HOTSPOT
-
You have an Azure subscription that contains a user named User1 and a Microsoft Sentinel workspace named Workspace1.
You need to ensure that User1 can create workbooks and playbooks in Workspace1. The solution must meet the following requirements:
• Minimize the number of roles assigned to User1.
• Follow the principle of least privilege.
Which roles should you assign to User1, and at which scope should you assign the roles? To answer, select the appropriate options in the answer area.
NOTE: Each correct solation is worth one point.
Show Answer
Correct Answer: Roles: Microsoft Sentinel Contributor and Logic App Contributor
Scope: Resource group
Explanation: Creating Sentinel workbooks requires Microsoft Sentinel Contributor, while creating playbooks requires Logic App Contributor. Assigning both at the resource group scope provides the required permissions without granting broader subscription-wide access, and workspace scope is insufficient for Logic Apps.
Question 12
HOTSPOT
-
You have a Microsoft Sentinel workspace named Workspace1 that contains a table named CommonSecurityLog.
You ingest logs into CommonSecurityLog. CommonSecurityLog has an average log ingestion time of five minutes.
You need to create an analytics rule that has a lookback period of seven minutes and uses the data in the CommonSecurityLog table. The solution must meet the following requirements:
• Prevent the same event from being processed twice.
• Minimize the number of missed events due to log ingestion delays.
How should you complete the KQL query that defines the rule? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Explanation: Extend the TimeGenerated window by the expected ingestion delay to capture late-arriving events, then filter by ingestion_time() over only the rule lookback window to avoid processing the same ingested event multiple times across overlapping executions.
Question 13
DRAG DROP
-
You have a Microsoft 365 subscription that uses Microsoft Defender XDR and contains a user named User1.
You need to ensure that User1 can identify endpoint vulnerabilities on devices affected by a security incident. The solution must NOT require that User1 have KQL knowledge.
Which three actions should User1 perform in the Microsoft Defender portal in sequence? To answer, move the appropriate actions from the list of actions to the answer area and arrange them in the correct order.
Show Answer
Correct Answer: Select Advanced hunting.
Specify a data domain and a filter.
Select Query in builder.
Explanation: Advanced hunting includes a query builder that does not require KQL. Choose the relevant data domain and filter, then use Query builder to identify endpoint vulnerabilities related to affected devices.
Question 14
HOTSPOT
-
You have a Microsoft 365 E5 subscription.
You need to configure Microsoft Sentinel to collect logs from Microsoft Entra.
Which two nodes should you use in the Microsoft Defender portal? To answer, select the appropriate nodes in the answer area.
NOTE: Each correct answer is worth one point.
Show Answer
Correct Answer: Content hub
Data connectors
Explanation: Install the Microsoft Entra ID solution from the Content hub (if needed) and enable the Microsoft Entra ID data connector under Configuration > Data connectors to collect Microsoft Entra logs.
Question 15
You have a Microsoft 365 subscription.
You have the devices shown in the following table.
All the devices are onboarded to Microsoft Defender for Endpoint.
You are investigating a potential malware exploit on the devices.
You need to review the system log of each device. The solution must minimize disruptions to the devices.
What should you do for each device first in the Microsoft Defender portal?
A. Isolate the device.
B. Collect an investigation package.
C. Initiate an automated investigation.
D. Initiate a live response session.
Show Answer
Correct Answer: B
Explanation: To review system logs while minimizing disruption, first use Collect an investigation package. This action gathers relevant diagnostic data, including system and event logs, into a package for offline analysis without isolating the device or starting an interactive session. Device isolation is disruptive, automated investigation is intended for remediation workflows rather than simply retrieving logs, and live response is an interactive remote shell that is more intrusive than necessary.
Question 16
You have a Microsoft Sentinel workspace that contains the following tables.
You need to investigate the log data by using a search.
Which tables can you search?
A. Table3 only
B. Table1 and Table3 only
C. Table3 and Table4 only
D. Table1, Table3, and Table4 only
E. Table1, Table2, Table3, and Table4
Show Answer
Correct Answer: E
Explanation: The question refers to investigating log data by using a search. Search jobs can search across Analytics, Basic, and archived data, so all listed tables are searchable in that context.
Sources:
https://learn.microsoft.com/en-us/azure/sentinel/workspaces-defender-portal
Question 17
You have an on-premises virtual machine named VM1 that runs Windows Server.
You have a Microsoft Sentinel workspace named Workspace1.
You install the Azure Connected Machine agent on VM1.
You need to collect events from VM1 and send the events to Workspace1.
Which two actions should you perform? Each correct answer presents part of the solution.
NOTE: Each correct answer is worth one point.
A. OnVM1, install the Microsoft Monitoring Agent.
B. On VM1, install the Log Analytics agent.
C. From the Microsoft Defender portal, add the Windows Security Events via AMA data connector.
D. From the Microsoft Defender portal, add the Syslog via AMA data connector.
E. On VM1, enable the Azure Monitor Agent extensions.
F. From the Microsoft Defender portal, create a data collection rule (DCR) that targets VM1.
Show Answer
Correct Answer: E, F
Explanation: Azure Arc–enabled servers use the Azure Monitor Agent (AMA), delivered as an Azure Monitor Agent extension on the connected machine. To collect Windows events, you must enable the AMA extension and create a Data Collection Rule (DCR) targeting the machine. The Windows Security Events via AMA data connector is used to ingest security events into Microsoft Sentinel, but the question asks for collecting events from the VM after installing the Azure Connected Machine agent; AMA plus a DCR are the required configuration steps.
Sources:
https://learn.microsoft.com/en-us/azure/azure-monitor/vm/data-collection-windows-events
Question 18
You have three Azure subscriptions. Each subscription contains multiple virtual machines that run Windows Server.
You have a Microsoft Sentinel workspace.
You need to ensure that failed sign-in attempts from all the virtual machines can be analyzed by using Microsoft Sentinel. The solution must minimize administrative effort.
What should you do first?
A. From the Microsoft Defender portal, install the Windows Security Events solution.
B. On each virtual machine, create an event subscription.
C. On each virtual machine, install the Azure Connected Machine agent.
D. From the Microsoft Defender portal, install the Syslog solution.
Show Answer
Correct Answer: A
Explanation: To analyze failed Windows sign-in attempts in Microsoft Sentinel, you need to ingest Windows Security event logs. The Windows Security Events solution is the recommended onboarding method and uses Azure Monitor Agent with Data Collection Rules, allowing centralized deployment across multiple subscriptions with minimal per-VM administration. Creating event subscriptions on every VM is unnecessary, Azure Connected Machine agent is for Arc management rather than security event collection, and Syslog is for Linux/Unix systems.
Question 19
You have a Microsoft 365 subscription that uses Microsoft Defender XDR. The subscription contains 500 devices that are joined to Microsoft Entra, are in the Microsoft Defender for Endpoint default device group, and are managed by using Microsoft Intune.
You need to implement Microsoft Defender Vulnerability Management. The solution must minimize the administrative effort.
What should you do first in the Microsoft Defender portal?
A. From Configuration management, configure the Enforcement scope settings.
B. Configure auto remediation for the default device group.
C. Set Microsoft Intune connection to On.
D. Set Live Response to On.
Show Answer
Correct Answer: C
Explanation: The first step to enable Microsoft Defender Vulnerability Management remediation with Intune-managed devices is to enable the Microsoft Intune connection in the Microsoft Defender portal. This integrates Defender with Intune so remediation actions can be deployed. Enforcement scope and auto remediation are configured afterward, and Live Response is unrelated to Vulnerability Management setup.
Question 20
HOTSPOT
-
You have the resources shown in the following table.
You have an Azure subscription that uses Microsoft Defender for Cloud.
You need to use Defender for Cloud to protect VM1 and Server1. The solution must meet the following requirements:
• Support Advanced Threat Protection and vulnerability assessment.
• Register each SQL Server 2022 instance as a SQL virtual machine.
• Minimize implementation and administrative effort.
What should you deploy to each server? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Show Answer
Correct Answer: VM1: A VM extension only
Server1: Azure Connected Machine agent and VM extension
Explanation: Azure SQL VMs can be registered and protected using the SQL IaaS/Defender VM extension. An on-premises server must first be Azure Arc-enabled with the Azure Connected Machine agent, then use the VM extension to enable SQL Server capabilities and Defender integration.
$19
Get all 383 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.
