HOTSPOT
-
You have a Microsoft 365 subscription.
You need to identify all the security principals that submitted requests to change or delete groups.
How should you complete the KQL query? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Show Answer
Correct Answer: RequestUri
"GET"
Explanation: Filter on RequestUri containing '/group' to target group operations. Excluding GET (RequestMethod != "GET") returns change/delete and other non-read requests. Projecting AppId, UserId, and ServicePrincipalId identifies the security principals.
Question 157
You have a Microsoft 365 subscription that uses Microsoft Defender for Endpoint Plan 2 and contains 500 Windows devices.
You plan to create a Microsoft Defender XDR custom deception rule.
You need to ensure that the rule will be applied to only 10 specific devices.
What should you do first?
A. Add custom lures to the rule.
B. Add the IP address of each device to the list of decoy accounts and hosts of the rule.
C. Add the devices to a group.
D. Assign a tag to the devices.
Show Answer
Correct Answer: D
Explanation: Microsoft Defender XDR custom deception rules can be scoped to all Windows client devices or to devices with specific tags. To target only 10 devices, you must first assign a common tag to those devices, then configure the rule scope to use that tag. Device groups are not used for deception rule scoping, and custom lures or decoy account/host entries do not determine which endpoints receive the rule.
Question 158
HOTSPOT
-
You have a Microsoft 365 E5 subscription that uses Microsoft Defender for Endpoint.
You have the on-premises devices shown in the following table.
You are preparing an incident response plan for devices infected by malware.
You need to recommend response actions that meet the following requirements:
• Block malware from communicating with and infecting managed devices.
• Do NOT affect the ability to control managed devices.
Which actions should you use for each device? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Show Answer
Correct Answer: Device1: Isolate device and Initiate Automated Investigation only
Device2: Contain device only
Explanation: Managed/onboarded Windows Server devices support isolation and automated investigation. Unmanaged discovered devices are handled with device containment to prevent communication with managed devices without requiring onboarding.
Question 159
DRAG DROP
-
You have a Microsoft Sentinel workspace named SW1.
In SW1, you enable User and Entity Behavior Analytics (UEBA).
You need to use KQL to perform the following tasks:
• View the entity data that has fields for each type of entity.
• Assess the quality of rules by analyzing how well a rule performs.
Which table should you use in KQL for each task? To answer, drag the appropriate tables to the correct tasks. Each table may be used once, more than once, or not at all. You may need to drag the split bar between panes or scroll to view content.
NOTE: Each correct selection is worth one point.
Explanation: BehaviorAnalytics contains UEBA entity records with fields for different entity types. Among the provided options, Anomalies is the best match for evaluating analytics/rule outcomes, although a more specific rule statistics table exists outside the listed choices.
Question 160
You have an Azure subscription that uses Microsoft Sentinel.
You need to minimize the administrative effort required to respond to the incidents and remediate the security threats detected by Microsoft Sentinel.
Which two features should you use? Each correct answer presents part of the solution.
NOTE: Each correct selection is worth one point.
A. Microsoft Sentinel workbooks
B. Azure Automation runbooks
C. Microsoft Sentinel automation rules
D. Microsoft Sentinel playbooks
E. Azure Functions apps
Show Answer
Correct Answer: C, D
Explanation: Microsoft Sentinel automation rules automate incident handling by triggering actions when incidents are created or updated, reducing manual triage. Microsoft Sentinel playbooks (built on Azure Logic Apps) automate response and remediation workflows such as blocking indicators, disabling accounts, notifying teams, and integrating with external systems. Workbooks are for visualization, Azure Automation runbooks are not Sentinel's primary incident response automation mechanism, and Azure Functions are custom code rather than the built-in feature for minimizing administrative effort.
Question 161
You have a Microsoft 365 subscription that uses Microsoft Defender for Endpoint Plan 2 and contains 1,000 Windows devices.
You have a PowerShell script named Script1.ps1 that is signed digitally.
You need to ensure that you can run Script1.ps1 in a live response session on one of the devices.
What should you do first from the live response session?
A. Run the library command.
B. Upload Script1.ps1 to the library.
C. Run the putfile command.
D. Modify the PowerShell execution policy of the device.
Show Answer
Correct Answer: B
Explanation: Before a script can be executed during a Microsoft Defender for Endpoint live response session, it must be available in the Live Response library. After it is uploaded to the library, it can be run from the session. The library command only lists library contents, putfile transfers files to the endpoint rather than registering them for execution, and changing the PowerShell execution policy is not the required first step.
Question 162
You have an Azure subscription that has Microsoft Defender for Cloud enabled.
You have a virtual machine named Server1 that runs Windows Server 2022 and is hosted in Amazon Web Services (AWS).
You need to collect logs and resolve vulnerabilities for Server1 by using Defender for Cloud.
What should you install first on Server1?
A. the Microsoft Monitoring Agent
B. the Azure Monitor agent
C. the Azure Connected Machine agent
D. the Azure Pipelines agent
Show Answer
Correct Answer: C
Explanation: Server1 is hosted in AWS, so it must first be onboarded to Azure through Azure Arc by installing the Azure Connected Machine agent. Once connected, Microsoft Defender for Cloud can enable capabilities such as log collection (via Azure Monitor agent as an extension where needed) and vulnerability assessment. The Microsoft Monitoring Agent is legacy, the Azure Monitor agent alone does not onboard non-Azure machines, and the Azure Pipelines agent is unrelated.
Question 163
You have a Microsoft Sentinel workspace that contains a custom workbook named Workbook1.
You need to create a visual based on the SecurityEvent table. The solution must meet the following requirements:
• Identify the number of security events ingested during the past week.
• Display the count of events by day in a timechart.
What should you add to Workbook1?
A. a query
B. a metric
C. a group
D. links or tabs
Show Answer
Correct Answer: A
Explanation: Add a query control to the workbook. A KQL query against the SecurityEvent table can filter to the last 7 days, summarize the event count by day, and render the results as a timechart. Metrics are for Azure Monitor metrics, while groups and links/tabs are layout/navigation elements.
Question 164
You have a Microsoft 365 E5 subscription that uses Microsoft Defender XDR and contains a user named User1.
You need to ensure that User1 can manage Microsoft Defender XDR custom detection rules and Endpoint security policies. The solution must follow the principle of least privilege.
Which role should you assign to User1?
A. Security Administrator
B. Security Operator
C. Cloud Device Administrator
D. Desktop Analytics Administrator
Show Answer
Correct Answer: A
Explanation: Managing Microsoft Defender XDR custom detection rules and Endpoint security policies requires administrative configuration permissions. The Security Administrator role can manage security settings, custom detection rules, and endpoint security policy access, whereas Security Operator is intended for investigating and responding to threats rather than configuring policies. Cloud Device Administrator and Desktop Analytics Administrator do not provide the required Defender XDR security management permissions.
Question 165
HOTSPOT
-
You have a Microsoft Sentinel workspace.
You plan to visualize data from Microsoft SharePoint Online and OneDrive sites.
You need to create a KQL query for the visual. The solution must meet the following requirements:
• Select all workloads as a single operation.
• Include two parameters named Operations and Users.
• In the results, exclude empty values for the site URLs.
How should you complete the query? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Show Answer
Correct Answer: First dropdown: | where Operation in ((Operations))
Second dropdown: | where SiteUrl != ""
Explanation: Use the workbook parameter for Operations to filter selected values, filter SharePoint and OneDrive together with an in() clause, and exclude records with empty SiteUrl values.
$19
Get all 383 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.
