You have an Azure subscription that uses Microsoft Sentinel.
You need to minimize the administrative effort required to respond to the incidents and remediate the security threats detected by Microsoft Sentinel.
Which two features should you use? Each correct answer presents part of the solution.
NOTE: Each correct selection is worth one point.
A. Microsoft Sentinel workbooks
B. Azure Automation runbooks
C. Microsoft Sentinel automation rules
D. Microsoft Sentinel playbooks
E. Azure Functions apps
Show Answer
Correct Answer: C, D
Explanation: To minimize administrative effort in responding to incidents and remediating threats in Microsoft Sentinel, you should use automation-focused features.
Microsoft Sentinel automation rules automatically trigger actions when incidents are created or updated, such as assigning owners, changing severity or status, adding tags, and invoking playbooks. This reduces manual triage and handling.
Microsoft Sentinel playbooks (built on Azure Logic Apps) automate response and remediation workflows. They can perform actions like disabling user accounts, blocking IPs, isolating virtual machines, or sending notifications. Together, automation rules and playbooks provide end-to-end automated incident response with minimal manual intervention.
Question 141
You have a Microsoft 365 subscription that uses Microsoft Defender for Endpoint Plan 2 and contains 1,000 Windows devices.
You have a PowerShell script named Script1.ps1 that is signed digitally.
You need to ensure that you can run Script1.ps1 in a live response session on one of the devices.
What should you do first from the live response session?
A. Run the library command.
B. Upload Script1.ps1 to the library.
C. Run the putfile command.
D. Modify the PowerShell execution policy of the device.
Show Answer
Correct Answer: B
Explanation: In Microsoft Defender for Endpoint live response, scripts must be placed in the live response library before they can be executed on a device. Therefore, the first step is to upload Script1.ps1 to the library. Execution policy changes are not required, and putfile/library commands are used after the script exists in the library.
Question 142
You have an Azure subscription that has Microsoft Defender for Cloud enabled.
You have a virtual machine named Server1 that runs Windows Server 2022 and is hosted in Amazon Web Services (AWS).
You need to collect logs and resolve vulnerabilities for Server1 by using Defender for Cloud.
What should you install first on Server1?
A. the Microsoft Monitoring Agent
B. the Azure Monitor agent
C. the Azure Connected Machine agent
D. the Azure Pipelines agent
Show Answer
Correct Answer: C
Explanation: Server1 is hosted in AWS, which is outside Azure. To use Microsoft Defender for Cloud on non-Azure machines, the server must first be onboarded to Azure via Azure Arc. Installing the Azure Connected Machine agent (Azure Arc agent) connects the AWS VM to Azure, after which Defender for Cloud can collect logs, assess vulnerabilities, and manage security. Other agents (Azure Monitor agent or Microsoft Monitoring Agent) are installed only after the machine is connected to Azure.
Question 143
You have a Microsoft Sentinel workspace that contains a custom workbook named Workbook1.
You need to create a visual based on the SecurityEvent table. The solution must meet the following requirements:
• Identify the number of security events ingested during the past week.
• Display the count of events by day in a timechart.
What should you add to Workbook1?
A. a query
B. a metric
C. a group
D. links or tabs
Show Answer
Correct Answer: A
Explanation: In a Microsoft Sentinel workbook, visuals such as timecharts are built from KQL queries. A query against the SecurityEvent table can filter events from the past week and summarize the count by day, which can then be rendered as a timechart. Metrics, groups, and links/tabs do not retrieve or aggregate table data.
Question 144
You have a Microsoft 365 E5 subscription that uses Microsoft Defender XDR and contains a user named User1.
You need to ensure that User1 can manage Microsoft Defender XDR custom detection rules and Endpoint security policies. The solution must follow the principle of least privilege.
Which role should you assign to User1?
A. Security Administrator
B. Security Operator
C. Cloud Device Administrator
D. Desktop Analytics Administrator
Show Answer
Correct Answer: A
Explanation: User1 must manage Microsoft Defender XDR custom detection rules and Endpoint security policies. Managing rules and policies requires configuration-level permissions. The Security Administrator role is the least-privileged built-in role that allows managing Defender XDR settings, custom detections, and access to the Endpoint security policies page. Security Operator is limited to investigation and response, while Cloud Device Administrator and Desktop Analytics Administrator do not grant Defender XDR policy or detection management permissions.
Question 145
HOTSPOT
-
You have a Microsoft Sentinel workspace.
You plan to visualize data from Microsoft SharePoint Online and OneDrive sites.
You need to create a KQL query for the visual. The solution must meet the following requirements:
• Select all workloads as a single operation.
• Include two parameters named Operations and Users.
• In the results, exclude empty values for the site URLs.
How should you complete the query? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Show Answer
Correct Answer: | where Operation in ((Operations))
| where SiteUrl != ""
Explanation: The Operations parameter is applied with a single filter using the multi-select syntax. Empty site URLs are excluded by filtering out blank SiteUrl values before summarization.
Question 146
You have an on-premises network.
You have a Microsoft 365 E5 subscription that uses Microsoft Defender for Identity.
From the Microsoft Defender portal, you investigate an incident on a device named Device1 of a user named User1. The incident contains the following Defender for Identity alert.
Suspected identity theft (pass-the-ticket) (external ID 2018)
You need to contain the incident without affecting users and devices. The solution must minimize administrative effort.
What should you do?
A. Disable User1 only.
B. Quarantine Device1 only.
C. Reset the password for all the accounts that previously signed in to Device1.
D. Disable User1 and quarantine Device1.
E. Disable User1, quarantine Device1, and reset the password for all the accounts that previously signed in to Device1.
Show Answer
Correct Answer: B
Explanation: The key requirements are to contain the incident without affecting users and devices and to minimize administrative effort. A pass-the-ticket attack involves reuse of a stolen Kerberos ticket, not stolen passwords. Quarantining (isolating) Device1 immediately stops the suspicious activity originating from that device, contains the incident, and requires a single action from the Defender portal. Disabling users or resetting passwords would impact users and add administrative overhead without necessarily invalidating existing Kerberos tickets.
Question 147
You have 500 on-premises devices.
You have a Microsoft 365 E5 subscription that uses Microsoft Defender 365.
You onboard 100 devices to Microsoft Defender 365.
You need to identify any unmanaged on-premises devices. The solution must ensure that only specific onboarded devices perform the discovery.
What should you do first?
A. Create a device group.
B. Create an exclusion.
C. Set Discovery mode to Basic.
D. Create a tag.
Show Answer
Correct Answer: D
Explanation: To identify unmanaged on-premises devices while ensuring that only specific onboarded devices perform discovery, you must first create a device tag. In Microsoft Defender for Endpoint, Standard discovery (which actively discovers unmanaged devices) can be limited to only devices that have specific tags. Creating the tag is the prerequisite step; afterward, you assign the tag to selected onboarded devices and configure discovery to use only devices with that tag. Other options do not control which specific devices perform discovery.
Question 148
You have an Azure subscription.
You need to stream the Microsoft Graph activity logs to a third-party security information and event management (SIEM) tool. The solution must minimize administrative effort.
To where should you stream the logs?
A. an Azure Event Hubs namespace
B. an Azure Storage account
C. an Azure Event Grid namespace
D. a Log Analytics workspace
Show Answer
Correct Answer: A
Explanation: Microsoft Graph activity logs support streaming directly to Azure Event Hubs, which is the recommended and lowest-effort integration point for third-party SIEM tools. Event Hubs is designed for high-throughput event streaming and is natively supported by most SIEM platforms, whereas Storage, Event Grid, or Log Analytics would require additional configuration or export steps.
Question 149
HOTSPOT
-
You have an Azure subscription that contains 50 virtual machines.
You plan to deploy Microsoft Defender for Cloud.
You need to enable agentless scanning for 40 virtual machines. The solution must create disk snapshots of the virtual machines and perform out-of-band analysis of the snapshots.
What should you do? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Show Answer
Correct Answer: Defender CSPM
Tagging
Explanation: Agentless VM scanning that creates disk snapshots and performs out-of-band analysis is provided by the Defender Cloud Security Posture Management (CSPM) plan. Specific virtual machines are excluded from agentless scanning by applying resource tags and configuring Defender for Cloud to honor those tags.
$19
Get all 370 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.
