Exam Flashcards
3.
DRAG DROP -
You have an Azure subscription linked to an Azure Active Directory (Azure AD) tenant. The tenant contains two users named User1 and User2.
You plan to deploy Azure Defender.
You need to enable User1 and User2 to perform tasks at the subscription level as shown in the following table.
User/Task
User1: - Assign initiatives, - Edit security policies, - enable automatic provisioning
User2: - View alerts and recommendations, -Apply security recommendations, - Dismiss alerts
The solution must use the principle of least privilege.
Which role should you assign to each user? To answer, drag the appropriate roles to the correct users. Each role may be used once, more than once, or not at all.
You may need to drag the split bar between panes or scroll to view content.
Select and Place:
Roles:
Contributor,
Owner,
Security administrator
Security Reader
User1: ?
User2: ?
User1: Owner
User2: Contributor
4.
You have a Microsoft 365 subscription that uses Microsoft Defender for Office 365.
You have Microsoft SharePoint Online sites that contain sensitive documents. The documents contain customer account numbers that each consists of 32 alphanumeric characters.
You need to create a data loss prevention (DLP) policy to protect the sensitive documents.
What should you use to detect which documents are sensitive?
- A. SharePoint search
- B. a hunting query in Microsoft 365 Defender
- C. Azure Information Protection
- D. RegEx pattern matching
C. Azure Information Protection
är rätt, men man kan även använda RegEx, vilket gör även D rätt. Men jag tror C är svaret dom är ute efter.
5.
DRAG DROP -
You have an Azure subscription.
You need to delegate permissions to meet the following requirements:
✑ Enable and disable Azure Defender.
✑ Apply security recommendations to resource.
The solution must use the principle of least privilege.
Which Azure Security Center role should you use for each requirement? To answer, drag the appropriate roles to the correct requirements. Each role may be used once, more than once, or not at all. You may need to drag the split bar between panes or scroll to view content.
Select and place:
Roles:
Security Admin
Resource Group Owner
Subscription Contributor
Subscribtion Owner
Answer Area:
Enable and disable Azure Defender: ?
Apply security recommendations to a resource: ?
Enable and disable Azure Defender: Resource Group Owner
Apply security recommendations to a resource: Subscription Contributor
6.
You have a suppression rule in Azure Security Center for 10 virtual machines that are used for testing. The virtual machines run Windows Server.
You are troubleshooting an issue on the virtual machines.
In Security Center, you need to view the alerts generated by the virtual machines during the last five days.
What should you do?
- A. Change the rule expiration date of the suppression rule.
- B. Change the state of the suppression rule to Disabled.
- C. Modify the filter for the Security alerts page.
- D. View the Windows event logs on the virtual machines.
SVAR: C. Modify the filter for the Security alerts page.
(so you display dismissed alerts)
7.
You have a Microsoft 365 subscription that uses Microsoft 365 Defender.
You need to identify all the entities affected by an incident.
Which tab should you use in the Microsoft 365 Defender portal?
- A. Investigations
- B. Devices
- C. Evidence and Response
- D. Alerts
D. Alerts
8.
HOTSPOT -
You purchase a Microsoft 365 subscription.
You plan to configure Microsoft Cloud App Security.
You need to create a custom template-based policy that detects connections to Microsoft 365 apps that originate from a botnet network.
What should you use? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Answer Area:
Policy template type: Access policy, Activity policy, Anomaly detection policy
Filter based on: IP address tag, Source, User agent string
Policy template type: Activity policy
Filter based on: IP address tag
9.
You need to configure Microsoft Cloud App Security to generate alerts and trigger remediation actions in response to external sharing of confidential files.
Which two actions should you perform in the Cloud App Security portal? Each correct answer presents part of the solution.
- A. From Settings, select Information Protection, select Azure Information Protection, and then select Only scan files for Azure Information Protection classification labels and content inspection warnings from this tenant.
- B. Select Investigate files, and then filter App to Office 365.
- C. Select Investigate files, and then select New policy from search.
- D. From Settings, select Information Protection, select Azure Information Protection, and then select Automatically scan new files for Azure Information Protection classification labels and content inspection warnings.
- E. From Settings, select Information Protection, select Files, and then enable file monitoring.
- F. Select Investigate files, and then filter File Type to Document.
D. From Settings, select Information Protection, select Azure Information Protection, and then select Automatically scan new files for Azure Information Protection classification labels and content inspection warnings.
E. From Settings, select Information Protection, select Files, and then enable file monitoring.
10.
Your company stores the data of every project in a different Azure subscription. All the subscriptions use the same Azure Active Directory (Azure AD) tenant.
Every project consists of multiple Azure virtual machines that run Windows Server. The Windows events of the virtual machines are stored in a Log Analytics workspace in each machine’s respective subscription.
You deploy Azure Sentinel to a new Azure subscription.
You need to perform hunting queries in Azure Sentinel to search across all the Log Analytics workspaces of all the subscriptions.
Which two actions should you perform? Each correct answer presents part of the solution.
- A. Add the Security Events connector to the Azure Sentinel workspace.
- B. Create a query that uses the workspace expression and the union operator.
- C. Use the alias statement.
- D. Create a query that uses the resource expression and the alias operator.
- E. Add the Azure Sentinel solution to each workspace.
B. Create a query that uses the workspace expression and the union operator.
E. Add the Azure solution to each workspace.
13.
DRAG DROP -
Your company deploys Azure Sentinel.
You plan to delegate the administration of Azure Sentinel to various groups.
You need to delegate the following tasks:
✑ Create and run playbooks
✑ Create workbooks and analytic rules.
The solution must use the principle of least privilege.
Which role should you assign for each task? To answer, drag the appropriate roles to the correct tasks. Each role may be used once, more than once, or not at all.
Select and Place:
Azure Sentinel Contributor, Azure Sentinel Responder, Azure Sentinel Reader, Logic App Contributor
Create and run playbooks: ?
Create workbooks and analytic rules: ?
Create and run playbooks: Logic App Contributor
Create workbooks and analytic rules: Microsoft Sentinel Contributor
14.
DRAG DROP -
You have an Azure subscription. The subscription contains 10 virtual machines that are onboarded to Microsoft Defender for Cloud.
You need to ensure that when Defender for Cloud detects digital currency mining behavior on a virtual machine, you receive an email notification. The solution must generate a test email.
Which three actions should you perform in sequence? To answer, move the appropriate actions from the list of actions to the answer area and arrange them in the correct order.
- From workflow automation in Defender for cloud, change the status of the workflow automation.
- From the Logic App Designer, run a trigger.
- From Security alerts in Defender for Cloud, create a sample alert.
- From the Logic App Designer, create a logic app.
- From workflow automation in Defender for cloud, add a workflow automation.
- From workflow automation in Defender for cloud, add a workflow automation.
- From the Logic App Designer, create a logic app.
- From Security alerts in Defender for Cloud, create a sample alert.
15.
HOTSPOT -
You have an Azure subscription that has Azure Defender enabled for all supported resource types.
You create an Azure logic app named LA1.
You plan to use LA1 to automatically remediate security risks detected in Azure Security Center.
You need to test LA1 in Security Center.
What should you do? To answer, select the appropriate options in the answer area.
Set the LA1 trigger to:
- When an Azure Security Center Recommendation is created or triggered
- When an Azure Security Center Alert is created or triggered
- When a response to an Azure Security Center alert is triggered
Trigger the execution of LA1 from:
- Recommendations
- Workflow automation
- Security alerts
Set the LA1 trigger to: When the Security Center Recommendation is created or triggered
Trigger the execution of LA1 from: Recommendations
16.
You have a Microsoft 365 subscription that has Microsoft 365 Defender enabled.
You need to identify all the changes made to sensitivity labels during the past seven days.
What should you use?
- A. the Incidents blade of the Microsoft 365 Defender portal
- B. the Alerts settings on the Data Loss Prevention blade of the Microsoft 365 compliance center
- C. Activity explorer in the Microsoft 365 compliance center
- D. the Explorer settings on the Email & collaboration blade of the Microsoft 365 Defender portal
C. Activity explorer in the Microsoft 365 compliance center
17.
You have a Microsoft 365 E5 subscription that uses Microsoft SharePoint Online.
You delete users from the subscription.
You need to be notified if the deleted users downloaded numerous documents from SharePoint Online sites during the month before their accounts were deleted.
What should you use?
- A. a file policy in Microsoft Defender for Cloud Apps
- B. an access review policy
- C. an alert policy in Microsoft Defender for Office 365
- D. an insider risk policy
D. an insider risk policy
18.
You have a Microsoft Sentinel workspace that contains the following incident.
Brute force attack against Azure Portal analytics rule has been triggered.
You need to identify the geolocation information that corresponds to the incident.
What should you do?
- A. From Overview, review the Potential malicious events map.
- B. From Incidents, review the details of the IPCustomEntity entity associated with the incident.
- C. From Incidents, review the details of the AccountCustomEntity entity associated with the incident.
- D. From Investigation, review insights on the incident entity.
B. From Incidents, review the details of the IPCustomEntity entity associated with the incident.
19.
You have a Microsoft Sentinel workspace named workspace1 that contains custom Kusto queries.
You need to create a Python-based Jupyter notebook that will create visuals. The visuals will display the results of the queries and be pinned to a dashboard. The solution must minimize development effort.
What should you use to create the visuals?
- A. plotly
- B. TensorFlow
- C. msticpy
- D. matplotlib
C. msticpy
20.
HOTSPOT -
You have an Azure Storage account that will be accessed by multiple Azure Function apps during the development of an application.
You need to hide Azure Defender alerts for the storage account.
Which entity type and field should you use in a suppression rule? To answer, select the appropriate options in the answer area.
Answer Area:
Entity type: IP address, Azure Resource, Host, User Account
Field: Name, Resource Id, Address, Command line
Entity type: Azure Resource
Field: Resource Id
21.
HOTSPOT -
You have an Azure subscription that uses Azure Defender.
You plan to use Azure Security Center workflow automation to respond to Azure Defender threat alerts.
You need to create an Azure policy that will perform threat remediation automatically.
What should you include in the solution? To answer, select the appropriate options in the answer area.
Hot Area:
Set available effects to: Append, DeployIfNotExists, EnforceRegoPolicy
To perform remediation use:
- An Azure Automation runbook that has a webhook
- An Azure Logic Apps app that has the trigger set to When an Azure Security Center Alert is created or triggered
- An Azure Logic Apps app that has the trigger set to When a response to an Azure Security Center Alert is triggered
Set available effects to: DeployIfNotExist
To perform remediation use: An Azure Logic Apps app that has the trigger set to When an Azure Security Center Alert is created or triggered
22.
You have an Azure subscription that has the enhanced security features in Microsoft Defender for Cloud enabled and contains a user named User1.
You need to ensure that User1 can export alert data from Defender for Cloud. The solution must use the principle of least privilege.
Which role should you assign to User1?
- A. User Access Administrator
- B. Owner
- C. Contributor
- D. Reader
B. Owner
23.
You have an Azure subscription that uses Microsoft Sentinel.
You need to minimize the administrative effort required to respond to the incidents and remediate the security threats detected by Microsoft Sentinel.
Which two features should you use? Each correct answer presents part of the solution.
- A. Microsoft Sentinel bookmarks
- B. Azure Automation runbooks
- C. Microsoft Sentinel automation rules
- D. Microsoft Sentinel playbooks
- E. Azure Functions apps
C. Microsoft Sentinel automation rules
D. Microsoft Sentinel playbooks
24.
You are investigating an incident in Azure Sentinel that contains more than 127 alerts.
You discover eight alerts in the incident that require further investigation.
You need to escalate the alerts to another Azure Sentinel administrator.
What should you do to provide the alerts to the administrator?
- A. Create a Microsoft incident creation rule
- B. Share the incident URL
- C. Create a scheduled query rule
- D. Assign the incident
D. Assign the incident
- You plan to create a custom Azure Sentinel query that will track anomalous Azure Active Directory (Azure AD) sign-in activity and present the activity as a time chart aggregated by day.
You need to create a query that will be used to display the time chart.
What should you include in the query?
- A. extend
- B. bin
- C. makeset
- D. workspace
B. bin
26.
A company uses Azure Sentinel.
You need to create an automated threat response.
What should you use?
- A. a data connector
- B. a playbook
- C. a workbook
- D. a Microsoft incident creation rule
B. a playbook
27.
You have five on-premises Linux servers.
You have an Azure subscription that uses Microsoft Defender for Cloud.
You need to use Defender for Cloud to protect the Linux servers.
What should you install on the servers first?
- A. the Dependency agent
- B. the Log Analytics agent
- C. the Azure Connected Machine agent
- D. the Guest Configuration extension
B. the Log Analytics Agent
28.
DRAG DROP -
You have an Azure Functions app that generates thousands of alerts in Azure Security Center each day for normal activity.
You need to hide the alerts automatically in Security Center.
Which three actions should you perform in sequence in Security Center? Each correct answer presents part of the solution.
Select and Place:
* Select Pricing & Settings.
* Select IP as the entity type and specify the IP address.
* Select Azure Resource as the entity type and specify the Resource ID.
* Select Security policy.
* Select Security alerts
* Select Suppression rules, and then select Create new suppression rule.
- Select Security alerts
- Select suppression rules, and then select Create new suppression rule
- Select Azure Resource as the entity type and specify the Resource ID
30.
Your company uses Microsoft Defender for Endpoint.
The company has Microsoft Word documents that contain macros. The documents are used frequently on the devices of the company’s accounting team.
You need to hide false positive in the Alerts queue, while maintaining the existing security posture.
Which three actions should you perform? Each correct answer presents part of the solution.
NOTE: Each correct selection is worth one point.
- A. Resolve the alert automatically.
- B. Hide the alert.
- C. Create a suppression rule scoped to any device.
- D. Create a suppression rule scoped to a device group.
- E. Generate the alert.
B. Hide the alert
D. Create a suppression rule scoped to a device group.
E. Generate the alert.
31.
You are configuring Azure Sentinel.
You need to send a Microsoft Teams message to a channel whenever an incident representing a sign-in risk event is activated in Azure Sentinel.
Which two actions should you perform in Azure Sentinel? Each correct answer presents part of the solution.
- A. Enable Entity behavior analytics.
- B. Associate a playbook to the analytics rule that triggered the incident.
- C. Enable the Fusion rule.
- D. Add a playbook.
- E. Create a workbook.
B. Associate a playbook to the analytics rule that triggered the incident.
D. Add a playbook.
33.
A security administrator receives email alerts from Azure Defender for activities such as potential malware uploaded to a storage account and potential successful brute force attacks.
The security administrator does NOT receive email alerts for activities such as antimalware action failed and suspicious network activity. The alerts appear in Azure Security Center.
You need to ensure that the security administrator receives email alerts for all the activities.
What should you configure in the Security Center settings?
- A. the severity level of email notifications
- B. a cloud connector
- C. the Azure Defender plans
- D. the integration settings for Threat detection
A. the severity level for email notifications
34.
You have an Azure subscription that uses Microsoft Sentinel and contains 100 Linux virtual machines.
You need to monitor the virtual machines by using Microsoft Sentinel. The solution must meet the following requirements:
✑ Minimize administrative effort.
✑ Minimize the parsing required to read fog data.
What should you configure?
- A. a Log Analytics Data Collector API
- B. REST API integration
- C. a Common Evert Format (CEF) connector
- D. a Syslog connector
C. a Common Event Format (CEF) connector
35.
You have a Microsoft 365 tenant that uses Microsoft Exchange Online and Microsoft Defender for Office 365.
What should you use to identify whether zero-hour auto purge (ZAP) moved an email message from the mailbox of a user?
- A. the Threat Protection Status report in Microsoft Defender for Office 365
- B. the mailbox audit log in Exchange
- C. the Safe Attachments file types report in Microsoft Defender for Office 365
- D. the mail flow report in Exchange
A. the Threat Protection Status report in Microsoft Defender for Office 365
36.
You are configuring Microsoft Cloud App Security.
You have a custom threat detection policy based on the IP address ranges of your company’s United States-based offices.
You receive many alerts related to impossible travel and sign-ins from risky IP addresses.
You determine that 99% of the alerts are legitimate sign-ins from your corporate offices.
You need to prevent alerts for legitimate sign-ins from known locations.
Which two actions should you perform? Each correct answer presents part of the solution.
- A. Configure automatic data enrichment.
- B. Add the IP addresses to the corporate address range category.
- C. Increase the sensitivity level of the impossible travel anomaly detection policy.
- D. Add the IP addresses to the other address range category and add a tag.
- E. Create an activity policy that has an exclusion for the IP addresses.
A. Configure automatic data enrichment.
B. Add the IP addresses to the corporate address range category.
37.
You have an existing Azure logic app that is used to block Azure Active Directory (Azure AD) users. The logic app is triggered manually.
You deploy Azure Sentinel.
You need to use the existing logic app as a playbook in Azure Sentinel.
What should you do first?
- A. Add a new scheduled query rule.
- B. Add a data connector to Azure Sentinel.
- C. Configure a custom Threat Intelligence connector in Azure Sentinel.
- D. Modify the trigger in the logic app.
B. Add a data connector to Azure Sentinel.
38.
You have two Azure subscriptions that use Microsoft Defender for Cloud.
You need to ensure that specific Defender for Cloud security alerts are suppressed at the root management group level. The solution must minimize administrative effort.
What should you do in the Azure portal?
- A. Create an Azure Policy assignment.
- B. Modify the Workload protections settings in Defender for Cloud.
- C. Create an alert rule in Azure Monitor.
- D. Modify the alert settings in Defender for Cloud.
A. Create an Azure Policy assignment.
39.
You use Azure Sentinel.
You need to receive an alert in near real-time whenever Azure Storage account keys are enumerated.
Which two actions should you perform? Each correct answer presents part of the solution.
- A. Create a livestream
- B. Add a data connector
- C. Create an analytics rule
- D. Create a hunting query
- E. Create a bookmark.
A. Create a livestream
D. Create a hunting query
40.
DRAG DROP -
You have an Azure subscription that contains 100 Linux virtual machines.
You need to configure Microsoft Sentinel to collect event logs from the virtual machines.
Which three actions should you perform in sequence? To answer, move the appropriate actions from the list of actions to the answer area and arrange them in the correct order.
Select and Place:
- Install the Log Analytics agent for Linux on the virtual machines.
- Add Microsoft Sentinel to a workspace.
- Add a Security Events connector to the workspace.
- Add a Microsoft Sentinel Workbook.
- Add a Syslog connector to the workspace.
- Add Microsoft Sentinel to a workspace.
- Install the Log Analytics agent for Linux on the virtual machines.
- Add a Syslog connector to the workspace.
41.
DRAG DROP -
You have a Microsoft Sentinel workspace named workspace1 and an Azure virtual machine named VM1.
You receive an alert for suspicious use of PowerShell on VM1.
You need to investigate the incident, identify which event triggered the alert, and identify whether the following actions occurred on VM1 after the alert:
✑ The modification of local group memberships
✑ The purging of event logs
Which three actions should you perform in sequence in the Azure portal? To answer, move the appropriate actions from the list of actions to the answer area and arrange them in the correct order.
Select and Place:
- From the details pane of the incident, select Investigate.
- From the Investigation blade, select the entity that represents VM1.
- From the Investigation blade, select the entity that represents powershell.exe.
- From the Investigation blade, select Timeline.
- From the Investigation blade, select Info.
- From the Investigation blade, select Insights.
- From the details pane of the incident, select Investigate.
- From the Investigation blade, select the entity that represents VM1.
- From the Investigation blade, select Insights.
42.
DRAG DROP -
You have the resources shown in the following table.
Name:Description
-SW1: An Azure Sentinel workspace
-CEF1: A Linux server configured to forward Common Event Format (CEF) logs to SW1
-Server1: A Linux server configured to send Common Event Format (CEF) logs to CEF1
-Server2: A Linux server configured to send Syslog logs to CEF1
You need to prevent duplicate events from occurring in SW1.
What should you use for each action? To answer, drag the appropriate resources to the correct actions. Each resource may be used once, more than once, or not at all. You may need to drag the split bar between panes or scroll to view content.
Select and Place:
SW1, CEF1, Server1, Server2
From the Syslog configuration, remove the facilities that send CEF messages: ?
From the Log Analytics agent, disable Syslog synchronization: ?
From the Syslog configuration, remove the facilities that send CEF messages: Server1
From the Log Analytics agent, disable Syslog synchronization: Server1
43.
Litware must meet the following requirements:
✑ Ensure that a user named admin1 can configure Azure Sentinel playbooks.
✑ The principle of least privilege must be used whenever possible.
You need to assign a role-based access control (RBAC) role to admin1 to meet the Azure Sentinel requirements and the business requirements.
Which role should you assign?
- A. Automation Operator
- B. Automation Runbook Operator
- C. Azure Sentinel Contributor
- D. Azure Sentinel Responder
Inget är rätt.
Logic App Contributor skulle vara rätt.
44.
You need to complete the query for failed sign-ins to meet the technical requirements.
Where can you find the column name to complete the where clause?
- A. Security alerts in Azure Security Center
- B. Activity log in Azure
- C. Azure Advisor
- D. the query windows of the Log Analytics workspace
D. the query windows of the Log Analytics workspace
(det fattas dock info i själva frågan)
45.
HOTSPOT -
You have 100 Azure subscriptions that have enhanced security features in Microsoft Defender for Cloud enabled. All the subscriptions are linked to a single Azure Active Directory (Azure AD) tenant.
You need to stream the Defender for Cloud logs to a syslog server. The solution must minimize administrative effort.
What should you do? To answer, select the appropriate options in the answer area.
Answer Area:
Exports logs to an:
- Azure event hub
- Azure storage account
- Log Analytics workspace
Configure streaming by:
- Configuring continuous export in Defender for Cloud for each subscription
- Creating an Azure policy assignment at the root management group
- Modifying the diagnostic settings of the tenant
Exports logs to an: Azure event hub
Configure streaming by: Creating an Azure policy assignment at the root management group
47.
You have the following environment:
Azure Sentinel -
✑ A Microsoft 365 subscription
✑ Microsoft Defender for Identity
✑ An Azure Active Directory (Azure AD) tenant
You configure Azure Sentinel to collect security logs from all the Active Directory member servers and domain controllers.
You deploy Microsoft Defender for Identity by using standalone sensors.
You need to ensure that you can detect when sensitive groups are modified in Active Directory.
Which two actions should you perform? Each correct answer presents part of the solution.
- A. Configure the Advanced Audit Policy Configuration settings for the domain controllers.
- B. Modify the permissions of the Domain Controllers organizational unit (OU).
- C. Configure auditing in the Microsoft 365 compliance center.
- D. Configure Windows Event Forwarding on the domain controllers.
A. Configure the Advanced Audit Policy Configuration settings for the domain controllers.
D. Configure Windows Event Forwarding on the domain controllers.
48.
Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.
After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.
You are configuring Azure Sentinel.
You need to create an incident in Azure Sentinel when a sign-in to an Azure virtual machine from a malicious IP address is detected.
Solution: You create a Microsoft incident creation rule for a data connector.
Does this meet the goal?
- A. Yes
- B. No
A. Yes
49.
Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.
After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.
You are configuring Azure Sentinel.
You need to create an incident in Azure Sentinel when a sign-in to an Azure virtual machine from a malicious IP address is detected.
Solution: You create a hunting bookmark.
Does this meet the goal?
- A. Yes
- B. No
B. No
50.
Azure Sentinel Requirements:
Litware must meet the following Azure Sentinel requirements:
✑ Integrate Azure Sentinel and Cloud App Security.
✑ Ensure that a user named admin1 can configure Azure Sentinel playbooks.
✑ Create an Azure Sentinel analytics rule based on a custom query. The rule must automatically initiate the execution of a playbook.
✑ Add notes to events that represent data access from a specific IP address to provide the ability to reference the IP address when navigating through an investigation graph while hunting.
✑ Create a test rule that generates alerts when inbound access to Microsoft Office 365 by the Azure AD test user accounts is detected. Alerts generated by the rule must be grouped into individual incidents, with one incident per test user account.
HOTSPOT -
You need to configure the Azure Sentinel integration to meet the Azure Sentinel requirements.
What should you do? To answer, select the appropriate options in the answer area.
Answer Area:
In the Cloud App Security portal:
- Add a security extension
- Configure app connectors
- Configure log collectors
From Azure Sentinel in the Azure portal:
- Add a data connector
- Add a workbook
- Configure the Logs settings
In the Cloud App Security portal: Add a security extension
From Azure Sentinel in the Azure portal: Add a data connector
51.
You implement Safe Attachments policies in Microsoft Defender for Office 365.
Users report that email messages containing attachments take longer than expected to be received.
You need to reduce the amount of time it takes to deliver messages that contain attachments without compromising security. The attachments must be scanned for malware, and any messages that contain malware must be blocked.
What should you configure in the Safe Attachments policies?
- A. Dynamic Delivery
- B. Replace
- C. Block and Enable redirect
- D. Monitor and Enable redirect
A. Dynamic Delivery
52.
Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.
After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.
You use Azure Security Center.
You receive a security alert in Security Center.
You need to view recommendations to resolve the alert in Security Center.
Solution: From Regulatory compliance, you download the report.
Does this meet the goal?
- A. Yes
- B. No
B. No
(info fattas)
53.
You receive an alert from Azure Defender for Key Vault.
You discover that the alert is generated from multiple suspicious IP addresses.
You need to reduce the potential of Key Vault secrets being leaked while you investigate the issue. The solution must be implemented as soon as possible and must minimize the impact on legitimate users.
What should you do first?
- A. Modify the access control settings for the key vault.
- B. Enable the Key Vault firewall.
- C. Create an application security group.
- D. Modify the access policy for the key vault.
B. Enable the Key Vault firewall
54.
DRAG DROP -
You create a new Azure subscription and start collecting logs for Azure Monitor.
You need to configure Azure Security Center to detect possible threats related to sign-ins from suspicious IP addresses to Azure virtual machines. The solution must validate the configuration.
Which three actions should you perform in a sequence? To answer, move the appropriate actions from the list of action to the answer area and arrange them in the correct order.
Select and Place:
- Change the alert severity threshold to Medium.
- Copy an executable file on a virtual machine and rename the file as ASC-AlerTest_662jfi039n.exe
- Enable Azure Defender for the subscription.
- Change the Alert severity threshold for emails to Low.
- Run the executable file and specify the appropriate arguments.
- Rename the executable file as AlertTest.exe.
- Enable Azure Defender for the subscription.
- Copy an executable file on a virtual machine and rename the file as ASC-AlerTest_662jfi039n.exe
- Run the executable file and specify the appropriate arguments.
55.
Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.
After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.
You use Azure Security Center.
You receive a security alert in Security Center.
You need to view recommendations to resolve the alert in Security Center.
Solution: From Security alerts, you select the alert, select Take Action, and then expand the Prevent future attacks section.
Does this meet the goal?
- A. Yes
- B. No
B. No
56.
You have a Microsoft 365 subscription that contains 1,000 Windows 10 devices. The devices have Microsoft Office 365 installed.
You need to mitigate the following device threats:
✑ Microsoft Excel macros that download scripts from untrusted websites
✑ Users that open executable attachments in Microsoft Outlook
✑ Outlook rules and forms exploits
What should you use?
- A. Microsoft Defender Antivirus
- B. attack surface reduction rules in Microsoft Defender for Endpoint
- C. Windows Defender Firewall
- D. adaptive application control in Azure Defender
B. attack surface reduction rules in Microsoft Defender for Endpoint
57.
You have a playbook in Azure Sentinel.
When you trigger the playbook, it sends an email to a distribution group.
You need to modify the playbook to send the email to the owner of the resource instead of the distribution group.
What should you do?
- A. Add a parameter and modify the trigger.
- B. Add a custom data connector and modify the trigger.
- C. Add a condition and modify the action.
- D. Add an alert and modify the action.
A. Add a parameter and modify the trigger.
ELLER
D. Add an alert and modify the action.
https://www.examtopics.com/discussions/microsoft/view/52689-exam-sc-200-topic-3-question-6-discussion/
