Microsoft Sentinel Ninja Cert Flashcards
(30 cards)
What is the maximum file size of a Watchlist?
500MB
Which AWS logs can be ingested by the Amazon Web Services S3 connector?
AWS GuardDuty
VPC Flow logs
AWS Cloudtrail
Which of the following MITRE ATT&CK techniques are classed as Execution?
User Execution
Launchctl
Which of the following are examples of Watchlist templates?
All of the options:
Identity Correlation
Terminated Employees
Service Accounts
Which of the following is correct regarding the Search feature?
Search jobs use parallel processing to run the search across long time spans, for extremely large data sets.
Microsoft Sentinel supports the MITRE ATT&CK framework version 9?
True
What actions will the following xPath query take?
Security!*[System[(EventID=4688)]] and * [EventData[Data[@Name=’ProcessName’]=’C:\Windows\System32\consent.exe’]]
Only Security events with Event ID=4688 and a process name of consent.exe will be collected.
How can you transform data before it is ingested into Microsoft Sentinel?
All of these options:
Logstash
Data Collection (DCR) rules
Azure Function
If you wanted to create a Microsoft Sentinel solution for Sentinel, where would you find the guide to help you do this?
Microsoft Sentinel GitHub Repo
Which of the following connectors are support by the SentinelHealth data table?
Dynamics 365
Threat Intelligence Platforms
Office ATP
Office 365
Automation rules can be triggered by alerts and incidents.
False
Which of the following tables can have data sent to them by the Custom logs API?
WindowsEvents and CommonSecurityLog
What KQL operator will specify a type of graph?
render
Which of the following are properties in the pollingConfig of a CCP connector?
auth
auth.authType
request
You must manually change Sentinel retention policy to 90 days after creating a new workspace.
True
Microsoft Sentinel is available in all Azure regions.
False
Where in Microsoft Sentinel can you enable the Archive feature?
Tables
How can you query data in an Archive log table?
Restoring archived logs
and
Running a search job
How do you run a KQL query in a Microsoft Sentinel notebook?
Install the MSTICPy or KQLMagic library and use a %kql magic command at the start of a query.
Where can you deploy honey tokens in the Microsoft Sentinel deception solution?
Azure Key Vault
Data Connectors will not always be visible in the Sentinel Data Connectors configuration page until the related solution has been deployed from Content Hub.
True
What rate can the AMA send data at?
5 K EPS
Which of the following are considered limitations of a Searchjob?
Only able to quert one table at a time
Results are limited to one million records in the record set
Why would a security analytst benefit from using Microsoft Sentinel notebooks?
Create data visualizations that aren’t provided out-of-the-box in Microsoft Sentinel.
Investigate security incidents at scale
Programmatically scale thret hunts beyound KQL queries
Document security workflows
