Microsoft Security Operations Analyst (SC-200)

You have a third - party security information and event management (SIEM) solution. You need to ensure that the SIEM solution can generate alerts for Azure Active Directory (Azure AD) sign - in events in near real time. What should you do to route events to the SIEM solution?

Note: This section contains one or more sets of questions with the same scenario and problem. Each question presents a unique solution to the problem. You must determine whether the solution meets the stated goals. More than one solution in the set might solve the problem. It is also possible that none of the solutions in the set solve the problem.

After you answer a question in this section, you will NOT be able to return. As a result, these questions do not appear on the Review Screen.

You have a Microsoft 365 subscription.

You have 1,000 Windows devices that have a third-party antivirus product installed and Microsoft Defender Antivirus in passive mode.

All Windows devices are onboarded to Microsoft Defender for Endpoint.

You need to ensure that the devices are protected from malicious artifacts that were undetected by the third-party antivirus product.

Solution: You enable Live Response.

Does this meet the goal?

After you answer a question in this section, you will NOT be able to return to it. As a result,

You are configuring Microsoft Defender for Identity integration with Active Directory.

From the Microsoft Defender for Identity portal, you need to configure several accounts for attacker

Solution: You add each account as a Sensitive account.

Does this meet the goal?

You have a Microsoft 365 E5 subscription that uses Microsoft Defender XDR.

You discover a malicious process that was initiated by a file named File1.exe on a device named Device1.

You need to create a KQL query that will identify when File1.exe was created. The solution must meet the following requirements:

• Return the FileName, InitiatingProcessFileName, and InitiatingProcessCommandLine columns.
• Minimize the volume of data returned.

How should you complete the query? To answer, select the appropriate options in the answer area.

NOTE: Each correct selection is worth one point.

Your company has a single office in Istanbul and a Microsoft 365 subscription.

The company plans to use conditional access policies to enforce multi - factor authentication (MFA).

You need to enforce MFA for all users who work remotely. What should you include in the solution?

You have a Microsoft 365 subscription that contains a Windows device named Device1. Device1 is onboarded to Microsoft Defender for Endpoint.

You initiate a live response session on Device1.

You need to execute a long running script. The solution must ensure that you can run additional commands during the session while the script is running.

How should you complete the live response command? To answer, select the appropriate options in the answer area.

NOTE: Each correct selection is worth one point.

You are configuring Microsoft Cloud App Security.

You have a custom threat detection policy based on the IP address ranges of your company's United States - based offices. You receive many alerts related to impossible travel and sign - ins from risky IP addresses.

You determine that 99 % of the alerts are legitimate sign - ins from your corporate offices.

You need to prevent alerts for legitimate sign - ins from known locations.

Which two actions should you perform? Each correct answer presents part of the solution.

NOTE: Each correct selection is worth one point.

You have a Microsoft 365 E5 subscription that contains a device named Device1.

From the Microsoft Defender portal, you discover that an alert was triggered for Device1.

From the Device inventory page, you isolate Device1.

You need to collect a list of installed programs on Device1.

What should you do?

You have 50 on-premises servers that run Windows Server and are Azure-Arc enabled.

You have an Azure subscription named Sub1 that contains a Microsoft Sentinel workspace named WS1 and 200 virtual machines that run Windows Server.

You collect Windows Security events from all the Windows servers.

You need to lower the data ingestion costs of Sub1. The solution must meet the following requirements:

• Implement a centrally managed configuration that can be reused across Azure and non-Azure servers.
• Ensure that successful sign-in and sign-out events are ingested.
• Minimize administrative effort.

What should you do?

You have an Azure subscription named Sub1 and a Microsoft 365 subscription. Sub1 is linked to an Azure Active Directory (Azure AD) tenant named contoso.com.

You create an Azure Sentinel workspace named workspace 1. In workspace1, you activate an Azure AD connector for contoso.com and an Office 365 connector for the Microsoft 365 subscription.

You need to use the Fusion rule to detect multi - staged attacks that include suspicious sign - ins to contoso.com followed by anomalous Microsoft Office 365 activity.

Which two actions should you perform? Each correct answer presents part of the solution. NOTE: Each correct selection is worth one point.

You have a Microsoft 365 E5 subscription that contains a device named Device1.

From the Microsoft Defender portal, you discover that an alert was triggered for Device1.

From the Device inventory page, you isolate Device1.

You need to collect a list of installed programs on Device1.

What should you do?

You have an Azure subscription that contains a Microsoft Sentinel workspace and 60 virtual machines that run Windows Server.

You need to create a data collection rule (DCR) that only ingests a specific event ID from the servers. The solution must minimize administrative effort.

What should you use?

You need to complete the query for failed sign - ins to meet the technical requirements.

Where can you find the column name to complete the where clause?

You have a query that contains the following statements.

You need to configure a custom detection rule that will use the query. The solution must minimize how long it takes to be notified about events that match the query.

Which frequency should you select for the rule?

You have a Windows 11 device named Device1 that is onboarded to Microsoft Defender for Endpoint and has tamper protection enabled.

You are investigating a potential threat on Device1.

You enable troubleshooting mode for Device1.

You need to temporarily disable tamper protection on Device1.

Which PowerShell command should you run on Device1?

You create an Azure subscription.

You enable Azure Defender for the subscription.

You need to use Azure Defender to protect on-premises computers. What should you do on the on-premises computers?

You have an Azure subscription named Sub1 that contains the resources shown in the following table.

 

You plan to configure Rule1 to trigger Lapp1 when an incident is generated.

You need to recommend the role-based access control (RBAC) role that you should assign to WS1, and the scope at which should you assign the role. The solution must follow the principle of least privilege.

What should you recommend? To answer, select the appropriate options in the answer area.

NOTE: Each correct selection is worth one point.

You have a Windows 11 device named Device1 that is onboarded to Microsoft Defender for Endpoint.

You start a live response session on Device1 to collect a suspicious executable named update.exe in a folder named C:\Users\Public\Downloads. When you attempt to download the file directly during the session, you receive an error message indicating that the file cannot be accessed.

You need to ensure that you can retrieve update.exe by using the live response session.

What should you do first?

A security administrator receives email alerts from Azure Defender for activities such as potential malware uploaded to a storage account and potential successful brute force attacks.

The security administrator does NOT receive email alerts for activities such as antimalware action failed and suspicious network activity. The alerts appear in Azure Security Center.

You need to ensure that the security administrator receives email alerts for all the activities. What should you configure in the Security Center settings?

You have a Microsoft Sentinel workspace that has a default data retention period of 30 days. The workspace contains two custom tables as shown in the following table.

 

Each table ingested two records per day during the past 365 days.

You build KQL statements for use in analytic rules as shown in the following table.

 

For each of the following statements, select Yes if the statement is true. Otherwise, select No.

NOTE: Each correct selection is worth one point.

You have a Microsoft Sentinel workspace that contains a custom workbook named Workbook1.

You need to create a visual in Workbook1 that will display the logon count for accounts that have logon event IDs of 4624 and 4634.

How should you complete the query? To answer, select the appropriate options in the answer area.

NOTE: Each correct selection is worth one point.

You plan to create a data loss prevention (DLP) policy that will be used with insider risk management. The severity level is set to Low. You need to ensure that insider risk management alerts are generated from rules in the DLP policies.

What should you do?

You have a Microsoft 365 subscription that uses Microsoft Copilot for Security.

You create a promptbook named Book1.

For Book1, you need to create a prompt that contains an input named IncidentID.

How should you format IncidentID?

You have a Microsoft 365 subscription that uses Microsoft Defender for Endpoint and contains a user named User1 and a Microsoft 365 group named Group1. All users are assigned a Microsoft Defender for Endpoint Plan 1 license.

You enable Microsoft Defender XDR Unified role-based access control (RBAC) for Endpoints & Vulnerability Management.

You need to ensure that User1 can configure alerts that will send email notifications to Group1. The solution must follow the principle of least privilege.

Which permissions should you assign to User1?

You use Azure Security Center; you receive a security alert in Security Center. You need to view recommendations to resolve the alert in Security Center. What should you do?

Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.

After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.

You have an Azure subscription that uses Microsoft Defender XDR.

From the Microsoft Defender portal, you perform an audit search and export the results as a file named File1.csv that contains 10,000 rows.

You use Microsoft Excel to perform Get & Transform Data operations to parse the AuditData column from File1.csv. The operations fail to generate columns for specific JSON properties.

You need to ensure that Excel generates columns for the specific JSON properties in the audit search results.

Solution: From Excel, you apply filters to the existing columns in File1.csv to reduce the number of rows, and then you perform the Get & Transform Data operations to parse the AuditData column.

Does this meet the requirement?

You have a Microsoft 365 subscription that uses Microsoft Defender XDR and contains a Windows device named Device1.

The timeline of Device1 includes three files named File1.ps1, File2.exe, and File3.dll.

You need to submit files for deep analysis in Microsoft Defender XDR.

Which files can you submit?

You have Linux virtual machines on Amazon Web Services (AWS).

You deploy Azure Defender and enable auto - provisioning. You need to monitor the virtual machines by using Azure Defender.

Solution: You enable Azure Arc and onboard the virtual machines to Azure Arc.

Does this meet the goal?

You have an Azure subscription that uses Microsoft Sentinel.

You need to minimize the administrative effort required to respond to the incidents and remediate the security threats detected by Microsoft Sentinel.

Which two features should you use? Each correct answer presents part of the solution.

NOTE: Each correct selection is worth one point.

You have an Azure subscription named Sub1 that uses Microsoft Defender for Cloud.

You need to assign a custom recommendation to Sub1 and have the recommendation displayed in the Defender for Cloud Regulatory compliance dashboard.

From Security policies in the Environment settings, you discover that the option to create a custom recommendation is unavailable.

What should you do first?

You need to restrict cloud apps running on CLIENT1 to meet the Microsoft Defender for Endpoint requirements.

Which two configurations should you modify? Each correct answer presents part of the solution.

NOTE. Each correct selection is worth one point.

You have a Microsoft 365 E5 subscription that uses Microsoft Defender XDR.

You have a Microsoft Sentinel workspace.

Microsoft Sentinel connectors are configured as shown in the following table.

 

You use Microsoft Sentinel to investigate suspicious Microsoft Graph API activity related to Conditional Access policies.

You need to search for the following activities:

• Downloads of the Conditional Access policies by using PowerShell
• Updates to the Conditional Access policies by using the Microsoft Entra admin center

Which tables should you query for each activity? To answer, select the appropriate options in the answer area.

NOTE: Each correct selection is worth one point.

You have a Microsoft 365 subscription that contains a user named User1.

User1 is suspected of exfiltrating sensitive files, which triggers an investigation in Microsoft Purview.

You need to perform the following actions as part of the investigation:

• Build a content search by using keywords, file types, dates, and grouped conditions.
• Review hit counts, locations, and sample results before adding items to scope.

What should you use for each action? To answer, drag the appropriate features to the correct actions. Each feature may be used once, more than once, or not at all. You may need to drag the split bar between panes or scroll to view content.

NOTE: Each correct selection is worth one point.

You need to complete the query for failed sign-ins to meet the technical requirements. Where can you find the column name to complete the where clause?

You have an Azure subscription named Sub1 that contains a resource group named RG1. RG1 contains two Azure key vaults named KV1 and KV2 that use Azure role-based access control (Azure RBAC).

The subscription contains the users shown in the following table.

 

KV1 contains a secret named Secret1. KV2 contains a secret named Secret2.

Which users can read the values of each secret? To answer, select the appropriate options in the answer area.

NOTE: Each correct selection is worth one point.

You have a Microsoft Sentinel workspace that is connected to the Microsoft Sentinel data lake.

Newly ingested data can take up to 15 minutes to become queryable in the data lake.

You schedule an hourly KQL job named Job1 that unions CommonSecurityLog across three workspaces and promotes the results to the analytics tier.

You need to configure Job1 to run every hour. The solution must minimize the risk of missing events that are still being ingested into the data lake.

What should you do?

You need to restrict cloud apps running on CLIENT1 to meet the Microsoft Defender for Endpoint requirements.

Which two configurations should you modify? Each correct answer present part of the solution.

NOTE: Each correct selection is worth one point.

You have an on-premises Linux server that runs a background process named App1 and has the Azure Connected Machine agent installed.

You have a Microsoft Sentinel workspace named WS1.

You need to configure a data collection rule (DCR) named DCR1 that will use the Syslog via AMA connector to collect messages related to App1. The solution must meet the following requirements:

• Only collect messages that have a priority level of critical.
• Minimize the volume of data collected.

Which facility and log level should you configure for DCR1? To answer, select the appropriate options in the answer area.

NOTE: Each correct selection is worth one point.

Your company uses Teams.

You need to configure Teams to meet the following requirements:

• The Teams client must display the Avatars app for all users.
• The Games for Work app must be unavailable in the Teams client.
• Users must be prevented from unpinning and rearranging apps in the Teams client.

Which type of policy should you configure for each requirement? To answer, drag the appropriate policy types to the correct requirements. Each policy type may be used once, more than once, or not at all. You may need to drag the split bar between panes or scroll to view content.

NOTE: Each correct selection is worth one point.

You are configuring Microsoft Cloud App Security.

You have a custom threat detection policy based on the IP address ranges of your company’s United States- based offices.

You receive many alerts related to impossible travel and sign-ins from risky IP addresses. You determine that 99% of the alerts are legitimate sign-ins from your corporate offices. You need to prevent alerts for legitimate sign-ins from known locations.

Which two actions should you perform? Each correct answer presents part of the solution.

NOTE: Each correct selection is worth one point.

You have a Microsoft 365 subscription.

You need to identify all the security principals that submitted requests to change or delete groups.

How should you complete the KQL query? To answer, select the appropriate options in the answer area.

NOTE: Each correct selection is worth one point.

You have a Microsoft 365 subscription that uses Microsoft Teams and contains a user named User 1.

You have the following Microsoft Teams team templates:

• Manage an Event
• Manage a Project
• Quality and Safety
• Onboard Employees

You have the Microsoft Teams template policies shown in the following table.

The Templates policy settings for User1 are configured as shown in the following exhibit.

Note: This question is part of a series of questions that present the same scenario. Each question in

the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.

After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.

You are configuring Microsoft Defender for Identity integration with Active Directory.

From the Microsoft Defender for identity portal, you need to configure several accounts for attackers to exploit.

Solution: You add each account as a Sensitive account. Does this meet the goal?

You have an Azure subscription name Sub1 that is linked to a Microsoft Entra tenant named contoso.com. Sub1 contains a Log Analytics workspace named Workspace1. All the logs from contoso.com are streamed to Workspace1.

You have a Microsoft 365 E5 subscription.

You need to query Workspace1 for the following:

• HTTP requests to the Microsoft Graph service of contoso.com
• Third-party app sign-in activities that use certificates or secrets

How should you complete the KQL query? To answer, select the appropriate options in the answer area.

NOTE: Each correct selection is worth one point.

You have a Microsoft 365 subscription that uses Microsoft Defender XDR and contains a user named User1.

You need to ensure that User1 can identify endpoint vulnerabilities on devices affected by a security incident. The solution must NOT require that User1 have KQL knowledge.

Which three actions should User1 perform in the Microsoft Defender portal in sequence? To answer, move the appropriate actions from the list of actions to the answer area and arrange them in the correct order.

You have a Microsoft 365 tenant that uses Microsoft Exchange Online and Microsoft Defender for Office 365.

What should you use to identify whether zero-hour auto purge (ZAP) moved an email message from the mailbox of a user?

You have an Azure subscription that contains a Microsoft Sentinel workspace named WS1.

You create a hunting query that detects a new attack vector. The attack vector maps to a tactic listed in the MITRE ATT&CK database.

You need to ensure that an incident is created in WS1 when the new attack vector is detected.

What should you configure?

You have a Microsoft Sentinel workspace named Workspace1 that is connected to the Microsoft Defender portal.

You perform the following actions:

• Configure the Log Analytics workspace diagnostic setting to collect query audit data into a table named LAQueryLogs in Workspace1.
• Enable the User and Entity Behavior Analytics (UEBA) behavior layers and confirm that behavior records are being generated and stored in the SentinelBehaviorInfo and SentinelBehaviorEntities tables in Workspace1.

You need to create an advanced hunting query that meets the following requirements:

• Returns UEBA behaviors that were generated by Microsoft Sentinel during the last 24 hours
• Includes the user principal name (UPN) associated with each behavior
• Returns the behavior row, even when there is no UPN associated

How should you complete the KQL query? To answer, select the appropriate options in the answer area.

You have a Microsoft 365 subscription that contains 1,000 Windows 10 devices. The devices have Microsoft Office 365 installed.

You need to mitigate the following device threats:

What should you use?

You have on-premises servers that run Windows Server.

You have a Microsoft Sentinel workspace named SW1. SW1 is configured to collect Windows Security log entries from the servers by using the Azure Monitor Agent data connector.

You plan to limit the scope of collected events to events 4624 and 4625 only.

You need to use a PowerShell script to validate the syntax of the filter applied to the connector.

How should you complete the script? To answer, select the appropriate options in the answer area.

NOTE: Each correct selection is worth one point.

You have an Azure subscription that contains a Microsoft Sentinel workspace named WS1.

WS1 has the Azure Activity and the Microsoft Entra ID data connectors configured.

You need to investigate which accounts have the most alerts and any corresponding incident information for each alert. The solution must minimize administrative effort.

What should you do first in WS1?

You have a third-party security information and event management (SIEM) solution.

You need to ensure that the SIEM solution can generate alerts for Azure Active Directory (Azure AD) sign- events in near real time.

What should you do to route events to the SIEM solution?

You have an Azure subscription named Sub1 that is linked to a Microsoft Entra tenant named contoso.com. Contoso.com contains a user named User1. Sub1 contains a Microsoft Sentinel workspace.

You provision a Microsoft Copilot for Security capacity.

You need to ensure that User1 can use Copilot for Security to perform the following tasks:

• Update the data sharing and feedback options.
• Investigate Microsoft Sentinel incidents.

The solution must follow the principle of least privilege.

Which role should you assign to User1 for each task? To answer, select the appropriate options in the answer area.

NOTE: Each correct selection is worth one point.

You have a Microsoft Sentinel workspace named Workspace1.

In Workspace1, you plan to create an auxiliary table that will contain five columns. The columns will store data collected from Linux-based appliances.

You need to perform the following actions:

• Create the table.
• Send data to the table.

The solution must minimize administrative effort.

What should you use to perform each action? To answer, select the appropriate options in the answer area.

You have an Azure subscription linked to an Azure Active Directory (Azure AD) tenant. The tenant contains two users named User1 and User2.

You plan to deploy Azure Defender.

You need to enable User1 and User2 to perform tasks at the subscription level as shown in the following table.

The solution must use the principle of least privilege.

Which role should you assign to each user? To answer, drag the appropriate roles to the correct users. Each role may be used once, more than once, or not at all. You may need to drag the split bar between panes or scroll to view content.

Select and Place:

Note: This section contains one or more sets of questions with the same scenario and problem. Each question presents a unique solution to the problem. You must determine whether the solution meets the stated goals. More than one solution in the set might solve the problem. It is also possible that none of the solutions in the set solve the problem.

After you answer a question in this section, you will NOT be able to return. As a result, these questions do not appear on the Review Screen.

You have a Microsoft 365 subscription.

You have 1,000 Windows devices that have a third-party antivirus product installed and Microsoft Defender Antivirus in passive mode.

You need to ensure that the devices are protected from malicious artifacts that were undetected by the third-party antivirus product.

Solution: You configure endpoint detection and response (EDR) in block mode.

Does this meet the goal?

You have a Microsoft 365 subscription that uses Microsoft Defender XDR.

You need to create a custom detection rule that will identify devices that had more than five antivirus detections within the last 24 hours.

How should you complete the query? To answer, select the appropriate options in the answer area.

NOTE: Each correct selection is worth one point.

You have a Microsoft 365 E5 subscription that contains 200 Windows 10 devices enrolled in Microsoft Defender for Endpoint.

You need to ensure that users can access the devices by using a remote shell connection directly from the Microsoft 365 Defender portal. The solution must use the principle of least privilege.

What should you do in the Microsoft 365 Defender portal? To answer, select the appropriate options in the answer area.

NOTE: Each correct selection is worth one point.

Hot Area:

You have a Microsoft Sentinel workspace.

You are investigating an incident that involves the following entities:

• A host named Host1

• A user account named User1

• An IP address of 175.45.176.99

You need to update the threat intelligence list to include the entities.

Which entities can you add on the Incident page?

You have 200 on-premises servers that run Linux.

You have a Microsoft Sentinel workspace named Workspace1.

You plan to collect Syslog events in the Common Event Format (CEF) from the servers and ingest them into Workspace1 by using the Log Ingestion API in Azure Monitor.

You need to configure a data collection rule (DCR) for the events by using an API request.

How should you complete the API request? To answer, select the appropriate options in the answer area.

NOTE: Each correct selection is worth one point.

You have an Azure Storage account that will be accessed by multiple Azure Function apps during the development of an application.

You need to hide Azure Defender alerts for the storage account.

Which entity type and field should you use in a suppression rule? To answer, select the appropriate options in the answer area.

NOTE: Each correct selection is worth one point.

Hot Area:

You have an Azure subscription that contains a Microsoft Sentinel workspace named Workspace1 and a user named User1.

You need to ensure that User1 can investigate incidents by using Workspace1. The solution must follow the principle of least privilege.

Which role should you assign to User1?

You have four Azure subscriptions. One of the subscriptions contains a Microsoft Sentinel workspace.

You need to deploy Microsoft Sentinel data connectors to collect data from the subscriptions by using Azure Policy. The solution must ensure that the policy will apply to new and existing resources in the subscriptions.

Which type of connectors should you provision, and what should you use to ensure that all the resources are monitored? To answer, select the appropriate options in the answer area.

NOTE: Each correct selection is worth one point.

You have an Azure Functions app that generates thousands of alerts in Azure Security Center each day for normal activity.

You need to hide the alerts automatically in Security Center.

Which three actions should you perform in sequence in Security Center? Each correct answer presents part of the solution.

NOTE: Each correct selection is worth one point.

Select and Place:

You have a Microsoft 365 E5 subscription.

You need to configure Microsoft Defender XDR automatic attack disruption to use signals generated by Microsoft Defender for Cloud Apps.

Which two actions should you perform for Defender for Cloud Apps in the Microsoft Defender portal? Each correct answer presents part of the solution.

NOTE: Each correct selection is worth one point.

You have a Microsoft 365 subscription that uses Microsoft Purview and contains a Microsoft Teams team named Team1.

You are investigating a suspected leak of internal credentials via messages and shared files in Teams chats.

You need to create a content search that returns content from the private and shared channels of Team1.

What should you include in the content search for each type of channel? To answer, select the appropriate options in the answer area.

NOTE: Each correct selection is worth one point.

You have an Azure subscription.

You need to delegate permissions to meet the following requirements:

Enable and disable Azure Defender.

Apply security recommendations to resource.

The solution must use the principle of least privilege.

Which Azure Security Center role should you use for each requirement? To answer, drag the appropriate roles to the correct requirements. Each role may be used once, more than once, or not at all. You may need to drag the split bar between panes or scroll to view content.

NOTE: Each correct selection is worth one point.

Select and Place:

You have a Microsoft 365 E5 subscription.

You have a PowerShell script that queries the unified audit log.

You discover that the query returns only the first page of results due to server-side paging.

You need to ensure that you get all the results.

Which property should you query in the results?

You have a Microsoft Sentinel workspace that is connected to the Microsoft Defender portal.

You have an advanced hunting query based on BehaviorInfo that returns the User and Entity Behavior Analytics (UEBA) behavior records, but the associated user principal name (UPN) is missing because the behavior records include multiple types of entities.

You need to correlate each behavior to the behavior record returned by the query.

What should you configure? To answer, select the appropriate options in the answer area.

NOTE: Each correct selection is worth one point.

You have an Azure subscription that uses Azure Defender.

You plan to use Azure Security Center workflow automation to respond to Azure Defender threat alerts. You need to create an Azure policy that will perform threat remediation automatically.

What should you include in the solution? To answer, select the appropriate options in the answer area.

NOTE: Each correct selection is worth one point.

Hot Area:

You have a Microsoft 365 E5 subscription and a Microsoft Sentinel workspace.

You need to create a KQL query that will combine data from the following sources:

• Microsoft Graph
• Risky users detected by using Microsoft Entra ID Protection

The solution must minimize the volume of data returned.

How should the query start?

You are investigating an incident in Microsoft Defender XDR for a simulated fileless PowerShell attack. The incident contains correlated alerts from Microsoft Defender for Endpoint and Microsoft Defender for Identity.

You need to identify the following:

• A list of devices that were affected by the incident
• A timeline of the incident

The solution must minimize administrative effort.

You have an Azure subscription that contains a virtual machine named VM1 and uses Azure Defender. Azure Defender has automatic provisioning enabled.

You need to create a custom alert suppression rule that will supress false positive alerts for suspicious use of PowerShell on VM1.

What should you do first?

You have an Azure subscription named Sub1. Sub1 contains a Microsoft Sentinel workspace named SW1 and a virtual machine named VM1 that runs Windows Server. SW1 collects security logs from VM1 by using the Windows Security Events via AMA connector.

You need to limit the scope of events collected from VM1. The solution must ensure that only audit failure events are collected.

How should you complete the filter expression for the connector? To answer, select the appropriate options in the answer area.

NOTE: Each correct selection is worth one point.

You have a Microsoft 365 subscription that uses Microsoft Purview Data Security Investigations.

An alert indicates that a user potentially downloaded sensitive files from Microsoft OneDrive and sent email messages during the last two weeks.

You need to identify and collect the files and emails associated with the actions of the user.

What should you use? To answer, select the appropriate options in the answer area.

NOTE: Each correct selection is worth one point.

Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.

After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.

You have Linux virtual machines on Amazon Web Services (AWS). You deploy Azure Defender and enable auto-provisioning.

You need to monitor the virtual machines by using Azure Defender.

Solution: You enable Azure Arc and onboard the virtual machines to Azure Arc. Does this meet the goal?

You have a Microsoft 365 E5 subscription that contains Windows 11 and Linux CentOS devices.

In Microsoft Defender XDR, Deception is set to On.

You plan to create a deception rule that will use a custom lure.

You need to specify the type of file, and the planting path for the custom lure.

What should you specify? To answer, select the appropriate options in the answer area.

NOTE: Each correct selection is worth one point.

Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.

After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.

You have Linux virtual machines on Amazon Web Services (AWS). You deploy Azure Defender and enable auto-provisioning.

You need to monitor the virtual machines by using Azure Defender.

Solution: You manually install the Log Analytics agent on the virtual machines.

Does this meet the goal?

You have a Microsoft 365 E5 subscription.

You have the following KQL query.

You use Azure Sentinel.

You need to use a built-in role to provide a security analyst with the ability to edit the queries of custom Azure Sentinel workbooks. The solution must use the principle of least privilege.

Which role should you assign to the analyst?

You have a Microsoft 365 E5 subscription that uses Microsoft Copilot for Security.

You have a Copilot for Security workspace that uses the following plugins:

• Microsoft Entra

• Microsoft Defender XDR

From the Microsoft Defender portal, you use Copilot for Security to investigate a reported incident.

You need to run a promptbook that will include information from Microsoft Entra ID Protection in the investigation.

What should you do first?

You create a hunting query in Azure Sentinel.

You need to receive a notification in the Azure portal as soon as the hunting query detects a match on the query. The solution must minimize effort.

What should you use?

You have an Azure subscription that contains a user named User1 and a Microsoft Sentinel workspace named WS1.

You deploy Advanced Security Information Model (ASIM) authentication parsers to WS1.

You need to use the parsers to query the authentication events generated by User1 during the last 24 hours. The solution must maximize the performance of the query.

How should you complete the query? To answer, select the appropriate options in the answer area.

NOTE: Each correct selection is worth one point.

You have an Azure subscription named Sub1 and a Microsoft 365 subscription. Sub1 is linked to an Azure Active Directory (Azure AD) tenant named contoso.com.

You create an Azure Sentinel workspace named workspace1. In workspace1, you activate an Azure AD connector for contoso.com and an Office 365 connector for the Microsoft 365 subscription.

You need to use the Fusion rule to detect multi-staged attacks that include suspicious sign-ins to contoso.com followed by anomalous Microsoft Office 365 activity.

Which two actions should you perform? Each correct answer present part of the solution.

NOTE: Each correct selection is worth one point.

You have a Microsoft 365 E5 subscription that contains a Microsoft SharePoint Online site named Site1.

You need to enable Microsoft Defender for Cloud Apps session control for Site1.

Which type of policy should you create first?

Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.

After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.

You are configuring Azure Sentinel.

You need to create an incident in Azure Sentinel when a sign-in to an Azure virtual machine from a malicious IP address is detected.

Solution: You create a livestream from a query.

Does this meet the goal?

You have a Microsoft Sentinel workspace named SW1.

You need to identify which anomaly rules are enabled in SW1.

What should you review in Microsoft Sentinel?

You need to create a query for a workbook. The query must meet the following requirements:

List all incidents by incident number.

Only include the most recent log for each incident.

How should you complete the query? To answer, select the appropriate options in the answer area.

NOTE: Each correct selection is worth one point.

Hot Area:

You have a Microsoft 365 E5 subscription that contains a device named Device1.

From the Microsoft Defender portal, you discover that an alert was triggered for Device1.

From the Device inventory page, you isolate Device1.

You need to collect a list of installed programs on Device1.

What should you do?

You have the resources shown in the following table.

You scplicate events from occurring in SW1.

What should you use for each action? To answer, drag the appropriate resources to the correct actions. Each resource may be used once, more than once, or not at all. You may need to drag the split bar between panes or scroll to view content.

NOTE: Each correct selection is worth one point.

Select and Place: