the portal. In Microsoft's documentation "Work with anomaly detection analytics rules in Microsoft Sentinel," it explains:
"You can now find anomaly rules displayed in a grid in the Anomalies tab in the Analytics page. ... On the Analytics page, select the Anomalies tab. ... Status - whether the rule is enabled or disabled." Microsoft Learn Thus, anomaly detection rules are a subtype of analytics rules in Sentinel, and they are surfaced under the Analytics area (in the Anomalies tab). That is where you can review which anomaly detection rules are active (enabled) or not.
By contrast:
* Settings is used for workspace-wide configurations (e.g. enabling UEBA, toggling anomalies on/off).
* Entity behavior is a separate feature (UEBA) for monitoring entities and their behavioral baselines, not the repository of which anomaly rules are enabled.
* Content hub is the repository of shared analytics templates and solutions you can import; it does not list which rules are enabled in your workspace.
Therefore, the correct place to review enabled anomaly detection rules is C. Analytics (speci fically under the Anomalies tab).