You have a Microsoft 365 E5 subscription that contains a device named Device1.
From the Microsoft Defender portal, you discover that an alert was triggered for Device1.
From the Device inventory page, you isolate Device1.
You need to collect a list of installed programs on Device1.
What should you do?
A. Collect an investigation package and download the results from the Action center.
B. Initiate a live response session and run the analyze command.
C. Run an advanced hunting query against the DeviceProcessEvents table.
D. Run an advanced hunting query against the DeviceTvmInfoGathering table.
Show Answer
Correct Answer: A
Explanation: The correct choice is A. After a device is isolated in Microsoft Defender for Endpoint, you can still use response actions such as collecting an investigation package. The investigation package includes forensic information such as installed programs, running processes, services, registry data, and other diagnostic artifacts. Advanced hunting tables do not directly provide a current installed-program list for an isolated device, and the live response 'analyze' command is not used to enumerate installed software.
Question 44
You have a Microsoft 365 E5 subscription that contains a device named Device1.
From the Microsoft Defender portal, you discover that an alert was triggered for Device1.
From the Device inventory page, you isolate Device1.
You need to collect a list of installed programs on Device1.
What should you do?
A. Initiate a live response session and run the processes command.
B. Initiate an automated investigation and view the results in the Action center.
C. Initiate a live response session and run the analyze command.
D. Run an advanced hunting query against the DeviceTvmSoftwareInventory table.
Show Answer
Correct Answer: D
Explanation: The DeviceTvmSoftwareInventory advanced hunting table contains the software inventory for devices collected by Microsoft Defender Vulnerability Management. Device isolation does not prevent querying existing inventory data from the service. The live response commands listed do not provide an installed software inventory, and automated investigation focuses on remediation rather than listing installed programs.
Question 46
You have a Microsoft 365 E5 subscription that uses Microsoft Defender XDR.
You have a custom detection rule named Rule1 that generates an alert if more than five antivirus detections are identified on a device. Rule1 has a lookback period of 12 hours.
You need to change the lookback period to 48 hours.
What should you modify for Rule1?
A. the scope
B. the summarize operator of the KQL query
C. the frequency
D. the where operator of the KQL query
Show Answer
Correct Answer: C
Explanation: In Microsoft Defender XDR custom detection rules, the lookback period is determined by the rule frequency setting. Increasing the lookback from 12 hours to 48 hours requires changing the frequency configuration. A KQL where clause can further restrict data within the platform-provided lookback window but does not extend the rule's lookback period. The summarize operator affects aggregation, and scope determines which entities the rule applies to.
Question 47
You have an Azure subscription that uses Microsoft Defender for Cloud.
You need to configure Defender for Cloud to mitigate the following risks:
• Vulnerabilities within the application source code
• Exploitation toolkits in declarative templates
• Operations from malicious IP addresses
• Exposed secrets
Which two Defender for Cloud services should you use? Each correct answer presents part of the solution.
NOTE: Each correct answer is worth one point.
A. Microsoft Defender for APIs
B. Microsoft Defender for Resource Manager
C. Microsoft Defender for App Service
D. Microsoft Defender for Servers
E. Microsoft Defender for DevOps
Show Answer
Correct Answer: B, E
Explanation: Microsoft Defender for DevOps scans source code repositories and CI/CD pipelines for code vulnerabilities, exposed secrets, and Infrastructure-as-Code (declarative template) security issues. Microsoft Defender for Resource Manager monitors Azure Resource Manager control-plane operations and detects suspicious management actions, including operations originating from known malicious IP addresses using Microsoft threat intelligence.
Question 48
HOTSPOT
-
You have a Microsoft 365 subscription. The subscription contains 500 Windows 11 devices that are onboarded to Microsoft Defender for Endpoint.
You need to configure Defender for Endpoint to meet the following requirements:
• Ensure that security operation analysts can run PowerShell scripts on client computers.
• Perform the automatic remediation of threats on client computers.
Which Endpoints settings should you configure in the Microsoft Defender XDR portal? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Show Answer
Correct Answer: Live Response in Advanced features
Device groups
Explanation: Live Response enables security analysts to remotely run PowerShell scripts on onboarded devices. Automatic remediation levels are configured through Device groups, where you set the automated remediation level (Full, Semi, or Manual) for devices.
Question 49
HOTSPOT
-
You have an Azure subscription named Sub1. Sub1 contains a Microsoft Sentinel workspace named SW1 and a virtual machine named VM1 that runs Windows Server. SW1 collects security logs from VM1 by using the Windows Security Events via AMA connector.
You need to limit the scope of events collected from VM1. The solution must ensure that only audit failure events are collected.
How should you complete the filter expression for the connector? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Show Answer
Correct Answer: First: System[
Second: Keywords
Explanation: In Windows Event XPath filters, the Keywords field is part of the System section. To collect only audit failure events, filter on the System/Keywords value corresponding to audit failure.
Question 50
You have a Microsoft 365 E5 subscription.
You have the following KQL query.
You need to use the query to create a Microsoft Defender XDR custom detection rule that can isolate an onboarded device.
How should you modify the query?
A. Add the AccountUpn and Timestamp columns to the project operator.
B. Add a distinct operator.
C. Add a summarize operator.
D. Add the DeviceId and Timestamp columns to the project operator.
Show Answer
Correct Answer: D
Explanation: Microsoft Defender XDR custom detection rules that perform device actions such as device isolation must return the DeviceId so the platform can identify the target device. The Timestamp column is also required for custom detection results. Therefore, modify the query so the project operator includes both DeviceId and Timestamp.
Question 51
HOTSPOT
-
You have an Azure subscription named Sub1 that contains a Microsoft Sentinel workspace named WS1.
You need to create a hunting query in WS1 that meets the following requirements:
• Returns the number of changes performed daily by each Microsoft Entra security principal during a seven-day period
• Identifies all the successful changes to the resources in Sub1
• Substitutes any missing data points with 0
How should you complete the KQL query? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Show Answer
Correct Answer: AzureActivity
make-series
Explanation: AzureActivity contains Azure Resource Manager activity logs for resource write operations. The make-series operator creates daily time series by Caller over the last 7 days and supports default=0 to fill missing data points.
Question 52
DRAG DROP
-
You have an Azure subscription that contains a Microsoft Sentinel workspace.
You need to create and customize a workbook for the Microsoft Entra ID Audit Logs.
Which three actions should you perform in sequence? To answer, move the appropriate actions from the list of actions to the answer area and arrange them in the correct order.
Show Answer
Correct Answer: 1. From Content hub, install the Microsoft Entra ID solution.
2. From Workbooks, select Microsoft Entra ID Audit logs and then select View Template.
3. From Workbooks, select Microsoft Entra ID Audit logs and then select Save.
Explanation: Install the solution to make the workbook template available. Open the workbook template to customize it, then save it as your own workbook.
Question 53
HOTSPOT
-
You have a Microsoft Sentinel workbook that contains the following KQL query.
You need to create a visual that will change the color of the errCount column based on the value returned.
How should you configure the visual? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Explanation: To color a grid column based on its numeric value, use a Grid visualization and apply the Heatmap column renderer to the numeric errCount column. Thresholds are formatting settings within supported renderers, but the column renderer for value-based coloring is Heatmap.
$19
Get all 383 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.
