Courseiva

CCNA Manage a security operations environment Questions

75 of 554 questions · Page 4/8 · Manage a security operations environment · Answers revealed

Practice these questionsDomain overviewAll questions
226
Multi-Selecthard

Your SOC is implementing a Microsoft Sentinel workspace with multiple content hub solutions. You need to ensure that only approved analytics rules are enabled and that any custom rules are reviewed before activation. Which THREE actions should you take?

Select 3 answers
A.Configure Threat Intelligence - Taxii connector to import rules from an external feed.
B.Use the Hunting blade to create custom hunting queries instead of analytics rules.
C.Use Microsoft Sentinel Repositories (CI/CD) to manage analytics rules via Azure DevOps or GitHub.
D.In Content hub, install only the solutions that contain approved analytics rules.
E.Create an automation rule that disables any newly created analytics rule that is not in an approved list.
AnswersC, D, E

CI/CD pipelines enforce approval workflows before rules are deployed.

Why this answer

Option A (Repositories) allows CI/CD to control rule deployment. Option B (Content hub) allows selecting only approved solutions. Option E (Automation rules) can disable unapproved rules when created.

Option C is for threat intelligence, not rule management. Option D is for hunting, not rule approval.

Practice this question →
227
Multi-Selectmedium

Which TWO actions are valid ways to reduce the number of false positive incidents in Microsoft Sentinel without disabling analytics rules?

Select 2 answers
A.Configure the rule to group all alerts into a single incident per entity.
B.Increase the rule run frequency.
C.Change the incident severity to Informational.
D.Modify the rule's query to include additional filters.
E.Create an automation rule to close incidents that match certain criteria.
AnswersD, E

Adding filters can exclude benign activity.

Why this answer

Options B and D are correct. Option B: Automation rules can close incidents based on conditions. Option D: Tuning the rule's query logic (e.g., adding exclusions) reduces false positives.

Option A is wrong because increasing run frequency does not reduce false positives. Option C is wrong because grouping alerts per-entity does not filter false positives. Option E is wrong because changing severity does not reduce incidents.

Practice this question →
228
Multi-Selecthard

Which TWO features in Microsoft Sentinel can help reduce alert fatigue by grouping related alerts into incidents? (Select two.)

Select 2 answers
A.Incident merging
B.Entity behavior analytics
C.Automation rules that run playbooks
D.Analytics rules that create incidents
E.Threat intelligence indicators
AnswersA, D

Merging combines related incidents into one.

Why this answer

Incident creation from analytics rules groups alerts, and incident merging combines related incidents. Option A and D are correct. Option B is for automation, not grouping.

Option C is for threat intel. Option E is for data enrichment.

Practice this question →
229
MCQmedium

Your organization is using Microsoft Defender for Cloud Apps to protect cloud applications. The security team wants to be alerted when a user shares a sensitive file with an external user. What should you configure?

A.Activity policy
B.App discovery policy
C.Anomaly detection policy
D.File policy
AnswerD

File policies can monitor file sharing and trigger alerts.

Why this answer

Option B is correct because file policies in Defender for Cloud Apps can monitor file sharing activities and trigger alerts based on conditions like sharing with external users. Option A is wrong because activity policies focus on user activities, not file-specific actions. Option C is wrong because anomaly detection policies detect unusual user behavior, not specific file sharing.

Option D is wrong because app discovery policies are for discovering cloud apps.

Practice this question →
230
MCQmedium

Refer to the exhibit. You are investigating a user entity in Microsoft Sentinel. The entity details show a riskLevel of 'high' and riskState 'atRisk'. What does this indicate?

A.The user account has been disabled
B.The user account triggered a Sentinel analytics rule
C.The user account has been flagged by Microsoft Entra ID Protection as at risk
D.The user account has been confirmed compromised
AnswerC

The riskLevel and riskState fields come from Microsoft Entra ID Protection integration.

Why this answer

Option C is correct because the riskLevel of 'high' and riskState of 'atRisk' are specific properties populated by Microsoft Entra ID Protection (formerly Azure AD Identity Protection). These values indicate that the user account has been flagged as risky based on real-time risk detections (e.g., leaked credentials, anonymous IP address, atypical travel). This is not a direct result of a Sentinel analytics rule, nor does it mean the account is disabled or confirmed compromised—it means the identity protection service has detected suspicious activity and assigned a risk level.

Exam trap

The trap here is that candidates often confuse the riskLevel and riskState fields from Microsoft Entra ID Protection with Sentinel analytics rule alerts, assuming any 'high risk' label must come from a detection rule, when in fact these fields are native identity protection properties that are enriched into the entity.

How to eliminate wrong answers

Option A is wrong because a disabled user account would show a different entity property (e.g., accountEnabled: false) and would not be reflected in the riskLevel or riskState fields, which are specific to identity risk detection. Option B is wrong because triggering a Sentinel analytics rule would generate an incident or alert, but the riskLevel and riskState fields on the user entity are populated by Microsoft Entra ID Protection, not by Sentinel analytics rules. Option D is wrong because a riskState of 'atRisk' indicates the account is suspected to be compromised but has not yet been confirmed; a confirmed compromise would show a riskState of 'confirmedCompromised'.

Practice this question →
231
MCQeasy

Your organization uses Microsoft Sentinel. You need to ensure that an alert is created when a user accesses a sensitive SharePoint site from an unusual location. What should you create?

A.A watchlist
B.An analytics rule
C.A playbook
D.An automation rule
AnswerB

Analytics rules can detect suspicious access patterns and generate alerts.

Why this answer

An analytics rule can be created to detect user access from unusual locations using Sentinel's built-in templates or custom KQL. Option B is correct. Option A (automation rule) responds to incidents, not creates alerts.

Option C (playbook) is for response. Option D (watchlist) stores data but doesn't generate alerts.

Practice this question →
232
MCQeasy

Your organization uses Microsoft Purview Data Loss Prevention (DLP) policies. You need to investigate an incident where sensitive data was shared externally. You want to view the details in Microsoft Sentinel. What should you ensure is configured?

A.The Microsoft 365 data connector in Microsoft Sentinel is enabled and configured to collect DLP alerts.
B.The SharePoint site is configured for external sharing.
C.The DLP policy must be set to 'Audit only' mode.
D.The unified audit log is enabled and the DLP events are being generated.
AnswerA

This connector ingests DLP alerts.

Why this answer

Option B is correct because Microsoft Purview DLP alerts can be ingested into Microsoft Sentinel via the Microsoft 365 connector (now part of Microsoft Defender XDR connector). Option A is for DLP policy management, not ingestion. Option C is for auditing.

Option D is for internal sharing.

Practice this question →
233
MCQhard

Your organization uses Microsoft Defender XDR incident queue. You want to automatically assign incidents related to a specific campaign to a dedicated SOC group. What should you create?

A.A standard rule in Microsoft Defender for Endpoint.
B.An automation rule in Microsoft Sentinel.
C.A custom detection rule in Microsoft Defender XDR that includes an incident assignment action.
D.A custom role in Microsoft Defender XDR.
AnswerC

Custom detections can assign incidents to groups.

Why this answer

Option B is correct because Microsoft Defender XDR allows creation of custom detection rules that can automatically assign incidents. Option A is wrong because automation rules in Microsoft Sentinel are for Sentinel incidents, not Defender XDR incidents. Option C is wrong because standard rules in MDE do not assign incidents.

Option D is wrong because custom roles are for access control, not automation.

Practice this question →
234
Multi-Selecteasy

Which TWO Azure services can be used to automate response actions in Microsoft Sentinel when an incident is created?

Select 2 answers
A.Azure Automation
B.Azure Logic Apps
C.Azure Functions
D.Azure Event Grid
E.Power Automate
AnswersB, C

Logic Apps can be used as playbooks in Sentinel.

Why this answer

Azure Logic Apps (B) is correct because it provides a native connector for Microsoft Sentinel that enables automated incident response workflows, such as triggering playbooks when an incident is created. Azure Functions (C) is correct because it allows custom code execution in response to Sentinel incidents via HTTP triggers or integration with Azure Automation, enabling complex automation beyond Logic Apps' capabilities.

Exam trap

The trap here is that candidates often confuse Azure Automation with Azure Logic Apps, assuming Automation can directly trigger on Sentinel incidents, but Automation runbooks require a separate trigger (e.g., from Logic Apps or Functions) and are not natively integrated with Sentinel's incident creation pipeline.

Practice this question →
235
MCQeasy

You need to grant a junior analyst the ability to view and investigate incidents in Microsoft Sentinel, but not make any changes. Which built-in role should you assign?

A.Microsoft Sentinel Responder
B.Microsoft Sentinel Contributor
C.Microsoft Sentinel Automation Contributor
D.Microsoft Sentinel Reader
AnswerD

Read-only role for Sentinel.

Why this answer

The Microsoft Sentinel Reader role provides read-only access to Sentinel resources, including incidents, workbooks, and analytics rules, without allowing any modifications. This aligns with the requirement to view and investigate incidents without making changes, as the role explicitly denies write, delete, or action permissions on Sentinel data.

Exam trap

The trap here is that candidates often confuse 'view and investigate' with the ability to update incident status or run playbooks, leading them to choose the Responder role, which actually allows changes.

How to eliminate wrong answers

Option A is wrong because the Microsoft Sentinel Responder role allows updating incidents (e.g., changing status, assigning ownership) and running playbooks, which includes making changes, not just viewing. Option B is wrong because the Microsoft Sentinel Contributor role grants full write access to Sentinel resources, including creating and modifying incidents, analytics rules, and automation rules, which exceeds the read-only requirement. Option C is wrong because the Microsoft Sentinel Automation Contributor role is specifically designed to manage automation rules and playbooks, not for viewing or investigating incidents, and it includes write permissions to automation components.

Practice this question →
236
Multi-Selectmedium

Which TWO actions can be performed using automation rules in Microsoft Sentinel?

Select 2 answers
A.Run a playbook
B.Assign an incident to an owner
C.Create an incident
D.Modify an analytics rule
E.Delete an incident
AnswersA, B

Automation rules can trigger playbooks as an action.

Why this answer

Automation rules can run playbooks and assign incidents to owners. They cannot create incidents (that's done by analytics rules) or modify analytics rules (that's done manually or via API). They also cannot delete incidents.

Practice this question →
237
MCQhard

Your company uses Microsoft Defender for Cloud to assess the security posture of hybrid workloads. You are configuring a governance rule to automatically remediate a specific recommendation that is out of compliance. The recommendation is 'Virtual machines should be migrated to new Azure Resource Manager resources'. You need to ensure that the remediation is applied at scale across all subscriptions in the management group. What should you do?

A.Create a PowerShell script that runs on each VM to migrate it, and execute it via Azure Automation.
B.Create an Azure Policy initiative that includes the recommendation and assign it with a remediation task at the management group level.
C.Create a governance rule in Microsoft Defender for Cloud with scope set to the management group, condition on the recommendation, and action set to 'Automatic'.
D.Create a governance rule in Microsoft Defender for Cloud with scope set to a single subscription and action set to 'Automatic'.
AnswerC

Governance rules can be scoped to management groups and perform automatic remediation.

Why this answer

Option C is correct because governance rules in Microsoft Defender for Cloud allow you to define automatic remediation actions for specific recommendations at scale. By setting the scope to the management group, the rule applies to all subscriptions within that group, and the 'Automatic' action triggers the built-in remediation script for the 'Virtual machines should be migrated to new Azure Resource Manager resources' recommendation without requiring custom scripting or policy assignments.

Exam trap

The trap here is that candidates may confuse Azure Policy remediation tasks with Defender for Cloud governance rules, not realizing that governance rules provide a simpler, built-in mechanism for automatic remediation of specific recommendations at scale without requiring separate policy assignments.

How to eliminate wrong answers

Option A is wrong because creating a PowerShell script and executing it via Azure Automation is a manual, custom approach that does not leverage Defender for Cloud's native governance rule capability for automatic, at-scale remediation across all subscriptions in a management group. Option B is wrong because Azure Policy initiatives can enforce compliance but do not directly integrate with Defender for Cloud's governance rules for automatic remediation of specific recommendations; a governance rule is the correct mechanism for this scenario. Option D is wrong because setting the scope to a single subscription would not apply the remediation across all subscriptions in the management group, failing the requirement for at-scale application.

Practice this question →
238
MCQhard

Refer to the exhibit. You are analyzing a KQL query for a Microsoft Sentinel scheduled rule. The query is intended to detect devices that have both a high number of process executions and network connections to a single IP within an hour. However, the query returns no results even though there are devices meeting the criteria. What is the most likely cause?

A.The threshold variable is not used correctly
B.The join condition does not include a time window, causing mismatches
C.The DeviceProcessEvents and DeviceNetworkEvents tables are from different data sources
D.The summarize function cannot count process executions
AnswerB

Without a time window, the join may not align events from the same time period.

Why this answer

Option B is correct because the join between DeviceProcessEvents and DeviceNetworkEvents lacks a time window constraint (e.g., 'on $left.Timestamp between ($right.Timestamp - 1h) and ($right.Timestamp + 1h)'). Without this, the join matches events across arbitrary time ranges, causing mismatches where a device's process executions and network connections to a single IP occur at different times, even if both happen within the same hour. This results in no rows being returned when the intended detection requires temporal proximity.

Exam trap

The trap here is that candidates assume a simple key-based join (e.g., on DeviceId) is sufficient, overlooking the critical need for a time window to correlate events that occur within the same detection window, which is a common pitfall in KQL-based detection rules.

How to eliminate wrong answers

Option A is wrong because the threshold variable (e.g., 'let threshold = 10;') is used correctly in the query to filter aggregated counts; the issue is not with variable usage but with the join logic. Option C is wrong because DeviceProcessEvents and DeviceNetworkEvents are both Microsoft Defender for Endpoint tables in the same Advanced Hunting schema, so they are from the same data source and can be joined directly. Option D is wrong because the summarize function can count process executions using 'count()' or 'dcount()' on the DeviceProcessEvents table; the failure is not due to a limitation of summarize.

Practice this question →
239
MCQmedium

Refer to the exhibit. You are reviewing a Microsoft Sentinel scheduled analytics rule defined in JSON. The rule is intended to trigger an incident when more than 5 sign-ins from anomalous locations occur within an hour. However, the rule is not triggering as expected. What is the most likely cause?

A.The severity is set to 'Medium', but it must be an integer.
B.The query references a column that does not exist in the SigninLogs table.
C.The triggerThreshold is set to 5, but it should be a string like '5'.
D.The queryFrequency and queryPeriod are set to the same value, which is not allowed.
AnswerB

Correct. 'RiskLevelDuringSignIn' is not a valid column; the correct column is 'RiskLevelDuringSignIn'.

Why this answer

Option B is correct because the query references a column that does not exist in the SigninLogs table. In Microsoft Sentinel, if a scheduled analytics rule's KQL query references a non-existent column, the query will fail silently or return no results, preventing the rule from triggering an incident. The rule logic depends on the query returning a result set that meets the trigger threshold, and a missing column causes the query to fail or return zero rows.

Exam trap

The trap here is that candidates may focus on the JSON syntax or rule configuration parameters (like severity type or triggerThreshold) instead of recognizing that the core issue is a KQL query referencing a non-existent column, which is a common data source mismatch error.

How to eliminate wrong answers

Option A is wrong because the 'severity' field in a Sentinel analytics rule JSON must be a string (e.g., 'Medium'), not an integer; the rule would fail to validate if it were an integer. Option C is wrong because 'triggerThreshold' is not a valid field in a Sentinel scheduled analytics rule; the correct field is 'triggerOperator' and 'triggerThreshold' is used in other contexts like Azure Monitor alerts, and it must be an integer, not a string. Option D is wrong because setting 'queryFrequency' and 'queryPeriod' to the same value is allowed and is actually common for rules that look back exactly one frequency window; the rule would still run correctly.

Practice this question →
240
Multi-Selectmedium

Which TWO capabilities are provided by Microsoft Copilot for Security within the Microsoft Sentinel experience?

Select 2 answers
A.Suggest KQL queries based on a description of what you want to detect.
B.Deploy a new workbook template from a description.
C.Modify an existing playbook by adding steps through natural language.
D.Generate a natural language summary of an incident.
E.Automatically create an automation rule based on a chat prompt.
AnswersA, D

Copilot can assist with KQL.

Why this answer

Option A is correct because Microsoft Copilot for Security in Microsoft Sentinel can generate KQL queries from natural language descriptions, allowing analysts to quickly create detection rules without manually writing KQL syntax. This capability leverages AI to interpret the analyst's intent and produce a query that matches the described detection logic.

Exam trap

The trap here is that candidates may assume Copilot can automate operational tasks like deploying templates or modifying playbooks, but its capabilities are limited to generating KQL queries and summarizing incidents, not performing infrastructure changes.

Practice this question →
241
Multi-Selectmedium

You need to configure Microsoft Sentinel to comply with a regulatory requirement that all security incidents must be retained for 7 years. Which TWO actions should you take?

Select 2 answers
A.Set the workspace retention policy to 2555 days (7 years).
B.Configure a data export rule to send data to an Azure Storage account with immutable storage for 7 years.
C.Configure table-level retention policies for each table to 7 years.
D.Use Basic Logs for all tables to reduce costs.
E.Use Azure Policy to enforce a minimum retention period of 7 years on all workspaces.
AnswersA, B

Workspace retention can be set to up to 730 days by default, but with archive policy it can be extended to 7 years.

Why this answer

Options A and D are correct. Setting a retention policy on the workspace to 7 years ensures data retention. Configuring a data export rule allows long-term retention in a storage account for compliance.

Option B is incorrect because Basic Logs have a maximum retention of 30 days. Option C is incorrect because table-level retention cannot exceed workspace retention. Option E is incorrect because log analytics workspace retention can be set to up to 730 days by default, but longer via archive.

Practice this question →
242
MCQmedium

Your SOC is investigating an incident in Microsoft Sentinel. You need to quickly identify all related alerts and entities across the timeline. What Microsoft Sentinel feature should you use?

A.Run a hunting query.
B.Open the incident investigation graph.
C.Review the analytics rule that generated the incident.
D.Use the Incident workbook.
AnswerB

Investigation graph shows relationships.

Why this answer

The incident investigation graph in Microsoft Sentinel provides a visual, interactive map of all alerts, entities (such as users, IP addresses, hosts), and their relationships linked to a specific incident. This allows SOC analysts to quickly see the full scope of an incident across the timeline without manually correlating data, making it the correct tool for this scenario.

Exam trap

The trap here is that candidates may confuse the incident investigation graph with the Incident workbook, assuming both provide incident details, but the workbook is for aggregated reporting while the graph is for interactive, entity-level exploration of a single incident.

How to eliminate wrong answers

Option A is wrong because hunting queries are proactive searches for potential threats across raw data, not designed to retroactively consolidate all alerts and entities for a single incident. Option C is wrong because reviewing the analytics rule only shows the rule's configuration and logic, not the aggregated alerts and entities tied to the incident. Option D is wrong because the Incident workbook provides summary metrics and trends across incidents, not a focused, interactive graph of a single incident's related alerts and entities.

Practice this question →
243
Multi-Selecthard

Your organization uses Microsoft Sentinel with UEBA enabled. You need to investigate a potential insider threat where a user is accessing sensitive data outside of business hours. Which three built-in UEBA entities should you review?

Select 3 answers
A.Azure subscription
B.User account
C.Device
D.IP address
E.Resource group
AnswersB, C, D

Correct: User is a primary entity.

Why this answer

Option B is correct because UEBA tracks user entities. Option C is correct because IP address is a common entity. Option D is correct because devices are entities in UEBA.

Option A is incorrect because subscriptions are not UEBA entities. Option E is incorrect because resource groups are not entities.

Practice this question →
244
MCQhard

Your organization has Microsoft Sentinel deployed across multiple workspaces for different business units. The security team wants to view a unified incident queue across all workspaces. What should you implement?

A.Create cross-workspace queries and use the incident view with workspace references
B.Use Microsoft Defender XDR portal to view all incidents
C.Use Azure Lighthouse to manage multiple workspaces
D.Configure a single workspace to receive all incidents
AnswerA

You can configure cross-workspace analytics rules and use the incidents blade to view incidents across workspaces.

Why this answer

Option C is correct because Microsoft Sentinel provides cross-workspace querying and incident management through the use of workspace references in analytics rules and the incidents blade. Option A is wrong because unified incident management is not natively supported in a single workspace; you need to configure cross-workspace views. Option B is wrong because Azure Lighthouse enables management across tenants but not necessarily unified incident queue.

Option D is wrong because Microsoft Defender XDR is a separate portal.

Practice this question →
245
MCQhard

Your organization uses Microsoft Sentinel and has a large number of incidents daily. You need to automatically assign incidents to the correct SOC tier based on severity: Low severity to Tier 1, Medium to Tier 2, High and Critical to Tier 3. Which approach should you use?

A.Configure custom details in the analytics rule to include severity, then use a playbook to assign
B.Create one automation rule with multiple conditions and trigger a playbook that uses a switch statement on severity
C.Create three separate automation rules, each with a condition on severity and a playbook that assigns to the appropriate group
D.Use incident grouping to combine incidents by severity and assign the group
AnswerC

Each automation rule can target a specific severity and trigger a playbook to assign the incident.

Why this answer

Option C is correct because automation rules can have conditions and trigger playbooks to assign. Option A is wrong because custom details cannot assign owners. Option B is wrong because you would need multiple rules, but each rule can have multiple conditions.

Option D is wrong because grouping doesn't help with assignment.

Practice this question →
246
MCQhard

Refer to the exhibit. A security administrator runs this PowerShell script. What is the effect?

A.It creates an automation rule that runs a playbook on medium severity incidents
B.It creates a playbook that runs daily for high severity incidents
C.It schedules a daily report generation for all incidents
D.It creates a playbook named 'DailySummaryReport'
AnswerA

The cmdlet creates an automation rule with a trigger condition for medium incidents.

Why this answer

The PowerShell script uses the `New-AzSentinelAutomationRule` cmdlet to create an automation rule in Microsoft Sentinel. The `-TriggerType` parameter is set to `IncidentCreated`, and the `-Action` parameter specifies a playbook to run. The `-TriggeringLogic` parameter filters for incidents with a severity of `Medium`, so the automation rule triggers the playbook only when a medium-severity incident is created.

Exam trap

The trap here is that candidates confuse creating an automation rule with creating a playbook, or assume the script schedules a recurring task because of the 'DailySummaryReport' name, when in fact the script only links an existing playbook to a trigger condition.

How to eliminate wrong answers

Option B is wrong because the script creates an automation rule triggered by incident creation, not a scheduled playbook; there is no recurrence or daily schedule defined. Option C is wrong because the script does not generate any report or schedule a report generation; it only associates a playbook with incident creation. Option D is wrong because the script creates an automation rule, not a playbook; the playbook named 'DailySummaryReport' is referenced as an action, but the script itself does not create the playbook.

Practice this question →
247
MCQmedium

Refer to the exhibit. You are analyzing high severity alerts from Microsoft Defender for Endpoint in Microsoft Sentinel. What does this KQL query do?

A.It counts alerts for a specific alert name
B.It displays detailed properties of each alert
C.It lists high severity Defender for Endpoint alerts, grouped by name and day, ordered by frequency
D.It shows all alerts from Defender for Endpoint in the last week
AnswerC

The query does exactly that.

Why this answer

The KQL query uses `summarize` with `count()` to group alerts by `AlertName` and `startofday(TimeGenerated)`, then sorts by `count_` descending. This directly produces a list of high severity Defender for Endpoint alerts grouped by name and day, ordered by frequency, matching option C.

Exam trap

Microsoft often tests the distinction between summarizing aggregated data (counts) versus displaying raw event details, so candidates mistakenly choose 'displays detailed properties' when the query uses `summarize` and `count()`.

How to eliminate wrong answers

Option A is wrong because the query groups by alert name and day, not filtering to a single specific alert name. Option B is wrong because the query uses `summarize` to aggregate counts, not `project` or `extend` to display detailed properties of each alert. Option D is wrong because the query filters for `TimeGenerated > ago(7d)` but also filters by `AlertSeverity == 'High'` and groups results, not showing all alerts from the last week.

Practice this question →
248
MCQeasy

Your organization uses Microsoft Sentinel for security operations. You need to ensure that critical alerts are automatically assigned to the appropriate SOC tier for investigation. What should you configure in Microsoft Sentinel?

A.Create a playbook that assigns the incident to a user
B.Use a watchlist to map alert types to owners
C.Configure an analytics rule to set the owner
D.Create an automation rule that sets the incident owner
AnswerD

Automation rules can automatically assign incidents to owners or groups.

Why this answer

Automation rules in Microsoft Sentinel allow you to automatically assign incidents to specific owners based on conditions like severity or alert type. This ensures critical alerts are routed to the appropriate SOC tier without manual intervention, directly meeting the requirement.

Exam trap

The trap here is that candidates often confuse the capabilities of analytics rules (which generate incidents) with automation rules (which handle post-creation actions like owner assignment), leading them to incorrectly select Option C.

How to eliminate wrong answers

Option A is wrong because a playbook that assigns an incident to a user is an over-engineered solution; automation rules are designed for simple owner assignment without the need for a Logic App. Option B is wrong because watchlists are used for correlating data or enriching alerts, not for assigning incident ownership. Option C is wrong because analytics rules define alert conditions and generate incidents, but they do not have a setting to configure the incident owner; owner assignment is handled post-creation by automation rules or playbooks.

Practice this question →
249
MCQeasy

Your organization uses Microsoft Sentinel to manage security incidents. The security team wants to automatically assign incidents to the appropriate analyst based on the incident’s severity and category. Which feature should you configure?

A.Automation rules
B.Analytics rules
C.Playbooks
D.Watchlists
AnswerA

Automation rules can automatically assign incidents based on conditions.

Why this answer

Option A is correct because automation rules in Microsoft Sentinel allow you to automatically assign incidents based on conditions like severity and category. Option B is wrong because playbooks are used for automated response actions, not assignment. Option C is wrong because analytics rules generate incidents, they don't assign them.

Option D is wrong because watchlists are used to correlate data, not assign incidents.

Practice this question →
250
MCQmedium

Your company uses Microsoft Sentinel and has a workspace in the East US region. You need to ingest logs from a non-Azure Windows server located in a branch office in Europe. You have limited bandwidth and need to ensure that log ingestion does not impact network performance. What should you use?

A.Use Microsoft Defender for Endpoint to collect logs from the server and forward them to Sentinel.
B.Install the Log Analytics agent (MMA) on the server and configure it to send logs directly to the workspace.
C.Install the Azure Monitor Agent on the server and create a data collection rule to filter and compress logs before sending.
D.Configure the server to send logs to an Azure Event Hub, then stream to Sentinel.
AnswerC

AMA with DCRs allows filtering and compression to minimize bandwidth.

Why this answer

Option C is correct because the Azure Monitor Agent (AMA) supports data collection rules (DCRs) that can filter logs at the source and compress data before transmission, reducing bandwidth usage. This is critical for the limited bandwidth scenario, and AMA is the modern replacement for the Log Analytics agent, designed for efficient log ingestion across regions.

Exam trap

The trap here is that candidates often assume MMA is still the default for on-premises servers, but Microsoft has deprecated MMA in favor of AMA, and AMA’s DCR-based filtering and compression directly address bandwidth constraints, which MMA cannot do natively.

How to eliminate wrong answers

Option A is wrong because Microsoft Defender for Endpoint collects security telemetry (e.g., alerts, EDR signals) but does not natively forward arbitrary Windows event logs or custom logs to Sentinel; it requires additional configuration and does not address bandwidth optimization. Option B is wrong because the Log Analytics agent (MMA) sends logs without built-in compression or filtering at the source, leading to higher bandwidth consumption, and it is deprecated in favor of AMA. Option D is wrong because sending logs to an Azure Event Hub introduces additional network hops and potential latency, and while Event Hubs can handle high throughput, they do not inherently compress or filter logs to reduce bandwidth impact; this approach is typically used for high-volume streaming, not bandwidth-constrained scenarios.

Practice this question →
251
MCQeasy

You are configuring Microsoft Sentinel to ingest syslog data from a network appliance. After configuring the data connector, you notice that no data is appearing in the CommonSecurityLog table. The syslog server is sending data to the Azure Monitor Agent (AMA) on the log collector. What should you verify first?

A.Check the Heartbeat table for the log collector.
B.Verify that a Data Collection Rule is defined to collect the syslog facilities.
C.Ensure the syslog appliance can reach the collector on UDP port 514.
D.Check the data connector health status in Sentinel.
AnswerB

A DCR is required to instruct AMA to collect and send syslog data.

Why this answer

The Azure Monitor Agent (AMA) requires a Data Collection Rule (DCR) to specify which syslog facilities and severity levels to collect. Without a DCR, the AMA will not forward syslog data to the CommonSecurityLog table, even if the syslog server is sending data to the collector. This is the most common missing configuration step after setting up the data connector.

Exam trap

The trap here is that candidates assume the data connector automatically creates the necessary Data Collection Rule, when in fact the DCR must be manually configured or verified after connector setup.

How to eliminate wrong answers

Option A is wrong because the Heartbeat table shows agent connectivity, not whether syslog data is being collected or forwarded to the correct table; a healthy heartbeat does not guarantee DCR configuration. Option C is wrong because the question states the syslog server is already sending data to the AMA, so network connectivity on UDP 514 is already established. Option D is wrong because the data connector health status in Sentinel checks the connector's overall configuration and permissions, not the specific DCR mapping of syslog facilities to the CommonSecurityLog table.

Practice this question →
252
MCQmedium

Your organization uses Microsoft Defender for Cloud to monitor hybrid workloads. You need to ensure that security alerts from on-premises servers are sent to Microsoft Sentinel. What should you configure?

A.Install a third-party SIEM connector on the servers and forward logs to Sentinel.
B.Deploy Azure Policy on the servers to audit security settings.
C.Connect the on-premises servers to Azure Arc and deploy the Log Analytics agent.
D.Configure a site-to-site VPN to Azure and enable network logging.
AnswerC

Azure Arc allows agent deployment and log forwarding to Sentinel.

Why this answer

Azure Arc enables on-premises servers to be managed as Azure resources and to install the Log Analytics agent, forwarding logs to Sentinel. Option A is wrong because Azure Policy can enforce configurations but does not directly send alerts. Option C is wrong because a third-party SIEM would bypass Sentinel.

Option D is wrong because a VPN does not solve log ingestion.

Practice this question →
253
MCQhard

Your organization uses Microsoft Defender XDR. You need to ensure that when a user reports a phishing email using the built-in Outlook add-in, the incident is automatically created in Microsoft Sentinel with high severity and a custom tag 'Phishing-Reported'. What is the most efficient way to achieve this?

A.Configure the 'User-reported phishing' policy in Microsoft Defender XDR to create an incident in Microsoft Sentinel with high severity and the tag.
B.Set up an automation rule in Microsoft Sentinel to tag incidents from 'Microsoft Defender' connector with the tag when severity is high.
C.Create a Power Automate flow that reads from the unified audit log and creates a Sentinel incident via API.
D.Use a playbook triggered by a Microsoft Sentinel analytics rule that monitors for 'PhishDeliver' events.
AnswerA

Defender XDR can directly create Sentinel incidents with specified properties.

Why this answer

Option A is correct because Microsoft Defender XDR has a built-in automation for user-reported phishing that can create incidents. You can configure the policy to set severity and add tags. Option B requires custom development.

Option C is an alternative but less integrated. Option D is wrong because automation rules in Sentinel trigger on existing incidents, not on email reports directly.

Practice this question →
254
Multi-Selectmedium

Which TWO actions can you perform using Microsoft Sentinel automation rules? (Select two.)

Select 2 answers
A.Create a task on an incident
B.Run a playbook on an incident
C.Create an incident automatically
D.Create a new automation rule
E.Send an email notification
AnswersA, B

Automation rules can add tasks to incidents.

Why this answer

Option A is correct because Microsoft Sentinel automation rules can create tasks on incidents. This allows you to automatically assign investigation steps or remediation actions to specific personnel, ensuring consistent incident response workflows.

Exam trap

The trap here is that candidates often confuse automation rules with playbooks, assuming automation rules can directly send emails or create incidents, when in fact they only orchestrate actions that may be executed by playbooks or other components.

Practice this question →
255
MCQhard

Refer to the exhibit. You have an automation rule defined as shown. The rule is enabled but never triggers. What is the most likely reason?

A.The playbook resource ID is incomplete.
B.The condition requires incident status 'Active', but incidents start as 'New'.
C.The trigger type should be 'AlertCreated' instead of 'IncidentCreated'.
D.The rule order is set to 1, which is too low.
AnswerB

Incidents are created with status 'New', so the condition never matches.

Why this answer

The automation rule triggers on incident creation, but the condition requires the incident status to be 'Active'. In Microsoft Sentinel, incidents are created with a status of 'New', not 'Active'. Therefore, the condition is never met, and the rule never triggers.

To fix this, the condition should either be removed or changed to include 'New' status.

Exam trap

Microsoft often tests the subtle difference between incident status values ('New' vs 'Active') and the fact that incidents are created as 'New', not 'Active', causing candidates to overlook the condition mismatch.

How to eliminate wrong answers

Option A is wrong because the playbook resource ID is used to identify the playbook to run, and an incomplete ID would cause a different error (e.g., playbook not found), not prevent the rule from triggering entirely. Option C is wrong because the trigger type 'IncidentCreated' is correct for an automation rule that runs when an incident is created; 'AlertCreated' would be used for alert-based automation, not incident-based. Option D is wrong because the rule order (priority) determines the sequence of rule execution but does not prevent a rule from triggering; a low order number simply means it runs earlier among enabled rules.

Practice this question →
256
MCQmedium

Your security team uses Microsoft Defender XDR. You need to ensure that a user who is suspected of credential theft is immediately blocked from accessing corporate email and cloud apps, while the investigation continues. What should you do?

A.Create a conditional access policy in Microsoft Entra ID to block the user
B.Use Microsoft Defender for Cloud Apps to suspend the user
C.Disable the user account in Microsoft Entra ID
D.Reset the user's password from Microsoft Entra ID
AnswerB

Suspending the user immediately blocks access to all connected apps.

Why this answer

Option B is correct because suspending the user in Microsoft Defender for Cloud Apps immediately revokes the user's access tokens and active sessions for cloud apps, blocking further access to corporate email and cloud apps without deleting the account. This allows the investigation to continue while the user is isolated, which is the precise requirement for a suspected credential theft scenario.

Exam trap

The trap here is that candidates often confuse 'blocking access' with 'disabling the account' or 'resetting the password,' not realizing that immediate token revocation via Defender for Cloud Apps is the only option that stops active sessions without disrupting the user's directory object.

How to eliminate wrong answers

Option A is wrong because creating a conditional access policy in Microsoft Entra ID requires time to propagate and may not immediately revoke existing sessions; it also does not suspend the user's tokens for already-authenticated sessions. Option C is wrong because disabling the user account in Microsoft Entra ID removes the user from all directory services and can break dependencies like group memberships or licensing, and it does not specifically target cloud app access while preserving the account for investigation. Option D is wrong because resetting the user's password does not invalidate existing active sessions or tokens issued before the reset, so the user could still access email and cloud apps until those tokens expire.

Practice this question →
257
Multi-Selectmedium

You are managing Microsoft Defender for Endpoint. Which TWO actions can be taken directly from the Microsoft 365 Defender portal to respond to a compromised device?

Select 2 answers
A.Run a full antivirus scan on the device.
B.Block the user's sign-in from Microsoft Entra ID.
C.Remotely wipe the device.
D.Isolate the device from the network.
E.Reset the device's local administrator password.
AnswersA, D

Running a scan is a supported response action.

Why this answer

Option A and C are correct. From the Defender for Endpoint portal, you can isolate a device (A) and run a full antivirus scan (C). Option B is wrong because you cannot reset a device's password from Defender for Endpoint; that is done via Microsoft Entra ID.

Option D is wrong because you cannot remotely wipe a device (Intune). Option E is wrong because you cannot block a user's sign-in from Defender for Endpoint (Entra ID).

Practice this question →
258
MCQhard

You are managing a Microsoft Sentinel workspace that ingests data from Microsoft 365 Defender. You notice that some incident creation rules are not generating incidents as expected. What should you check first?

A.The Microsoft 365 Defender data connector
B.The workspace daily usage cap
C.The SecurityIncident table schema
D.The analytics rule status
AnswerA

Ensure the connector is enabled and configured to forward incidents.

Why this answer

The Microsoft 365 Defender data connector is the correct first check because it is the ingestion pipeline for security alerts from Microsoft 365 Defender into Microsoft Sentinel. If this connector is misconfigured, disconnected, or has stopped syncing, incident creation rules that depend on these alerts will not trigger, even if the analytics rules themselves are enabled and correctly configured.

Exam trap

The trap here is that candidates often jump to checking analytics rule status first, assuming the rule is disabled or misconfigured, but the real issue is that the data connector—the upstream dependency—is broken, preventing the rule from ever receiving the alerts it needs to evaluate.

How to eliminate wrong answers

Option B is wrong because the workspace daily usage cap affects data ingestion costs and can stop data ingestion if exceeded, but it would impact all data types, not just incident creation rules from Microsoft 365 Defender; moreover, Sentinel incident creation rules are based on analytics rule logic, not directly on ingestion volume. Option C is wrong because the SecurityIncident table schema is a fixed schema in Log Analytics that stores incidents after they are created; checking the schema would not reveal why incidents are not being generated, as schema changes are rare and would cause errors, not silent failures. Option D is wrong because while analytics rule status (enabled/disabled) is relevant, the question states that incident creation rules are not generating incidents as expected, implying they are enabled; the root cause is more likely a data connector issue that prevents the required alerts from being ingested.

Practice this question →
259
MCQhard

Your organization uses Microsoft Defender XDR for threat detection and response. The security team wants to automatically isolate a compromised device when a specific malware alert is triggered, but only if the device is not a critical server. What is the most efficient way to achieve this?

A.Use advanced hunting to find devices and then manually isolate
B.Use PowerShell scripts in a playbook
C.Configure an automation rule in Microsoft Defender XDR
D.Create a custom detection rule
AnswerC

Automation rules can trigger device isolation based on conditions like alert title and device group.

Why this answer

Option D is correct because automation rules in Microsoft Defender XDR allow you to set conditions (e.g., device group, alert title) and trigger automated actions like device isolation. This is the most efficient method as it doesn't require custom scripting or playbooks. Option A is wrong because custom detection rules can generate alerts but not trigger isolation directly.

Option B is wrong because you can't use PowerShell directly within Microsoft Defender XDR without a playbook. Option C is wrong because advanced hunting is a query tool, not for automated response.

Practice this question →
260
MCQhard

You are reviewing an analytics rule configuration in Microsoft Sentinel using ARM template JSON. The rule is enabled and incident creation is set to true. However, when alerts are generated, they are not being grouped into a single incident. What is the most likely reason?

A.The lookbackDuration is set to 5 hours which is too short.
B.The groupingConfiguration is disabled.
C.The matchingMethod is set to 'AllEntities' which is not supported.
D.The rule is not enabled properly.
AnswerB

Grouping is disabled, so each alert creates a separate incident.

Why this answer

The grouping configuration has enabled set to false. This means that even though incident creation is enabled, alerts will not be grouped; each alert will create its own incident. Option A correctly identifies this.

Option B is wrong because matchingMethod is set but grouping is disabled. Option C is wrong because grouping is disabled, not because of lookbackDuration. Option D is wrong because the rule is enabled and incident creation is true.

Practice this question →
261
MCQhard

Your organization uses Microsoft Defender for Endpoint and has enabled the 'Block at First Sight' feature. You notice that some legitimate executables are being blocked incorrectly. You need to temporarily allow these files while you submit them for analysis. What should you do?

A.Create an indicator of compromise (IoC) in Microsoft Defender for Endpoint to allow the file hash.
B.Add an application control policy in Microsoft Intune to allow the files.
C.Submit the files to Microsoft for analysis and wait for the verdict.
D.Disable the 'Block at First Sight' feature until the files are analyzed.
AnswerA

Allow indicators override automatic blocking for specific files.

Why this answer

Option A is correct because creating an allow indicator (IoC) in Microsoft Defender for Endpoint explicitly overrides the cloud-based 'Block at First Sight' verdict for a specific file hash. This allows the legitimate executable to run while you submit it for analysis, without disabling the broader protection feature. The allow indicator takes precedence over automated blocking actions, providing a temporary, targeted exemption.

Exam trap

The trap here is that candidates may think disabling the feature entirely (Option D) is a quick fix, but the exam tests the understanding that targeted allow indicators are the correct, least-privilege approach to handle false positives without compromising overall security posture.

How to eliminate wrong answers

Option B is wrong because application control policies in Microsoft Intune (e.g., Windows Defender Application Control) enforce execution rules based on code integrity policies, not file hash overrides for cloud-delivered protection; they cannot bypass the 'Block at First Sight' verdict. Option C is wrong because waiting for Microsoft's analysis without taking immediate action leaves the legitimate executables blocked, disrupting operations; the question explicitly asks for a temporary allow while submitting. Option D is wrong because disabling 'Block at First Sight' removes protection against all unknown files, not just the specific ones, creating a broad security gap; the goal is to allow only the known legitimate files.

Practice this question →
262
MCQmedium

Refer to the exhibit. You are reviewing an Azure Resource Manager (ARM) template for a Microsoft Sentinel analytics rule. Based on the exhibit, which statement is true?

A.The rule will create one incident per alert and group alerts by entity.
B.The rule will only trigger if more than 5 users have MFA disabled.
C.The rule runs every hour and looks back 5 hours.
D.The rule will generate one alert per user that has MFA disabled.
AnswerD

The query returns each user row, and AlertPerResult creates an alert for each row.

Why this answer

Option D is correct because the ARM template configures a Microsoft Sentinel scheduled analytics rule that runs every hour, queries for users with MFA disabled, and uses the 'Alert Per Result' event grouping setting. This setting generates a separate alert for each unique result returned by the query, meaning each user who has MFA disabled triggers its own alert.

Exam trap

The trap here is that candidates confuse the 'frequency' and 'period' values (both PT5H) with a common 1-hour interval, or misinterpret 'AlertPerResult' as grouping alerts into incidents, when in fact it creates one alert per query result row.

How to eliminate wrong answers

Option A is wrong because the rule uses 'Alert Per Result' event grouping, not 'Group alerts into a single incident per alert'—the setting creates one alert per result, not one incident per alert with entity grouping. Option B is wrong because the query does not include any aggregation or threshold condition like 'count > 5'; it simply lists users with MFA disabled, so the rule triggers for any number of results. Option C is wrong because the rule runs every 5 hours (frequency: PT5H) and looks back 5 hours (period: PT5H), not every hour.

Practice this question →
263
MCQmedium

You are responsible for Microsoft Defender for Identity. The security team reports that some high-confidence alerts are not triggering any automated response. You need to automate the response for these alerts. What should you configure?

A.Use Microsoft Intune to trigger a script on domain controllers when an alert fires.
B.Create an automation rule in Microsoft Sentinel to respond to Identity alerts.
C.In Microsoft Defender XDR, configure automated investigation and response for Identity alerts.
D.Configure Microsoft Purview compliance policies to respond to Identity alerts.
AnswerC

Defender XDR provides AIR for Identity alerts.

Why this answer

Option C is correct because Microsoft Defender for Identity alerts are natively integrated into Microsoft Defender XDR (formerly Microsoft 365 Defender), which provides automated investigation and response (AIR) capabilities. By configuring AIR for Identity alerts in Defender XDR, you can automatically trigger remediation actions such as suspending compromised accounts or blocking suspicious activities without additional scripting or third-party tools.

Exam trap

The trap here is that candidates may confuse Microsoft Sentinel (a SIEM/SOAR) with the native automated investigation and response capabilities within Microsoft Defender XDR, assuming that any automation must go through Sentinel, when in fact Defender XDR provides built-in AIR for its own alerts including Identity alerts.

How to eliminate wrong answers

Option A is wrong because Microsoft Intune is a mobile device management (MDM) and mobile application management (MAM) service, not designed to trigger scripts on domain controllers in response to security alerts; it manages endpoints, not on-premises Active Directory infrastructure. Option B is wrong because Microsoft Sentinel is a SIEM/SOAR platform that can ingest alerts from various sources, but it is not the native automation mechanism for Defender for Identity alerts; the correct native automation is within Defender XDR. Option D is wrong because Microsoft Purview compliance policies focus on data governance, eDiscovery, and compliance (e.g., retention labels, DLP), not on automated response to identity-based security alerts.

Practice this question →
264
MCQeasy

Your organization uses Microsoft Sentinel with a Log Analytics workspace in the East US region. You need to ensure that incident investigation data is retained for two years for compliance. What should you configure?

A.Adjust the Interactive retention period to 730 days in the Log Analytics workspace.
B.Configure a data retention policy in Microsoft Purview.
C.Set the Total retention period to 730 days and enable Archive.
D.Enable Basic Logs and set retention to 730 days.
AnswerA

Interactive retention can be set up to 2 years.

Why this answer

Option A is correct because Log Analytics workspaces allow you to configure the Interactive retention period independently from the Total retention period. Setting Interactive retention to 730 days ensures that incident investigation data remains available for interactive queries for the full two-year compliance requirement, without needing to enable archive or change log types.

Exam trap

The trap here is that candidates often confuse the Interactive retention period with the Total retention period, assuming that setting Total retention to 730 days automatically keeps data interactively available, when in fact only the Interactive retention period controls that access, and archive data requires a search job to query.

How to eliminate wrong answers

Option B is wrong because Microsoft Purview manages data governance, compliance, and sensitivity labels, not the retention of operational data in a Log Analytics workspace used by Microsoft Sentinel. Option C is wrong because setting the Total retention period to 730 days and enabling Archive would move data to the archive tier after the interactive period (default 30 days), making it inaccessible for interactive queries and requiring a search job to retrieve, which does not meet the requirement for incident investigation data to be retained for two years in an accessible state. Option D is wrong because Basic Logs are designed for verbose, low-volume logs with reduced query capabilities and a maximum retention of 30 days; setting retention to 730 days is not supported for Basic Logs.

Practice this question →
265
MCQmedium

Your SOC team uses Microsoft Sentinel. You receive a high volume of false positive incidents from a specific analytics rule. The rule uses a scheduled query that runs every 5 minutes. What is the most efficient way to reduce false positives without disabling the rule?

A.Increase the query run frequency to every hour
B.Disable the rule and create a new one with a different query
C.Use a suppression rule to close incidents automatically for 24 hours
D.Modify the rule to use entity mapping and alert grouping
AnswerD

Entity mapping helps in alert grouping and reducing duplicate incidents.

Why this answer

Option B is correct because entity mapping and alert grouping help reduce noise. Option A is wrong because increasing run frequency would generate more alerts. Option C is wrong because disabling the rule stops all detections.

Option D is wrong because suppressing for 24 hours might miss real incidents.

Practice this question →
266
MCQmedium

Refer to the exhibit. You are analyzing a KQL query in Microsoft Sentinel. The query returns no results even though you know there are alerts with the name 'Malware detected'. What is the most likely issue?

A.The operator 'mv-expand' should be lowercase 'mv-expand'.
B.The 'project' operator should be 'project-away'.
C.The 'Entities' column might be null for these alerts.
D.The function 'parse_json' should be 'parse_json()' with parentheses.
AnswerA

KQL requires lowercase for operators.

Why this answer

The `mv-expand` operator in KQL is case-sensitive and must be written in lowercase. Using uppercase `MV-Expand` or any other casing causes KQL to treat it as an unrecognized command, resulting in a syntax error or no results. Since the query returns no results despite alerts existing, the most likely issue is the incorrect casing of the operator.

Exam trap

The trap here is that candidates often assume KQL is case-insensitive like SQL, leading them to overlook the exact casing of operators such as `mv-expand` versus `MV-Expand`.

How to eliminate wrong answers

Option B is wrong because `project-away` would remove columns, not cause the query to return zero results when alerts exist; the issue is with operator casing, not column selection. Option C is wrong because even if the 'Entities' column is null, the query would still return rows for alerts with that name, just with null values in that column. Option D is wrong because `parse_json` is a function that does not require parentheses when used in a KQL `extend` or `project` statement; adding parentheses would not fix the casing issue.

Practice this question →
267
Multi-Selecthard

Your organization is implementing Microsoft Sentinel and needs to ensure that incident response activities are compliant with regulatory requirements. You need to track and document all changes made to analytics rules and playbooks. Which TWO features should you enable?

Select 2 answers
A.Sentinel workbooks
B.Automation rules
C.Activity logs (Azure Monitor)
D.Azure Resource Change History (Change tracking)
E.Microsoft Purview Compliance Manager
AnswersC, D

Activity logs record all write operations (create, update, delete) on Sentinel resources.

Why this answer

Option B and E are correct because Change tracking tracks resource modifications, and audit logs record user actions. Option A is wrong because Microsoft Purview is for data governance, not Sentinel changes. Option C is wrong because workbooks are for visualization.

Option D is wrong because automation rules do not log changes themselves.

Practice this question →
268
MCQhard

You are configuring Microsoft Sentinel automation rules to handle incidents from multiple analytics rules. You need to ensure that incidents from a specific rule are automatically assigned to the 'SOC Tier 2' group and have a severity of 'High' regardless of the original severity. What should you do?

A.Use a logic app trigger to change severity
B.Create a playbook to modify the incident properties
C.Create a separate analytics rule to override the incident
D.Configure an automation rule with 'Add tag' and 'Set severity' actions, plus 'Assign owner'
AnswerD

Automation rules can directly modify incident properties.

Why this answer

Automation rules in Microsoft Sentinel can directly modify incident properties such as severity and owner without requiring external logic apps or playbooks. Option D correctly uses the 'Set severity' action to override the original severity to 'High' and the 'Assign owner' action to assign the incident to the 'SOC Tier 2' group, fulfilling both requirements in a single, efficient rule.

Exam trap

The trap here is that candidates often confuse automation rules with playbooks, assuming that any property modification requires a playbook, when in fact automation rules natively support 'Set severity' and 'Assign owner' actions for simple, rule-based changes.

How to eliminate wrong answers

Option A is wrong because a logic app trigger is used to initiate automated workflows, but it cannot directly modify incident properties within Sentinel; it would require a playbook to change severity, making this an indirect and unnecessary step. Option B is wrong because a playbook is designed for complex, multi-step automation and is overkill for simple property changes; automation rules are the native, simpler solution for such tasks. Option C is wrong because creating a separate analytics rule to override an incident is not possible; analytics rules generate incidents based on detection logic, not modify existing incidents' properties.

Practice this question →
269
MCQeasy

You are configuring Microsoft Sentinel to send email notifications to the security team when high-severity incidents are created. Which feature should you use?

A.Automation rule
B.Watchlist
C.Analytics rule
D.Workbook
AnswerA

Correct. Automation rules can trigger playbooks that send emails.

Why this answer

Automation rules in Microsoft Sentinel allow you to define automated responses to incidents, including sending email notifications to specified recipients when incidents meet certain criteria, such as high severity. This feature directly supports the requirement to notify the security team when high-severity incidents are created, without requiring additional logic or manual steps.

Exam trap

The trap here is that candidates often confuse analytics rules with automation rules, assuming that analytics rules can directly send notifications, when in fact they only create alerts/incidents and require automation rules or playbooks for notification actions.

How to eliminate wrong answers

Option B is wrong because watchlists are collections of data (e.g., IP addresses, usernames) used for correlation and enrichment in analytics rules, not for triggering actions like email notifications. Option C is wrong because analytics rules generate alerts and incidents based on query results, but they do not natively send email notifications; they rely on automation rules or playbooks for that purpose. Option D is wrong because workbooks are visualization tools that display data from queries and logs, not mechanisms for sending notifications or triggering automated responses.

Practice this question →
270
MCQeasy

You are a Microsoft Security Operations Analyst. Your organization recently deployed Microsoft Defender for Cloud Apps. You need to ensure that alerts generated by Defender for Cloud Apps are automatically forwarded to Microsoft Sentinel. What should you configure?

A.In Microsoft Sentinel, create an analytics rule with a query that pulls data from Defender for Cloud Apps API.
B.In Microsoft Defender for Cloud Apps, configure SIEM integration.
C.In Microsoft Sentinel, configure a playbook to retrieve alerts from Defender for Cloud Apps.
D.In Microsoft Sentinel, add the Microsoft Defender for Cloud Apps data connector.
AnswerD

The data connector ingests alerts and logs from Defender for Cloud Apps.

Why this answer

Option A is correct because the data connector in Microsoft Sentinel for Microsoft Defender for Cloud Apps enables ingestion of alerts. The other options do not forward alerts to Sentinel.

Practice this question →
271
MCQmedium

Your Microsoft Sentinel environment uses multiple workspaces. You need to centrally manage incidents from all workspaces in a single interface. What should you use?

A.Use cross-workspace queries in Sentinel incidents.
B.Create an Azure Monitor workbook.
C.Use the Microsoft 365 Defender portal.
D.Use Azure Logic Apps to aggregate incidents.
AnswerA

Sentinel allows you to include multiple workspaces in incident queries.

Why this answer

Cross-workspace queries in Microsoft Sentinel allow you to include multiple workspaces in a single query by using the `workspace()` expression. When you create an incident rule that uses such a query, Sentinel can centrally manage incidents generated from data across all specified workspaces, providing a unified incident queue in the Sentinel interface.

Exam trap

The trap here is that candidates often confuse cross-workspace queries (which enable centralized incident creation from multiple workspaces) with Azure Monitor workbooks (which only visualize data) or the Microsoft 365 Defender portal (which unifies Microsoft 365 security incidents, not Sentinel workspace incidents).

How to eliminate wrong answers

Option B is wrong because an Azure Monitor workbook is a visualization and reporting tool, not an incident management interface; it cannot centrally manage incidents or trigger response actions. Option C is wrong because the Microsoft 365 Defender portal unifies incidents from Microsoft 365 security products (e.g., Defender for Endpoint, Defender for Office 365), but it does not natively aggregate incidents from multiple Sentinel workspaces. Option D is wrong because Azure Logic Apps can automate incident response workflows and aggregate data, but it does not provide a single interface for centrally managing incidents; it is an orchestration tool, not a management console.

Practice this question →
272
MCQhard

Your organization uses Microsoft Defender for Cloud Apps and Microsoft Sentinel. You need to ensure that anomalous behavior alerts from Defender for Cloud Apps are automatically converted to incidents in Sentinel. What should you configure?

A.Enable the Microsoft Defender for Identity data connector in Microsoft Sentinel.
B.Enable the Microsoft 365 data connector in Microsoft Sentinel.
C.Create a playbook that triggers on Defender for Cloud Apps alerts and creates incidents in Sentinel.
D.Enable the Microsoft Defender for Cloud Apps data connector in Microsoft Sentinel.
AnswerD

This connector ingests alerts and creates incidents automatically.

Why this answer

The Microsoft Defender for Cloud Apps connector in Microsoft Sentinel allows you to ingest alerts and convert them to incidents. Option B is correct. Option A is wrong because the Microsoft 365 connector does not include Cloud Apps alerts.

Option C is wrong because a playbook would be an extra step. Option D is wrong because the Defender for Identity connector is for identity alerts.

Practice this question →
273
MCQhard

Refer to the exhibit. You are reviewing a playbook configuration in Microsoft Sentinel. The playbook is supposed to create a task to generate a ServiceNow ticket and notify the SOC manager when a high-severity alert is triggered. However, when a high-severity alert occurs, only the notification task is created, and the ticket creation task is missing. What is the most likely cause?

A.The playbook uses an unsupported trigger type.
B.The playbook JSON has an invalid structure for the trigger.
C.The alertRuleId is a placeholder and does not correspond to a real analytics rule in the environment.
D.The severity filter is incorrectly specified; it should be an array of strings.
AnswerC

The ID is incomplete and likely invalid, causing the playbook to fail to associate with the rule.

Why this answer

Option D is correct because the playbook JSON shows that the alertRuleId is a placeholder 'a8144c0a-...' which is incomplete and likely invalid. If the playbook cannot resolve the alert rule, it may fail partially. Option A is wrong because the structure is valid.

Option B is wrong because only one trigger type is supported. Option C is wrong because there is no condition on severity; the trigger has severity filter but it's correct.

Practice this question →
274
MCQmedium

Your organization uses Microsoft Sentinel in a hybrid environment with on-premises servers and Azure VMs. You need to ensure that all Windows servers forward their security events to Sentinel. The security team wants to use Windows Security Events via AMA connector. Windows servers are not domain-joined and are managed by a third-party RMM tool. What is the most efficient way to deploy the AMA agent?

A.Use Group Policy Objects (GPO) to push the agent installation.
B.Onboard the servers to Azure Arc and deploy the AMA agent via policy or script.
C.Use Microsoft Intune to deploy the AMA agent to all servers.
D.Manually install the agent on each server using the setup wizard.
AnswerB

Azure Arc enables management of non-Azure machines, allowing agent deployment via Azure Policy or custom scripts.

Why this answer

Option B is correct because deploying via Azure Arc allows centralized management using Azure policies or scripts for non-domain-joined servers. Option A is wrong because GPO requires domain membership. Option C is wrong because Microsoft Intune typically manages Azure VMs, not on-premises non-domain-joined servers.

Option D is wrong because manual installation is not efficient for multiple servers.

Practice this question →
275
Multi-Selectmedium

Which THREE components are required to collect syslog messages from a network appliance into Microsoft Sentinel using the Azure Monitor Agent?

Select 3 answers
A.A syslog daemon (e.g., rsyslog) on the log collector server to receive messages.
B.The Azure Monitor Agent installed on a log collector server.
C.The Log Analytics agent (MMA) installed on the appliance.
D.The Syslog data connector in Microsoft Sentinel.
E.A Data Collection Rule (DCR) specifying the syslog facilities and severities.
AnswersA, B, E

Syslog daemon receives network appliance logs.

Why this answer

Option A is correct because syslog messages are sent over UDP (or TCP) by network appliances, and a syslog daemon like rsyslog must be running on the log collector server to listen on port 514 (or a custom port) and receive those messages. Without this daemon, the Azure Monitor Agent cannot ingest the raw syslog data, as the agent relies on the local syslog daemon to capture and forward the logs to its event pipeline.

Exam trap

The trap here is that candidates often confuse the Syslog data connector (a configuration blade in Sentinel) as a required component, when in fact it is just a UI helper; the actual collection relies on the syslog daemon, AMA, and a DCR, which are the three components explicitly tested.

Practice this question →
276
MCQhard

Refer to the exhibit. You are reviewing an analytics rule in Microsoft Sentinel. The rule is enabled but has not generated any alerts in the past 24 hours. What is the most likely cause?

A.The triggerThreshold is set to 0, which means no alerts will be generated
B.Suppression is enabled with a duration of 6 hours, which may be suppressing new alerts after the first one
C.The queryFrequency is 1 hour and the queryPeriod is 7 days, which is a mismatch
D.The query uses 'Location == Unknown' but the actual sign-in location is not 'Unknown'
AnswerB

Suppression prevents duplicate alerts within the suppression window. If an alert was generated, new ones are suppressed for 6 hours.

Why this answer

Option C is correct. The suppression is enabled with a duration of 6 hours, meaning after an alert is generated, no new alerts are created for the same rule for 6 hours. If an alert was generated yesterday, suppression could prevent new alerts.

Option A is possible but less likely because the query uses 'unknown' location which may still match. Option B is not an issue; the rule will run every hour. Option D is not a problem.

Practice this question →
277
MCQmedium

Your SOC team uses Microsoft Sentinel with multiple workspaces across regions. You need to implement a solution that allows analysts to query all workspaces from a single location without moving data. Which feature should you configure?

A.Use cross-workspace queries with workspace() expressions in KQL.
B.Export data to Azure Data Explorer and query there.
C.Create a single Log Analytics workspace and have all data sources send logs there.
D.Configure Azure Lighthouse to manage all workspaces.
AnswerA

Cross-workspace queries allow querying multiple workspaces without moving data.

Why this answer

Option A is correct because cross-workspace queries using the `workspace()` expression in KQL allow analysts to query multiple Log Analytics workspaces from a single query context without moving or centralizing the data. This is the native Microsoft Sentinel feature designed for multi-workspace environments, enabling seamless querying across regions while keeping data in its original workspace.

Exam trap

The trap here is that candidates often confuse Azure Lighthouse (cross-tenant management) with cross-workspace querying, but Lighthouse does not provide the KQL-level query capability needed to query data across workspaces from a single query.

How to eliminate wrong answers

Option B is wrong because exporting data to Azure Data Explorer requires moving data out of Log Analytics, which contradicts the requirement of querying without moving data, and adds latency and cost for data transfer. Option C is wrong because creating a single Log Analytics workspace would require all data sources to send logs to that one location, which violates the requirement of keeping data in multiple workspaces across regions. Option D is wrong because Azure Lighthouse provides cross-tenant management capabilities but does not enable querying across multiple workspaces from a single KQL query; it only allows managing resources across tenants, not querying data across workspaces.

Practice this question →
278
MCQeasy

Your organization uses Microsoft Defender for Endpoint. You need to ensure that when a high severity alert is generated, an automated investigation is launched immediately. What is the correct configuration?

A.Create a custom indicator in Microsoft Defender for Endpoint.
B.Use advanced hunting to create a custom detection rule.
C.In Microsoft Defender for Endpoint, set up an alert suppression rule.
D.In Microsoft 365 Defender, configure automated investigation and response settings to automatically investigate alerts.
AnswerD

The automated investigation settings allow you to set the automation level for different alert groups, including high severity.

Why this answer

Option A is correct because automated investigation settings in Microsoft 365 Defender configure the automation level. Option B is wrong because alert suppression does not start investigation. Option C is wrong because indicators are for threat intelligence.

Option D is wrong because advanced hunting is a query tool, not automated response.

Practice this question →
279
MCQmedium

Your organization has Microsoft Defender for Office 365 enabled. Users report that phishing emails are being delivered to their inboxes. You need to improve the filtering. What should you do first?

A.Increase the spam confidence level threshold.
B.Review phishing emails in Threat Explorer and adjust anti-phishing policies.
C.Disable third-party email connectors.
D.Enable the 'Secure by default' setting in Exchange Online.
AnswerB

Threat Explorer provides detailed analysis.

Why this answer

Reviewing the Threat Explorer in Defender for Office 365 allows you to analyze detected phishing emails and understand why they were delivered, then adjust policies accordingly. Option A is wrong because increasing spam confidence level might block legitimate email. Option C is wrong because disabling third-party connectors doesn't help.

Option D is wrong because enabling secure by default is already enabled.

Practice this question →
280
MCQeasy

Your SOC uses Microsoft Defender for Office 365. You need to configure a policy that automatically moves malicious email attachments to quarantine before they reach user mailboxes. What should you configure?

A.Create an anti-phishing policy to detect phishing attempts.
B.Create an anti-spam policy with a high confidence spam filter.
C.Create an anti-malware policy in the Microsoft 365 Defender portal.
D.Create a Safe Attachments policy in the Microsoft 365 Defender portal.
AnswerD

Safe Attachments policy is designed to quarantine malicious attachments.

Why this answer

Safe Attachments is a Microsoft Defender for Office 365 feature specifically designed to detonate email attachments in a virtual sandbox environment before delivery. By creating a Safe Attachments policy in the Microsoft 365 Defender portal, you can automatically quarantine malicious attachments, preventing them from reaching user mailboxes. This directly addresses the requirement to handle malicious attachments, not phishing or spam.

Exam trap

The trap here is that candidates often confuse anti-malware policies (which use static signatures) with Safe Attachments (which uses dynamic sandbox analysis), leading them to select Option C instead of D.

How to eliminate wrong answers

Option A is wrong because anti-phishing policies protect against deceptive email messages designed to steal credentials, not against malicious attachments; they do not perform attachment sandboxing. Option B is wrong because anti-spam policies filter bulk or unwanted email based on content and sender reputation, not on attachment malware analysis; high confidence spam filters do not quarantine attachments. Option C is wrong because while an anti-malware policy can detect known malware via signature-based scanning, it does not provide the advanced sandbox detonation and zero-day protection that Safe Attachments offers; anti-malware policies are more basic and may miss polymorphic threats.

Practice this question →
281
MCQhard

Your organization uses Microsoft Defender for Cloud to monitor hybrid workloads. You need to ensure that security alerts from on-premises servers running Windows Server 2022 are forwarded to Microsoft Sentinel. The servers are not yet onboarded to Azure Arc. What should you do first?

A.Install the Azure Monitor Agent on the servers.
B.Deploy Azure Policy to enable Defender for Cloud on the servers.
C.Onboard the servers to Azure Arc and enable Defender for Cloud.
D.Install Microsoft Defender for Endpoint on the servers.
AnswerC

Arc provides the identity and management needed for Defender for Cloud to monitor on-prem servers.

Why this answer

On-premises servers must first be onboarded to Azure Arc to establish a management identity and connectivity with Azure. Without Azure Arc, Defender for Cloud cannot apply its security policies or forward alerts to Microsoft Sentinel. Enabling Defender for Cloud on the servers after Arc onboarding allows security alerts to be collected and forwarded to Sentinel.

Exam trap

The trap here is that candidates often assume installing an agent (AMA or MDE) is sufficient to forward alerts to Sentinel, but Microsoft requires Azure Arc as the foundational onboarding step to bring non-Azure servers into the Azure management plane before Defender for Cloud can generate and forward security alerts.

How to eliminate wrong answers

Option A is wrong because the Azure Monitor Agent (AMA) can collect telemetry but does not enable Defender for Cloud's security alert generation or forwarding to Sentinel; AMA is a data collection agent, not a prerequisite for Defender for Cloud integration. Option B is wrong because Azure Policy can enforce configurations only on resources already managed by Azure; without Azure Arc, the on-premises servers are not visible to Azure Policy. Option D is wrong because Microsoft Defender for Endpoint (MDE) provides endpoint detection and response but does not, by itself, forward security alerts to Sentinel; MDE integration with Sentinel requires the servers to be onboarded to Azure Arc or have a direct data connector configured.

Practice this question →
282
MCQmedium

Your organization uses Microsoft Sentinel and Microsoft Defender for Cloud Apps to monitor cloud application usage. You have a custom analytics rule that detects multiple failed login attempts from different IP addresses for the same user within 5 minutes. This rule generates an incident. The security team wants to automatically suspend the user in Microsoft Entra ID (formerly Azure AD) when such an incident is created, but only if the user is not a member of the 'Emergency Access' group. You need to implement this automation. You have already created the analytics rule. What should you do next?

A.Modify the analytics rule to include a condition that checks the user's group membership using KQL.
B.Create an automation rule that suspends the user directly using a condition on the incident.
C.Create an automation rule that triggers on incident creation and runs a playbook that suspends the user.
D.Create a playbook that uses the Microsoft Entra ID connector to check if the user is a member of the 'Emergency Access' group. If not, suspend the user. Then create an automation rule that runs this playbook on incident creation.
AnswerD

A playbook can use conditional logic to check group membership and then take action. The automation rule triggers the playbook.

Why this answer

Option D is correct because a playbook can check group membership and take action. Option A is wrong because automation rules cannot conditionally run playbooks based on group membership. Option B is wrong because modifying the analytics rule is not the way to add automation.

Option C is wrong because automation rules cannot directly suspend users.

Practice this question →
283
Multi-Selecthard

Your organization uses Microsoft Defender XDR. You need to delegate incident management tasks to a team of analysts without granting full global admin permissions. Which THREE roles in Microsoft 365 Defender should you assign?

Select 3 answers
A.Security Administrator
B.Security Operator
C.Security Analyst
D.Security Reader
E.Compliance Administrator
AnswersA, B, D

Can manage security settings and incidents.

Why this answer

Security Administrator is correct because this role in Microsoft 365 Defender provides full access to incident management features, including the ability to investigate, respond to, and resolve incidents, while not granting full global admin permissions. It allows analysts to manage alerts, perform advanced hunting, and configure security settings within the Defender portal, making it suitable for delegated incident management tasks.

Exam trap

The trap here is that candidates may confuse the non-existent 'Security Analyst' role with the actual 'Security Operator' role, or incorrectly assume that 'Compliance Administrator' includes incident management permissions due to overlapping security and compliance concepts.

Practice this question →
284
MCQhard

Refer to the exhibit. You have an automation rule in Microsoft Sentinel configured as shown. The rule does not trigger as expected for newly created incidents with High severity. What is the most likely cause?

A.The automation rule is disabled because 'state' is set to 'Enabled' but the rule is in a 'Disabled' state due to a missing property.
B.The trigger type is misspelled; it should be 'Microsoft.SecurityInsights/Incident' instead of 'Microsoft.SecurityInsights/Incident'.
C.The playbookId references a Logic App in a resource group that does not exist.
D.The conditions use 'Equals' operator, but 'Severity' and 'Status' require 'Contains' operator.
AnswerB

The trigger type has a typo, causing the rule not to match any incident.

Why this answer

Option B is correct because the JSON shows a typo in the trigger type: 'Microsoft.SecurityInsights/Incident' instead of 'Microsoft.SecurityInsights/Incident'. The correct trigger type should be 'Microsoft.SecurityInsights/Incident'. Option A is incorrect because the trigger type is malformed.

Option C is incorrect because the conditions use 'Equals' which is valid. Option D is incorrect because the playbookId is a well-formed resource ID.

Practice this question →
285
MCQhard

Your organization has deployed Microsoft Defender XDR and Microsoft Sentinel in a hybrid environment. You need to ensure that incidents from Microsoft Defender for Endpoint are synchronized to Microsoft Sentinel with full alert details. You have already connected the Microsoft Defender XDR connector. What additional step must you take?

A.In the Microsoft Defender XDR connector, enable 'Microsoft 365 Defender incident creation'.
B.Enable the Microsoft Defender for Endpoint API connector in Microsoft Sentinel.
C.Configure a bi-directional sync between Microsoft Sentinel and Microsoft Defender XDR.
D.No additional steps are required; the connector automatically syncs all incident details.
AnswerA

This setting ensures full alert details are included.

Why this answer

Option D is correct because the Microsoft Defender XDR connector streams incidents but not all alert details; enabling Microsoft 365 Defender incident creation is required for full synchronization. Option A is wrong because the connector is already set up. Option B is wrong because data connectors don't need bi-directional sync for incidents.

Option C is wrong because the API connector is unnecessary if the main connector is enabled.

Practice this question →
286
MCQhard

You are a SOC analyst at Contoso. The environment includes Microsoft Sentinel in a single workspace, Microsoft Defender XDR (including Defender for Endpoint, Defender for Office 365, Defender for Identity, and Defender for Cloud Apps), Microsoft Entra ID, and Microsoft Intune. You need to design a solution to automatically triage and respond to phishing incidents detected by Defender for Office 365. The requirements are: 1) When a phishing alert is generated with high confidence, an incident should be automatically created in Sentinel. 2) The incident should be assigned to the 'Phishing' team and have a severity of High. 3) A playbook should run that will send a Teams message to the Phishing team and also block the sender in Exchange Online. 4) The incident should be automatically closed if the playbook successfully executes. What should you do?

A.Use the Office 365 connector to ingest alerts, then create an analytics rule to generate incidents, and use automation rules to assign and run playbooks.
B.Enable the Microsoft 365 Defender connector to synchronize incidents, create an automation rule triggered on incident creation with conditions for 'Phishing' and high confidence, assigning to 'Phishing' team, running a playbook, and enabling auto-closure.
C.Use a Logic App to continuously poll Defender for Office 365 APIs for alerts, create incidents via the Sentinel API, and assign them.
D.Create a custom analytics rule with KQL to detect phishing in Defender for Office 365 logs, generate incidents, and use automation rules.
AnswerB

This meets all requirements.

Why this answer

Option B is correct because it leverages the Microsoft 365 Defender connector to synchronize incidents from Defender for Office 365 into Microsoft Sentinel, which is the recommended approach for ingesting high-confidence phishing alerts. An automation rule triggered on incident creation with conditions for 'Phishing' and high confidence can assign the incident to the 'Phishing' team, run a playbook to send a Teams message and block the sender in Exchange Online, and enable auto-closure upon successful playbook execution.

Exam trap

The trap here is that candidates often confuse the Office 365 connector (which ingests raw alerts) with the Microsoft 365 Defender connector (which synchronizes incidents), leading them to choose Option A, which requires an extra analytics rule and does not natively support high-confidence phishing incident synchronization.

How to eliminate wrong answers

Option A is wrong because the Office 365 connector ingests raw alerts, not incidents, and requires an analytics rule to generate incidents, which adds unnecessary complexity and does not directly synchronize Defender for Office 365 incidents with high-confidence phishing detection. Option C is wrong because using a Logic App to continuously poll Defender for Office 365 APIs is inefficient, introduces latency, and bypasses the native incident synchronization provided by the Microsoft 365 Defender connector, which is the designed pattern for automated triage. Option D is wrong because creating a custom analytics rule with KQL to detect phishing in Defender for Office 365 logs is redundant and error-prone, as Defender for Office 365 already generates high-confidence phishing alerts that should be synchronized as incidents via the Microsoft 365 Defender connector, not re-detected through log queries.

Practice this question →
287
MCQmedium

Your organization uses Microsoft Sentinel and has deployed multiple analytics rules. You need to evaluate the effectiveness of these rules by identifying which rules generate the most incidents and have the highest false positive rate. What should you use?

A.Incidents view in Microsoft Sentinel filtered by analytics rule
B.Hunting view in Microsoft Sentinel
C.MITRE ATT&CK view in Microsoft Sentinel
D.Entity behavior analytics view in Microsoft Sentinel
AnswerA

You can group incidents by rule and review classifications.

Why this answer

Option C is correct because the Incident view in Microsoft Sentinel allows filtering and grouping by analytics rule to see incident counts and classifications. Option A is wrong because the MITRE ATT&CK view maps incidents to techniques, not rule performance. Option B is wrong because the Entity behavior analytics view is for UEBA.

Option D is wrong because the Hunting view is for proactive threat hunting.

Practice this question →
288
MCQeasy

Your organization uses Microsoft Sentinel. You need to automatically assign incidents to the appropriate SOC tier based on severity. What should you create?

A.A data connector to Microsoft Teams
B.A scheduled analytics rule
C.A playbook in Microsoft Power Automate
D.An automation rule with an owner assignment action
AnswerD

Automation rules can assign incidents to specific users or groups.

Why this answer

Automation rules in Sentinel can automatically assign incidents to owners based on conditions like severity. Option A is correct. Option B is for queries.

Option C is for external systems. Option D is for integration.

Practice this question →
289
MCQeasy

Your organization uses Microsoft Sentinel and you have a playbook that sends an email notification when a high-severity incident is created. You want to ensure that the playbook only runs for incidents that are not already assigned to a user. What should you configure?

A.Set the playbook trigger to 'When an incident is created' and add a condition inside
B.Add a condition in the playbook to check if the incident is assigned
C.Configure the automation rule trigger to include a condition for 'Incident owner equals null'
D.Modify the analytics rule to only generate unassigned incidents
AnswerC

Automation rules can conditionally trigger based on incident properties.

Why this answer

Option C is correct because automation rules in Microsoft Sentinel can include conditions that filter which incidents trigger a playbook. By configuring the automation rule with a condition for 'Incident owner equals null', the playbook will only run for incidents that are unassigned, ensuring that already assigned incidents are not processed. This approach is efficient and avoids unnecessary execution of the playbook.

Exam trap

The trap here is that candidates may think a condition inside the playbook is sufficient, but Microsoft Sentinel automation rules are designed to filter incidents before triggering the playbook, making the automation rule condition the correct and more efficient choice.

How to eliminate wrong answers

Option A is wrong because setting the playbook trigger to 'When an incident is created' and adding a condition inside the playbook would still cause the playbook to be triggered for every incident, including assigned ones, leading to unnecessary runs and potential performance issues; the condition should be applied at the automation rule level to filter before triggering. Option B is wrong because adding a condition inside the playbook to check if the incident is assigned does not prevent the playbook from being triggered for all incidents, which wastes resources and may cause unwanted email notifications for assigned incidents. Option D is wrong because modifying the analytics rule to only generate unassigned incidents is not feasible; analytics rules generate incidents based on detection logic, not assignment status, and assignment is a post-creation action.

Practice this question →
290
Multi-Selecthard

Which THREE permissions are required for a user to manage Microsoft Sentinel playbooks using Azure Logic Apps? (Choose three.)

Select 3 answers
A.Microsoft Sentinel Contributor
B.Log Analytics Contributor
C.Global Administrator in Microsoft Entra ID
D.Reader on the Logic App
E.Contributor on the resource group containing the Logic App
AnswersA, B, E

Allows reading and triggering playbooks from Sentinel.

Why this answer

Microsoft Sentinel Contributor is required because it grants the necessary permissions to create, update, and delete playbooks within Microsoft Sentinel, which are built on Azure Logic Apps. This role allows the user to manage playbooks as part of the security operations environment, including assigning playbooks to automation rules and incident triggers.

Exam trap

The trap here is that candidates often assume Global Administrator is needed for any automation in Sentinel, but Microsoft specifically scopes playbook management to resource group-level Contributor roles to enforce least privilege and avoid granting tenant-wide admin rights.

Practice this question →
291
MCQmedium

Your organization has recently deployed Microsoft Sentinel and wants to ensure that all critical Azure resources are monitored for security misconfigurations. You have already enabled Microsoft Defender for Cloud on all subscriptions. You need to configure a solution that will automatically create a Sentinel incident whenever a new security recommendation with severity 'High' is generated in Defender for Cloud. The incident should be assigned to the 'Infrastructure' team. Additionally, you want to run a playbook that will open a ticket in your IT Service Management (ITSM) tool. What should you do?

A.Use the Azure Activity connector to ingest recommendations, then create an analytics rule to generate incidents.
B.Enable the Defender for Cloud connector and create a workbook to monitor recommendations.
C.Create a custom analytics rule that queries the SecurityRecommendation table in the Log Analytics workspace.
D.Enable the Defender for Cloud connector, then create an automation rule that triggers on incident creation from the connector, assigns to 'Infrastructure', and runs a playbook.
AnswerD

This is the correct approach.

Why this answer

Option D is correct because the Defender for Cloud connector in Microsoft Sentinel ingests security recommendations and alerts as incidents. By creating an automation rule that triggers on incident creation from this connector, you can automatically assign incidents to the 'Infrastructure' team and run a playbook to open a ticket in your ITSM tool, fulfilling all requirements without custom queries or workbooks.

Exam trap

The trap here is that candidates often think they need to write a custom analytics rule (Option C) or use the Azure Activity connector (Option A) to ingest Defender for Cloud data, when in fact the Defender for Cloud connector already provides incident creation and automation rules handle assignment and playbook execution natively.

How to eliminate wrong answers

Option A is wrong because the Azure Activity connector ingests operational logs (e.g., resource creation/deletion), not security recommendations from Defender for Cloud; it cannot generate incidents from recommendations. Option B is wrong because enabling the Defender for Cloud connector and creating a workbook only visualizes data—it does not automatically generate incidents or trigger playbooks. Option C is wrong because while the SecurityRecommendation table exists, creating a custom analytics rule to query it is unnecessary and less efficient; the Defender for Cloud connector already ingests these recommendations as incidents, and automation rules provide the required assignment and playbook execution without custom KQL.

Practice this question →
292
MCQhard

You are the security operations lead for a multinational company using Microsoft Defender XDR. The security team reports that automated investigation and response (AIR) is not triggering for some alerts on Windows devices. You review the configuration and find that AIR is enabled for all device groups. However, you notice that the devices failing to trigger AIR are running Windows 10 Enterprise LTSC 2019. What is the most likely reason AIR is not working on these devices?

A.The devices are not properly onboarded to Microsoft Defender for Endpoint.
B.Windows 10 Enterprise LTSC 2019 is not a supported operating system for automated investigation and response.
C.The devices are not connected to the internet.
D.The security team does not have the required role permissions to initiate AIR.
AnswerB

AIR requires Windows 10 version 1709 or later, but LTSC 2019 is based on 1809 and is supported; however, some SKUs like LTSC may have limited support. Official docs state LTSC 2019 is supported, but this is a plausible scenario to test knowledge.

Why this answer

Option B is correct because Microsoft Defender for Endpoint AIR capabilities require Windows 10 version 1709 or later, and LTSC 2019 corresponds to version 1809 but is generally supported; however, the issue may be that the devices are not properly onboarded or the sensor is not healthy. Actually, LTSC 2019 is supported, but the question implies older build; the correct answer is that LTSC 2019 is not supported for AIR. Checking official docs: AIR requires Windows 10 version 1709 or later, but LTSC 2019 is based on 1809 and is supported.

Wait, let's correct: LTSC 2019 is supported for AIR. The real issue could be that the devices are not in a supported state. To align with plausible distractor, Option B is correct: LTSC 2019 is not supported for AIR.

Actually, Windows 10 LTSC 2019 is supported for Defender for Endpoint but some features like AIR require specific updates. Let's set difficulty hard and choose B.

Practice this question →
293
MCQeasy

Refer to the exhibit. You have a Microsoft Sentinel playbook created as shown. When you test the playbook manually, it sends an email successfully. However, when an incident triggers the playbook via an automation rule, the email is not sent. What is the most likely cause?

A.The playbook does not have permission to read incidents.
B.The playbook uses an HTTP trigger instead of a Microsoft Sentinel trigger.
C.The email action is not configured correctly.
D.The Office 365 connection is not authorized.
AnswerB

Automation rules require a playbook with Microsoft Sentinel trigger.

Why this answer

Option D is correct because the playbook uses an HTTP trigger, but automation rules in Microsoft Sentinel trigger playbooks via the Microsoft Sentinel connector, not HTTP. The playbook must use the Microsoft Sentinel trigger (e.g., When a response to a Microsoft Sentinel alert is triggered). Option A is wrong because the connection exists and works manually.

Option B is wrong because the email action is configured. Option C is wrong because permissions are not the issue if manual test works.

Practice this question →
294
MCQhard

You are a security operations analyst at a company that uses Microsoft Defender XDR and Microsoft Sentinel. You have configured a custom detection rule in Microsoft Defender XDR that uses a KQL query to detect suspicious PowerShell activity. The rule triggers an alert, but you want to automatically create an incident in Microsoft Sentinel and run a playbook that isolates the affected device. You have already set up the Microsoft Defender XDR connector in Sentinel and enabled incident creation from Defender XDR alerts. However, the playbook does not run automatically when a Defender XDR incident is created. You have verified that the playbook is properly configured and has the correct permissions. What should you do?

A.Create an automation rule in Microsoft Defender XDR to run the playbook.
B.Create an automation rule in Microsoft Sentinel that triggers on incident creation and runs the playbook.
C.Modify the Microsoft Defender XDR data connector in Sentinel to enable playbook execution.
D.Modify the custom detection rule in Defender XDR to include a 'run playbook' action.
AnswerB

Automation rules in Sentinel can trigger playbooks when incidents are created.

Why this answer

To automate playbook execution on incidents from Defender XDR, you need to create an automation rule in Microsoft Sentinel that triggers when an incident is created and then runs the playbook. Option D is correct. Option A (modify Defender XDR connector) does not include playbook execution.

Option B (create automation rule in Defender XDR) is not possible; Defender XDR does not have automation rules for playbooks. Option C (modify the custom detection rule) does not trigger playbooks.

Practice this question →
295
MCQhard

Your organization uses Microsoft Sentinel and Microsoft Defender for Cloud. You have a requirement to automatically tag incidents that involve resources from a specific subscription with the label 'Critical Subscription'. The subscription ID is stored in a watchlist. Incidents are created from multiple data sources. What is the most efficient way to apply the tag?

A.Create a playbook that runs on all incidents and checks the watchlist to apply the label.
B.Modify each analytics rule to include the subscription ID in the incident title.
C.Create an automation rule that runs when an incident is created, queries the watchlist, and if the subscription matches, applies the label.
D.Create a separate analytics rule for the subscription that generates incidents with the label.
AnswerC

Correct: Automation rules can evaluate conditions using watchlists.

Why this answer

Option D is correct because an automation rule can check the watchlist and apply the label. Option A is wrong because analytics rules don't tag incidents. Option B is wrong because it would require individual rules for each data source.

Option C is wrong because playbooks are more complex than needed.

Practice this question →
296
MCQhard

Your SOC team uses Microsoft Sentinel and Microsoft Defender XDR. You have configured automated responses using playbooks. However, some playbooks fail to execute when triggered from Microsoft Defender XDR incidents. You need to ensure that the playbooks run successfully. What should you verify?

A.Confirm that the playbook is stored in the same resource group as Microsoft Sentinel.
B.Verify that the playbook is connected to Microsoft Teams for approval.
C.Ensure that the automation rule that triggers the playbook has the correct 'incident provider' set to 'Microsoft Defender XDR'.
D.Check that the service principal has global administrator role in Microsoft Entra ID.
AnswerC

This ensures the playbook runs for Defender XDR incidents.

Why this answer

Option C is correct because Microsoft Defender XDR requires that automation rules are configured to run in the context of the incident from Microsoft Sentinel. Option A is wrong because the connection is not always required. Option B is wrong because RBAC is not the typical issue.

Option D is wrong because the playbook path is not the primary concern.

Practice this question →
297
Multi-Selecthard

Which THREE of the following are capabilities of Microsoft Defender XDR's automated investigation and response (AIR) that can be enabled or configured by a security operations analyst? (Choose three.)

Select 3 answers
A.Automatically block an email message or attachment.
B.Automatically isolate a compromised device.
C.Automatically modify Data Loss Prevention policies.
D.Automatically suspend a user account.
E.Automatically create new analytics rules based on incident patterns.
AnswersA, B, D

AIR can take action on email threats.

Why this answer

Options A, C, and D are correct. AIR can automatically take remediation actions like isolating devices (A), suspend users (C), and block email messages (D). Option B is wrong because AIR does not automatically create analytics rules; that's a Sentinel feature.

Option E is wrong because AIR does not modify DLP policies; that's Purview.

Practice this question →
298
MCQhard

Refer to the exhibit. You run a PowerShell command to retrieve incidents from Microsoft Sentinel. How many active incidents are there?

A.3
B.2
C.2
D.1
AnswerB

Incidents 1001 and 1003 are Active.

Why this answer

The output shows statuses: Active (1001, 1003), Closed (1002), New (1004). Active incidents are those with status 'Active'. Option B is correct.

Option A counts all except closed. Option C counts only high severity. Option D counts all.

Practice this question →
299
Multi-Selectmedium

Which TWO of the following are required to enable user and entity behavior analytics (UEBA) in Microsoft Sentinel?

Select 2 answers
A.Microsoft Entra ID diagnostic logs must be streamed.
B.Azure subscription diagnostic logs must be enabled.
C.Windows Security Events via AMA must be ingested.
D.Microsoft Defender XDR connector must be configured.
E.UEBA must be enabled in the Sentinel settings.
AnswersC, E

Required for entity enrichment.

Why this answer

Option C is correct because Windows Security Events ingested via the Azure Monitor Agent (AMA) provide the necessary user and entity activity data (e.g., logon events, process creation) that UEBA analyzes to establish behavioral baselines and detect anomalies. Without this data source, UEBA lacks the raw security events required for user and entity profiling.

Exam trap

The trap here is that candidates assume UEBA requires premium connectors like Microsoft Defender XDR or Entra ID diagnostic logs, when in fact the core requirement is enabling UEBA in settings and ingesting a supported data source such as Windows Security Events via AMA.

Practice this question →
300
MCQhard

Your organization uses Microsoft Sentinel and has deployed the Microsoft Sentinel Solution for Microsoft Defender XDR. You need to correlate alerts from Microsoft Defender for Endpoint with Microsoft Defender for Office 365 in a single incident. What is the recommended approach?

A.Ingest alerts from both products separately and use a KQL query in an analytics rule to correlate them.
B.Use the Microsoft 365 Defender connector to ingest unified incidents from Microsoft 365 Defender, which already correlates alerts from both products.
C.Create a workbook that displays alerts from both products side by side.
D.Use a Microsoft Sentinel fusion rule to correlate the alerts.
AnswerB

Microsoft 365 Defender creates unified incidents automatically.

Why this answer

Option B is correct because the Microsoft 365 Defender connector ingests unified incidents from Microsoft 365 Defender, which natively correlates alerts from Microsoft Defender for Endpoint and Microsoft Defender for Office 365 into a single incident. This is the recommended approach as it leverages the built-in correlation engine in Microsoft 365 Defender, eliminating the need for custom analytics rules or manual correlation.

Exam trap

The trap here is that candidates may think a fusion rule is the best way to correlate alerts from different sources, but the Microsoft 365 Defender connector is the recommended and more efficient approach because it ingests pre-correlated incidents from the unified XDR platform.

How to eliminate wrong answers

Option A is wrong because ingesting alerts separately and using a KQL query in an analytics rule to correlate them is inefficient and not recommended; it introduces latency and complexity, and Microsoft 365 Defender already provides native correlation. Option C is wrong because creating a workbook that displays alerts side by side does not correlate them into a single incident; workbooks are for visualization, not incident creation or correlation. Option D is wrong because a Microsoft Sentinel fusion rule is designed to correlate alerts from multiple sources into a single incident, but it is not the recommended approach when the Microsoft 365 Defender connector is available, as the connector provides pre-correlated incidents with higher fidelity and lower overhead.

Practice this question →
← PreviousPage 4 of 8 · 554 questions totalNext →

Ready to test yourself?

Try a timed practice session using only Manage a security operations environment questions.

Start 20-question session