You have an Azure subscription that uses Microsoft Sentinel.
You need to create a custom workbook that will calculate the average time it takes to close security incidents. The solution must minimize administrative effort.
Which built-in Microsoft Sentinel workbook template should you select?
A. Security operations efficiency
B. Incident Overview
C. Workspace Usage Report
D. Investigation Insights
Show Answer
Correct Answer: A
Explanation: The Security operations efficiency workbook is designed to measure SOC performance metrics, including mean time to close (MTTC) incidents. Using this built-in template minimizes administrative effort while directly providing the required average incident closure time.
Question 19
You have a Microsoft 365 subscription that uses Microsoft Defender XDR, Microsoft Purview, and Exchange Online.
You have a partner company named Contoso, Ltd.
You need to review all the emails that contain PDF attachments and were received from Contoso during the past month. The solution must minimize administrative effort.
What should you use?
A. Content search
B. Content explorer
C. Activity explorer
D. Advanced Hunting
Show Answer
Correct Answer: A
Explanation: Content search in the Microsoft Purview compliance portal is designed to search Exchange Online mailboxes with simple criteria such as sender domain (Contoso), date range (past month), and attachment type (PDF). It allows quick review of matching emails with minimal setup and administrative effort. Content explorer and Activity explorer focus on data classification and user activities, while Advanced Hunting is more complex and intended for security telemetry analysis rather than straightforward email review.
Question 20
HOTSPOT
-
You have a Microsoft 365 E5 subscription that uses Microsoft Defender XDR.
You have an Azure subscription that contains a Log Analytics workspace named Workspace1.
You forward all logs to Workspace1.
You need to identify all the applications and security principals that made requests to modify Microsoft Entra groups during the previous 24 hours.
How should you complete the KQL query? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Show Answer
Correct Answer: MicrosoftGraphActivityLogs
PUT
Explanation: MicrosoftGraphActivityLogs records Microsoft Graph API calls, including Entra group modifications with AppId, UserId, and ServicePrincipalId. Using a non-GET method targets modification operations; the answer selection shown uses PUT for update-type requests.
Question 21
HOTSPOT
-
You have a Microsoft Sentinel workspace named Workspace1.
You need to create a custom workbook in Workspace1. Workspace1 must display a time chart that shows failed Microsoft Entra sign-ins from the past seven days. The solution must ensure that the chart includes a count of failed sign-ins for each day.
How should you complete the KQL query? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Show Answer
Correct Answer: summarize
by bin(TimeGenerated, 1d)
Explanation: Use summarize with count() grouped by bin(TimeGenerated, 1d) to aggregate failed sign-ins per day over the last seven days, which is required for a daily time chart.
Question 22
You have a Microsoft 365 subscription that uses Microsoft Defender XDR. The subscription contains 500 Windows 11 devices that are onboarded to Microsoft Defender for Endpoint.
You discover unauthorized changes to the membership of the Administrators group for the devices.
You need to configure a solution that meets the following requirements:
• Every hour, check the Administrators group membership of each endpoint.
• When a change to the Administrators group membership is detected, create an incident in Microsoft Defender XDR.
What should you create first?
A. a device group
B. an advanced hunting query
C. an alert tuning rule
D. a detection rule
Show Answer
Correct Answer: B
Explanation: To meet the requirement, you must first define how to detect changes to the local Administrators group. This is done by creating an advanced hunting query in Microsoft Defender XDR using KQL to identify relevant events (such as local group membership changes). That query is then used as the basis for a custom detection rule, which can be scheduled to run every hour and generate alerts and incidents. Because the detection rule depends on the query, the advanced hunting query must be created first.
Question 23
You have a Microsoft 365 E5 subscription that contains a device named Device1.
From the Microsoft Defender portal, you discover that an alert was triggered for Device1.
From the Device inventory page, you isolate Device1.
You need to collect a list of installed programs on Device1.
What should you do?
A. Collect an investigation package and download the results from the Action center.
B. Initiate a live response session and run the analyze command.
C. Run an advanced hunting query against the DeviceProcessEvents table.
D. Run an advanced hunting query against the DeviceTvmInfoGathering table.
Show Answer
Correct Answer: A
Explanation: When a device is isolated in Microsoft Defender for Endpoint, the supported way to retrieve detailed forensic data such as a list of installed programs is to collect an investigation package. The investigation package includes software inventory information and can be downloaded from the Action center. Live response commands and advanced hunting tables either do not provide a complete installed programs list in this scenario or rely on different datasets that are not appropriate for direct collection from an isolated device.
Question 24
You have a Microsoft 365 E5 subscription that contains a device named Device1.
From the Microsoft Defender portal, you discover that an alert was triggered for Device1.
From the Device inventory page, you isolate Device1.
You need to collect a list of installed programs on Device1.
What should you do?
A. Initiate a live response session and run the processes command.
B. Initiate an automated investigation and view the results in the Action center.
C. Initiate a live response session and run the analyze command.
D. Run an advanced hunting query against the DeviceTvmSoftwareInventory table.
Show Answer
Correct Answer: D
Explanation: To collect a list of installed programs on an isolated device, you should use Microsoft Defender for Endpoint advanced hunting. The DeviceTvmSoftwareInventory table is specifically designed to provide software inventory details for devices, regardless of isolation state. Live response commands are limited and not intended for full software inventory, and automated investigations focus on threat remediation rather than comprehensive program listings.
Question 26
You have a Microsoft 365 E5 subscription that uses Microsoft Defender XDR.
You have a custom detection rule named Rule1 that generates an alert if more than five antivirus detections are identified on a device. Rule1 has a lookback period of 12 hours.
You need to change the lookback period to 48 hours.
What should you modify for Rule1?
A. the scope
B. the summarize operator of the KQL query
C. the frequency
D. the where operator of the KQL query
Show Answer
Correct Answer: C
Explanation: In Microsoft Defender XDR custom detection rules, the lookback period is not controlled by the KQL query itself. It is automatically determined by the rule’s frequency setting. Changing the frequency adjusts how far back the system looks when evaluating events. The where operator only filters data already included within the platform-defined lookback window and cannot extend it. Therefore, to change the lookback period from 12 hours to 48 hours, you must modify the rule’s frequency.
Question 27
You have an Azure subscription that uses Microsoft Defender for Cloud.
You need to configure Defender for Cloud to mitigate the following risks:
• Vulnerabilities within the application source code
• Exploitation toolkits in declarative templates
• Operations from malicious IP addresses
• Exposed secrets
Which two Defender for Cloud services should you use? Each correct answer presents part of the solution.
NOTE: Each correct answer is worth one point.
A. Microsoft Defender for APIs
B. Microsoft Defender for Resource Manager
C. Microsoft Defender for App Service
D. Microsoft Defender for Servers
E. Microsoft Defender for DevOps
Show Answer
Correct Answer: B, E
Explanation: The risks span both the development pipeline and Azure control plane operations.
Microsoft Defender for DevOps mitigates pre-deployment risks by scanning application source code and Infrastructure as Code (ARM/Bicep/Terraform) for vulnerabilities, exposed secrets, and malicious patterns such as exploitation toolkits.
Microsoft Defender for Resource Manager protects the Azure control plane by monitoring deployment and management operations, detecting suspicious or malicious activities such as operations originating from known malicious IP addresses and abuse of declarative templates at deployment time.
Question 28
HOTSPOT
-
You have a Microsoft 365 subscription. The subscription contains 500 Windows 11 devices that are onboarded to Microsoft Defender for Endpoint.
You need to configure Defender for Endpoint to meet the following requirements:
• Ensure that security operation analysts can run PowerShell scripts on client computers.
• Perform the automatic remediation of threats on client computers.
Which Endpoints settings should you configure in the Microsoft Defender XDR portal? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Show Answer
Correct Answer: Live Response in Advanced features
Enable EDR in block mode in Advanced features
Explanation: Live Response allows security analysts to remotely access endpoints and run PowerShell scripts for investigation and response. Enabling EDR in block mode allows Defender for Endpoint to automatically block malicious activity and remediate threats, even when another antivirus is primary.
$19
Get all 370 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.
