Courseiva

CCNA Manage a security operations environment Questions

44 questions · Manage a security operations environment · All types, answers revealed

Practice these questionsDomain overviewAll questions
1
MCQmedium

Your organization has Microsoft Defender for Cloud Apps (MDA) connected to Microsoft Sentinel. The SOC team wants to receive alerts when a user accesses a sanctioned cloud app from an anonymous IP address. What should you configure?

A.Create a file policy in Defender for Cloud Apps.
B.Create an activity policy in Defender for Cloud Apps and connect it to Sentinel.
C.Enable the Defender for Cloud Apps connector in Sentinel without additional configuration.
D.Create a session policy in Defender for Cloud Apps.
AnswerB

Activity policies can detect specific behaviors like anonymous IP access and send alerts to Sentinel.

Why this answer

An activity policy in Defender for Cloud Apps can be configured to trigger alerts on specific user activities, such as accessing a sanctioned app from an anonymous IP address. This policy can then be connected to Microsoft Sentinel via the Defender for Cloud Apps data connector, which ingests alerts as incidents for SOC review. File policies (A) focus on file-level actions like sharing or malware detection, not user access events, while session policies (D) control real-time access but do not generate alerts for historical or post-access monitoring.

Exam trap

The trap here is that candidates confuse file policies with activity policies, assuming any policy in Defender for Cloud Apps can detect access events, but only activity policies are designed to monitor user sign-in and access behaviors against IP-based conditions.

How to eliminate wrong answers

Option A is wrong because file policies monitor file-related activities (e.g., sharing, upload, download) and cannot detect user access events like logging into an app from an anonymous IP. Option C is wrong because simply enabling the Defender for Cloud Apps connector in Sentinel without additional configuration only ingests default alerts (e.g., from anomaly detection policies), not custom activity-based alerts for anonymous IP access. Option D is wrong because session policies are designed for real-time access control and monitoring during a user session (e.g., blocking downloads), not for generating alerts on access events that have already occurred.

Practice this question →
2
MCQhard

Your organization is migrating to Microsoft Sentinel. You need to ensure that the workspace retains data for 2 years for compliance, but you want to reduce costs by using cheaper storage for data older than 90 days. What should you configure?

A.Set the workspace retention to 730 days and enable a data cap.
B.Set workspace retention to 90 days and configure long-term retention in Azure Data Explorer (ADX).
C.Export data older than 90 days to a storage account and delete from workspace.
D.Configure the workspace retention to 90 days and use Azure Storage archiving.
AnswerB

ADX integration allows cost-effective long-term retention with query capabilities.

Why this answer

Microsoft Sentinel allows you to set the workspace retention to 90 days for interactive, hot-tier access, and then configure long-term retention in Azure Data Explorer (ADX) for data older than 90 days. This approach meets the 2-year compliance requirement while reducing costs, as ADX provides cheaper storage for older data that is queried less frequently.

Exam trap

The trap here is that candidates often confuse Azure Storage archiving or data export with the ability to query the data in Sentinel, not realizing that only ADX provides native, queryable long-term retention integrated with Sentinel's KQL interface.

How to eliminate wrong answers

Option A is wrong because enabling a data cap does not provide cheaper storage for older data; it only limits data ingestion, and setting workspace retention to 730 days keeps all data in the expensive hot tier for the entire period, increasing costs. Option C is wrong because exporting data to a storage account and deleting it from the workspace breaks the ability to query that data within Sentinel, and Sentinel does not natively support querying data from external storage accounts without additional tooling. Option D is wrong because Azure Storage archiving is not natively integrated with Sentinel for querying archived data; Sentinel requires data to be in the workspace or in ADX for long-term retention with query capability.

Practice this question →
3
MCQmedium

Your SOC team uses Microsoft Defender XDR. You want to ensure that all incidents are automatically classified and determined by the built-in AI before any manual review. What should you configure?

A.Create a custom detection rule in Microsoft Defender XDR.
B.Enable the incident summarization and classification feature in Microsoft Defender XDR.
C.Enable automation rules in Microsoft Sentinel to classify incidents.
D.Configure a workbook in Microsoft Sentinel to analyze incidents.
AnswerB

The incident summarization and classification feature in Microsoft Defender XDR is a built-in AI capability that automatically analyzes the alert and incident evidence, generates a natural-language summary, and assigns a classification (e.g., true positive, false positive, informational) and determination to each incident. Enabling this feature meets the stated objective because it activates the platform's native machine learning reasoning to pre-classify incidents before human review, significantly reducing analyst workload.

Why this answer

Microsoft Defender XDR includes a built-in AI-driven incident summarization and classification feature that automatically assigns a classification (e.g., true positive, false positive) and determination (e.g., malicious, clean) to each incident before manual review. This feature leverages machine learning models trained on Microsoft's global threat intelligence to reduce alert fatigue and streamline SOC workflows.

Exam trap

The trap here is that candidates may confuse the AI-driven incident classification in Defender XDR with automation rules in Microsoft Sentinel, which are for response actions, not for the built-in AI classification and determination of incidents.

How to eliminate wrong answers

Option A is wrong because custom detection rules in Microsoft Defender XDR are used to create custom alerts based on specific query logic, not to automatically classify or determine incidents via AI. Option C is wrong because automation rules in Microsoft Sentinel are designed for automated incident response and orchestration (e.g., assigning ownership, changing status), not for the built-in AI classification and determination of incidents within Defender XDR. Option D is wrong because workbooks in Microsoft Sentinel are visualization tools for analyzing data and metrics, not a configuration that enables automatic AI-driven incident classification.

Practice this question →
4
MCQhard

Your organization uses Microsoft Sentinel and has multiple workspaces for different regions. The security team wants to use a single workbook to display data from all workspaces. What is the correct approach?

A.Create a workbook with cross-workspace queries using the workspace() expression
B.Export data from all workspaces to a single Azure Data Lake
C.Create a workbook in one workspace and configure it to use Azure Lighthouse
D.Create a workbook in each workspace and merge them manually
AnswerA

Cross-workspace queries allow a single workbook to query multiple workspaces.

Why this answer

Microsoft Sentinel workbooks support cross-workspace queries using the `workspace()` expression in Kusto Query Language (KQL). This allows a single workbook to aggregate and display data from multiple Sentinel workspaces without moving or duplicating the data, meeting the security team's requirement efficiently.

Exam trap

The trap here is that candidates may confuse Azure Lighthouse (which is for cross-tenant management) with cross-workspace querying, or assume that data must be centralized (e.g., via Data Lake) before it can be visualized in a single workbook.

How to eliminate wrong answers

Option B is wrong because exporting data to Azure Data Lake requires additional services (e.g., Azure Data Factory or Event Hubs) and does not provide a native way to query the data in a Sentinel workbook; it also incurs extra cost and latency. Option C is wrong because Azure Lighthouse enables cross-tenant management but does not allow a single workbook to query multiple workspaces within the same tenant; workbooks still need explicit cross-workspace queries. Option D is wrong because creating separate workbooks in each workspace and manually merging them is not a scalable or automated solution, and it defeats the purpose of a single unified view.

Practice this question →
5
MCQmedium

Your organization uses Microsoft Sentinel and Microsoft Defender for Cloud. You need to ensure that security incidents from Defender for Cloud are automatically sent to Sentinel. What should you configure?

A.Configure the Azure Active Directory data connector
B.Configure the Microsoft Defender for Cloud data connector
C.Create an Azure Event Hub and push Defender for Cloud alerts to Sentinel via a custom connector
D.Configure the Microsoft 365 Defender data connector
AnswerB

The Microsoft Defender for Cloud data connector is the native, purpose-built integration that ingests Defender for Cloud security alerts, recommendations, and incidents directly into Microsoft Sentinel. It requires no extra infrastructure or custom code, automatically streaming alerts from Azure, on-premises, and other cloud workloads protected by Defender for Cloud, and it supports bidirectional status synchronization. This is the correct connector because it directly satisfies the requirement to ingest Defender for Cloud incidents into Sentinel.

Why this answer

The Microsoft Defender for Cloud data connector is the correct choice because it is specifically designed to ingest security alerts and incidents from Defender for Cloud into Microsoft Sentinel. This connector enables automatic synchronization of Defender for Cloud's security findings, ensuring that incidents are created in Sentinel without manual intervention or custom infrastructure.

Exam trap

The trap here is that candidates often confuse the Microsoft Defender for Cloud data connector with the Microsoft 365 Defender data connector, mistakenly thinking that all 'Defender' services are covered by a single connector, when in fact each has its own dedicated connector for specific alert sources.

How to eliminate wrong answers

Option A is wrong because the Azure Active Directory data connector ingests sign-in logs and audit logs, not security incidents from Defender for Cloud. Option C is wrong because while an Event Hub can be used for custom data ingestion, it is unnecessary and overly complex; the native Defender for Cloud data connector provides a direct, supported integration without custom development. Option D is wrong because the Microsoft 365 Defender data connector ingests alerts from Microsoft 365 Defender (e.g., Defender for Endpoint, Defender for Office 365), not from Defender for Cloud.

Practice this question →
6
MCQeasy

Your organization uses Microsoft Sentinel and Microsoft Defender XDR. The security team wants to automatically create an incident in Microsoft Sentinel when a Microsoft Defender for Endpoint alert is triggered. What should you configure?

A.Enable the Microsoft Defender XDR connector in Microsoft Sentinel and select the incident creation settings.
B.Set up a Logic App custom connector to poll Defender alerts.
C.Configure the Security Events connector to forward Defender alerts.
D.Create analytics rules in Microsoft Sentinel for each Defender alert type.
AnswerA

The Microsoft Defender XDR connector automatically creates incidents from Defender alerts.

Why this answer

The Microsoft Defender XDR connector in Microsoft Sentinel is specifically designed to ingest alerts and incidents from Microsoft Defender for Endpoint and other Defender products. By enabling this connector and configuring its incident creation settings, Sentinel automatically creates incidents when Defender for Endpoint alerts are triggered, without requiring custom logic or manual polling.

Exam trap

The trap here is that candidates often confuse the purpose of analytics rules (which generate alerts from raw data) with the connector's role (which ingests pre-existing alerts from external sources), leading them to incorrectly select Option D.

How to eliminate wrong answers

Option B is wrong because a Logic App custom connector would require building a custom polling mechanism, which is unnecessary and inefficient when the native Microsoft Defender XDR connector already provides automated, real-time incident ingestion. Option C is wrong because the Security Events connector is used to collect Windows security event logs (e.g., Event ID 4625) from on-premises or cloud-based systems, not Defender for Endpoint alerts. Option D is wrong because analytics rules in Sentinel are used to generate alerts from raw data sources (like Syslog or Windows Events), not to import existing alerts from Defender for Endpoint; the connector handles that ingestion automatically.

Practice this question →
7
Multi-Selectmedium

Your organization uses Microsoft Sentinel and you are designing a data retention strategy. You have a Log Analytics workspace with the following tables: SecurityEvent, SigninLogs, and CommonSecurityLog. The compliance team requires that SigninLogs be retained for 7 years, while other tables can be retained for 1 year. Which THREE steps must you take to meet this requirement?

Select 3 answers
A.Set an archiving policy to move SigninLogs to cold storage after 1 year.
B.Set the workspace retention to 7 years.
C.Enable Azure Data Explorer (ADX) for long-term storage.
D.Configure table-level retention for SigninLogs to 7 years.
E.Ensure that the workspace is in a region that supports 7-year retention.
AnswersB, D, E

Setting the Log Analytics workspace retention to 7 years ensures that all tables, including SigninLogs, will initially meet the 7-year retention requirement for Microsoft Entra ID sign-in data. This is crucial because individual table retention settings can only reduce, not extend, the overall workspace retention period. Therefore, this step establishes the necessary ceiling, allowing SecurityEvent and CommonSecurityLog tables to be subsequently configured with a 1-year retention, overriding the workspace default downwards.

Why this answer

Setting the workspace retention to 7 years ensures that all tables in the workspace, including SigninLogs, are retained for the maximum required period. However, this alone would also retain other tables longer than needed, so you must combine it with table-level retention to override the workspace setting for specific tables. This approach allows you to meet the 7-year compliance requirement for SigninLogs while keeping other tables at 1 year.

Exam trap

The trap here is that candidates often think archiving (Option A) or external services like ADX (Option C) are required for long-term retention, when in fact Log Analytics supports up to 7 years of native retention with table-level granularity, making workspace and table-level settings the correct combination.

Practice this question →
8
MCQeasy

Your SOC uses Microsoft Sentinel and Microsoft Defender for Cloud Apps. You need to configure a policy that triggers when a user downloads a large number of files from SharePoint Online within a short period. Which policy type should you use?

A.Session policy
B.File policy
C.Anomaly detection policy
D.Activity policy
AnswerD

Activity policies allow custom detection of specific activities like mass downloads.

Why this answer

An activity policy in Microsoft Defender for Cloud Apps is designed to monitor and respond to specific user activities, such as downloading a large number of files from SharePoint Online within a short period. This policy type allows you to set thresholds and triggers based on user actions, making it the correct choice for detecting anomalous download behavior.

Exam trap

The trap here is that candidates often confuse anomaly detection policies (which are predefined and use machine learning) with activity policies (which are customizable and rule-based), leading them to select anomaly detection when a custom threshold-based trigger is required.

How to eliminate wrong answers

Option A is wrong because session policies are used for real-time monitoring and control of user sessions, such as blocking downloads during a session, but they do not trigger based on historical activity thresholds like a large number of downloads over time. Option B is wrong because file policies focus on detecting specific file types, content, or metadata (e.g., sensitive data in files), not on the volume or frequency of file downloads. Option C is wrong because anomaly detection policies in Defender for Cloud Apps use machine learning to detect unusual patterns across users, but they are predefined and cannot be customized to trigger specifically on a high volume of downloads from SharePoint Online within a short period.

Practice this question →
9
MCQeasy

Your organization uses Microsoft Sentinel. You need to ensure that an incident is automatically assigned to the appropriate team based on the type of alert. What should you configure?

A.Workbook
B.Playbook
C.Analytics rule
D.Automation rule
AnswerD

Automation rules in Microsoft Sentinel can be configured to trigger on alert creation and use conditions such as alert name or severity to automatically assign incidents to a specific team via the "Assign owner" action. This satisfies the stem’s constraint of routing incidents based on alert type without requiring manual triage or separate playbook logic.

Why this answer

Automation rules in Microsoft Sentinel allow you to automatically assign incidents to specific teams based on conditions such as alert type or severity. This is the correct configuration because automation rules can trigger actions like incident assignment, tagging, or status changes without requiring a complex logic app or custom code.

Exam trap

The trap here is that candidates often confuse Playbooks (which can also assign incidents via Logic Apps) with Automation rules, but Automation rules are the native, simpler, and more efficient method for straightforward assignment tasks, while Playbooks are better for complex multi-step workflows.

How to eliminate wrong answers

Option A is wrong because Workbooks are visualization tools for querying and displaying data, not for automating incident assignment. Option B is wrong because Playbooks are automated workflows (often using Azure Logic Apps) that can respond to alerts or incidents, but they are not the primary or simplest method for automatic assignment; automation rules are designed for this purpose. Option C is wrong because Analytics rules generate alerts based on data queries, but they do not handle post-alert actions like incident assignment; that is the role of automation rules.

Practice this question →
10
Multi-Selecteasy

Which TWO are valid methods to ingest syslog data into Microsoft Sentinel?

Select 2 answers
A.Use the Syslog data connector from the Content hub
B.Configure a syslog forwarder with the Cisco ASIM parser
C.Use the Log Analytics agent to collect syslog from Linux machines
D.Deploy a Splunk Universal Forwarder to send syslog to Sentinel
E.Install a Windows-based syslog collector and forward to Sentinel using the Azure Monitor agent
AnswersA, C

The Syslog connector is a standard method.

Why this answer

The Syslog data connector available from the Content hub in Microsoft Sentinel provides a direct, built-in method to ingest syslog data from on-premises or cloud-based syslog sources. This connector uses the Log Analytics agent (or the newer Azure Monitor Agent with a Data Collection Rule) to collect syslog messages forwarded by a syslog daemon, typically over UDP port 514 or TCP, and maps them to the Syslog table in Log Analytics. It is the standard, supported approach for syslog ingestion without requiring third-party tools or custom parsers.

Exam trap

The trap here is that candidates confuse data ingestion methods with post-ingestion processing tools (like ASIM parsers) or assume that any universal forwarder (like Splunk's) can send data to Sentinel, when in fact only specific connectors and agents are supported for syslog ingestion.

Practice this question →
11
MCQeasy

Your security operations center (SOC) uses Microsoft Sentinel. Analysts need to collaborate on incidents by adding comments and changing severity. Which feature should they use?

A.Hunting
B.Playbooks
C.Workbooks
D.Incident management
AnswerD

Incident management provides commenting and severity changes.

Why this answer

Incident management in Microsoft Sentinel provides the built-in capability for SOC analysts to collaborate on incidents by adding comments and changing severity. This feature allows multiple analysts to work on the same incident, track changes, and update the severity level directly within the incident interface, which is essential for effective teamwork and triage.

Exam trap

The trap here is that candidates often confuse Hunting or Workbooks as tools for incident collaboration because they involve data exploration, but they lack the direct incident editing and commenting capabilities that incident management provides.

How to eliminate wrong answers

Option A is wrong because Hunting is a proactive search for threats using KQL queries, not a feature for collaborating on existing incidents or modifying their severity. Option B is wrong because Playbooks are automated workflows triggered by incidents or alerts, designed for response actions, not for manual collaboration or severity changes. Option C is wrong because Workbooks are interactive dashboards for visualizing data and metrics, not for direct incident collaboration or severity updates.

Practice this question →
12
MCQmedium

Your company is deploying Microsoft Sentinel in a multi-tenant environment using Azure Lighthouse. You need to ensure that SOC analysts can triage incidents across all tenants from a single workspace. What is the minimum configuration required?

A.Create a second Sentinel workspace in the managing tenant and configure cross-workspace queries.
B.Configure Azure AD B2B collaboration to grant external users access to each tenant's Sentinel workspace.
C.Use Azure Policy to enforce a standard analytics rule across all tenants.
D.Onboard each tenant as a delegated resource under Azure Lighthouse, then route all logs to a single Sentinel workspace in the managing tenant.
AnswerD

Onboarding each tenant with Azure Lighthouse grants the managing tenant's users delegated access to administer resources, including configuring diagnostic settings and data connectors to route logs centrally. By sending all logs into a single Sentinel workspace in the managing tenant, events and alerts are consolidated and correlated in one analytical store, and Sentinel generates a unified incident queue for SOC analysts. This gives a single pane of glass for triage and response without the need to switch between tenants or manually craft cross-workspace KQL queries, which keeps the data fragmented.

Why this answer

Azure Lighthouse enables multi-tenant management by delegating subscriptions or resource groups from each tenant as delegated resources to the managing tenant. Once delegated, you can configure a single Microsoft Sentinel workspace in the managing tenant to ingest logs from all delegated tenants via diagnostic settings, allowing SOC analysts to triage incidents centrally without needing separate workspaces or cross-workspace queries.

Exam trap

The trap here is that candidates often confuse cross-workspace queries (Option A) as a valid centralized solution, but they fail to realize that Azure Lighthouse's delegated resource model is the minimum configuration required to route all logs into a single workspace without additional overhead.

How to eliminate wrong answers

Option A is wrong because creating a second Sentinel workspace in the managing tenant and using cross-workspace queries still requires maintaining multiple workspaces and does not centralize incident management into a single pane of glass; it only allows querying across workspaces, not unified triage. Option B is wrong because Azure AD B2B collaboration grants external user access to each tenant's Sentinel workspace individually, but it does not consolidate logs or incidents into a single workspace; analysts would still need to switch between tenants to triage incidents. Option C is wrong because Azure Policy enforces compliance rules (e.g., analytics rule deployment) but does not route logs or provide centralized incident triage; it is a governance tool, not a data ingestion or workspace unification solution.

Practice this question →
13
Multi-Selecteasy

Which TWO features are available in Microsoft Sentinel to automate incident response?

Select 2 answers
A.Playbooks based on Azure Logic Apps.
B.Workbooks.
C.Kusto Query Language (KQL) queries.
D.UEBA.
E.Automation rules.
AnswersA, E

Playbooks automate response actions.

Why this answer

Playbooks based on Azure Logic Apps are correct because they provide a native, low-code automation framework within Microsoft Sentinel. They allow security analysts to define and execute complex, multi-step response actions—such as isolating a compromised VM, blocking an IP address, or opening a ticket—triggered by alerts or incidents. This directly automates incident response workflows without manual intervention.

Exam trap

The trap here is that candidates often confuse detection or analysis tools (Workbooks, KQL, UEBA) with automation tools, failing to recognize that only Playbooks and Automation Rules provide the actual execution of response actions in Sentinel.

Practice this question →
14
Multi-Selecthard

Your organization uses Microsoft Sentinel with multiple workspaces. You need to create a unified incident queue across all workspaces. Which TWO solutions should you consider?

Select 2 answers
A.Use cross-workspace queries in workbooks.
B.Consolidate all data into a single Log Analytics workspace.
C.Configure incident grouping rules in Microsoft Sentinel.
D.Use Azure Policy to enforce workspace configuration.
E.Deploy multiple playbooks to synchronize incidents.
AnswersB, C

A single workspace provides a unified incident queue.

Why this answer

Consolidating all data into a single Log Analytics workspace is the most straightforward and supported method to create a unified incident queue in Microsoft Sentinel. With a single workspace, all alerts and incidents are naturally aggregated, eliminating the need for cross-workspace synchronization. This approach simplifies management, ensures consistent analytics rules, and avoids the complexity of stitching incidents across multiple workspaces.

Exam trap

The trap here is that candidates may think cross-workspace queries (Option A) can unify the incident queue, but they only provide a read-only, query-based view without the ability to manage or act on incidents as a single entity.

Practice this question →
15
MCQhard

A company uses Microsoft Sentinel with the Microsoft 365 Defender connector. The security team notices that alerts from Microsoft Defender for Endpoint (MDE) are not appearing in Sentinel. The MDE data connector status shows 'Connected'. Which step should you take to troubleshoot this issue?

A.Verify that the Microsoft 365 Defender connector is configured to ingest MDE alerts.
B.Check if the Microsoft Defender for Endpoint data connector is added.
C.Verify that the ingestion rules in Sentinel are not filtering out MDE alerts.
D.Check the Microsoft 365 Defender portal to ensure MDE alerts are being generated and forwarded to Microsoft 365 Defender.
AnswerD

Before troubleshooting Sentinel, verify that Microsoft Defender for Endpoint alerts are actually being produced and sent to Microsoft 365 Defender by reviewing the Microsoft 365 Defender portal. If no MDE alerts are visible there, they cannot propagate downstream to Sentinel, regardless of connector configuration. This is the root-cause check because the Microsoft 365 Defender connector only ingests what Microsoft 365 Defender itself has received and correlated; an empty source yields empty Sentinel tables.

Why this answer

The Microsoft 365 Defender connector in Microsoft Sentinel ingests alerts that have already been generated and forwarded by Microsoft Defender for Endpoint (MDE) to the Microsoft 365 Defender portal. Even if the connector status shows 'Connected', if MDE alerts are not being generated or forwarded to Microsoft 365 Defender (e.g., due to a licensing issue, misconfigured alert policy, or service health problem), they will never reach Sentinel. Therefore, the first troubleshooting step is to verify alert generation and forwarding at the source in the Microsoft 365 Defender portal.

Exam trap

The trap here is that candidates assume a 'Connected' status guarantees data flow, but the connector status only reflects the API connection to Microsoft 365 Defender, not the actual generation or forwarding of alerts from the underlying MDE service.

How to eliminate wrong answers

Option A is wrong because the Microsoft 365 Defender connector is specifically designed to ingest MDE alerts (along with other Microsoft 365 Defender signals) — there is no separate configuration toggle within the connector to enable or disable MDE alert ingestion; if the connector is connected, it ingests all available alerts from Microsoft 365 Defender. Option B is wrong because there is no separate 'Microsoft Defender for Endpoint data connector' in Sentinel; MDE alerts are ingested exclusively through the Microsoft 365 Defender connector, so adding a non-existent connector is not a valid troubleshooting step. Option C is wrong because ingestion rules in Sentinel filter data after it has been received by the connector; if alerts are not appearing, the issue is upstream (before ingestion rules apply), and checking ingestion rules would only be relevant if alerts were being dropped after arrival.

Practice this question →
16
MCQhard

Refer to the exhibit. You are analyzing a KQL query for a Microsoft Sentinel scheduled rule. The query is intended to detect devices that have both a high number of process executions and network connections to a single IP within an hour. However, the query returns no results even though there are devices meeting the criteria. What is the most likely cause?

A.The threshold variable is not used correctly
B.The join condition does not include a time window, causing mismatches
C.The DeviceProcessEvents and DeviceNetworkEvents tables are from different data sources
D.The summarize function cannot count process executions
AnswerB

Without a time window, the join may not align events from the same time period.

Why this answer

The join between DeviceProcessEvents and DeviceNetworkEvents lacks a time window constraint (e.g., 'on $left.Timestamp between ($right.Timestamp - 1h) and ($right.Timestamp + 1h)'). Without this, the join matches events across arbitrary time ranges, causing mismatches where a device's process executions and network connections to a single IP occur at different times, even if both happen within the same hour. This results in no rows being returned when the intended detection requires temporal proximity.

Exam trap

The trap here is that candidates assume a simple key-based join (e.g., on DeviceId) is sufficient, overlooking the critical need for a time window to correlate events that occur within the same detection window, which is a common pitfall in KQL-based detection rules.

How to eliminate wrong answers

Option A is wrong because the threshold variable (e.g., 'let threshold = 10;') is used correctly in the query to filter aggregated counts; the issue is not with variable usage but with the join logic. Option C is wrong because DeviceProcessEvents and DeviceNetworkEvents are both Microsoft Defender for Endpoint tables in the same Advanced Hunting schema, so they are from the same data source and can be joined directly. Option D is wrong because the summarize function can count process executions using 'count()' or 'dcount()' on the DeviceProcessEvents table; the failure is not due to a limitation of summarize.

Practice this question →
17
Multi-Selectmedium

You need to configure Microsoft Sentinel to comply with a regulatory requirement that all security incidents must be retained for 7 years. Which TWO actions should you take?

Select 2 answers
A.Set the workspace retention policy to 2555 days (7 years).
B.Configure a data export rule to send data to an Azure Storage account with immutable storage for 7 years.
C.Configure table-level retention policies for each table to 7 years.
D.Use Basic Logs for all tables to reduce costs.
E.Use Azure Policy to enforce a minimum retention period of 7 years on all workspaces.
AnswersA, B

Workspace retention can be set to up to 730 days by default, but with archive policy it can be extended to 7 years.

Why this answer

Setting the workspace retention policy to 2555 days (7 years) ensures that all log data ingested into the Log Analytics workspace is retained for the required period. This is the foundational mechanism for meeting long-term retention requirements in Microsoft Sentinel, as Sentinel inherits the workspace's retention settings for incident-related data.

Exam trap

The trap here is that candidates often confuse table-level retention policies with workspace-level retention, thinking they can set retention per table to meet compliance, but incidents are not stored in user-defined tables and require workspace-level retention or data export to immutable storage.

Practice this question →
18
MCQmedium

Your SOC is investigating an incident in Microsoft Sentinel. You need to quickly identify all related alerts and entities across the timeline. What Microsoft Sentinel feature should you use?

A.Run a hunting query.
B.Open the incident investigation graph.
C.Review the analytics rule that generated the incident.
D.Use the Incident workbook.
AnswerB

Investigation graph shows relationships.

Why this answer

The incident investigation graph in Microsoft Sentinel provides a visual, interactive map of all alerts, entities (such as users, IP addresses, hosts), and their relationships linked to a specific incident. This allows SOC analysts to quickly see the full scope of an incident across the timeline without manually correlating data, making it the correct tool for this scenario.

Exam trap

The trap here is that candidates may confuse the incident investigation graph with the Incident workbook, assuming both provide incident details, but the workbook is for aggregated reporting while the graph is for interactive, entity-level exploration of a single incident.

How to eliminate wrong answers

Option A is wrong because hunting queries are proactive searches for potential threats across raw data, not designed to retroactively consolidate all alerts and entities for a single incident. Option C is wrong because reviewing the analytics rule only shows the rule's configuration and logic, not the aggregated alerts and entities tied to the incident. Option D is wrong because the Incident workbook provides summary metrics and trends across incidents, not a focused, interactive graph of a single incident's related alerts and entities.

Practice this question →
19
MCQeasy

Your organization uses Microsoft Sentinel for security operations. You need to ensure that critical alerts are automatically assigned to the appropriate SOC tier for investigation. What should you configure in Microsoft Sentinel?

A.Create a playbook that assigns the incident to a user
B.Use a watchlist to map alert types to owners
C.Configure an analytics rule to set the owner
D.Create an automation rule that sets the incident owner
AnswerD

Automation rules can automatically assign incidents to owners or groups.

Why this answer

Automation rules in Microsoft Sentinel allow you to automatically assign incidents to specific owners based on conditions like severity or alert type. This ensures critical alerts are routed to the appropriate SOC tier without manual intervention, directly meeting the requirement.

Exam trap

The trap here is that candidates often confuse the capabilities of analytics rules (which generate incidents) with automation rules (which handle post-creation actions like owner assignment), leading them to incorrectly select Option C.

How to eliminate wrong answers

Option A is wrong because a playbook that assigns an incident to a user is an over-engineered solution; automation rules are designed for simple owner assignment without the need for a Logic App. Option B is wrong because watchlists are used for correlating data or enriching alerts, not for assigning incident ownership. Option C is wrong because analytics rules define alert conditions and generate incidents, but they do not have a setting to configure the incident owner; owner assignment is handled post-creation by automation rules or playbooks.

Practice this question →
20
Multi-Selectmedium

Which TWO actions can you perform using Microsoft Sentinel automation rules? (Select two.)

Select 2 answers
A.Create a task on an incident
B.Run a playbook on an incident
C.Create an incident automatically
D.Create a new automation rule
E.Send an email notification
AnswersA, B

Automation rules can add tasks to incidents.

Why this answer

Microsoft Sentinel automation rules can create tasks on incidents. This allows you to automatically assign investigation steps or remediation actions to specific personnel, ensuring consistent incident response workflows.

Exam trap

The trap here is that candidates often confuse automation rules with playbooks, assuming automation rules can directly send emails or create incidents, when in fact they only orchestrate actions that may be executed by playbooks or other components.

Practice this question →
21
MCQmedium

Your SOC team uses Microsoft Sentinel with multiple workspaces across regions. You need to implement a solution that allows analysts to query all workspaces from a single location without moving data. Which feature should you configure?

A.Use cross-workspace queries with workspace() expressions in KQL.
B.Export data to Azure Data Explorer and query there.
C.Create a single Log Analytics workspace and have all data sources send logs there.
D.Configure Azure Lighthouse to manage all workspaces.
AnswerA

Cross-workspace queries allow querying multiple workspaces without moving data.

Why this answer

Cross-workspace queries using the `workspace()` expression in KQL allow analysts to query multiple Log Analytics workspaces from a single query context without moving or centralizing the data. This is the native Microsoft Sentinel feature designed for multi-workspace environments, enabling seamless querying across regions while keeping data in its original workspace.

Exam trap

The trap here is that candidates often confuse Azure Lighthouse (cross-tenant management) with cross-workspace querying, but Lighthouse does not provide the KQL-level query capability needed to query data across workspaces from a single query.

How to eliminate wrong answers

Option B is wrong because exporting data to Azure Data Explorer requires moving data out of Log Analytics, which contradicts the requirement of querying without moving data, and adds latency and cost for data transfer. Option C is wrong because creating a single Log Analytics workspace would require all data sources to send logs to that one location, which violates the requirement of keeping data in multiple workspaces across regions. Option D is wrong because Azure Lighthouse provides cross-tenant management capabilities but does not enable querying across multiple workspaces from a single KQL query; it only allows managing resources across tenants, not querying data across workspaces.

Practice this question →
22
MCQeasy

Your organization uses Microsoft Defender for Endpoint. You need to ensure that when a high severity alert is generated, an automated investigation is launched immediately. What is the correct configuration?

A.Create a custom indicator in Microsoft Defender for Endpoint.
B.Use advanced hunting to create a custom detection rule.
C.In Microsoft Defender for Endpoint, set up an alert suppression rule.
D.In Microsoft 365 Defender, configure automated investigation and response settings to automatically investigate alerts.
AnswerD

The automated investigation settings allow you to set the automation level for different alert groups, including high severity.

Why this answer

Microsoft 365 Defender's automated investigation and response (AIR) capabilities allow you to configure automatic investigation for alerts of specific severity levels. By enabling this setting for high severity alerts, Defender for Endpoint will immediately launch an investigation when such an alert is generated, without requiring manual intervention.

Exam trap

The trap here is that candidates often confuse custom detection rules (advanced hunting) or custom indicators with the ability to trigger automated investigations, when in fact the correct configuration is a simple toggle in the automated investigation and response settings within Microsoft 365 Defender.

How to eliminate wrong answers

Option A is wrong because custom indicators (IOCs) are used to define entities like files, IPs, or domains for detection, alerting, or blocking—they do not control automated investigation launch behavior. Option B is wrong because advanced hunting custom detection rules create custom alerts based on KQL queries, but they do not configure the automatic investigation trigger for existing high severity alerts. Option C is wrong because alert suppression rules are designed to suppress or hide alerts based on criteria, not to initiate automated investigations.

Practice this question →
23
MCQhard

Your organization uses Microsoft Defender for Cloud to monitor hybrid workloads. You need to ensure that security alerts from on-premises servers running Windows Server 2022 are forwarded to Microsoft Sentinel. The servers are not yet onboarded to Azure Arc. What should you do first?

A.Install the Azure Monitor Agent on the servers.
B.Deploy Azure Policy to enable Defender for Cloud on the servers.
C.Onboard the servers to Azure Arc and enable Defender for Cloud.
D.Install Microsoft Defender for Endpoint on the servers.
AnswerC

Arc provides the identity and management needed for Defender for Cloud to monitor on-prem servers.

Why this answer

On-premises servers must first be onboarded to Azure Arc to establish a management identity and connectivity with Azure. Without Azure Arc, Defender for Cloud cannot apply its security policies or forward alerts to Microsoft Sentinel. Enabling Defender for Cloud on the servers after Arc onboarding allows security alerts to be collected and forwarded to Sentinel.

Exam trap

The trap here is that candidates often assume installing an agent (AMA or MDE) is sufficient to forward alerts to Sentinel, but Microsoft requires Azure Arc as the foundational onboarding step to bring non-Azure servers into the Azure management plane before Defender for Cloud can generate and forward security alerts.

How to eliminate wrong answers

Option A is wrong because the Azure Monitor Agent (AMA) can collect telemetry but does not enable Defender for Cloud's security alert generation or forwarding to Sentinel; AMA is a data collection agent, not a prerequisite for Defender for Cloud integration. Option B is wrong because Azure Policy can enforce configurations only on resources already managed by Azure; without Azure Arc, the on-premises servers are not visible to Azure Policy. Option D is wrong because Microsoft Defender for Endpoint (MDE) provides endpoint detection and response but does not, by itself, forward security alerts to Sentinel; MDE integration with Sentinel requires the servers to be onboarded to Azure Arc or have a direct data connector configured.

Practice this question →
24
MCQmedium

Your organization uses Microsoft Sentinel and Microsoft Defender for Cloud Apps to monitor cloud application usage. You have a custom analytics rule that detects multiple failed login attempts from different IP addresses for the same user within 5 minutes. This rule generates an incident. The security team wants to automatically suspend the user in Microsoft Entra ID (formerly Azure AD) when such an incident is created, but only if the user is not a member of the 'Emergency Access' group. You need to implement this automation. You have already created the analytics rule. What should you do next?

A.Modify the analytics rule to include a condition that checks the user's group membership using KQL.
B.Create an automation rule that suspends the user directly using a condition on the incident.
C.Create an automation rule that triggers on incident creation and runs a playbook that suspends the user.
D.Create a playbook that uses the Microsoft Entra ID connector to check if the user is a member of the 'Emergency Access' group. If not, suspend the user. Then create an automation rule that runs this playbook on incident creation.
AnswerD

A playbook can use conditional logic to check group membership and then take action. The automation rule triggers the playbook.

Why this answer

A playbook can check group membership and take action. Option A is wrong because automation rules cannot conditionally run playbooks based on group membership. Option B is wrong because modifying the analytics rule is not the way to add automation.

Option C is wrong because automation rules cannot directly suspend users.

Practice this question →
25
MCQeasy

Your organization uses Microsoft Sentinel. You need to automatically assign incidents to the appropriate SOC tier based on severity. What should you create?

A.A data connector to Microsoft Teams
B.A scheduled analytics rule
C.A playbook in Microsoft Power Automate
D.An automation rule with an owner assignment action
AnswerD

Automation rules can assign incidents to specific users or groups.

Why this answer

Automation rules in Microsoft Sentinel allow you to automatically assign incidents to specific owners based on conditions like severity, using the 'Assign owner' action. This directly meets the requirement to route incidents to the appropriate SOC tier without manual intervention, leveraging Sentinel's native incident management capabilities.

Exam trap

The trap here is that candidates often confuse automation rules with playbooks, assuming that any automated response requires a playbook, when in fact simple owner assignment is a native automation rule action that does not need a separate playbook or Power Automate workflow.

How to eliminate wrong answers

Option A is wrong because a data connector to Microsoft Teams is used to ingest collaboration data (e.g., chat logs) into Sentinel for analysis, not to automate incident assignment based on severity. Option B is wrong because a scheduled analytics rule generates alerts from log data based on a query schedule, but it does not perform post-incident actions like owner assignment; it only creates incidents or alerts. Option C is wrong because a playbook in Microsoft Power Automate (or Azure Logic Apps) can automate response actions, but it is typically triggered by an automation rule or analytics rule, not directly used for initial owner assignment; the native 'Assign owner' action in automation rules is the correct, simpler method for this specific requirement.

Practice this question →
26
MCQeasy

You are configuring Microsoft Defender for Cloud Apps session controls for a SharePoint site containing sensitive data. Which condition must be met to apply real-time monitoring?

A.The SharePoint site must be added as a custom app in Defender for Cloud Apps.
B.Users must access the site through Microsoft Entra ID application proxy.
C.A browser extension must be installed on all client devices.
D.Users must be configured with Conditional Access policies from Microsoft Entra ID.
AnswerD

Session controls in Microsoft Defender for Cloud Apps are implemented through the Conditional Access session control pipeline in Microsoft Entra ID. When a user is subject to a Conditional Access policy that includes 'Use Conditional Access App Control' as a session control, the user's session is redirected through the Defender for Cloud Apps reverse proxy. Without this policy, the proxy never intercepts the request, so session-level monitoring and restrictions (e.g., download blocking) will not be enforced for SharePoint Online.

Why this answer

Microsoft Defender for Cloud Apps session controls for SharePoint require users to be routed through the Cloud App Security proxy, which is invoked by Conditional Access policies in Microsoft Entra ID. Conditional Access app controls apply session policies to traffic when users access SharePoint, enabling real-time monitoring. The Microsoft Entra ID application proxy is designed for on-premises apps, not for SaaS apps like SharePoint Online.

Therefore, the correct prerequisite is having Conditional Access policies configured.

Exam trap

Candidates often confuse the Microsoft Entra ID application proxy with the Cloud App Security proxy. For SharePoint Online session controls, Conditional Access policies trigger the Cloud App Security proxy, not the application proxy.

How to eliminate wrong answers

Option A is wrong because SharePoint is already a recognized app in Defender for Cloud Apps; adding it as a custom app is unnecessary and does not enable session controls. Option B is correct as explained. Option C is wrong because session controls for SharePoint do not require a client-side browser extension; the proxy handles interception server-side.

Option D is wrong because while Conditional Access policies are used to route traffic to the session control, they are not the condition that enables real-time monitoring—the proxy is the prerequisite.

Practice this question →
27
MCQhard

Your organization uses Microsoft Sentinel with multiple workspaces across different regions. You need to centrally manage all security incidents from a single pane of glass. The solution must allow analysts to investigate incidents across workspaces without switching contexts. What should you configure?

A.Deploy Microsoft Sentinel in a single region and use Azure Arc to connect other workspaces.
B.Create a union query across workspaces using the workspace() expression.
C.Use Azure Lighthouse to manage multiple workspaces and enable cross-workspace incident view in Microsoft Sentinel.
D.Configure a single workspace and use diagnostic settings to send all logs to it.
AnswerC

Azure Lighthouse allows managing multiple workspaces from a single view.

Why this answer

Azure Lighthouse enables cross-workspace incident management in Microsoft Sentinel by granting delegated access across multiple Azure tenants or regions. This allows analysts to view and investigate incidents from all connected workspaces in a single pane of glass without switching contexts, fulfilling the requirement for centralized incident management.

Exam trap

The trap here is that candidates often confuse cross-workspace querying (Option B) with centralized incident management, not realizing that the workspace() expression only enables log queries, not the aggregated incident view required for a single pane of glass.

How to eliminate wrong answers

Option A is wrong because Azure Arc extends Azure management to on-premises or multi-cloud resources, not to other Sentinel workspaces; it does not provide a unified incident view across multiple Sentinel workspaces. Option B is wrong because a union query using the workspace() expression is used for cross-workspace log queries in Log Analytics, not for centrally managing security incidents in the Sentinel incident interface; it requires manual querying and does not aggregate incidents into a single pane of glass. Option D is wrong because configuring a single workspace and sending all logs to it via diagnostic settings would require redesigning the existing multi-workspace architecture and does not address the need to centrally manage incidents from already deployed workspaces across different regions.

Practice this question →
28
MCQeasy

Your organization is implementing Microsoft Sentinel. You need to design a solution to automatically disable a user account in Microsoft Entra ID when a high-severity incident is triggered in Microsoft Sentinel related to that user. Which component should you use?

A.A playbook that uses the Microsoft Graph API to disable the user.
B.An analytics rule that includes a query to disable the user.
C.An automation rule that runs a PowerShell script on a hybrid worker.
D.A workbook that triggers a webhook to disable the user.
AnswerA

Playbooks can automate response actions like disabling a user.

Why this answer

A playbook is the correct component because it is an automated workflow that can be triggered by a Microsoft Sentinel incident. By using the Microsoft Graph API within the playbook, you can programmatically disable a user account in Microsoft Entra ID, which is the required action for a high-severity incident. This aligns with the need for an automated response that integrates Sentinel with identity management.

Exam trap

The trap here is that candidates may confuse automation rules with playbooks, thinking that automation rules can directly execute scripts or API calls, when in fact automation rules only trigger playbooks or run actions like changing incident status, not performing external remediation.

How to eliminate wrong answers

Option B is wrong because an analytics rule is designed to generate alerts based on query results, not to execute remediation actions like disabling a user; it lacks the capability to perform API calls or modify Entra ID objects. Option C is wrong because an automation rule in Sentinel can trigger a playbook or run a script on a hybrid worker, but running a PowerShell script directly on a hybrid worker does not natively integrate with Microsoft Graph API to disable a user without additional custom logic; the standard pattern is to use a playbook for such actions. Option D is wrong because a workbook is a visualization tool for data analysis and reporting; it cannot trigger webhooks or execute actions to disable user accounts.

Practice this question →
29
Multi-Selectmedium

Which THREE actions can be performed by automation rules in Microsoft Sentinel?

Select 3 answers
A.Modify a data connector to ingest more logs
B.Create a new analytics rule
C.Assign an incident to a specific owner
D.Run a playbook on an incident
E.Add a tag to an incident
AnswersC, D, E

Automation rules have an 'Assign owner' action.

Why this answer

Automation rules in Microsoft Sentinel can automatically assign incidents to specific owners based on conditions such as severity, entity type, or custom criteria. This action helps streamline incident response by ensuring the right personnel are notified and responsible for handling the incident without manual intervention.

Exam trap

The trap here is that candidates may confuse automation rules with analytics rules or data connectors, assuming automation rules can modify data sources or create detection logic, when in fact automation rules are limited to post-ingestion incident management actions.

Practice this question →
30
MCQhard

Your organization uses Microsoft Sentinel with a workspace in the East US region. You have a playbook that runs an automation rule to create a support ticket in ServiceNow. The playbook fails intermittently with a timeout error. You have verified that the playbook's managed identity has the correct permissions. What should you check next?

A.Ensure the playbook is assigned to an Azure Policy that allows outbound connections.
B.Check if the ServiceNow API has rate limits that are being exceeded.
C.Verify that the logic app's network connectivity allows outbound traffic to the ServiceNow endpoint, including any regional restrictions.
D.Verify that the logic app's workflow is configured to use asynchronous operations.
AnswerC

Intermittent timeouts often indicate network issues like firewall rules or regional routing.

Why this answer

The playbook is a Logic App, and intermittent timeout errors when calling an external API (ServiceNow) often indicate network connectivity issues. Since the managed identity permissions are correct, the next logical step is to verify that the Logic App's outbound traffic is allowed to the ServiceNow endpoint, including any regional restrictions that might block or delay traffic from the East US region. This directly addresses the root cause of the timeout.

Exam trap

The trap here is that candidates confuse authentication/authorization (managed identity) with network connectivity, assuming that correct permissions guarantee successful API calls, when in fact network restrictions or regional IP blocking can cause intermittent timeouts even with valid credentials.

How to eliminate wrong answers

Option A is wrong because Azure Policy does not manage outbound connections for Logic Apps; it enforces compliance rules on Azure resources, not network traffic. Option B is wrong because rate limits typically cause HTTP 429 responses, not timeout errors, and the question states the error is a timeout, not a throttling response. Option D is wrong because asynchronous operations affect how the Logic App handles long-running tasks internally, not the network connectivity to an external endpoint, and the timeout is on the outbound HTTP call, not the workflow execution.

Practice this question →
31
MCQhard

You are a security analyst for a company that uses Azure Firewall. You are reviewing a custom rule deployed via Azure Firewall Manager. The exhibit shows the rule configuration. The rule is intended to block inbound traffic from known Tor exit nodes. However, a recent incident involved an attacker using a Tor exit node with IP 138.197.5.5 to access an internal web server on port 8080. The log shows the traffic was ALLOWED. What is the most likely reason the rule did not block the traffic?

A.The destination port 8080 is not listed in the rule.
B.The source address range does not include 138.197.5.5.
C.The rule type is 'Prevention' but should be 'Detection'.
D.The rule priority is too low and is overridden by a higher priority rule.
AnswerA

The application rule's destination port list is the crux: it only specifies 443 (HTTPS) and 80 (HTTP), so any outbound connection to port 8080 does not match the rule's conditions, even when the destination FQDN or IP is otherwise covered. A matching source and destination are not enough; for an Azure Firewall application rule to apply, the protocol:port must also be present in the rule. Because 8080 is absent, the traffic bypasses this deny action, which explains why the connection was allowed.

Why this answer

The rule is configured to block traffic on destination port 80, but the attacker used port 8080. Azure Firewall rules are explicit; if the destination port in the traffic does not match any port specified in the rule, the rule is not applied, and the traffic is evaluated by subsequent rules or default allow logic. Since the rule only lists port 80, traffic to port 8080 is not matched, and thus the rule does not block it.

Exam trap

The trap here is that candidates assume a rule blocking a source IP will block all traffic from that IP, but Azure Firewall rules require exact port matching, and the rule only specifies port 80, not port 8080.

How to eliminate wrong answers

Option B is wrong because the exhibit shows the source address range includes 138.197.5.5, so the source IP is correctly covered. Option C is wrong because Azure Firewall Manager does not use 'Prevention' or 'Detection' rule types; those are concepts from other security products like Microsoft Defender for Cloud or IDS/IPS systems, not Azure Firewall custom rules. Option D is wrong because rule priority determines the order of evaluation, but if the rule does not match the traffic (due to port mismatch), priority is irrelevant; the rule is simply skipped.

Practice this question →
32
MCQhard

Your organization has Microsoft Defender for Cloud Apps and Microsoft Sentinel integrated. You need to create an automated playbook that, when a Microsoft Sentinel incident is created from a Defender for Cloud Apps alert, automatically suspends the user in Microsoft Entra ID and sends a notification to the security team. Which two connectors should you use in the playbook?

A.Microsoft Power BI and Microsoft Teams
B.Microsoft Entra ID and Microsoft Teams
C.Azure Automation and Microsoft Sentinel
D.Microsoft Entra ID and Outlook.com
AnswerB

Correct. Entra ID suspends user, Teams sends notification.

Why this answer

Microsoft Entra ID provides the identity management action to suspend a user account, and Microsoft Teams enables sending a notification to the security team via a Teams channel or chat. This combination directly fulfills the requirements of suspending the user in Entra ID and notifying the team when a Sentinel incident is triggered from a Defender for Cloud Apps alert.

Exam trap

The trap here is that candidates often confuse Outlook.com with Office 365 Outlook (Exchange Online) or think Power BI can be used for notifications, but the question specifically requires enterprise-grade identity suspension and team notification, which only Microsoft Entra ID and Microsoft Teams provide as native connectors in a Logic App playbook.

How to eliminate wrong answers

Option A is wrong because Microsoft Power BI is a data visualization tool, not a connector for suspending users or sending real-time notifications; it cannot perform identity management actions. Option C is wrong because Azure Automation can run scripts but is not a direct connector for suspending a user in Entra ID or sending a Teams notification; it would require additional modules and complexity, and Microsoft Sentinel is the trigger, not an action connector. Option D is wrong because Outlook.com is a personal email service, not enterprise-grade for security team notifications, and it lacks the structured channel-based notification and compliance features of Microsoft Teams.

Practice this question →
33
MCQmedium

Your organization uses Microsoft Sentinel and Microsoft Defender XDR. A new security policy requires that all incidents involving 'Credential Access' tactics be automatically assigned to the Tier 1 SOC team and have a severity of 'High'. You need to configure this automation. What should you do?

A.Configure an automated investigation rule in Microsoft Defender XDR to assign incidents.
B.Create a playbook in Microsoft Sentinel that runs on incident creation and assigns the incident to Tier 1 SOC.
C.Create an automation rule in Microsoft Sentinel with conditions for tactic 'Credential Access' and actions to assign to Tier 1 SOC and set severity to High.
D.Modify the analytics rule that generates the incidents to include the assignment and severity settings.
AnswerC

Correct: Automation rules can set incident properties based on conditions.

Why this answer

Automation rules in Microsoft Sentinel allow you to define conditions based on incident properties, such as tactic, and then trigger actions like assigning the incident to a specific owner (Tier 1 SOC) and setting the severity. This directly meets the policy requirement without requiring external playbooks or modifying analytics rules.

Exam trap

The trap here is that candidates may confuse automation rules (incident-level) with automated investigation rules (Defender XDR) or think that analytics rules can directly assign incidents, when in fact automation rules are the correct post-creation mechanism for assignment and severity changes.

How to eliminate wrong answers

Option A is wrong because automated investigation rules in Microsoft Defender XDR are designed for automated response actions (e.g., isolating devices) and cannot assign incidents to a SOC team or set severity based on MITRE tactics. Option B is wrong because while a playbook can assign incidents, it requires additional configuration and is not the simplest or most direct method; automation rules are the native, recommended approach for incident-level automation in Sentinel. Option D is wrong because analytics rules generate alerts/incidents but do not support actions like assignment or severity override; those are post-creation automation tasks.

Practice this question →
34
MCQhard

Your organization uses Microsoft Sentinel and has enabled UEBA. A security analyst observes that a user account with no prior administrative activity performed a high volume of Azure Resource Manager operations. The analyst wants to investigate further. Which Microsoft Sentinel feature should the analyst use to quickly identify if this behavior is anomalous based on the user's historical profile?

A.Hunting queries
B.Workbooks
C.User and Entity Behavior Analytics (UEBA)
D.Analytics rules
AnswerC

User and Entity Behavior Analytics (UEBA) is the correct capability because it uses machine learning models to build a personalized historical baseline for each user and entity—such as typical logon times, locations, and performed actions—then continuously scores new activities against that profile to identify anomalous behavior automatically in Sentinel. UEBA's anomaly detections are surfaced as suspicious activities or incidents and feed into the entity timeline, requiring no custom rule authoring to compare current events to the user's own established patterns.

Why this answer

UEBA is the correct feature because it builds a behavioral baseline for each user over time, including typical Azure Resource Manager activity patterns. When a user with no prior administrative history suddenly performs a high volume of ARM operations, UEBA can flag this as anomalous by comparing the current activity against the user's historical profile, surfacing the deviation in the UEBA investigation pane without requiring custom query creation.

Exam trap

The trap here is that candidates often confuse UEBA with Analytics rules, assuming that any detection must come from a rule, but UEBA is specifically designed for behavior-based anomaly detection against a user's own historical baseline, not signature-based or rule-based detection.

How to eliminate wrong answers

Option A is wrong because Hunting queries are proactive, iterative searches for potential threats using KQL, but they do not automatically compare current behavior against a user's historical baseline; they require the analyst to manually define and run queries. Option B is wrong because Workbooks are visualization dashboards that aggregate data from various sources, but they do not perform user-specific anomaly detection or compare against historical profiles. Option D is wrong because Analytics rules are used to create automated detections and alerts based on predefined logic, but they do not inherently leverage UEBA's historical user profiles to identify anomalies unless specifically configured with UEBA data, and the question asks for quickly identifying anomalous behavior based on the user's historical profile, which is UEBA's core function.

Practice this question →
35
Multi-Selectmedium

Your organization uses Microsoft Sentinel. You need to automatically classify incidents based on MITRE ATT&CK techniques. Which THREE methods can be used to accomplish this?

Select 3 answers
A.Enable the MITRE ATT&CK data connector.
B.Create a watchlist with MITRE techniques.
C.Use analytics rules that include MITRE ATT&CK mapping.
D.Use UEBA to detect techniques.
E.Create an automation rule that tags incidents with MITRE techniques.
AnswersA, C, E

This connector provides threat intelligence and enriches incidents.

Why this answer

The MITRE ATT&CK data connector in Microsoft Sentinel ingests threat intelligence feeds that include MITRE ATT&CK technique mappings, enabling automatic classification of incidents by technique. This connector pulls in indicators of compromise (IOCs) with associated technique IDs, which Sentinel then uses to tag and classify incidents during analysis.

Exam trap

The trap here is that candidates often confuse watchlists (static enrichment) with automated classification mechanisms, or think UEBA's anomaly detection inherently maps to MITRE techniques, when in fact it does not assign technique IDs without additional configuration.

Practice this question →
36
Multi-Selectmedium

Which TWO actions can be performed using automation rules in Microsoft Sentinel? (Select TWO.)

Select 2 answers
A.Create a new incident from an alert.
B.Modify the query of an existing analytics rule.
C.Assign an incident to a specific owner.
D.Delete an incident automatically.
E.Trigger a playbook when an incident is created.
AnswersC, E

Assignment is a supported action in automation rules.

Why this answer

Automation rules in Microsoft Sentinel can perform actions such as assigning an incident to a specific owner. This is a built-in action within the automation rule configuration, allowing you to automatically set the owner field of an incident based on conditions like severity or rule ID, without requiring a playbook.

Exam trap

The trap here is that candidates often confuse automation rules with analytics rules, mistakenly thinking automation rules can create incidents or modify analytics rule logic, when in fact automation rules only act on existing incidents and cannot alter detection logic or delete incidents.

Practice this question →
37
Multi-Selecthard

Your organization uses Microsoft Sentinel and Microsoft Defender for Cloud. You need to implement a solution that automatically suppresses low-severity incidents from specific IP addresses that are known internal scanners. Which THREE configurations should you make?

Select 3 answers
A.Add the IP addresses to a watchlist and reference it in analytics rules.
B.Configure an analytics rule with a suppression condition that includes the IP addresses.
C.Create an automation rule that closes incidents matching the IP addresses.
D.Create a suppression rule in Microsoft Defender for Cloud.
E.Create a playbook that deletes incidents from those IP addresses.
AnswersA, B, C

Correct: Watchlists can be used for filtering.

Why this answer

A watchlist in Microsoft Sentinel can store known internal scanner IP addresses, and analytics rules can reference this watchlist to automatically suppress low-severity incidents from those IPs. This allows you to exclude benign scanner activity from generating alerts without modifying the rule logic for other threats.

Exam trap

The trap here is that candidates confuse suppression rules in Defender for Cloud (which suppress alerts at the CSPM level) with incident suppression in Sentinel, leading them to select Option D incorrectly.

Practice this question →
38
MCQeasy

You are configuring Microsoft Sentinel to ingest logs from Azure Active Directory (now Microsoft Entra ID). Which of the following connectors should you use to collect sign-in logs and audit logs?

A.Microsoft Defender for Cloud connector.
B.Office 365 connector.
C.Azure Activity connector.
D.Microsoft Entra ID connector.
AnswerD

This connector collects sign-in logs, audit logs, and provisioning logs.

Why this answer

The Microsoft Entra ID connector (formerly Azure AD connector) is the correct choice because it is specifically designed to ingest sign-in logs, audit logs, and provisioning logs from Microsoft Entra ID into Microsoft Sentinel. This connector uses the Microsoft Graph API to pull these logs, enabling security monitoring of user authentication and administrative activities.

Exam trap

The trap here is that candidates often confuse the Azure Activity connector (which logs Azure resource operations) with the Entra ID connector (which logs identity and authentication events), leading them to incorrectly select option C.

How to eliminate wrong answers

Option A is wrong because the Microsoft Defender for Cloud connector is used to ingest security alerts and recommendations from Defender for Cloud, not Azure AD sign-in or audit logs. Option B is wrong because the Office 365 connector ingests logs from Exchange Online, SharePoint Online, Teams, and other Office 365 workloads, but it does not include Azure AD sign-in or audit logs. Option C is wrong because the Azure Activity connector ingests subscription-level operational logs from Azure Resource Manager (e.g., create/delete resources), not Azure AD sign-in or audit logs.

Practice this question →
39
MCQmedium

Refer to the exhibit. You have created a scheduled analytics rule in Microsoft Sentinel as shown. The rule is not generating any incidents, even though you know Copilot for Microsoft 365 is accessing sensitive files. What is the most likely cause?

A.The triggerThreshold is too high
B.The table being queried does not contain Copilot events
C.The severity is set to Medium, which suppresses incidents
D.The queryFrequency is too short
AnswerB

Copilot events are in CloudAppEvents.

Why this answer

The rule queries the 'SensitivityLabelEvents' table, which tracks sensitivity label changes but does not contain Copilot for Microsoft 365 events. Copilot events are stored in the 'MicrosoftCopilotAudit' table (or 'CloudAppEvents' with specific filters). Since the query targets the wrong table, no matching records are returned, and no incidents are generated.

Exam trap

The trap here is that candidates assume any table related to sensitivity labels will contain all Copilot events, but Microsoft separates Copilot-specific audit logs into a dedicated table, and the exam tests awareness of this schema distinction.

How to eliminate wrong answers

Option A is wrong because the triggerThreshold of 1 is the minimum value; a higher threshold would reduce incidents, but here the issue is zero incidents, not too few. Option C is wrong because severity settings (Medium, High, etc.) do not suppress incident creation; they only affect the incident's priority in the queue. Option D is wrong because a queryFrequency of 5 hours is reasonable for detecting patterns; making it shorter would increase run frequency but would not fix the root cause of querying the wrong table.

Practice this question →
40
Multi-Selectmedium

Your organization uses Microsoft Sentinel and Microsoft Defender XDR. You need to ensure that all incidents are reviewed within 24 hours. Which TWO actions should you take?

Select 2 answers
A.Create an automation rule that runs 24 hours after incident creation and escalates if status is not 'In progress'.
B.Create a playbook that runs every hour and checks incident age.
C.Configure Microsoft Defender XDR to automatically reassign incidents after 24 hours.
D.Create a workbook that displays incidents older than 24 hours and alerts the SOC manager.
E.Modify the analytics rule to automatically close incidents after 24 hours.
AnswersA, D

Correct: Automation rules can use conditions based on time.

Why this answer

Automation rules in Microsoft Sentinel can be configured to run a specific time after incident creation (e.g., 24 hours) and trigger an action, such as changing the status or reassigning the incident, ensuring it is reviewed within the required timeframe. This directly enforces the SLA without manual intervention.

Exam trap

The trap here is that candidates may confuse the purpose of automation rules (for enforcement) with workbooks (for visibility) and incorrectly think that a periodic playbook or a Defender XDR feature is the correct approach, when in fact only automation rules and workbooks provide the required review and alerting capabilities.

Practice this question →
41
MCQhard

Your organization uses Microsoft Defender for Cloud Apps and Microsoft Sentinel. You discover that a user is performing unusual bulk downloads from SharePoint. You need to automatically create an incident in Sentinel and suspend the user in Microsoft Entra ID. What should you use?

A.Create a scheduled analytics rule in Sentinel and use automation rules to trigger a playbook that suspends the user.
B.Configure a Microsoft Entra ID Protection policy to require password reset for risky users.
C.Use a playbook triggered by an incident creation rule to suspend the user.
D.Configure a policy in Defender for Cloud Apps with a governance action to suspend the user.
AnswerA

Automation rules run playbooks, which can use Microsoft Graph to suspend the user.

Why this answer

A scheduled analytics rule in Sentinel can detect the unusual bulk download behavior from SharePoint (via ingested logs from Defender for Cloud Apps or Office 365 connector). An automation rule on that analytics rule triggers a playbook (Azure Logic App) that uses the Microsoft Graph API to suspend the user in Microsoft Entra ID, creating an incident automatically as part of the rule's configuration.

Exam trap

The trap here is that candidates assume Defender for Cloud Apps governance actions alone can satisfy both requirements, but they forget that creating a Sentinel incident requires an analytics rule and automation rule orchestration, not just a cloud app policy.

How to eliminate wrong answers

Option B is wrong because Microsoft Entra ID Protection policies focus on sign-in risk and user risk (e.g., leaked credentials, anonymous IP) but do not directly detect bulk download anomalies from SharePoint; they also cannot trigger a Sentinel incident. Option C is wrong because 'incident creation rule' is not a valid Sentinel construct—incidents are created by analytics rules, and playbooks are triggered by automation rules, not by a rule named 'incident creation rule'. Option D is wrong because while Defender for Cloud Apps can apply governance actions (like suspend user) directly, it does not automatically create an incident in Sentinel; the question requires both an incident in Sentinel AND user suspension, which requires the orchestration of a playbook.

Practice this question →
42
MCQmedium

Your Microsoft Sentinel environment is not generating incidents from a custom KQL detection rule. The rule runs successfully in the Log Analytics query editor but no incidents appear. What is the most likely cause?

A.The rule's alert grouping settings are misconfigured
B.The rule is set to create alerts but not incidents
C.The rule's query schedule is too long
D.The rule does not have entity mapping configured
AnswerB

Correct. The rule is set to create alerts but not incidents, meaning the 'Create incident' toggle is off. This is the most common reason for missing incidents despite successful query execution.

Why this answer

The most likely cause is that the rule is set to create alerts but not incidents. In Microsoft Sentinel, analytics rules have a toggle to 'Create incidents' from alerts. If this toggle is disabled, alerts are generated but not grouped into incidents.

The query running successfully in Log Analytics confirms the rule logic works, but incidents will not appear unless the incident creation toggle is enabled. Entity mapping is not required for incident creation; it enhances correlation but is not a prerequisite.

Exam trap

The trap is that candidates often assume entity mapping is necessary for incident creation, but in reality the key setting is the 'Create incident' toggle. They may overlook this simple configuration.

How to eliminate wrong answers

Option A is wrong because alert grouping settings control how alerts are grouped into a single incident (e.g., by entity or time window), but they do not prevent incidents from being created entirely; if incidents are enabled, misconfigured grouping might cause unexpected grouping, not a total absence of incidents. Option B is wrong because this is the correct description of the issue—the rule is set to create alerts but not incidents, which directly explains why no incidents appear despite successful query execution. Option C is wrong because a long query schedule (e.g., running every 24 hours) would delay incident creation but not prevent it; incidents would still appear after the scheduled run if the rule is configured to create them.

Practice this question →
43
MCQeasy

You are configuring a Microsoft Sentinel automation rule to automatically assign incidents to a specific owner based on a custom property. Which action type should you use?

A.Run playbook
B.Assign owner
C.Change status
D.Create ticket (preview)
AnswerB

This action sets the incident owner to a specified user or group.

Why this answer

The 'Assign owner' action type is specifically designed to change the owner of an incident in Microsoft Sentinel. When you need to automatically assign incidents to a specific owner based on a custom property (e.g., a tag or custom field), this action directly modifies the incident's 'Owner' property. Other action types serve different purposes: 'Run playbook' executes a logic app, 'Change status' updates the incident's status (e.g., New, Active, Closed), and 'Create ticket (preview)' creates an external ticket in a connected ticketing system.

Exam trap

The trap here is that candidates often confuse 'Assign owner' with 'Run playbook', thinking a playbook is required to change the owner, but Sentinel provides a native action for this simple property change without needing a Logic App.

How to eliminate wrong answers

Option A is wrong because 'Run playbook' triggers a Logic App workflow, which can include complex logic but is not a direct action to set the incident owner; it is used for automation beyond simple property changes. Option C is wrong because 'Change status' modifies the incident's status (e.g., from New to Active), not the owner assignment. Option D is wrong because 'Create ticket (preview)' generates a ticket in an external system (e.g., ServiceNow) and does not modify the Sentinel incident's owner field.

Practice this question →
44
MCQhard

Your security team uses Microsoft Defender XDR (formerly Microsoft 365 Defender) to investigate incidents. You notice that some alerts from Microsoft Defender for Endpoint are not being automatically correlated into incidents as expected. You have confirmed that the relevant alert sources are enabled in the Microsoft Defender XDR portal. What is the most likely cause?

A.Alert tuning rules are causing the alerts to be excluded.
B.Incident correlation rules are not enabled for the relevant alert sources.
C.Automation rules in Microsoft Sentinel are deleting the alerts.
D.Alert suppression rules are blocking the alerts.
AnswerB

Correlation rules must be enabled to automatically create incidents from alerts.

Why this answer

Microsoft Defender XDR uses built-in correlation logic to automatically group related alerts from different sources (e.g., Defender for Endpoint, Defender for Office 365) into incidents. If alerts from a specific source, such as Defender for Endpoint, are not being correlated, the most likely cause is that the incident correlation rules for that source are not enabled in the Microsoft Defender XDR portal. Enabling the alert source alone is insufficient; the correlation engine must be explicitly activated for each source to aggregate alerts into incidents.

Exam trap

The trap here is that candidates assume enabling an alert source in the Microsoft Defender XDR portal automatically enables incident correlation for that source, but in reality, correlation rules must be explicitly enabled separately for each source.

How to eliminate wrong answers

Option A is wrong because alert tuning rules in Microsoft Defender XDR are used to reduce noise by suppressing or grouping alerts, but they do not prevent alerts from being correlated into incidents; they only affect alert generation. Option C is wrong because automation rules in Microsoft Sentinel are separate from Microsoft Defender XDR and operate on Sentinel incidents, not on Defender XDR alert correlation; Sentinel automation rules cannot delete alerts from Defender XDR. Option D is wrong because alert suppression rules in Defender for Endpoint are designed to suppress alerts based on criteria like device groups or severity, but they do not block alerts from being correlated into incidents; suppression only prevents alert creation, not correlation.

Practice this question →

Ready to test yourself?

Try a timed practice session using only Manage a security operations environment questions.

Start 20-question session