SC-200 practice questions 241–250

1. Question 241 · 392 in bank

   Select 2

   Your company stores the data of every project in a different Azure subscription. All the subscriptions use the same Azure Active Directory (Azure AD) tenant. Every project consists of multiple Azure virtual machines that run Windows Server. The Windows events of the virtual machines are stored in a Log Analytics workspace in each machine's respective subscription. You deploy Azure Sentinel to a new Azure subscription. You need to perform hunting queries in Azure Sentinel to search across all the Log Analytics workspaces of all the subscriptions. Which two actions should you perform? Each correct answer presents part of the solution. NOTE: Each correct selection is worth one point.

   • AAdd the Security Events connector to the Azure Sentinel workspace.
   • BCreate a query that uses the workspace expression and the union operator.
   • CUse the alias statement.
   • DCreate a query that uses the resource expression and the alias operator.
   • EAdd the Azure Sentinel solution to each workspace.

   Show answer

   Answer: BE

   Explanation

   Correct - every sentinel deployment must have a workspace - and the union command is used to join multiple workspaces together.

   Source: Adapted from community discussion — Eltooth

   References

   • Microsoft Learn
   • Microsoft Learn

   Next question

2. Question 242 · 392 in bank

   DRAG DROP - You have a Microsoft Sentinel workspace that contains an Azure AD data connector. You need to associate a bookmark with an Azure AD-related incident. What should you do? To answer, drag the appropriate blades to the correct tasks. Each blade may be used once, more than once, or not at all. You may need to drag the split bar between panes or scroll to view content. NOTE: Each correct selection is worth one point.

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   Logs and Hunting. You create a bookmark based on a query you have run. So go to logs and run a query. Choose one of the results and then you get the option to save as Bookmark. Only once you have created the query will you then see the query on the hunting blade under bookmarks. Then in the hunting blade we have the option to link the new bookmark to an incident. Based on real world experience I go with Logs and Hunting

   Source: Adapted from community discussion — danb67

   References

   • Microsoft Learn
   • Microsoft Learn

   

   Next question

3. Question 243 · 392 in bank

   HOTSPOT - You have an Azure subscription that contains a guest user named User1 and a Microsoft Sentinel workspace named workspace1. You need to ensure that User1 can triage Microsoft Sentinel incidents in workspace1. The solution must use the principle of least privilege. Which roles should you assign to User1? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   References

   • Microsoft Learn

   

   Next question

4. Question 244 · 392 in bank

   HOTSPOT - You have an Azure subscription that uses Microsoft Sentinel and contains a user named User1. You need to ensure that User1 can enable User and Entity Behavior Analytics (UEBA) for entity behavior in Azure AD. The solution must use the principle of least privilege. Which roles should you assign to User1? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   Microsoft Sentinel: https://learn.microsoft.com/en-gb/azure/sentinel/enable-entity-behavior-analytics. As per the prerequisites, I have both: the Security Administrator admin role in Entra Id the Microsoft Sentinel Contributor RBAC role on the entire subscription

   Source: Adapted from community discussion — uday1985

   References

   • Microsoft Learn
   • Microsoft Learn

   

   Next question

5. Question 245 · 392 in bank

   HOTSPOT - You have an Azure subscription that contains the following resources: • A virtual machine named VM1 that runs Windows Server • A Microsoft Sentinel workspace named Sentinel1 that has User and Entity Behavior Analytics (UEBA) enabled You have a scheduled query rule named Rule1 that tracks sign-in attempts to VM1. You need to update Rule1 to detect when a user from outside the IT department of your company signs in to VM1. The solution must meet the following requirements: • Utilize UEBA results. • Maximize query performance. • Minimize the number of false positives. How should you complete the rule definition? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   Correct answer https://learn.microsoft.com/en-us/azure/sentinel/ueba-reference#ueba-enrichments The IdentityInfo table is where identity information synchronized to UEBA from Azure Active Directory (and from on-premises Active Directory via Microsoft Defender for Identity) is stored. In the question it's trying to join 2 tables using AccountSID with the $left and $right corresponding to respective tables SecurityEvent | where EventID in ("4624","4672") | where Computer == "My.High.Value.Asset" | join kind=inner ( IdentityInfo | summarize arg_max(TimeGenerated, *) by AccountObjectId) on $left.SubjectUserSid == $right.AccountSID | where Department != "IT" https://learn.microsoft.com/en-us/azure/sentinel/investigate-with-ueba#embed-identityinfo-data-in-your-analytics-rules-public-preview

   Source: Adapted from community discussion — donathon

   References

   • Microsoft Learn
   • Microsoft Learn

   

   Next question

6. Question 246 · 392 in bank

   DRAG DROP - Your network contains an on-premises Active Directory Domain Services (AD DS) domain that syncs with an Azure AD tenant. You have a Microsoft Sentinel workspace named Sentinel1. You need to enable User and Entity Behavior Analytics (UEBA) for Sentinel1 and collect security events from the AD DS domain. Which three actions should you perform in sequence? To answer, move the appropriate actions from the list of actions to the answer area and arrange them in the correct order.

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   For Sentinel1, configure the Microsoft defender for identity connector. This will allow you to sync user entities from on-premises Active Directory, using Microsoft Defender for Identity. To the AD DS Domain, deploy Microsoft Defender for Identity. You need to install the MDI sensor on your Active Directory domain controller to enable UEBA to collect security events from your on-premises AD DS domain. For Sentinel1, enable UEBA. You need to switch the toggle to On and select the data sources on which you want to enable UEBA.

   Source: Adapted from community discussion — mali1969

   References

   • Microsoft Learn

   

   Next question

7. Question 247 · 392 in bank

   You have a Microsoft Sentinel workspace. You enable User and Entity Behavior Analytics (UEBA) by using Audit Logs and Signin Logs. The following entities are detected in the Azure AD tenant: • App name: App1 • IP address: 192.168.1.2 • Computer name: Device1 • Used client app: Microsoft Edge • Email address: user1@company.com • Sign-in URL: https://www.company.com Which entities can be investigated by using UEBA?

   • AIP address and email address only
   • Bapp name, computer name, IP address, email address, and used client app only
   • CIP address only
   • Dused client app and app name only

   Show answer

   Answer: B

   Explanation

   B. app name, computer name, IP address, email address, and used client app only. These are all entities that can be investigated by using UEBA in Microsoft Sentinel.

   Source: Adapted from community discussion — mali1969

   References

   • Microsoft Learn
   • Microsoft Learn

   Next question

8. Question 248 · 392 in bank

   HOTSPOT - You have an Azure subscription that contains a Microsoft Sentinel workspace. You need to create a hunting query using Kusto Query Language (KQL) that meets the following requirements: • Identifies an anomalous number of changes to the rules of a network security group (NSG) made by the same security principal. • Automatically associates the security principal with a Microsoft Sentinel entity. How should you complete the query? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   

   Next question

9. Question 249 · 392 in bank

   HOTSPOT - You have a Microsoft Sentinel workspace. You need to configure a report visual for a custom workbook. The solution must meet the following requirements: • The count and usage trend of AppDisplayName must be included. • The TrendList column must be useable in a sparkline visual. How should you complete the KQL query? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   He is right there, correct answers are - Join & make-series. Join is 100% correct; searched up for make-series it is to be correct too.

   Source: Adapted from community discussion — Anil0512

   

   Next question

10. Question 250 · 392 in bank

    DRAG DROP - You have an Azure subscription that contains two users named User1 and User2 and a Microsoft Sentinel workspace named workspace1. You need to ensure that the users can perform the following tasks in workspace1: • User1 must be able to dismiss incidents and assign incidents to users. • User2 must be able to modify analytics rules. The solution must use the principle of least privilege. Which role should you assign to each user? To answer, drag the appropriate roles to the correct users. Each role may be used once, more than once, or not at all. You may need to drag the split bar between panes or scroll to view content. NOTE: Each correct selection is worth one point.

    

    This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

    Show the answer figure

    Answer: See figure below

    Explanation

    All Microsoft Sentinel built-in roles grant read access to the data in your Microsoft Sentinel workspace. Microsoft Sentinel Reader can view data, incidents, workbooks, and other Microsoft Sentinel resources. Microsoft Sentinel Responder can, in addition to the above, manage incidents (assign, dismiss, etc.). Microsoft Sentinel Contributor can, in addition to the above, create and edit workbooks, analytics rules, and other Microsoft Sentinel resources. Microsoft Sentinel Playbook Operator can list, view, and manually run playbooks. Microsoft Sentinel Automation Contributor allows Microsoft Sentinel to add playbooks to automation rules. It isn't meant for user accounts.

    Source: Adapted from community discussion — donathon

    References

    • Microsoft Learn

    

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

SC-200 practice, question 241. 392 questions available.