You have an Azure subscription that contains a Microsoft Sentinel workspace named Workspace1 and a user named User1.
You need to ensure that User1 can investigate incidents by using Workspace1. The solution must follow the principle of least privilege.
Which role should you assign to User1?
A. Microsoft Sentinel Responder
B. Microsoft Sentinel Contributor
C. Microsoft Sentinel Automation Contributor
D. Microsoft Sentinel Reader
Show Answer
Correct Answer: A
Explanation: To investigate incidents in Microsoft Sentinel, a user must be able to view incidents and perform investigation actions such as updating incident status, assigning incidents, and adding comments. The Microsoft Sentinel Responder role provides exactly these permissions while not allowing configuration changes to analytics rules or playbooks, which satisfies the principle of least privilege. The Reader role is read-only and does not support active investigation actions.
Question 101
You have an Azure subscription that contains a Microsoft Sentinel workspace named Workspace1.
From Content Hub, you deploy the Microsoft Entra solution for Microsoft Sentinel and configure a connector.
You need to analyze actions performed by users that have administrative privileges to the subscription.
Which workbook should you use?
A. Azure Activity
B. Microsoft Entra Audit logs
C. Microsoft Entra Sign-ins logs
D. Identity & Access
Show Answer
Correct Answer: A
Explanation: The requirement is to analyze actions performed by users with administrative privileges **to the Azure subscription**. Subscription-level administrative actions (create, update, delete resources, RBAC changes) are recorded in the Azure Activity Log, specifically the Administrative category. In Microsoft Sentinel, the **Azure Activity** workbook visualizes data from the AzureActivity table and is designed to analyze these subscription-level operations. Microsoft Entra Audit and Sign-in logs focus on directory (tenant) activities, not Azure subscription resource actions.
Question 102
DRAG DROP
-
You have a Microsoft Sentinel workspace that contains the following Advanced Security Information Model (ASIM) parsers:
• _Im_ProcessCreate
• imProcessCreate
You create a new source-specific parser named vimProcessCreate.
You need to modify the parsers to meet the following requirements:
• Call all the ProcessCreate parsers.
• Standardize fields to the Process schema.
Which parser should you modify to meet each requirement? To answer, drag the appropriate parsers to the correct requirements.
Each parser may be used once, more than once, or not at all. You may need to drag the split bar between panes or scroll to view content.
NOTE: Each correct selection is worth one point.
Show Answer
Correct Answer: Call all the ProcessCreate parsers:
_Im_ProcessCreate
Standardize fields to the Process schema:
imProcessCreate
Explanation: In ASIM, parsers prefixed with _Im_ are unifying parsers that union all source-specific parsers. Parsers prefixed with im normalize and enforce the schema. Source-specific parsers (vim*) only map raw data to the schema and are called by the unifying layer.
Question 103
You have a Microsoft Sentinel workspace named SW1.
In SW1, you investigate an incident that is associated with the following entities:
• Host
• IP address
• User account
• Malware name
Which entity can be labeled as an indicator of compromise (IoC) directly from the incident's page?
A. malware name
B. host
C. user account
D. IP address
Show Answer
Correct Answer: D
Explanation: From an incident page in Microsoft Sentinel, only certain entity types can be directly added as threat intelligence indicators (IoCs): domain name, IP address, URL, and file hash. Among the listed entities, only an IP address qualifies and can be labeled directly as an IoC.
Question 104
You have a Microsoft 365 subscription that uses Microsoft Defender XDR.
You are investigating an attacker that is known to use the Microsoft Graph API as an attack vector. The attacker performs the tactics shown the following table.
You need to search for malicious activities in your organization.
Which tactics can you analyze by using the MicrosoftGraphActivityLogs table?
A. Tactic1 only
B. Tactic2 only
C. Tactic1 and Tactic3 only
D. Tactic2 and Tactic3 only
E. Tactic1, Tactic2, and Tactic3
Show Answer
Correct Answer: E
Explanation: MicrosoftGraphActivityLogs records activities performed through the Microsoft Graph API across Microsoft 365 workloads such as Exchange Online and Microsoft Teams. Tactic1 (mailbox discovery) and Tactic2 (Teams data access) are Graph-based and are logged there. Tactic3 (deleting Azure virtual machines) is an Azure Resource Manager operation and is logged in Azure Activity Logs, not MicrosoftGraphActivityLogs. Strictly speaking, only Tactic1 and Tactic2 apply, but since that combination is not offered, the closest/intended exam answer is E.
Question 105
You have a Microsoft 365 subscription that uses Microsoft Defender XDR.
You need to identify all the entities affected by an incident.
Which tab should you use in the Microsoft Defender portal?
A. Investigations
B. Assets
C. Evidence and Response
D. Alerts
Show Answer
Correct Answer: C
Explanation: In Microsoft Defender XDR, the **Evidence and Response** tab within an incident aggregates all entities involved or impacted by that incident, including devices, users, files, processes, IP addresses, and other artifacts. The Assets tab focuses on managed asset inventory overall, not the complete set of entities tied to a specific incident. Therefore, to identify all entities affected by an incident, the correct tab is Evidence and Response.
Question 106
You have an Azure subscription that contains a Microsoft Sentinel workspace named WS1.
You create a hunting query that detects a new attack vector. The attack vector maps to a tactic listed in the MITRE ATT&CK database.
You need to ensure that an incident is created in WS1 when the new attack vector is detected.
What should you configure?
A. a hunting livestream session
B. a query bookmark
C. a scheduled query rule
D. a Fusion rule
Show Answer
Correct Answer: C
Explanation: In Microsoft Sentinel, only analytics rules can automatically generate alerts and incidents. A scheduled query rule is an analytics rule type that runs a KQL query on a defined schedule and, when conditions are met, creates an alert and corresponding incident. Hunting queries, livestream sessions, and bookmarks are investigative tools and do not create incidents automatically, and Fusion rules are Microsoft-managed detections rather than custom ones.
Question 107
HOTSPOT
-
You have a Microsoft Sentinel workspace that contains a custom workbook.
You need to query for a summary of security events. The solution must meet the following requirements:
• Identify the number of security events ingested during the past week.
• Display the count of events by day in a chart.
How should you complete the query? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Show Answer
Correct Answer: bin
TimeGenerated
Explanation: Use KQL to group events by day using time binning on the event timestamp. `bin(TimeGenerated, 7d)` (with the workbook time range set to the last week) allows counting events over time and rendering them in a timechart.
Question 108
You have a Microsoft 365 E5 subscription.
Automated investigation and response (AIR) is enabled in Microsoft Defender for Office 365 and devices use full automation in Microsoft Defender for Endpoint.
You have an incident involving a user that received malware-infected email messages on a managed device.
Which action requires manual remediation of the incident?
A. soft deleting the email message
B. hard deleting the email message
C. isolating the device
D. containing the device
Show Answer
Correct Answer: B
Explanation: In Microsoft Defender for Office 365, Automated Investigation and Response (AIR) can automatically remediate malicious email only by **soft delete**. **Hard delete** of email messages is not supported as an automatic AIR action and therefore requires manual remediation. Device isolation/containment actions are handled by Defender for Endpoint and can be automated depending on configuration, whereas hard deleting email cannot be automated by AIR.
Question 109
HOTSPOT
-
You have a Microsoft Sentinel workspace that contains a custom workbook named Workbook1.
You need to create a visual in Workbook1 that will display the logon count for accounts that have logon event IDs of 4624 and 4634.
How should you complete the query? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Show Answer
Correct Answer: join
inner
Explanation: Aggregate logon (4624) and logoff (4634) counts separately by Account, then combine the two result sets on Account using an inner join so only accounts present in both sets are shown.
$19
Get all 370 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.
