Free Microsoft SC-200 Practice Questions

Correct answer: C. Activity from infrequent country

Activity from infrequent country detects when a user signs in from a location/country that is not typical for that user or uncommon across the organization. This is the policy designed to alert on sign-ins from geographically unusual locations that haven't been seen before in your tenant.

Why the other options are wrong

• A. Impossible travel detects when a user travels between distant locations in an impossibly short time period, not about locations never used by other users.
• B. Activity from anonymous IP addresses detects sign-ins from known anonymous proxies or VPNs, not about location frequency within the organization.
• D. Malware detection identifies malicious software, not sign-in location anomalies.

Correct answer: D. RegEx pattern matching

RegEx pattern matching is the correct method to detect documents containing 32-character alphanumeric patterns (customer account numbers) in DLP policies. DLP uses regex patterns to identify and classify sensitive content for protection rules.

Why the other options are wrong

• A. SharePoint search is a discovery tool but not the mechanism DLP uses to detect sensitive patterns.
• B. Hunting queries in Microsoft 365 Defender are for threat investigation, not for DLP policy creation.
• C. Azure Information Protection is a labeling and classification solution, not the detection method used within DLP policies for pattern matching.

Correct answer: B, D, E. Hide the alert; Create a suppression rule scoped to a device group; Generate the alert.

To hide false positives while maintaining security: Hide the alert (B) to remove it from the queue, create a suppression rule scoped to a device group (D) containing the accounting team devices to prevent future similar alerts on those specific devices, and enable/generate the alert mechanism (E) to ensure legitimate threats are still detected. Device group scoping maintains security posture by only suppressing on specific devices.

Why the other options are wrong

• A. Resolving the alert automatically closes it but doesn't prevent future occurrences like a suppression rule does.
• C. Creating a suppression rule scoped to any device would suppress the alert across all devices, reducing security posture.

Correct answer: A, C, D. Assign a tag to the device group; Add a tag to the machines; Create a new device group that has a rank of 1.

To temporarily group machines for automated actions: Create a new device group with rank 1 (D) to establish a temporary grouping for the sensitive devices, add tags to the machines (C) to identify and organize them, and assign a tag to the device group (A) for management purposes. Tags provide flexible temporary organization while device groups with appropriate rank enable automated action scoping.

Why the other options are wrong

• B. Adding device users to admin roles is not necessary for grouping machines.
• E. Creating a new admin role is not required for temporary device grouping.
• F. A rank of 4 is lower priority; rank 1 is higher priority and appropriate for sensitive devices requiring action.

Correct answer: A. Yes

Yes, configuring accounts as Honeytoken accounts in the Entity tags section of Microsoft Defender for Identity portal is the correct solution for setting up decoy accounts that attackers will attempt to exploit. Honeytokens are designed to be attractive targets that generate alerts when compromised.

Correct answer: B. No

No, configuring sign-in risk policy in Azure AD Identity Protection does not meet the goal. Sign-in risk policies respond to detected risky sign-ins but do not configure accounts for attackers to exploit. This is a reactive detection mechanism, not an offensive honeypot configuration.

Correct answer: B. No

No, marking an Active Directory group as Sensitive does not configure accounts for attackers to exploit. Sensitive groups designation protects existing important accounts from being compromised, but does not create honeypot accounts designed to attract and detect attackers.

Correct answer: A. Dynamic Delivery

Dynamic Delivery reduces message delivery delays by delivering the message immediately with a placeholder for attachments while they are being scanned in the background. Once scanning completes, the actual attachments are added. This maintains malware protection while improving user experience and delivery speed.

Why the other options are wrong

• B. Replace action substitutes attachments with text warnings but doesn't address delivery speed.
• C. Block and Enable redirect prevents delivery entirely until scanning completes, increasing delay.
• D. Monitor and Enable redirect provides monitoring but doesn't reduce delivery time.

Correct answer: C. a file hash indicator that has Action set to Alert and block

When dealing with a potential attack using an image file, a file hash indicator is the appropriate choice. File hash indicators allow detection and blocking of specific malicious files based on their cryptographic hash, which is ideal for image files. The Action should be set to 'Alert and block' to both detect and prevent the malicious image from executing. URL/domain indicators are used for web-based threats, and certificate indicators are for SSL/TLS certificate-based threats, neither of which apply to image file attacks.

Why the other options are wrong

• A. URL/domain indicators are for web threats, not image files.
• B. URL/domain indicators do not apply to image file-based attacks.
• D. Certificate indicators are for SSL/TLS threats, not image file exploits.

Correct answer: B. From Incidents, review the details of the IPCustomEntity entity associated with the incident.

The IPCustomEntity contains the IP address information associated with the brute force attempt, and reviewing its details in the incident will reveal geolocation information about that IP. The Potential malicious events map (A) shows events on a map but doesn't directly associate with this specific incident's geolocation data. AccountCustomEntity (C) relates to user accounts, not IP geolocation.

Why the other options are wrong

• A. The Potential malicious events map is a general overview, not specific to incident entity geolocation details.
• C. AccountCustomEntity relates to user accounts and credentials, not IP geolocation.
• D. Investigation insights are broader; entity-level IP details are more direct for geolocation.

Correct answer: A. Microsoft Sentinel Responder

The Microsoft Sentinel Responder role is the least privileged role that allows users to investigate and respond to incidents. It provides permissions to view, investigate, and update incidents without granting broader administrative capabilities. The Responder role follows the principle of least privilege by limiting access to only incident investigation and response functions.

Why the other options are wrong

• B. Contributor role grants too many permissions, including configuration and deployment capabilities.
• C. Automation Contributor is for automation rule management, not incident investigation.
• D. Reader role only allows viewing; it does not provide permissions to investigate or update incidents.

Correct answer: A, D. cp /bin/echo ./asc_alerttest_662jfi039n; ./asc_alerttest_662jfi039n testing eicar pipe

To test Azure Defender alerts on Linux, you must first create a copy of the echo binary with the specific alert test filename (asc_alerttest_662jfi039n), then execute it with the alert test parameters. The first command (A) creates the test file by copying the echo binary with the required name. The second command (D) executes this test file with the 'testing eicar pipe' parameters, which triggers the alert simulation that Azure Defender detects and reports.

Why the other options are wrong

• B. Running alert test commands without first creating the correctly-named asc_alerttest file will fail.
• C. Using 'alerttest' as the filename instead of 'asc_alerttest_662jfi039n' will not trigger the proper alert mechanism.

Correct answer: A. Microsoft Sentinel - Incidents

The Microsoft Sentinel - Incidents page in the Azure portal provides a unified view of incidents from multiple workspaces when accessed at the subscription or tenant level. This allows viewing all 50 workspaces' incidents on a single page with minimal administrative effort. The Log Analytics workspaces page does not provide incident views, workbooks are for visualization only, and the generic Sentinel page does not offer consolidated incident views.

Why the other options are wrong

• B. Workbooks are visualization tools, not incident viewing interfaces.
• C. The generic Microsoft Sentinel page does not provide consolidated multi-workspace incident views.
• D. Log Analytics workspaces page does not display Sentinel incidents.

Correct answer: B. No

Controlled folder access is a ransomware protection feature that prevents unauthorized apps from modifying files in protected folders. However, the goal is to protect devices from malicious artifacts undetected by third-party antivirus. Controlled folder access does not detect or prevent undetected malware; it only restricts file modifications. This does not address the core requirement of detecting and protecting against malware that bypassed the third-party solution.

Why the other options are wrong

• A. Controlled folder access is a containment feature, not a detection mechanism for undetected malware.

Correct answer: C. Azure Event Hubs

Azure Event Hubs is the appropriate service for continuous export of Security Center alerts to third-party SIEM solutions. Event Hubs provides real-time data streaming capabilities that allow SIEM systems to consume alerts as they are generated, making it ideal for security operations centers that need immediate access to threat intelligence.

Why the other options are wrong

• A. Azure Cosmos DB is a NoSQL database, not designed for real-time alert streaming to SIEM systems.
• B. Azure Event Grid is for event-driven architecture but is not the standard mechanism for SIEM integration.
• D. Azure Data Lake is a data storage solution, not designed for real-time alert export to external systems.

Correct answer: B. union kind = inner

The union operator with kind=inner is correct for combining multiple tables while retaining all rows from each table. The question asks to 'link' tables and 'return all rows in the tables,' which describes a union operation rather than a join. A union operation appends rows from multiple tables with the same schema, whereas a join combines tables based on common columns, which would reduce rows based on matching criteria.

Why the other options are wrong

• A. The search operator is for searching content across tables, not for linking/combining specific tables
• C. A join operation would only return matching rows between tables, not all rows as required
• D. The evaluate hint.remote operator is for remote query execution and doesn't combine tables

Correct answer: A. Endpoint security

The Endpoint security node in Microsoft Intune admin center is specifically designed to manage security configurations, baselines, and their deployment status. It provides detailed reporting on which devices have received or failed to receive security baselines, along with specific baseline information. This is the dedicated area for monitoring baseline compliance and troubleshooting deployment issues.

Why the other options are wrong

• B. Apps is used for application management and deployment, not security baseline tracking.
• C. Devices shows device inventory but lacks the detailed baseline compliance reporting needed.
• D. Groups is for group management, not for monitoring baseline compliance status.

Correct answer: D. Create an automation rule.

An automation rule can suppress or dismiss alerts for specific entities based on conditions, preventing false positive alerts for that account while allowing legitimate alerts to continue for other accounts. This provides granular, low-effort control without modifying the underlying detection rule.

Why the other options are wrong

• A. Modifying the analytics rule would affect all accounts, not just the problematic one, and would lose legitimate detections.
• B. A watchlist stores reference data and cannot be used to suppress alerts.
• C. Activity templates in entity behavior are for modeling normal activity patterns, not for suppressing specific alerts.

Correct answer: D. Reader

The Reader role provides the minimum permissions needed to view and export alert data from Microsoft Defender for Cloud without the ability to make changes or manage access. User Access Administrator, Owner, and Contributor all grant excessive permissions beyond what is needed for exporting alerts, violating the principle of least privilege.

Why the other options are wrong

• A. User Access Administrator can manage role assignments, which exceeds export-only requirements.
• B. Owner has full control of the subscription, far exceeding the need to export alerts.
• C. Contributor can create and modify resources, which is unnecessary for exporting alert data.

Correct answer: D. an automation rule

An automation rule must be created first to define the trigger conditions and response actions that will launch the logic app when Microsoft Sentinel detects Azure AD alerts. Automation rules connect detection rules to playbooks/logic apps and orchestrate the response workflow.

Why the other options are wrong

• A. A repository connection is for source control integration, not for triggering logic apps.
• B. A watchlist is for storing reference data, not for automating logic app launches.
• C. An analytics rule detects threats but doesn't directly trigger logic apps; an automation rule is needed for that connection.

Correct answer: A, E. Configure auto-provisioning by setting the security event storage to Common; From Defender for Cloud in the Azure portal, enable Microsoft Defender for Servers.

To collect event data from Windows VMs with minimal effort and cost, you should: (A) Configure auto-provisioning with security event storage set to 'Common' to collect essential events without unnecessary volume, and (E) Enable Microsoft Defender for Servers which automatically deploys the necessary agents and configurations. These two actions together provide automated deployment across all 100 VMs with appropriate data collection settings.

Why the other options are wrong

• B. Microsoft Endpoint Manager enrollment is for device management, not specifically for Defender for Cloud event collection
• C. Azure Event Grid subscription is not the primary method for collecting security event data from VMs in Defender for Cloud
• D. Setting security event storage to 'All Events' increases costs unnecessarily when 'Common' meets the requirement to minimize costs

Correct answer: B, D. Associate a playbook to the analytics rule that triggered the incident; Add a playbook.

To send a Teams message when a sign-in risk incident is activated, you need to add a playbook (containing the Teams notification logic) and associate it to the analytics rule that generates the sign-in risk incidents. This ensures the playbook triggers automatically when the rule detects and creates the incident.

Why the other options are wrong

• A. Entity behavior analytics detects anomalies but doesn't send notifications
• C. Fusion rule detects advanced attacks but isn't specifically for sign-in risk
• E. Workbooks visualize data but don't execute automated actions

Correct answer: C. count

The count function aggregates data by counting occurrences within groups, which is the fundamental operation needed to create a bar graph showing the number of security alerts by category or dimension. When combined with summarize, count produces the aggregated values necessary for bar chart visualization.

Why the other options are wrong

• A. extend adds calculated columns but doesn't aggregate for visualization
• B. bin groups continuous values for time aggregation, not typical bar graphs
• D. workspace references a workspace but doesn't perform counting aggregation

Correct answer: C. the Azure Arc agent

To enable Microsoft Defender for Cloud to manage and monitor resources outside of Azure (such as AWS EC2 instances), the Azure Arc agent must be installed first. Azure Arc extends Azure management capabilities to non-Azure resources. While the Azure Monitor agent or Microsoft Monitoring Agent might be installed afterward for log collection, Azure Arc is the prerequisite for onboarding non-Azure machines to Defender for Cloud.

Why the other options are wrong

• A. Microsoft Monitoring Agent alone cannot connect AWS resources to Defender for Cloud without Azure Arc.
• B. Azure Monitor agent requires Azure Arc connectivity first to function on non-Azure machines.
• D. Azure Pipelines agent is for CI/CD pipelines, not for security monitoring.

Correct answer: A. notebooks in Azure Sentinel

Notebooks in Azure Sentinel provide an interactive environment where you can visualize data, integrate third-party data sources, and enrich data to identify indicators of compromise. Notebooks support Python and KQL, allowing complex analysis and enrichment workflows with external sources.

Why the other options are wrong

• B. Cloud App Security focuses on cloud application security, not general IoC identification
• C. Azure Monitor is for monitoring and alerting, not for enriching with third-party IoC data
• D. Hunting queries search for threats but lack the enrichment and visualization capabilities of notebooks

Correct answer: B. No

A hunting bookmark does not meet the goal of creating an automated incident when a malicious IP sign-in is detected. Hunting bookmarks are manual investigation tools used by analysts to mark interesting query results for later review. They do not automatically create incidents. An automated scheduled analytics rule is required for this functionality.

Correct answer: E, F. From Cloud apps, select Files, and then select New policy from search; From Settings, select Information Protection, select Azure Information Protection, and then select Automatically scan new files for Azure Information Protection classification labels and content inspection warnings.

To generate alerts and remediation actions for external sharing of confidential files: E - Create a new policy from the Files search interface to define the detection rules, and F - Enable automatic scanning of new files for Azure Information Protection labels to identify confidential content that triggers the policy.

Why the other options are wrong

• A. Limiting to only classification labels restricts detection and is the opposite of what's needed.
• B. Filtering by Document type doesn't address the core requirement of detecting external sharing.
• C. File monitoring alone doesn't create alerts; policies are needed for that.
• D. Filtering by Office 365 app is too narrow; the solution needs to detect sharing across cloud apps.

Correct answer: C. Evidence and Response

The Evidence and Response tab within an incident details page in Microsoft 365 Defender portal displays all entities affected by an incident, including devices, users, emails, and other affected assets. This tab provides a comprehensive view of the incident's scope and impact across all affected entities.

Why the other options are wrong

• A. Investigations tab shows investigation details but is not the primary location for viewing all affected entities.
• B. Devices tab shows device-specific information, not all entity types affected by an incident.
• D. Alerts tab shows individual alerts that triggered the incident, not consolidated affected entities.

Correct answer: C. Pricing & settings

Email notifications for security alerts in Security Center are configured in the 'Pricing & settings' section, specifically under the 'Email notifications' settings. This is where you specify which email addresses should receive alerts and configure notification preferences for different alert severities.

Why the other options are wrong

• A. Security solutions are for third-party integrations, not notification settings.
• B. Security policy relates to compliance and enforcement rules, not alert notifications.
• D. Security alerts is where you view alerts, not where you configure notification delivery.
• E. Azure Defender is the service providing detections, not where notification settings are configured.

Correct answer: C. On VM1, trigger a PowerShell alert.

Before creating a custom alert suppression rule, you must first trigger the actual alert on VM1. This generates the alert data needed to create specific suppression rules based on the alert's properties. Once the alert is generated, you can view its details in Defender for Cloud and create a rule to suppress similar false positives based on the alert's characteristics.

Why the other options are wrong

• A. Exporting alerts is not necessary before creating a suppression rule; you need to generate the alert first
• B. Workflow automation is for automating responses to alerts, not for creating suppression rules
• D. The Get-MPThreatCatalog cmdlet is for Windows Defender threat catalog management, not for creating alert suppression rules

Correct answer: C, D. Microsoft Sentinel automation rules; Microsoft Sentinel playbooks

Microsoft Sentinel automation rules and playbooks together enable automated incident response and remediation with minimal administrative effort. Automation rules trigger responses based on incident properties, and playbooks execute remediation actions. Bookmarks are manual, and while Azure Automation and Functions can help, playbooks and automation rules are the primary built-in Sentinel features for this purpose.

Why the other options are wrong

• A. Bookmarks are manual tools for marking incidents, not automated response mechanisms.
• B. Azure Automation runbooks are external to Sentinel; playbooks are the built-in solution.
• E. Azure Functions are not the primary Sentinel feature for incident response automation.

Correct answer: A, B. Add a playbook; Associate a playbook to an incident.

To send a Teams message automatically when suspicious sign-ins are detected, you must add a playbook (which contains the logic to send the message) and associate it to an analytics rule or incident so it triggers automatically. A playbook defines the action (Teams notification), and association ensures it executes when the condition is met.

Why the other options are wrong

• C. Entity behavior analytics detects anomalies but doesn't send notifications
• D. Workbooks visualize data but don't execute automated actions
• E. Fusion rules detect advanced attacks but don't independently send messages

Correct answer: B. No

A livestream monitors a query in real-time but does not automatically create incidents. To create incidents when detections occur, you need to use analytics rules (scheduled or NRT rules), not livestreams. Livestreams are for interactive monitoring and exploration, not incident creation.

Correct answer: C. a UEBA activity template

User and Entity Behavior Analytics (UEBA) includes built-in activity templates that automatically detect anomalies such as failed interactive sign-ins without requiring manual rule creation. UEBA activity templates are purpose-built for behavioral analysis and minimize administrative effort compared to creating custom scheduled alert queries. This aligns with the requirement to minimize administrative effort.

Why the other options are wrong

• A. A scheduled alert query would require manual creation and maintenance, increasing administrative effort.
• B. The Activity Log data connector provides activity data but does not automatically detect failed sign-ins.
• D. Hunting queries are manual investigation tools, not automated detection mechanisms.

Correct answer: C. notebooks

Notebooks in Azure Sentinel provide custom visualization capabilities and integrate Jupyter notebooks with machine learning libraries. They allow security teams to create sophisticated visualizations, perform advanced analysis, and apply machine learning algorithms to detect and investigate threats. This directly addresses both requirements: custom visualization and machine learning-based threat inference.

Why the other options are wrong

• A. Built-in queries provide standard hunting capabilities but lack custom visualization and ML integration.
• B. Livestream is for real-time monitoring of specific events, not for custom visualization or ML analysis.
• D. Bookmarks are for saving investigation findings, not for creating visualizations or applying ML.

Correct answer: D, E. From Settings, select Information Protection, select Azure Information Protection, and then select Automatically scan new files for Azure Information Protection classification labels and content inspection warnings; From Settings, select Information Protection, select Files, and then enable file monitoring.

To configure Microsoft Cloud App Security to generate alerts and trigger remediation for external sharing of confidential files, two actions are necessary. First, enabling automatic scanning of new files for Azure Information Protection labels (option D) ensures that confidential files are identified automatically. Second, enabling file monitoring in Settings > Information Protection > Files (option E) ensures that file activities are tracked and monitored. Together, these settings enable the detection and response to external sharing of confidential files.

Why the other options are wrong

• A. Selecting 'Only scan' is restrictive and would not enable new file scanning.
• B. Filtering by Office 365 is part of investigation, not initial configuration.
• C. Creating a policy from search results is not the primary configuration step.
• F. Filtering by Document type is a specific investigation action, not a configuration requirement.

Correct answer: A, D. Configure the Advanced Audit Policy Configuration settings for the domain controllers; Configure Windows Event Forwarding on the domain controllers.

To detect sensitive group modifications in Active Directory, you must configure Advanced Audit Policy Configuration on domain controllers to enable auditing of sensitive group changes (such as DirectoryServiceChanges and GroupMembership events), and configure Windows Event Forwarding to send those audit logs to Azure Sentinel for analysis and detection.

Why the other options are wrong

• B. OU permissions control access but don't enable the necessary audit logging
• C. Microsoft 365 compliance center configures Microsoft 365 auditing, not Active Directory auditing

Correct answer: B. Advanced Hunting

Advanced Hunting in Microsoft 365 Defender is the dedicated page where you create custom hunting queries using KQL (Kusto Query Language). This feature allows you to build and save tracked queries for ongoing threat assessment and hunting activities across your environment.

Why the other options are wrong

• A. Threat analytics provides pre-built threat intelligence reports, not custom query creation.
• C. Explorer is for investigating specific content and activities, not for creating custom hunting queries.
• D. Policies & rules is for configuring security policies, not for query creation.

Correct answer: B. device tags

To implement deception rules in Microsoft Defender XDR with limited scope, device tags should be created first. Device tags allow you to organize and segment devices logically, which enables scoping deception rules to specific subsets of devices. While device groups also exist, device tags provide the more granular and flexible approach for limiting the scope of deception rules across your environment.

Why the other options are wrong

• A. Device groups exist but device tags provide more granular control for scoping deception rules.
• C. Honeytoken entity tags are used for marking sensitive entities, not for scoping deception rules.
• D. Sensitive entity tags are for marking sensitive data, not for controlling deception rule scope.

Correct answer: C. Activity explorer in the Microsoft 365 compliance center

Activity Explorer in the Microsoft 365 compliance center is the dedicated tool for reviewing detailed audit logs of activities performed on information protection objects, including all changes made to sensitivity labels over a specific time period such as the past seven days. It provides searchable and filterable audit records for compliance and investigation purposes.

Why the other options are wrong

• A. The Incidents blade in Defender portal focuses on security incidents, not sensitivity label configuration changes.
• B. DLP alert settings are for configuring alert policies, not for reviewing historical changes to labels.
• D. Explorer settings on the Email & collaboration blade focus on email and collaboration threats, not label modifications.

Correct answer: B. No

The 'Prevent future attacks' section in the Take Action menu provides remediation recommendations, but the question asks about viewing recommendations to resolve the alert specifically. The correct approach involves selecting the alert and reviewing the recommendations section directly, which provides suggested actions to address the security issue. The 'Prevent future attacks' section may contain future prevention guidance but is not the primary location for resolving the current alert.

Why the other options are wrong

• A. While 'Prevent future attacks' may contain some guidance, recommendations to resolve the current alert are better found in the main recommendations section.

Correct answer: C. Collect investigation package

The 'Collect investigation package' response action is the specific action used to gather investigation packages from devices in Microsoft 365 Defender portal. This action collects forensic data and diagnostic information from the device for investigation purposes. While Live Response can be used to interact with devices, the direct action to collect investigation packages is the dedicated 'Collect investigation package' option.

Why the other options are wrong

• A. Run antivirus scan is for malware scanning, not investigation package collection
• B. Initiate Automated Investigation starts the automated investigation process, not package collection
• D. Live Response Session is an interactive tool; collection packages is the dedicated action for this purpose

Correct answer: D. Configure role-based access control (RBAC).

Role-based access control (RBAC) must be configured first to enable users to have the necessary permissions to initiate remote shell connections from the Microsoft 365 Defender portal. RBAC determines which users can perform specific actions like remote shell sessions on managed devices. Without proper RBAC roles assigned, users won't have the capability to perform remote connections regardless of other settings.

Why the other options are wrong

• A. Permissions are controlled through RBAC roles, not general permission modifications
• B. Device groups are organizational tools but not prerequisite for remote shell capability
• C. Automated investigation features are separate from remote shell connection capabilities

Correct answer: B. No

Creating a scheduled query rule for a data connector does not meet the goal. Data connectors themselves ingest data but don't create rules; you would create a scheduled analytics rule (not attached to a specific data connector) to detect the malicious IP sign-in pattern. The phrasing 'for a data connector' is incorrect, analytics rules operate on the data in the workspace, independent of which connector provides it.

Correct answer: B. Copy and executable and rename the file as ASC_AlertTest_662jfi039N.exe.

To safely simulate an attack and generate Defender for Cloud alerts without actual malicious activity, copy any executable file and rename it to ASC_AlertTest_662jfi039N.exe. Defender for Cloud recognizes this specific naming pattern and triggers a test alert when the file is executed. This is the documented method for validating alert functionality.

Why the other options are wrong

• A. The Log Analytics Troubleshooting Tool is for diagnostics, not alert simulation.
• C. Modifying Microsoft Monitoring Agent settings won't simulate an attack.
• D. Running MMASetup with a –foo argument is not a valid method for alert simulation.

Correct answer: A. at the subscription level

Azure Defender must be enabled at the subscription level to provide JIT VM access and network detections across all Azure resources in that subscription. Enabling at the workspace or resource level would not provide comprehensive coverage of these features across the subscription.

Why the other options are wrong

• B. Enabling at the workspace level only affects Log Analytics workspace-related resources, not JIT and network detections.
• C. Enabling at individual resource level is not practical and does not provide the subscription-wide coverage needed for JIT and network detections.

Correct answer: B. attack surface reduction rules in Microsoft Defender for Endpoint

Attack surface reduction (ASR) rules in Microsoft Defender for Endpoint are specifically designed to block the types of threats described: Excel macros downloading scripts, executable attachments in Outlook, and Outlook rules/forms exploits. ASR rules provide granular control over dangerous behaviors and application behaviors without requiring full application blocking. Microsoft Defender Antivirus provides basic malware detection but not behavioral blocking; Windows Defender Firewall controls network traffic; and Azure Defender adaptive application control is for server environments, not Office 365 client threats.

Why the other options are wrong

• A. Antivirus alone does not provide specific behavioral blocking for Office exploits.
• C. Windows Firewall controls network access, not Office macro or attachment execution.
• D. Adaptive application control is for Azure Defender on servers, not Office 365 desktop threats.

Correct answer: B. Create an import file that contains the IP address of 171.23.34.32/27. Select Import and import the file.

The CIDR notation 171.23.34.32/27 efficiently represents the entire IP range 171.23.34.32-171.23.34.63 (32 addresses) with a single entry. Importing this via file using CIDR notation minimizes administrative effort compared to manually entering 32 individual IPs or using the single-entry Add indicator interface for each address.

Why the other options are wrong

• A. While functional, creating a file with 32 individual IP addresses requires more administrative effort than using CIDR notation.
• C. The Add indicator interface does not accept IP ranges in hyphenated format; CIDR notation is required.
• D. The Add indicator interface is designed for single indicator entry, not efficient bulk range addition; file import with CIDR is the proper approach.

Correct answer: A. 192.168.10.200

Microsoft Sentinel allows direct labeling of entities as indicators of compromise (IoC) from the incidents page, but only for certain entity types. IP addresses are one of the supported entity types that can be labeled as IoC. User accounts, Azure VMs, and on-premises servers cannot be directly labeled as IoC from the incidents page interface.

Why the other options are wrong

• B. Azure virtual machines cannot be labeled as IoC directly from the incidents page.
• C. On-premises servers cannot be labeled as IoC directly from the incidents page.
• D. User accounts cannot be labeled as IoC directly from the incidents page.

Correct answer: D. Modify the alert settings in Defender for Cloud.

Modifying alert settings directly in Defender for Cloud allows you to suppress specific security alerts at the management group level with minimal administrative effort. This is the built-in feature designed for this purpose. Azure Policy is broader than alert suppression, Azure Monitor alerts are separate from Defender alerts, and Workload protections manage detection rules, not alert suppression.

Why the other options are wrong

• A. Azure Policy is for resource governance, not Defender alert suppression.
• B. Workload protections settings configure detection capabilities, not alert suppression.
• C. Azure Monitor alert rules are separate from Defender for Cloud alert management.

Correct answer: B. Security Admin

The Security Admin role is the least privileged role that can modify Microsoft Defender for Cloud security policies. It grants the minimum necessary permissions to manage security policies without broader administrative access. Security Operator is read-only, while Owner and Contributor grant excessive permissions beyond policy management.

Why the other options are wrong

• A. Security Operator has read-only permissions and cannot modify policies.
• C. Owner role provides excessive permissions beyond security policy management.
• D. Contributor provides broad access to multiple resource types, violating least privilege.

Correct answer: A. Azure Activity

The Azure Activity workbook is the appropriate choice for analyzing actions performed by users with administrative privileges to the subscription. It tracks Azure control plane operations and administrative activities. While Microsoft Entra workbooks track authentication and sign-in events, the Azure Activity workbook specifically focuses on administrative actions and resource changes at the subscription level.

Why the other options are wrong

• B. Microsoft Entra Audit logs shows directory service changes, not Azure subscription administrative actions.
• C. Microsoft Entra Sign-ins logs displays authentication events, not administrative privilege actions.
• D. Identity & Access is a general workbook that does not specifically focus on administrative actions.

Correct answer: A. Azure Sentinel Responder

The Azure Sentinel Responder role is specifically designed to allow security analysts to assign and resolve incidents while following the principle of least privilege. This role grants permissions to view, assign, and dismiss incidents without granting broader administrative capabilities. The Reader role lacks write permissions, the Contributor role grants excessive permissions, and Logic App Contributor is unrelated to incident management.

Why the other options are wrong

• B. Logic App Contributor is for managing Logic Apps, not for incident response in Sentinel.
• C. Azure Sentinel Contributor grants excessive permissions beyond what's needed for the stated task.
• D. Azure Sentinel Reader can only view incidents, not assign or resolve them.

Correct answer: C. Add a condition and modify the action.

To send email to the resource owner instead of a static distribution group, you need to add a condition to evaluate which resource triggered the alert and modify the email action to dynamically use the owner's information. This involves conditional logic and dynamic content in the action configuration to extract and use the resource owner from the incident/alert data.

Why the other options are wrong

• A. Adding parameters to the trigger doesn't enable dynamic recipient resolution based on resource ownership.
• B. Custom data connectors are for ingesting data sources, not for modifying playbook recipient logic.
• D. Adding an alert doesn't help modify the email recipient; the action itself needs modification with conditional logic.

Correct answer: C. the Office 365 connector

The Office 365 connector must be configured first to enable Microsoft Defender for Cloud Apps to access and investigate threats using data from the unified audit log of Office 365 and Microsoft 365, providing visibility into cloud app activities.

Why the other options are wrong

• A. User enrichment settings enhance user data but don't enable audit log access.
• B. The Azure connector connects Azure resources but doesn't provide Office 365 unified audit log data.
• D. Automatic log upload settings configure log collection but require the connector to be established first.

Correct answer: D. Create a scheduled query rule.

To customize which details are included when an alert is created for a specific event from the Defender for Cloud data connector, you create a scheduled query rule. This rule allows you to define custom logic that determines alert content and properties based on specific events. UEBA focuses on behavioral analysis, not alert customization. DCRs control data collection, not alert detail customization.

Why the other options are wrong

• A. UEBA performs behavioral analysis but doesn't customize alert details for specific events.
• B. Data Collection Rules control what data is collected, not how alert details are customized.
• C. Connector properties control connection settings, not the content of individual alerts.

Correct answer: A. the incident automation settings

To associate a playbook with a near-real-time (NRT) analytics rule in Sentinel, you configure the incident automation settings. This is where you specify which playbooks should automatically run in response to incidents generated by the NRT rule. The incident automation settings are specifically designed for this playbook integration.

Why the other options are wrong

• B. The query rule defines what triggers alerts but doesn't configure playbook execution.
• C. Entity mapping maps alert fields to entities for investigation, not for playbook automation.
• D. Alert automation settings are not the primary mechanism for NRT rules; incident automation settings are used instead.

Correct answer: C, E. From Defender for Cloud, configure the AWS connector; From Defender for Cloud, configure auto-provisioning.

To enable Microsoft Defender for Servers on AWS VMs, you must: (C) Configure the AWS connector in Defender for Cloud to establish connectivity and discovery of AWS resources, and (E) Configure auto-provisioning to automatically deploy the necessary agents and extensions to the discovered AWS VMs. These two actions enable the service across AWS infrastructure.

Why the other options are wrong

• A. Agentless scanning is optional and not required for enabling Defender for Servers
• B. While Defender for Endpoint can be deployed, it's not a prerequisite step for Defender for Servers enablement
• D. The Azure VM Agent is for Azure VMs; AWS VMs use different agent mechanisms

Correct answer: C. Modify the properties of the computer objects listed as exposed entities.

Unsecure Kerberos delegation is remediated by modifying the properties of the exposed computer objects to disable unconstrained or constrained delegation settings. This involves changing the delegation configuration at the Active Directory object level for the affected computers.

Why the other options are wrong

• A. Disabling legacy protocols addresses different security risks, not Kerberos delegation.
• B. LDAP signing remediation addresses LDAP security, not Kerberos delegation issues.
• D. LAPS extension addresses local administrator password management, not Kerberos delegation.

Correct answer: A. notebooks in Microsoft Sentinel

Notebooks in Microsoft Sentinel are the tool designed to visualize Sentinel data and enrich it using third-party data sources to identify indicators of compromise (IoC). Notebooks provide Python and Markdown support for custom analysis workflows and integration with external threat intelligence sources.

Why the other options are wrong

• B. Defender for Cloud Apps focuses on cloud application security, not general IoC identification.
• C. Azure Monitor is for monitoring and alerting, not for enriching data with third-party sources for IoC analysis.

Correct answer: B, D. the Active remediation actions role in Microsoft Defender for Endpoint; the Security Reader role in Azure Active Directory (Azure AD)

To enable a security analyst to approve and reject pending actions in Microsoft Defender for Endpoint while following the principle of least privilege, two roles are required. The 'Active remediation actions' role in Microsoft Defender for Endpoint grants the specific permission to manage remediation actions. The 'Security Reader' role in Azure AD provides read-only access to security features in the Microsoft 365 security center. Together, these roles provide the minimum necessary permissions without granting excessive administrative access.

Why the other options are wrong

• A. Compliance Data Administrator is focused on compliance and data governance, not remediation actions.
• C. Security Administrator role grants too many permissions and violates the principle of least privilege.

Correct answer: A. the severity level of email notifications

Email alert configuration in Azure Security Center is controlled by the severity level settings. The security administrator is receiving alerts for high-severity items but not for lower-severity items. Adjusting the severity level of email notifications in Security Center settings will ensure alerts for all activity levels are sent to the administrator.

Why the other options are wrong

• B. Cloud connectors connect external security solutions, not for configuring email alert severity.
• C. Azure Defender plans enable/disable services but don't control notification thresholds.
• D. Threat detection integration settings don't directly configure email notification severity levels.

Correct answer: B. Threat analytics

Threat analytics in Microsoft 365 Defender provides information about new attack techniques discovered by Microsoft, tracks vulnerable resources in your subscription, and minimizes administrative effort by providing consolidated analysis and remediation guidance in one blade.

Why the other options are wrong

• A. Advanced hunting requires manual query writing and is not optimized for identifying vulnerable resources.
• C. Incidents & alerts shows detected threats but doesn't focus on new techniques or systematic vulnerability identification.
• D. Learning hub provides training resources, not threat analysis or vulnerability identification.

Correct answer: B, E. Create a query that uses the workspace expression and the union operator; Add the Azure Sentinel solution to each workspace.

To perform hunting queries across multiple Log Analytics workspaces in different subscriptions, you need two things: First, add the Azure Sentinel solution to each workspace (E) to ensure they're properly configured for Sentinel. Second, create KQL queries using the workspace() expression and the union operator (B) to combine results from multiple workspaces in a single query. This approach enables cross-workspace hunting efficiently.

Why the other options are wrong

• A. The Security Events connector is for data ingestion, not for cross-workspace query capability.
• C. The alias statement is not used for cross-workspace queries in KQL.
• D. The resource expression and alias operator are not the standard method for cross-workspace hunting queries.

Correct answer: B. Enable the Key Vault firewall.

Enabling the Key Vault firewall is the fastest and most appropriate first action to prevent unauthorized access from suspicious IP addresses. The firewall can be enabled immediately without detailed access policy analysis, and it allows legitimate users to continue accessing the Key Vault through authorized networks while blocking unknown sources. This provides immediate protection with minimal disruption during investigation. Modifying access policies requires more analysis; ASGs are not directly applicable to Key Vault; and modifying access control is less immediate than firewall enablement.

Why the other options are wrong

• A. Modifying access control requires analysis and planning; firewall provides quicker protection.
• C. Application security groups do not directly protect Key Vault resources.
• D. Access policy modification is less immediate than enabling the firewall for rapid response.

Correct answer: D. Assign the incident

Assigning the incident to another Azure Sentinel administrator is the direct way to escalate it and provide them access to investigate. Incident assignment in Azure Sentinel allows you to delegate the eight specific alerts that need investigation to the appropriate administrator while keeping them within the incident context.

Why the other options are wrong

• A. Incident creation rules generate new incidents; they don't escalate existing ones
• B. Sharing a URL might work but assignment is the proper escalation mechanism in Azure Sentinel
• C. Scheduled query rules create alerts; they don't escalate existing incidents

Correct answer: B. app name, computer name, IP address, email address, and used client app only

UEBA can investigate app name, computer name, IP address, email address, and used client app. These entities are part of standard UEBA analysis from Audit Logs and Sign-in Logs. The Sign-in URL is not a recognized entity type in UEBA; it's a URL string rather than an entity that can be profiled for behavioral analysis.

Why the other options are wrong

• A. UEBA can investigate more than just IP address and email; it also includes app, device, and client app entities.
• C. UEBA investigates multiple entity types, not just IP address alone.
• D. UEBA investigates more entity types than just used client app and app name.

Correct answer: B. Azure Policy

Just-in-time VM access is a Microsoft Defender for Cloud feature, and its rules, the allowed port and protocol (RDP only) and the maximum request time (two hours), can be applied to all 20 virtual machines in RG1 at once through Azure Policy instead of configuring each machine by hand, which keeps administrative effort to a minimum.

Why the other options are wrong

• A. Azure AD Privileged Identity Management controls role activation, not network access to virtual machines.
• C. Azure Bastion provides browser-based RDP and SSH connections, but it does not define just-in-time access rules.
• D. Azure Front Door is a global load balancer and web application firewall and has no role in VM access.

Correct answer: A. Azure Sentinel Contributor

The Azure Sentinel Contributor role is the built-in role specifically designed to allow editing of Azure Sentinel resources including custom workbooks and queries. Security Administrator and Azure Sentinel Responder have broader or different permissions that don't align with least privilege for this specific task. Logic App Contributor is unrelated to Sentinel workbooks.

Why the other options are wrong

• B. Security Administrator has excessive permissions beyond editing workbooks, violating least privilege.
• C. Azure Sentinel Responder is limited to responding to incidents, not editing workbooks.
• D. Logic App Contributor manages logic apps, not Azure Sentinel workbooks.

Correct answer: A. From Defender for Cloud, modify Microsoft Defender for Servers plan settings.

To collect security event logs from Azure virtual machines in Defender for Cloud, you must modify the Microsoft Defender for Servers plan settings. This is where you configure which types of security events are collected and how they are processed. The plan settings control the data collection configuration for all VMs reporting to the workspace.

Why the other options are wrong

• B. Registering a provider is not necessary for security event log collection from existing VMs
• C. Workflow automation is for automating responses to alerts, not for configuring event collection
• D. Creating a workbook is for visualization and analysis, not for configuring event collection

Correct answer: B, C. hide; resolve

Alert tuning rules in Microsoft Defender for Endpoint can hide alerts from view and resolve them (mark as resolved). Hiding alerts removes them from the alert queue to reduce alert fatigue, while resolving them marks them as completed. These are the two primary actions available for tuning alerts to reduce noise from commonly triggering but low-risk files without permanently deleting audit records.

Why the other options are wrong

• A. Delete is not an alert tuning action; alerts cannot be permanently deleted to maintain audit trails
• D. Merge is not a standard alert tuning rule action
• E. Assign is for changing alert ownership, not for tuning to reduce fatigue

Correct answer: C. Add an environment.

To integrate GitHub repositories with Microsoft Defender for Cloud, you must first add an environment in the Defender for Cloud portal. Adding an environment establishes the connection to the external source (GitHub in this case), allowing Defender for Cloud to discover and monitor the repositories. This is the first step before any scanning or policy enforcement can occur.

Why the other options are wrong

• A. Enabling integrations comes after setting up the environment connection
• B. Enabling a plan is specific to Defender for Cloud service plans, not for GitHub repository access
• D. Security policies are configured after the environment is added

Correct answer: A. Create an analytics rule.

An analytics rule converts a hunting query into an automated detection mechanism that continuously scans for the threat pattern. This is the standard, minimal-effort approach to operationalize hunting findings into ongoing security monitoring.

Why the other options are wrong

• B. Adding the query to a workbook creates visualization but does not enable automated threat detection.
• C. A watchlist stores reference data and cannot be used to automatically detect threats from hunting queries.
• D. A playbook defines response actions but does not create the initial automated detection of threats.

Correct answer: A. From Security alerts, select the alert, select Take Action, and then expand the Prevent future attacks section.

To view recommendations for resolving a security alert in Azure Security Center, you select the specific alert from Security alerts, then click 'Take Action', and expand the 'Prevent future attacks' section which contains the remediation recommendations. This is the standard workflow for addressing alerts in Security Center.

Why the other options are wrong

• B. Take Action doesn't have a 'Mitigate the threat' section; the correct section is 'Prevent future attacks'.
• C. Regulatory compliance reports show compliance posture, not specific alert remediation steps.
• D. Downloading a CSV report from Recommendations doesn't help resolve a specific alert.

Correct answer: C, F. From Settings, select Cloud App, select Microsoft Information Protection, select Files, and then enable file monitoring; From Settings, select Cloud App, select Microsoft Information Protection, and then select Automatically scan new files for Microsoft Information Protection sensitivity labels and content inspection warnings.

To generate alerts and remediation actions for external sharing of confidential files, you must first enable file monitoring by configuring Microsoft Information Protection settings (option C) and then automatically scan new files for sensitivity labels (option F). Option C enables the monitoring capability for files in Cloud Apps, while option F ensures that newly uploaded files are automatically scanned for MIP labels, allowing the system to detect confidential files that are externally shared and trigger appropriate alerts and remediation.

Why the other options are wrong

• A. This setting is about filtering scan scope, not enabling the core monitoring functionality
• B. Filtering by document type is a search refinement, not a prerequisite configuration step
• D. Filtering by Office 365 app is a search parameter, not a configuration action
• E. Creating a policy from search is done after monitoring is enabled, not a prerequisite step

Correct answer: C. a livestream

A livestream in Azure Sentinel monitors a hunting query in real-time and displays matches immediately in the portal with notifications, minimizing effort compared to playbooks or bookmarks which require additional setup. Notebooks are for analysis and visualization, not real-time alerting.

Why the other options are wrong

• A. Playbooks require additional configuration and are better for automated remediation than simple notifications.
• B. Notebooks are used for data analysis and visualization, not real-time query monitoring.
• D. Bookmarks are for marking and annotating query results, not for automatic notifications.

Correct answer: A. Create an exclusion tag.

Creating an exclusion tag is the minimal-effort solution to prevent Server1 from being scanned in agentless scanning mode. Tags can be applied to resources to exclude them from scanning without upgrading plans or creating complex governance rules.

Why the other options are wrong

• B. Upgrading to Plan 2 is unnecessary and increases costs without being the most efficient solution.
• C. Governance rules are more complex and administrative-heavy than using exclusion tags.
• D. Exclusion groups require more setup than simply tagging the individual server.

Correct answer: B. the risky users report

The risky users report shows users whose identities may have been compromised based on risk detections over the specified time period. This report aggregates all risk signals for a user and indicates if their account was involved in risky activities. While risk detections report shows individual events, risky users report provides the user-centric view needed to determine if a specific user's identity was compromised.

Why the other options are wrong

• A. The risk detections report shows individual events but requires manual correlation to assess user compromise.
• C. Identity Secure Score recommendations are for improving security posture, not detecting compromise.
• D. The risky sign-ins report focuses on sign-in events, not overall user identity compromise status.

Correct answer: D. the Alerts page in the Microsoft 365 Defender portal

To update a Microsoft Sentinel incident with an alert from Microsoft Defender for Cloud Apps, you must use the Microsoft 365 Defender portal. While the Timeline tab and investigation graph in Sentinel show related information, actually adding/updating alerts from Cloud Apps requires working in the M365 Defender portal where both Sentinel incidents and Cloud Apps alerts are unified. The entity side panel is for viewing entity details, not for adding alerts.

Why the other options are wrong

• A. The entity side panel displays entity information but does not allow adding alerts from Cloud Apps.
• B. The Timeline tab shows existing alerts but is not the interface for adding new alerts to the incident.
• C. The investigation graph visualizes relationships but does not provide the capability to add Cloud Apps alerts.

Correct answer: A. Key Vault firewalls and virtual networks

To mitigate unauthorized access attempts from suspicious sources like Tor exit nodes, you should configure Key Vault firewalls and virtual networks. These network-level controls restrict access to the Key Vault based on IP addresses and network locations, preventing malicious actors from reaching the vault even if they have credentials.

Why the other options are wrong

• B. Azure AD permissions govern authentication but do not block network-level attacks from specific IP ranges.
• C. RBAC controls what authenticated users can do but does not prevent access from unauthorized network locations.
• D. Access policy settings define permissions for authenticated principals but do not restrict access based on source IP address or network location.

Correct answer: D. a Syslog connector

A Syslog connector minimizes administrative effort by natively collecting standard Linux system logs with built-in parsing, reducing the need for manual data transformation. Syslog is the standard protocol for Linux logging and integrates seamlessly with Microsoft Sentinel.

Why the other options are wrong

• A. Log Analytics Data Collector API requires custom code development, increasing administrative effort.
• B. REST API integration requires significant custom development and data formatting work.
• C. CEF connector is designed for third-party security appliances, not native Linux monitoring.

Correct answer: C, D. Create a Microsoft Cloud App Security connector; Create an Azure AD Identity Protection connector.

The Fusion detection rule specifically requires Microsoft Cloud App Security connector data to detect Office 365 anomalies and Azure AD Identity Protection connector data to detect suspicious sign-ins. These two connectors provide the necessary data sources for Fusion to correlate multi-staged attacks across Azure AD and Office 365.

Why the other options are wrong

• A. Custom rules are not required; Fusion is a built-in rule that uses specific connectors.
• B. Azure Security Center incident rules are unrelated to detecting suspicious sign-ins and Office 365 anomalies.

Correct answer: D. an insider risk policy

Insider risk management policies are specifically designed to detect and alert on suspicious user activities including data exfiltration patterns such as unusual document downloads before account deletion. This feature can retroactively analyze user activities from the past month and flag concerning download patterns by deleted users, making it the appropriate solution for this scenario.

Why the other options are wrong

• A. File policies in Defender for Cloud Apps focus on file-level detection but are not optimized for historical analysis of deleted user activities.
• B. Access review policies are for governance and compliance reviews, not for detecting unusual download behaviors.
• C. Alert policies in Defender for Office 365 are more focused on email threats and phishing rather than SharePoint document activity patterns.

Correct answer: B. the Azure Connected Machine agent

To onboard AWS EC2 instances to Microsoft Defender for Cloud, you must install the Azure Connected Machine agent (also known as the hybrid agent). This agent enables non-Azure machines to be recognized and managed by Azure services. The Log Analytics agent alone cannot establish the connection to Defender for Cloud without the Azure Connected Machine agent, and the other options are not designed for this purpose.

Why the other options are wrong

• A. Log Analytics agent alone cannot onboard AWS instances to Defender for Cloud without the Azure Connected Machine agent
• C. The unified Microsoft Defender for Endpoint solution is for threat protection, not for onboarding to Defender for Cloud
• D. Microsoft Monitoring Agent is legacy and has been replaced by the Azure Connected Machine agent for hybrid scenarios

Correct answer: A. Yes

When you select a security alert in Security Center and choose 'Take Action', you can expand the 'Mitigate the threat' section which contains specific recommendations and steps to resolve the alert. This is the correct method to view recommendations directly associated with the security alert.

Why the other options are wrong

• B. This solution accurately describes the correct process for viewing alert-specific remediation recommendations.

Correct answer: A. From the Microsoft Defender portal, add an indicator.

Adding an indicator in the Microsoft Defender portal allows you to block or alert on specific file hashes, URLs, or IPs. By adding File1.docx as an indicator with a block action, you can prevent users from downloading this known threat file across your organization. This is the direct and efficient method to block a specific file threat.

Why the other options are wrong

• B. DLP policies protect sensitive data patterns and content, not specific threat files.
• C. Sensitivity labels are for data classification and protection, not threat file blocking.
• D. Automated investigation is for analyzing incidents after detection, not for preventive blocking.

Correct answer: B. AuditLogs | where Timestamp between (datetime(2023-02-01)..datetime(2023-02-10)) | where FileName contains “Project1”

The correct answer uses proper KQL (Kusto Query Language) syntax for searching audit logs. Option B correctly uses the AuditLogs table with the Timestamp operator using the between function with datetime objects, which is the standard way to query audit logs in Microsoft Purview. The where clause then filters for files containing 'Project1'. The other options use incorrect syntax that doesn't conform to KQL standards.

Why the other options are wrong

• A. Uses incorrect parenthetical syntax that is not valid KQL
• C. Uses invalid KQL syntax with improper operator placement
• D. Uses a relative time filter (ago function) instead of absolute dates, which doesn't meet the specific date range requirement

Correct answer: A, D. The rule query takes too long to run and times out; There are connectivity issues between the data sources and Log Analytics

Custom analytics rules fail intermittently primarily due to query timeouts (when complex queries exceed execution limits) and connectivity issues between data sources and Log Analytics (causing incomplete or missing data). Permission changes and workspace deletion cause consistent failures, not intermittent ones. Timeouts and connectivity fluctuations specifically cause intermittent failures as described.

Why the other options are wrong

• B. A deleted workspace would cause consistent failures, not intermittent ones.
• C. Permission modifications would result in persistent failures rather than intermittent issues.

Correct answer: B. Configure the Diagnostics settings in Azure AD to stream to an event hub.

To route Azure AD sign-in events to a third-party SIEM solution in near real time, you must configure Diagnostics settings in Azure AD to stream events to an Event Hub. An Event Hub provides real-time streaming capabilities that allow external systems to consume events immediately. This is the standard integration pattern for third-party SIEM solutions requiring near real-time event delivery.

Why the other options are wrong

• A. Azure Sentinel with Security Events connector is for Microsoft security events, not for routing to third-party SIEM solutions.
• C. Azure Sentinel with Azure AD connector is a Microsoft solution, not suitable for third-party SIEM integration.
• D. Archiving to storage account provides batch processing, not near real-time alert generation.

Correct answer: A. incidents

Incidents in Microsoft 365 Defender portal provide a unified view of malware alerts, automatically group related alerts, collect evidence across devices, and allow you to initiate response actions like device isolation from a central location. This is the primary interface for managing security incidents.

Why the other options are wrong

• B. Remediation is a result of investigation, not the tool for identifying devices and collecting evidence.
• C. Investigations are detailed technical analysis but incidents provide the integrated view needed for isolation decisions.
• D. Advanced hunting requires manual queries and is not optimized for typical alert-driven device isolation workflows.

Correct answer: A. In the grid query, include the take operator.

The 'take' operator in KQL is used to limit the number of rows returned from a query. To ensure a grid contains a maximum of 100 rows, you would add 'take 100' to the query. The project operator selects columns, not rows. Settings and Advanced Editor don't directly control row limits; the query itself must enforce this constraint.

Why the other options are wrong

• B. Project operator selects which columns to display, not the number of rows.
• C. Settings in the query editor interface don't directly limit row count.
• D. Advanced Editor allows query editing but doesn't inherently limit rows without using the take operator.

Correct answer: A. SecurityIncident

The SecurityIncident table is the correct target for querying incident information and incident tasks in Microsoft Sentinel. This table contains incident data including tasks that were performed on incidents. SecurityEvent and SecurityAlert contain different event types, while SentinelAudit tracks operational changes to Sentinel itself, not incident tasks.

Why the other options are wrong

• B. SecurityEvent table contains security events, not incident task information.
• C. SentinelAudit table tracks Sentinel operational changes, not incident tasks.
• D. SecurityAlert table contains individual alerts, not incident task data.

Correct answer: D. Modify the trigger in the logic app.

For a logic app to work as a playbook in Azure Sentinel, it must be triggered automatically by Azure Sentinel events. Since the existing logic app uses a manual trigger, you must modify it to use an Azure Sentinel trigger (such as 'When a response to an Azure Sentinel alert is triggered'). This is the prerequisite before the playbook can function within Azure Sentinel's automation framework.

Why the other options are wrong

• A. Adding a scheduled query rule doesn't enable an existing logic app to function as a playbook.
• B. Data connectors are for ingesting data into Sentinel, not for configuring playbooks.
• C. Threat Intelligence connectors are for ingesting threat data, not for playbook configuration.

Correct answer: A. From Security Center, enable data collection

To collect security event logs from Azure virtual machines in Security Center, you must enable data collection from within Security Center itself. This setting configures the Log Analytics agent to gather security events from VMs and send them to the designated workspace. Registering providers or creating workbooks are not the direct mechanism for enabling security log collection.

Why the other options are wrong

• B. Registering a provider is not the mechanism for enabling security log collection in Security Center.
• C. Workflow automation is used for automated responses to alerts, not for initial data collection configuration.
• D. Creating a workbook is for visualizing data, not for enabling the collection of security logs.

Correct answer: A. From the History tab in the Action center, revert the actions.

The Action center's History tab in Microsoft 365 Defender portal allows you to review and revert automated investigation and response actions, including quarantine actions, marking files as safe and removing them from quarantine across multiple devices.

Why the other options are wrong

• B. The investigation page reviews AIR processes but doesn't provide the interface to revert quarantine actions.
• C. The Quarantine review page manages quarantined items but reverting requires the Action center History.
• D. Threat tracker reviews query results for threat identification, not remediation reversion.

Correct answer: B. an Azure logic app

A playbook is fundamentally an Azure Logic App. To create a playbook that responds to Sentinel alerts, you must first create the Logic App itself. While you will later attach it via automation rules in Sentinel, the playbook (Logic App) must exist first as the executable component that performs the automated actions.

Why the other options are wrong

• A. Hunting queries search for threats; they don't execute automated responses.
• C. Automation rules connect playbooks to alerts but don't create the playbook itself.
• D. Azure Functions are not the primary mechanism for Sentinel playbooks; Logic Apps are the standard approach.

Correct answer: B. No

The goal is to configure accounts for attackers to exploit, which means identifying high-value targets that attackers would prioritize. Simply marking accounts as 'Sensitive' does not configure them for exploitation detection, it only flags them for monitoring. To truly configure accounts that attackers would target, you need to set up honeypot accounts or decoys that actively detect attack attempts. Marking sensitive accounts only provides enhanced monitoring; it does not set up accounts as bait for attackers to exploit.

Why the other options are wrong

• A. Adding accounts as Sensitive only monitors them; it does not configure them as targets for attackers to exploit.

Correct answer: D. Create a YAML file based on the DNS template.

To make 200 custom ASIM parsers based on the DNS schema available in Workspace1 with minimal administrative effort, you create a YAML file based on the DNS template. YAML files define the parser configuration and can be bulk-deployed, significantly reducing manual effort compared to other approaches. JSON and XML are not the standard formats for ASIM parser templates.

Why the other options are wrong

• A. Copying parsers manually to Azure Monitor Logs would require significant administrative effort.
• B. JSON is not the standard format for ASIM parser templates; YAML is preferred.
• C. XML is not used for ASIM parser template definitions; YAML is the standard.

Correct answer: C. the Contributor role for RG1

To apply quick fixes to virtual machines in RG1 using Azure Defender while maintaining least privilege, SecAdmin1 should be assigned the Contributor role specifically for RG1. This grants the necessary permissions to modify resources within that resource group without elevating privileges beyond the specific scope. Security Admin role alone does not provide the capability to apply quick fixes; Contributor at subscription level violates least privilege by granting broader access than needed; Owner role is excessive and violates least privilege.

Why the other options are wrong

• A. Security Reader role does not permit making changes to resources.
• B. Subscription-level Contributor violates least privilege by granting broader access than needed.
• D. Owner role is excessive and violates the principle of least privilege.

Correct answer: D. Perform a content search.

Content search is the appropriate tool in Microsoft Purview to search for specific email messages by subject line across selected mailboxes. This feature allows you to specify search criteria (Project1 in subject line) and select specific user mailboxes to search, making it ideal for finding emails matching specific criteria within a defined set of mailboxes. Content search is designed for exactly this scenario of targeted email discovery.

Why the other options are wrong

• A. User data search is for exporting user data, not for searching message content
• B. Records management disposition is for retention and disposal policies, not email search
• C. Audit search is for tracking user and admin activities, not for searching email content

Correct answer: A. Yes

Yes, configuring EDR in block mode meets the goal. EDR in block mode allows Microsoft Defender for Endpoint to take action on malicious artifacts even when running alongside third-party antivirus in passive mode. This provides additional protection by actively blocking threats that the third-party antivirus may have missed, ensuring comprehensive coverage against undetected malicious artifacts.

Why the other options are wrong

• B. The solution does meet the stated goal of protecting against maliciously detected artifacts

Correct answer: A. custom network indicators

Custom network indicators is the Advanced feature that must be enabled first to allow or block user-specified ranges of IP addresses and URLs in Microsoft Defender for Endpoint. This feature is specifically designed for managing custom indicators of compromise (IoCs) including IP ranges and URL patterns.

Why the other options are wrong

• B. Live response for servers is used for remote investigation and remediation, not for blocking IP/URL ranges.
• C. EDR in block mode provides behavioral blocking but doesn't manage custom IP/URL indicators.
• D. Web content filtering controls access to websites by category, not custom IP/URL ranges.

Correct answer: A. the Events tab of the alert

The Events tab within a DLP aggregated alert in the compliance center displays all individual events and affected entities that comprise the aggregated alert. This tab shows the detailed breakdown of which users, files, and locations were involved in the DLP violation.

Why the other options are wrong

• B. Sensitive Info Types tab shows the types of sensitive data detected, not the impacted entities.
• C. Management log is a separate audit log, not part of individual alert review.
• D. Details tab shows summary information but Events tab is where individual entity-level details are displayed.

Correct answer: C. Add Azure Sentinel to a workspace.

To use scheduled analytics rules in one workspace to query data from another workspace in a different region, you must first add Azure Sentinel to the LogsWest workspace. This enables the cross-workspace query capability and ensures the second workspace is properly configured for Sentinel. Only after this can the analytics rules in the primary workspace reference data from LogsWest.

Why the other options are wrong

• A. Azure Data Catalog is not related to Sentinel's cross-workspace query functionality.
• B. Modifying workspace settings alone does not establish the necessary Sentinel infrastructure in the second workspace.
• D. Data connectors ingest data but are not the prerequisite for cross-workspace queries in analytics rules.

Correct answer: C. The rule query takes too long to run and times out.

When an analytics rule query takes too long to execute and times out repeatedly, Azure Sentinel automatically disables the rule with an 'AUTO_DISABLED' prefix to prevent resource exhaustion. This is a built-in protection mechanism that prevents poorly performing queries from consuming excessive Log Analytics resources. The issue is indicated by the AUTO_DISABLED prefix in the rule name.

Why the other options are wrong

• A. Connectivity issues would cause data gaps but wouldn't trigger auto-disable with the AUTO_DISABLED prefix.
• B. Alert volume thresholds are not a documented cause of auto-disabling rules with this prefix.
• D. While permission issues could cause query failures, they don't specifically trigger the AUTO_DISABLED prefix mechanism.

Correct answer: B. No

Live Response is a remote investigation and remediation tool that allows security teams to interactively investigate and respond to threats on endpoints. However, it is a reactive, forensic tool used after threats are detected. It does not proactively protect devices from undetected malware. The goal requires protection from malware that bypassed the third-party antivirus, which requires active detection capabilities, not just investigative tools.

Why the other options are wrong

• A. Live Response investigates detected threats but does not protect against undetected malware artifacts.

Correct answer: C. a named location

To enforce MFA specifically for remote workers while not requiring it for office workers in Istanbul, a named location should be created. A named location defines trusted IP ranges or locations; by creating a named location for the Istanbul office and excluding it from the MFA requirement, users in that office will not need MFA, while all remote workers will be required to use MFA. This is the proper use of named locations in conditional access policies.

Why the other options are wrong

• A. Fraud alerts are for detecting suspicious authentication patterns, not for location-based conditional access.
• B. User risk policies evaluate user behavior over time, not geographic location.
• D. Sign-in user policies are not the correct mechanism for enforcing MFA based on location.

Correct answer: B. a watchlist

To exclude a built-in source-specific ASIM parser from a built-in unified ASIM parser, you create a watchlist in Sentinel that defines which parsers should be excluded. The watchlist is used by the unified parser to filter out excluded source-specific parsers during execution.

Why the other options are wrong

• A. Analytic rules detect threats, not manage ASIM parser configuration.
• C. Workbooks are for visualization and reporting, not parser management.
• D. Hunting queries search for threats, not configure parser behavior.

Correct answer: B. Change the state of the suppression rule to Disabled.

To view alerts that are currently suppressed by a suppression rule, you must change the state of the suppression rule to 'Disabled'. This will temporarily deactivate the rule and allow the suppressed alerts to appear again in Security Center so you can troubleshoot the testing virtual machines.

Why the other options are wrong

• A. Changing the expiration date doesn't immediately show the alerts; the rule would still be active.
• C. Modifying filters on the Security alerts page won't bypass an active suppression rule.
• D. Windows event logs are a separate troubleshooting mechanism and won't show Security Center alerts.

Correct answer: C. Medium

Unusual user access to key vaults, logon from unusual locations, and impossible travel activity are all behavioral anomalies that Defender for Cloud classifies as Medium severity alerts. These represent suspicious activities that warrant investigation but are not critical system failures. High severity alerts typically indicate confirmed compromises or critical system threats, while Low and Informational are for less urgent findings.

Why the other options are wrong

• A. Informational severity is for non-threatening notifications and status information.
• B. Low severity covers minor issues with minimal security impact; these activities are more suspicious.
• D. High severity is reserved for confirmed compromises and critical threats, not behavioral anomalies.

Correct answer: C. msticpy

Msticpy is the Microsoft Security Toolkit for Python specifically designed for Jupyter notebooks in Sentinel. It provides pre-built functions for querying Sentinel data, creating security-focused visualizations, and pinning results to dashboards with minimal development effort. Plotly and matplotlib are general visualization libraries requiring more work, and TensorFlow is for machine learning.

Why the other options are wrong

• A. Plotly is a general visualization library requiring more custom coding than msticpy.
• B. TensorFlow is for machine learning, not visualization of query results.
• D. Matplotlib requires more development effort than msticpy's pre-built Sentinel integration.

Correct answer: A. Yes

Creating a Microsoft incident creation rule for a data connector meets the goal. This rule type specifically transforms alerts from data connectors (such as Azure AD or Azure Defender alerts about malicious IP sign-ins) into incidents within Azure Sentinel. This is the correct approach for automating incident creation based on detected security events.

Why the other options are wrong

• B. Microsoft incident creation rules are designed precisely for this purpose and will properly convert connector alerts into Sentinel incidents.

Correct answer: B. Add indicators.

After enabling the 'Allow or block file' option in Microsoft Defender portal, you must add indicators to specify which files should be blocked. Indicators define the specific files (by hash, IP, URL, or domain) that will be blocked on the devices. This is the next step after enabling the feature to make it functional.

Why the other options are wrong

• A. Configuring automated response is about automating actions after detections, not about setting up file blocking
• C. Creating asset rules is not the correct terminology or process for file blocking in Defender XDR
• D. Assigning remediation levels is about categorizing threat severity, not about blocking specific files

Correct answer: B. Intent

The Intent field in Defender for Cloud alert JSON contains the MITRE ATT&CK tactic classification. This field maps detected behaviors to the MITRE ATT&CK framework tactics such as Privilege Escalation, Persistence, Defense Evasion, etc. SIEM solutions search this field to filter alerts by attack tactic.

Why the other options are wrong

• A. Description provides narrative context but not structured MITRE ATT&CK tactic data.
• C. ExtendedProperties contains additional metadata but not primary MITRE ATT&CK tactic information.
• D. Entities lists affected resources but doesn't contain MITRE ATT&CK tactic classifications.

Correct answer: A. the Threat Protection Status report in Microsoft Defender for Office 365

The Threat Protection Status report in Microsoft Defender for Office 365 is specifically designed to show actions taken by the service, including zero-hour auto purge (ZAP) activities. This report displays when emails are moved, deleted, or quarantined by ZAP and other protection mechanisms. The mailbox audit log tracks user actions, not service actions; Safe Attachments reports focus on attachment verdicts; and mail flow reports track message routing, not threat remediation actions.

Why the other options are wrong

• B. Mailbox audit logs track user actions, not automatic service actions like ZAP.
• C. Safe Attachments reports show file verdicts, not ZAP movements.
• D. Mail flow reports track message routing, not threat remediation actions.

Correct answer: C. the Azure Connected Machine agent

To protect on-premises Linux servers with Microsoft Defender for Cloud, you must first install the Azure Connected Machine agent. This agent enables the servers to be managed as if they were Azure resources and allows the Log Analytics agent to be installed and provisioned automatically through Defender's auto-provisioning feature.

Why the other options are wrong

• A. The Dependency agent is for application dependency mapping, not foundational Defender protection.
• B. While the Log Analytics agent is eventually needed, the Connected Machine agent must be installed first to integrate on-premises servers with Azure.
• D. The Guest Configuration extension is used for compliance and configuration management, not for security threat protection.

Correct answer: A. Install the Log Analytics agent.

To protect on-premises computers with Azure Defender, you must install the Log Analytics agent on those machines. The agent enables data collection and communication with Azure Defender for threat detection and protection. This is the foundational requirement for on-premises machine protection in Azure Defender.

Why the other options are wrong

• B. The Dependency agent is used for application dependency mapping, not for Defender protection.
• C. Hybrid Runbook Worker is used for automation, not for security protection.
• D. The Connected Machine agent enables Azure Arc integration but doesn't directly provide Defender capabilities without the Log Analytics agent.

Correct answer: B. a playbook

A playbook, implemented as an Azure Logic App, is the correct tool for creating automated threat responses in Azure Sentinel. Playbooks can automatically execute actions such as blocking users, creating tickets, or sending notifications in response to detected incidents. Data connectors ingest data, workbooks are for visualization, and incident creation rules generate incidents but don't automate responses.

Why the other options are wrong

• A. Data connectors bring data into Sentinel but do not automate threat responses.
• C. Workbooks are for visualization and analysis, not for automated response actions.
• D. Incident creation rules generate incidents but do not automatically respond to threats.

Correct answer: B, C. Build a custom unifying parser and include the built-in parser version; Redeploy the built-in parser and specify a CallerContext parameter of Any and a SourceSpecificParser parameter of Any.

Building a custom unifying parser that includes the built-in parser version allows you to control updates through your custom wrapper, preventing automatic updates to the built-in version. Redeploying the built-in parser with CallerContext=Built-in prevents automatic updates by marking it as manually managed rather than auto-updating.

Why the other options are wrong

• A. Creating a hunting query has no effect on parser update behavior.
• D. The CallerContext parameter of Built-in alone does not prevent automatic updates without also redeploying the parser.
• E. Creating an analytics rule that references the parser does not prevent automatic updates to the parser itself.

Correct answer: B, C. Add a data connector; Create an analytics rule

To receive near real-time alerts for Storage account key enumeration, you must first add a data connector to ingest the relevant logs (Azure Activity or Azure Storage logs that capture key enumeration events), and then create an analytics rule that detects the specific activity pattern and triggers alerts automatically.

Why the other options are wrong

• A. Livestream is for live monitoring but isn't the mechanism for automated alerting
• D. Hunting queries are for manual investigation, not automated near real-time alerts
• E. Bookmarks are for marking items during investigation, not for creating alerts