Courseiva

CCNA Manage Secops Environment Questions

75 of 554 questions · Page 2/8 · Manage Secops Environment topic · Answers revealed

Practice these questionsExam hubAll questions
76
Multi-Selecteasy

Which TWO permissions are required for a user to manage Microsoft Sentinel playbooks?

Select 2 answers
A.Microsoft Sentinel Reader
B.Logic App Contributor
C.Microsoft Sentinel Contributor
D.Automation Operator
E.Global Administrator
AnswersB, C

Playbooks are Logic Apps, so this role is needed.

Why this answer

Microsoft Sentinel playbooks are built on Azure Logic Apps, so managing them requires the Logic App Contributor role to create, edit, and delete the underlying logic app resources. Additionally, Microsoft Sentinel Contributor is needed to attach playbooks to analytics rules or automation rules within Sentinel, as this involves modifying Sentinel-specific configurations. Without both roles, a user cannot fully manage playbooks in the Sentinel context.

Exam trap

The trap here is that candidates often assume only a Sentinel-specific role (like Microsoft Sentinel Contributor) is sufficient, forgetting that playbooks are built on Azure Logic Apps and thus require the Logic App Contributor role for direct management of the playbook resource itself.

Practice this question →
77
MCQmedium

A security analyst reports that a scheduled analytics rule in Microsoft Sentinel has stopped generating incidents after a recent update. The rule still runs but produces no alerts. What should you check first?

A.Verify that the rule is enabled and not paused.
B.Check the entity mapping configuration for missing fields.
C.Review the rule's query logic for changes or syntax errors.
D.Ensure that the automation rule triggering the incident is still active.
AnswerC

A broken query produces no results, hence no alerts.

Why this answer

Option C is correct because the most likely cause of a scheduled analytics rule running but producing no alerts is a change or error in the KQL query logic. Since the rule still executes, the issue is not with the rule being disabled or paused, but rather with the query failing to return results due to syntax errors, schema changes, or logic flaws introduced during the update.

Exam trap

The trap here is that candidates assume a rule that 'still runs' is functioning correctly, but Microsoft tests the distinction between execution and result generation—a rule can execute its query yet produce zero alerts due to query logic issues, not configuration or automation problems.

How to eliminate wrong answers

Option A is wrong because the rule is explicitly stated to still run, so it is enabled and not paused; checking this would not resolve the issue. Option B is wrong because entity mapping configuration affects how alerts are structured, not whether alerts are generated; missing fields would cause mapping errors, not a lack of alerts. Option D is wrong because automation rules trigger actions after an incident is created; if no alerts are generated, no incidents exist to trigger automation rules, so checking automation rules is premature.

Practice this question →
78
MCQmedium

Your organization uses Microsoft Sentinel and Microsoft Defender XDR. You are responsible for managing the security operations environment. Recently, the SOC team reported that incidents from Microsoft Defender for Endpoint are not appearing in Microsoft Sentinel. You have already configured the data connector for Microsoft Defender XDR and verified that logs are flowing into the 'SecurityAlert' table. However, incidents are not being created in Sentinel. What should you do?

A.Enable 'Create incidents from Microsoft 365 Defender' in the Microsoft Defender XDR data connector.
B.Create an analytics rule that queries the SecurityAlert table and generates incidents.
C.Verify the Azure Sentinel solution is installed and enable the streaming of incidents.
D.Configure the Microsoft Defender for Endpoint data connector.
AnswerA

Correct: This setting creates Sentinel incidents from Defender XDR incidents.

Why this answer

Option A is correct because incident creation from Defender XDR requires enabling the 'Microsoft 365 Defender' incident creation in the data connector. Option B is wrong because analytics rules are not needed; incidents come from the connector. Option C is wrong because that connector is for alerts, not incidents.

Option D is wrong because streaming is not the issue.

Practice this question →
79
MCQmedium

Your organization uses Microsoft Sentinel. You need to configure a playbook that automatically responds to incidents by creating a support ticket in ServiceNow. Which connector should you use?

A.HTTP connector
B.ServiceNow connector
C.Azure Monitor connector
D.Office 365 Outlook connector
AnswerB

Provides native integration for creating tickets.

Why this answer

The ServiceNow connector is the correct choice because it provides a direct, pre-built integration between Microsoft Sentinel and ServiceNow, enabling automated creation of incidents or tickets in ServiceNow when a Sentinel incident is triggered. This connector uses the ServiceNow REST API to map Sentinel fields to ServiceNow ticket fields, eliminating the need for custom HTTP calls or additional middleware.

Exam trap

The trap here is that candidates may choose the HTTP connector thinking it is more flexible, but the ServiceNow connector is the purpose-built, supported solution that handles authentication and field mapping natively, making it the correct choice for this specific integration.

How to eliminate wrong answers

Option A is wrong because the HTTP connector is a generic connector that requires manual configuration of endpoints, authentication, and payload formatting, which is more complex and error-prone than using a dedicated ServiceNow connector. Option C is wrong because the Azure Monitor connector is designed to send data from Azure Monitor to other systems, not to create tickets in ServiceNow from Sentinel incidents. Option D is wrong because the Office 365 Outlook connector is used for email-based actions (e.g., sending notifications) and does not support direct integration with ServiceNow's ticketing system.

Practice this question →
80
MCQhard

Your organization uses Microsoft Sentinel in a multi-workspace environment with a central SOC. You need to create a single incident view across all workspaces while minimizing latency. What should you deploy?

A.Use cross-workspace queries in a workbook
B.Enable incident across workspaces in Microsoft Sentinel
C.Merge all workspaces into one Log Analytics workspace
D.Set up Azure Lighthouse and connect workspaces
AnswerB

This feature aggregates incidents from multiple workspaces into one view.

Why this answer

Option B is correct because Microsoft Sentinel's 'Incident across workspaces' feature (enabled via the 'SecurityIncident' table union) provides a single incident view across multiple workspaces with minimal latency by leveraging built-in cross-workspace incident synchronization. This avoids the overhead of manual queries or external orchestration, ensuring near-real-time incident correlation for a central SOC.

Exam trap

The trap here is that candidates often confuse Azure Lighthouse (which provides cross-workspace visibility through delegated access) with the native incident synchronization feature, not realizing that Lighthouse alone does not create a unified incident view and requires additional manual configuration to achieve the same low-latency result.

How to eliminate wrong answers

Option A is wrong because cross-workspace queries in a workbook are read-only and do not create a unified incident management view; they are for ad-hoc analysis, not operational incident handling, and introduce latency from repeated query execution. Option C is wrong because merging workspaces violates multi-workspace architecture requirements, causes data ingestion and retention cost bloat, and is not a scalable solution for a central SOC. Option D is wrong because Azure Lighthouse enables delegated resource management but does not natively provide a single incident view across workspaces; it requires additional configuration and does not minimize latency as effectively as the built-in incident synchronization.

Practice this question →
81
MCQeasy

You need to ensure that critical incidents in Microsoft Sentinel are automatically assigned to a senior security analyst. What should you configure?

A.Create an analytics rule with a custom schedule.
B.Configure a workbook to filter incidents by owner.
C.Add the analyst to a watchlist used in analytics rules.
D.Create an automation rule that assigns the incident to the analyst.
AnswerD

Automation rules can assign incidents to owners.

Why this answer

Automation rules in Microsoft Sentinel allow you to automatically assign incidents to specific users or groups based on conditions like severity or title. By creating an automation rule that triggers on incident creation and sets the owner to the senior security analyst, you ensure critical incidents are assigned without manual intervention.

Exam trap

The trap here is that candidates confuse automation rules (which handle incident lifecycle actions like assignment) with analytics rules (which generate alerts), leading them to pick option A incorrectly.

How to eliminate wrong answers

Option A is wrong because analytics rules with custom schedules are used to generate alerts from log data, not to assign ownership of incidents. Option B is wrong because workbooks are visualization tools that display data, not mechanisms for assigning incident ownership. Option C is wrong because watchlists are used to correlate data or filter alerts in analytics rules, not to assign incidents to specific users.

Practice this question →
82
MCQeasy

Your organization uses Microsoft Purview Data Loss Prevention (DLP). You need to receive an alert when a user attempts to share a credit card number via email. What should you configure?

A.Create a sensitivity label that blocks sharing.
B.Create a DLP policy in Microsoft Purview with the credit card number sensitive info type.
C.Create a retention label that identifies credit card data.
D.Create a file policy in Microsoft Defender for Cloud Apps.
AnswerB

DLP policies detect and alert on sensitive info.

Why this answer

Option B is correct because Microsoft Purview DLP policies can be configured to detect sensitive information types, such as credit card numbers, and trigger alerts when users attempt to share that data via email. By creating a DLP policy with the credit card number sensitive info type and setting an action to send an alert, you meet the requirement to receive an alert on such sharing attempts.

Exam trap

The trap here is that candidates often confuse sensitivity labels or retention labels with DLP policies, not realizing that only DLP policies can directly detect and alert on sensitive data in transit like email sharing.

How to eliminate wrong answers

Option A is wrong because sensitivity labels are used for classification and protection (e.g., encryption or visual markings) but do not natively generate alerts on sharing attempts; they require integration with DLP or other mechanisms for alerting. Option C is wrong because retention labels are designed to manage data lifecycle and retention policies, not to detect or alert on sharing of sensitive data. Option D is wrong because a file policy in Microsoft Defender for Cloud Apps focuses on monitoring and controlling cloud app usage, not directly on email sharing within Exchange Online; DLP policies in Purview are the correct tool for email-based sensitive data detection.

Practice this question →
83
MCQhard

Your company uses Microsoft Defender XDR. The security team needs to restrict access to the Microsoft Defender portal so that only analysts in the 'Security Operations' group can view incidents. What is the most efficient way to achieve this?

A.Assign the Security Operations group the Defender for Endpoint administrator role.
B.Configure Conditional Access policy to allow only Security Operations group to sign in to the Defender portal.
C.Assign the Security Operations group the Security Reader role in Microsoft Entra ID.
D.Create a custom role in the Microsoft Defender portal with permissions to view incidents and assign it to the Security Operations group.
AnswerD

Custom RBAC roles in Defender XDR can restrict access to specific areas.

Why this answer

Option D is correct because Microsoft Defender XDR uses role-based access control (RBAC) within the portal itself. Creating a custom role with permissions to view incidents and assigning it to the Security Operations group directly controls access to incident data without affecting broader Azure AD roles or requiring Conditional Access policies. This is the most efficient method as it scopes permissions precisely to the Defender portal's incident management functionality.

Exam trap

The trap here is that candidates often confuse Azure AD roles (like Security Reader) with Defender portal RBAC roles, or assume Conditional Access can control data-level permissions, when in fact only custom Defender roles can restrict incident viewing to a specific group without granting broader privileges.

How to eliminate wrong answers

Option A is wrong because the Defender for Endpoint administrator role grants full administrative access to the Defender for Endpoint configuration and settings, not just incident viewing, which is overly permissive and violates the principle of least privilege. Option B is wrong because Conditional Access policies control authentication and sign-in access to the portal, not authorization to view specific data like incidents; they can block sign-in entirely but cannot restrict what a signed-in user sees within the portal. Option C is wrong because the Security Reader role in Microsoft Entra ID provides read-only access to security-related information across Azure services, but it does not grant granular permissions to view incidents specifically within the Microsoft Defender portal; it is a broad Azure AD role, not a Defender-specific RBAC role.

Practice this question →
84
MCQeasy

You are configuring Microsoft Sentinel SOAR capabilities. You need to create an automated response that, when a critical incident is created, triggers a playbook that sends a message to a Teams channel. Which connector should you use in the playbook?

A.Microsoft Exchange connector
B.Azure DevOps connector
C.Microsoft Teams connector
D.Microsoft Entra ID connector
AnswerC

Allows sending messages to Teams channels.

Why this answer

The Microsoft Teams connector is the correct choice because it enables the playbook to post messages directly to a Teams channel via an HTTP trigger and the Teams webhook action. This connector is specifically designed for sending notifications and messages to Teams, which aligns with the requirement to alert a channel when a critical incident is created.

Exam trap

The trap here is that candidates may confuse the Microsoft Teams connector with the Microsoft Exchange connector, assuming both can send notifications, but Exchange is strictly for email, not Teams messaging.

How to eliminate wrong answers

Option A is wrong because the Microsoft Exchange connector is used for email-related operations (e.g., sending emails, managing mailboxes), not for posting messages to Teams channels. Option B is wrong because the Azure DevOps connector is designed for managing work items, pipelines, and repositories in Azure DevOps, not for sending messages to Teams. Option D is wrong because the Microsoft Entra ID connector (formerly Azure AD) is used for identity and access management tasks (e.g., managing users, groups, and roles), not for sending messages to Teams channels.

Practice this question →
85
MCQeasy

Your organization uses Microsoft Sentinel and Microsoft Defender XDR. The security team wants to automatically create an incident in Microsoft Sentinel when a Microsoft Defender for Endpoint alert is triggered. What should you configure?

A.Enable the Microsoft Defender XDR connector in Microsoft Sentinel and select the incident creation settings.
B.Set up a Logic App custom connector to poll Defender alerts.
C.Configure the Security Events connector to forward Defender alerts.
D.Create analytics rules in Microsoft Sentinel for each Defender alert type.
AnswerA

The Microsoft Defender XDR connector automatically creates incidents from Defender alerts.

Why this answer

Option A is correct because the Microsoft Defender XDR connector in Microsoft Sentinel is specifically designed to ingest alerts and incidents from Microsoft Defender for Endpoint and other Defender products. By enabling this connector and configuring its incident creation settings, Sentinel automatically creates incidents when Defender for Endpoint alerts are triggered, without requiring custom logic or manual polling.

Exam trap

The trap here is that candidates often confuse the purpose of analytics rules (which generate alerts from raw data) with the connector's role (which ingests pre-existing alerts from external sources), leading them to incorrectly select Option D.

How to eliminate wrong answers

Option B is wrong because a Logic App custom connector would require building a custom polling mechanism, which is unnecessary and inefficient when the native Microsoft Defender XDR connector already provides automated, real-time incident ingestion. Option C is wrong because the Security Events connector is used to collect Windows security event logs (e.g., Event ID 4625) from on-premises or cloud-based systems, not Defender for Endpoint alerts. Option D is wrong because analytics rules in Sentinel are used to generate alerts from raw data sources (like Syslog or Windows Events), not to import existing alerts from Defender for Endpoint; the connector handles that ingestion automatically.

Practice this question →
86
MCQmedium

You are configuring Microsoft Sentinel automation rules to handle incidents generated from Microsoft Defender for Cloud. You need to ensure that when a high-severity security alert is triggered, an automated response runs a playbook that creates a support ticket in ServiceNow. However, the playbook fails to execute for some alerts. Upon investigation, you find that the automation rule is triggered only when the incident is created. What is the most likely cause of the failure?

A.The automation rule is configured to trigger only on incident creation, but the playbook requires the incident to be in an updated state.
B.The automation rule lacks permissions to the ServiceNow connector because of Microsoft Entra ID conditional access policies.
C.Playbooks cannot be called by automation rules in Microsoft Sentinel.
D.Automation rules cannot be triggered on incident creation from Microsoft Defender for Cloud.
AnswerA

Some playbooks require incident updates (e.g., after alert grouping) which won't trigger if rule is set only on creation.

Why this answer

Option B is correct because automation rules can run when incidents are created or updated, but the condition 'incident creation' will not trigger again on subsequent updates. If the playbook requires an updated incident (e.g., after alert grouping), it won't run. Option A is wrong because automation rules in Sentinel can trigger on incident creation.

Option C is wrong because playbooks can be called by automation rules. Option D is wrong because the issue is not related to Microsoft Entra ID permissions.

Practice this question →
87
MCQhard

Refer to the exhibit. You are troubleshooting an endpoint that is not receiving real-time protection from Microsoft Defender Antivirus. The output shows RealTimeProtectionEnabled is False. Which command should you run next to enable real-time protection?

A.Set-MpPreference -DisableRealtimeMonitoring $false
B.Add-MpPreference -ExclusionPath C:\Temp
C.Start-MpScan
D.Update-MpSignature
AnswerA

Enables real-time monitoring.

Why this answer

The Set-MpPreference cmdlet with the -DisableRealtimeMonitoring $false parameter is the correct command to enable real-time protection in Microsoft Defender Antivirus. The output shows RealTimeProtectionEnabled is False, which directly corresponds to the DisableRealtimeMonitoring setting; setting it to $false re-enables the feature. This cmdlet modifies the local policy for the Microsoft Defender Antivirus engine, immediately activating real-time scanning of file operations and process activity.

Exam trap

The trap here is that candidates often confuse disabling real-time monitoring with other maintenance tasks like scanning or updating signatures, assuming any Defender-related command will fix the protection state, but only Set-MpPreference directly controls the RealTimeProtectionEnabled flag.

How to eliminate wrong answers

Option B is wrong because Add-MpPreference -ExclusionPath C:\Temp adds a file or folder exclusion from scanning, which does not affect the RealTimeProtectionEnabled state; it only prevents Defender from scanning the specified path. Option C is wrong because Start-MpScan initiates a one-time on-demand scan (e.g., quick, full, or custom scan) but does not toggle the real-time protection setting; it runs a scan regardless of whether real-time monitoring is enabled. Option D is wrong because Update-MpSignature downloads and installs the latest security intelligence updates (virus definitions) but has no impact on the RealTimeProtectionEnabled flag; it updates signatures without enabling or disabling real-time protection.

Practice this question →
88
MCQhard

You are a Microsoft Security Operations Analyst for a large enterprise with 50,000 users. Your organization uses Microsoft Defender XDR, Microsoft Sentinel, and Microsoft Defender for Cloud Apps. The security team has observed an increase in alerts related to SaaS applications (e.g., Box, Salesforce) accessed from unusual locations. You need to design a solution to automatically investigate and respond to these alerts. The solution should: (1) correlate user activity across multiple SaaS apps, (2) automatically isolate a user's account if the risk score exceeds 90, and (3) create an incident in Sentinel. Which approach should you use?

A.Use Microsoft Sentinel UEBA to detect anomalies and manually trigger a playbook to block the user.
B.Deploy Microsoft Defender for Endpoint on all devices and use device risk as a factor for conditional access.
C.Configure Microsoft Defender for Cloud Apps to use session policies that require reauthentication or block access when risk is high, and stream alerts to Sentinel.
D.Create analytics rules in Sentinel for each SaaS app and a playbook to isolate accounts using Microsoft Entra ID conditional access.
AnswerC

Session policies can apply across SaaS apps and enforce actions based on risk.

Why this answer

Option B is correct because Defender for Cloud Apps provides session policies that can block or isolate access based on risk, and it integrates with Sentinel. Option A is not cross-app; Option C is for endpoints; Option D is not automated.

Practice this question →
89
Multi-Selecteasy

Which TWO tasks can you perform using Microsoft Sentinel automation rules?

Select 2 answers
A.Send an email notification without a playbook.
B.Assign an incident to an analyst.
C.Delete an incident.
D.Change the severity of an incident.
E.Create a new analytics rule.
AnswersB, D

Automation rules can assign incidents.

Why this answer

Option B is correct because automation rules in Microsoft Sentinel can directly assign incidents to specific analysts or groups without requiring a playbook. This is a native action within the automation rule configuration, enabling immediate ownership and accountability for incident response.

Exam trap

The trap here is that candidates often confuse automation rule capabilities with playbook actions, assuming email notifications or deletions are possible natively, but Microsoft Sentinel restricts automation rules to incident property changes and playbook triggers only.

Practice this question →
90
Multi-Selecthard

Which TWO actions should you take to ensure that Microsoft Sentinel can properly ingest logs from a Linux server running rsyslog? (Choose two.)

Select 2 answers
A.Install and configure syslog-ng instead of rsyslog
B.Configure rsyslog to forward logs to the agent on TCP 514
C.Install the Log Analytics agent (or Azure Monitor Agent) on the Linux server
D.Configure Windows Event Forwarding (WEF) to collect logs from the Linux server
E.Configure rsyslog to forward logs to the Log Analytics agent on UDP 25224
AnswersC, E

The agent is required to collect syslog data.

Why this answer

Option C is correct because the Log Analytics agent (or Azure Monitor Agent) must be installed on the Linux server to receive and forward syslog data to Microsoft Sentinel. Without the agent, Sentinel has no direct mechanism to collect logs from the server. The agent listens for syslog messages forwarded by rsyslog and then sends them to the Log Analytics workspace.

Exam trap

The trap here is that candidates often assume syslog must be sent on the standard port 514 (TCP or UDP) or that replacing rsyslog with syslog-ng is necessary, but the Log Analytics agent specifically requires forwarding to UDP 25224 and works with rsyslog out of the box.

Practice this question →
91
MCQhard

Refer to the exhibit. You are reviewing a Microsoft Sentinel scheduled analytics rule defined in ARM template format. The rule is enabled but no incidents are being created even though matching sign-in events exist. What is the most likely reason?

A.The query uses a dynamic list incorrectly
B.The rule does not have entity mapping configured
C.The suppressionDuration is incorrectly configured
D.The queryFrequency is set too high, causing missed events
AnswerB

Entity mapping is required for incident creation; without it, incidents may not be generated.

Why this answer

Option C is correct because the query uses a static list of IP addresses in the `in` operator but they are not wrapped in quotes as strings; `dynamic(['10.0.0.1', '192.168.1.1'])` is valid but the IPs are strings and should be compared as strings. However, the more critical issue is that the `queryPeriod` and `queryFrequency` are both 5 hours, and the `suppressionDuration` is also 5 hours, but suppression is disabled. The real problem is that the `triggerThreshold` is set to 0 and `triggerOperator` is GreaterThan, meaning it will trigger if any results are found.

But if no incidents are created, the issue could be that the query is not returning results because the IP addresses are not in the log. However, the exhibit says matching events exist. Another possibility: the rule uses `SigninLogs` which is a table in Microsoft Entra ID, but the data source might not be connected.

But the most likely reason is that the `queryPeriod` and `queryFrequency` are the same, which is correct. Actually, the exhibit shows `groupingConfiguration.enabled: false`, so each alert becomes an incident. But the `eventGroupingSettings.aggregationKind` is `SingleAlert`, meaning each alert is a single incident.

If incidents are not created, it could be that the rule is not mapping entities correctly. However, the exhibit does not show entity mapping. Option C highlights that entity mapping is missing, which is required for incident creation in some versions of Sentinel.

But wait, in Sentinel, incident creation does not strictly require entity mapping; it's recommended but not mandatory. The actual issue might be that the `query` is invalid because `IPAddress` is not a field in `SigninLogs`? Actually, `SigninLogs` has `IPAddress` field. Let's think: the query looks correct.

But the rule is set to `createIncident: true`, so incidents should be created. The most plausible answer is that entity mapping is missing because without it, the incident might not be created properly in newer Sentinel versions? Actually, that's not true. The correct answer is that the `queryPeriod` and `queryFrequency` are the same, which is fine.

Maybe the issue is that the `suppressionDuration` is set but not used. I think the most likely is that the query returns results but the incident creation fails due to missing entity mapping. I'll go with Option C.

But the explanation should be clear.

Practice this question →
92
MCQeasy

A junior SOC analyst receives multiple low-severity alerts from Microsoft Sentinel. The alerts are related to failed logon attempts from a single IP address over a short period. The analyst wants to group these alerts into a single incident to reduce noise. What should the analyst do?

A.Use the Microsoft Defender XDR incident queue to group the alerts
B.Configure the analytics rule to group alerts into incidents by the IP address
C.Create an automation rule to close duplicate alerts
D.Manually merge the alerts into one incident in the Sentinel incidents blade
AnswerB

Incident grouping in the analytics rule automatically groups related alerts.

Why this answer

Option B is correct because incident grouping in analytics rules allows merging of alerts into a single incident based on criteria like IP address. Option A is wrong because manually grouping is not scalable. Option C is wrong because the incident queue does not have a built-in grouping feature.

Option D is wrong because automation rules do not group alerts; they act on incidents.

Practice this question →
93
MCQhard

You are a security operations analyst for a large enterprise with a hybrid environment. Your organization uses Microsoft Sentinel as the central SIEM, Microsoft Defender for Cloud for Azure workloads, Microsoft Defender for Endpoint for endpoints, and Microsoft Defender for Identity for on-premises Active Directory. Recently, the security team has been overwhelmed by a high volume of low-severity incidents from Defender for Cloud that are not actionable. These incidents are generated from the built-in 'ASC Default' policy initiative. You need to reduce the noise without disabling the entire policy. The security team still wants to be alerted on high-severity incidents. You have been asked to implement a solution that automatically suppresses low-severity incidents from Defender for Cloud but still allows high-severity ones to be created in Sentinel. You must not modify the policy initiative itself. What should you do?

A.Create a new analytics rule that creates incidents only for high-severity alerts from Defender for Cloud.
B.Modify the 'ASC Default' analytics rule in Sentinel to only trigger on high-severity alerts.
C.Turn off the Defender for Cloud data connector in Sentinel.
D.Create an automation rule that triggers when an incident is created from Defender for Cloud with severity Low or Medium, and set the status to Closed.
AnswerD

This automatically closes low-severity incidents, reducing noise.

Why this answer

Option B is correct because creating an automation rule that automatically closes low-severity incidents from Defender for Cloud will reduce noise while still allowing high-severity incidents to be created. Option A is wrong because modifying the analytics rule is not possible for built-in rules; also it would affect all severities. Option C is wrong because creating a separate analytics rule does not suppress the existing ones.

Option D is wrong because turning off the connector would stop all incidents.

Practice this question →
94
Multi-Selectmedium

Your organization uses Microsoft Sentinel and you are designing a data retention strategy. You have a Log Analytics workspace with the following tables: SecurityEvent, SigninLogs, and CommonSecurityLog. The compliance team requires that SigninLogs be retained for 7 years, while other tables can be retained for 1 year. Which THREE steps must you take to meet this requirement?

Select 3 answers
A.Set an archiving policy to move SigninLogs to cold storage after 1 year.
B.Set the workspace retention to 7 years.
C.Enable Azure Data Explorer (ADX) for long-term storage.
D.Configure table-level retention for SigninLogs to 7 years.
E.Ensure that the workspace is in a region that supports 7-year retention.
AnswersB, D, E

Workspace retention must be at least as long as the longest table-level retention.

Why this answer

Option A, B, and D are correct. Option A is required to set workspace retention to the maximum (7 years) to allow for table-level retention. Option B is required to configure table-level retention for SigninLogs.

Option D is required because the compliance team needs to retain for 7 years. Option C is wrong because archiving is not needed if retention is set to 7 years. Option E is wrong because interactive retention can be set to 7 years without archiving.

Practice this question →
95
Multi-Selecthard

Which THREE components are required to ingest Microsoft Entra ID (Azure AD) audit logs into Microsoft Sentinel?

Select 3 answers
A.A Log Analytics workspace in the same region as Microsoft Entra ID.
B.A user account with Security Administrator or Global Administrator role to configure the connector.
C.A playbook to parse the audit logs.
D.Microsoft Sentinel's Microsoft Entra ID data connector.
E.Microsoft Entra ID P1 or P2 license.
AnswersB, D, E

Permissions are required to set up the connector.

Why this answer

Option B is correct because configuring the Microsoft Entra ID (Azure AD) data connector in Microsoft Sentinel requires a user account with at least the Security Administrator role (or Global Administrator) to grant the necessary permissions for the connector to read audit logs and sign-in logs from Microsoft Entra ID via the Microsoft Graph API. Without this role, the connector cannot authenticate and retrieve the required data.

Exam trap

The trap here is that candidates often assume a Log Analytics workspace must be regionally aligned with the data source, but Microsoft Entra ID is a global service and the workspace region is irrelevant for ingestion.

Practice this question →
96
MCQhard

You are analyzing sign-in logs in Microsoft Sentinel. The KQL query shown in the exhibit returns a list of users who have signed into Office 365 Exchange Online more than 10 times in the last 24 hours. You need to identify potential brute-force attacks. What additional information should you add to the query to improve detection?

A.Include both successful and failed sign-in attempts, then filter for users with a high number of failed attempts and at least one successful attempt.
B.Change the time window to 1 hour to detect rapid attempts.
C.Add a condition to only include sign-ins from unusual geographic locations.
D.Add a condition to exclude users who have multi-factor authentication (MFA) enabled.
AnswerA

Brute-force often involves many failures and eventual success.

Why this answer

To detect brute-force attacks, you need to look for multiple failed sign-in attempts followed by a success. The current query only shows successful sign-ins. Option A is correct because adding a condition to include failed attempts (ResultType != 0) and then filtering for users with many failures and at least one success would better indicate brute-force.

Option B (excluding MFA) does not help. Option C (filtering by location) may reduce false positives but not detect brute-force. Option D (time bin) is already there.

Practice this question →
97
MCQmedium

Refer to the exhibit. Your SOC manager runs this KQL query in Microsoft Sentinel to see which analysts have the most active high-severity incidents in the past 7 days. The query returns no results. What is the most likely reason?

A.The query has a syntax error.
B.The table name is misspelled.
C.No high-severity incidents were created in the last 7 days.
D.The SecurityIncident table is not available in the Logs workspace; it is only accessible through the Sentinel incidents blade.
AnswerD

SecurityIncident is a Sentinel-specific table not directly queryable.

Why this answer

Option D is correct because the SecurityIncident table is not available in the standard Log Analytics workspace; it is a Sentinel-specific table that is only accessible through the Microsoft Sentinel incidents blade or via the SecurityIncident table in the Sentinel Logs workspace when Sentinel is enabled. The query fails because the table does not exist in the workspace's schema, not because of syntax or data absence.

Exam trap

Microsoft often tests the misconception that all Sentinel data is available in the standard Log Analytics workspace, when in fact the SecurityIncident table is Sentinel-specific and requires the Sentinel solution to be enabled and the user to be in the Sentinel Logs context.

How to eliminate wrong answers

Option A is wrong because the KQL query syntax appears valid (e.g., 'SecurityIncident | where Severity == 'High' and TimeGenerated > ago(7d) | summarize count() by Owner') and would not cause a 'no results' return if the table existed. Option B is wrong because the table name 'SecurityIncident' is correctly spelled and is the standard Sentinel table name; a misspelling would typically generate a 'table not found' error, not an empty result. Option C is wrong because while it is possible no high-severity incidents were created, the question states the query 'returns no results'—in KQL, a valid query against a non-existent table returns an error, not an empty result set, making table unavailability the more likely cause.

Practice this question →
98
Multi-Selectmedium

Which TWO actions require the Global Administrator role in Microsoft 365?

Select 2 answers
A.Create a data loss prevention (DLP) policy in Microsoft Purview
B.Create a custom role in Microsoft Defender XDR
C.View the Microsoft 365 Defender incident queue
D.Configure tenant-wide settings in Microsoft 365
E.Manage roles and administrators in Microsoft Entra ID
AnswersD, E

Many tenant-wide settings require Global Admin.

Why this answer

Correct options are A and B because managing roles in Azure AD (Entra ID) and configuring Microsoft 365 tenant-level settings both require Global Administrator. Option C can be done by Security Administrator. Option D can be done by Security Reader.

Option E can be done by Compliance Administrator.

Practice this question →
99
MCQeasy

You are configuring Microsoft Sentinel to detect potential ransomware activity. The security team wants to be alerted when a single host contacts multiple suspicious domains within a short time. Which analytic rule type should you create?

A.NRT (Near-Real-Time) rule
B.Scheduled query rule
C.Anomaly rule
D.Microsoft security rule
AnswerA

NRT rules process events continuously and can detect rapid sequences.

Why this answer

A NRT (Near-Real-Time) rule is the correct choice because it continuously processes events with a minimum latency of about 1 minute, making it ideal for detecting patterns like a single host contacting multiple suspicious domains within a short time window. Unlike scheduled rules that run on a fixed interval (e.g., every 5 minutes), NRT rules evaluate data as it arrives, enabling rapid detection of multi-event sequences such as DNS queries to known malicious domains.

Exam trap

The trap here is that candidates often confuse NRT rules with scheduled query rules, assuming a scheduled rule can achieve the same low latency by setting a short interval, but scheduled rules still incur a processing delay and cannot match the continuous streaming evaluation of NRT rules.

How to eliminate wrong answers

Option B (Scheduled query rule) is wrong because it runs on a predefined schedule (e.g., every 5 or 15 minutes), which introduces latency that could miss the tight time window required for detecting rapid multi-domain contacts. Option C (Anomaly rule) is wrong because it uses machine learning to baseline normal behavior and flag statistical outliers, not to match a specific pattern of a single host contacting multiple known suspicious domains. Option D (Microsoft security rule) is wrong because it ingests alerts from other Microsoft security products (e.g., Microsoft Defender for Endpoint) and does not allow custom detection logic based on raw event sequences like DNS queries.

Practice this question →
100
MCQhard

Refer to the exhibit. You run the KQL query in Microsoft Sentinel to identify analysts with high incident assignments. The query returns no results, but you know incidents exist. What is the most likely reason?

A.The summarize operator is incorrectly used
B.The SecurityIncident table does not exist
C.The query period is too short to capture incidents
D.Incidents are not assigned to any owner, so the Owner field is null
AnswerD

Null values are grouped but not counted in the condition if null.

Why this answer

Option D is correct because if incidents have no assigned owner, the Owner field is null. The KQL query likely filters or groups by Owner, and null values are excluded from results by default in aggregation operations like summarize. Since incidents exist but are unassigned, the query returns no results.

Exam trap

Microsoft often tests the nuance that KQL aggregation operators like summarize exclude null group-by keys by default, leading candidates to overlook the data quality issue and instead blame syntax or table existence.

How to eliminate wrong answers

Option A is wrong because the summarize operator is correctly used for grouping by owner; the issue is not syntax but data content. Option B is wrong because the SecurityIncident table does exist in Microsoft Sentinel; it is a standard table for incident data. Option C is wrong because the query period is not specified as too short; the problem is that incidents exist but lack owner assignments, not that they fall outside the time range.

Practice this question →
101
MCQhard

You are designing a Microsoft Sentinel deployment. You need to minimize ingestion costs while ensuring that all security-relevant events are collected. Which strategy should you use?

A.Use Analytic Logs for all data sources to ensure full query capabilities
B.Use Basic Logs for verbose data sources like Windows firewall logs, and Analytic Logs for high-value security logs
C.Set short retention periods for all logs and export to storage
D.Collect only logs from Microsoft 365 Defender and ignore other sources
AnswerB

Basic Logs are low-cost and suitable for high-volume logs that are rarely queried.

Why this answer

Option A is correct because Basic Logs are cheaper and suitable for verbose logs. Option B is wrong because Analytic logs are more expensive. Option C is wrong because you need some logs.

Option D is wrong because not all logs need full retention.

Practice this question →
102
Multi-Selecteasy

Which TWO Microsoft 365 security solutions include capabilities for managing security incidents?

Select 2 answers
A.Microsoft Intune
B.Microsoft Defender XDR
C.Microsoft Entra ID Protection
D.Microsoft Purview
E.Microsoft Sentinel
AnswersB, E

Defender XDR has an incident queue for managing correlated alerts.

Why this answer

Correct options are A and B. Microsoft Sentinel is a SIEM that manages incidents, and Microsoft Defender XDR has an incident management queue. Option C is for endpoint management.

Option D is for compliance. Option E is for identity protection but not incident management in the same sense.

Practice this question →
103
MCQmedium

Your organization uses Microsoft Sentinel and Microsoft Defender XDR. You need to configure a solution that automatically escalates incidents that have been in 'New' status for more than 4 hours. The escalation should change the status to 'Active' and assign the incident to a senior analyst. What should you do?

A.Create an automation rule that triggers when an incident is created, with a condition 'Time since created > 4 hours' and actions to set status and owner.
B.Modify the analytics rule to update the incident after 4 hours.
C.Configure Microsoft Defender XDR to escalate incidents older than 4 hours.
D.Create a playbook that runs every hour and updates incidents.
AnswerA

Correct: Automation rules can have time-based conditions.

Why this answer

Option C is correct because automation rules can be created with a condition 'Incident created time older than 4 hours' and actions to change status and owner. Option A is wrong because playbooks need to be triggered by an automation rule. Option B is wrong because analytics rules don't run on existing incidents.

Option D is wrong because Microsoft Defender XDR doesn't manage Sentinel incidents.

Practice this question →
104
MCQeasy

Your organization uses Microsoft Sentinel. An analyst reports that a scheduled analytics rule is not firing. You verify that the rule is enabled and the query returns results when run manually. What is the most likely cause?

A.The alert threshold is set too high
B.The data connector is disconnected
C.The workspace is in a different region
D.The query uses unsupported KQL functions
AnswerA

The rule may require more results than currently exist.

Why this answer

If the query returns results manually but the rule doesn't fire, the issue is often the alert threshold setting. Option A is correct. Option B would prevent manual runs too.

Option C would affect all rules. Option D is unrelated.

Practice this question →
105
MCQmedium

You are the security analyst for a company that uses Microsoft Sentinel. You notice that a critical analytics rule has not generated any incidents in the past week, but you know that relevant logs are being ingested. You need to troubleshoot why the rule is not firing. What is the first step you should take?

A.Check the incident creation rule configuration.
B.Verify that the log sources are connected and sending data to the workspace.
C.Disable and re-enable the analytics rule.
D.Run the analytics rule's query directly in Log Analytics to see if it returns results.
AnswerD

Running the query helps identify if the rule logic is correct.

Why this answer

Option D is correct because the first step in troubleshooting a Sentinel analytics rule that is not generating incidents despite relevant logs being ingested is to run the rule's query directly in Log Analytics. This isolates whether the issue is with the query logic itself (e.g., syntax errors, time range misconfiguration, or data not matching the KQL conditions) rather than with data ingestion or rule settings. If the query returns results in Log Analytics, the problem lies elsewhere; if it returns no results, the query needs adjustment.

Exam trap

The trap here is that candidates often jump to checking data ingestion (Option B) even when the question states logs are being ingested, or they assume a rule reset (Option C) will fix a logic problem, missing the fundamental step of validating the query itself.

How to eliminate wrong answers

Option A is wrong because incident creation rule configuration is not a concept in Microsoft Sentinel; analytics rules define incident creation, and checking this is premature before verifying the query returns data. Option B is wrong because the question explicitly states that relevant logs are being ingested, so verifying connectivity is unnecessary and wastes time. Option C is wrong because disabling and re-enabling the rule is a brute-force reset that does not diagnose the root cause and may reset rule state without addressing underlying query or scheduling issues.

Practice this question →
106
MCQeasy

Your organization uses Microsoft Defender XDR and Microsoft Sentinel. The security operations center (SOC) team frequently receives false positive alerts for a specific user login pattern from a legacy application. You need to reduce alert fatigue without disabling the underlying detection rule. What should you configure?

A.Use Microsoft Sentinel bookmarks to mark the alerts as false positives.
B.Configure an automated investigation and remediation rule in Microsoft Defender XDR to suppress alerts matching the legacy application pattern.
C.Create a watchlist in Microsoft Sentinel containing the legacy application's user accounts and use it in the rule.
D.Modify the analytics rule in Microsoft Sentinel to exclude the legacy application IP range.
AnswerB

Automated investigation rules can suppress false positives based on conditions.

Why this answer

Option C is correct because automated investigation and remediation rules in Microsoft Defender XDR allow you to take action on alerts, including suppressing false positives based on conditions. Option A is wrong because modifying the analytics rule in Sentinel would affect all detections of that rule, not just the legacy app pattern. Option B is wrong because a watchlist in Sentinel is used for correlation, not suppression.

Option D is wrong because bookmarks are for preserving evidence, not suppressing alerts.

Practice this question →
107
MCQhard

Your organization has deployed Microsoft Sentinel in multiple regions. You need to ensure that incidents created in one workspace are available for correlation in a central workspace. What should you implement?

A.Cross-workspace queries in KQL
B.Sentinel workspace manager (incident replication)
C.Automated export of incidents to central workspace using Logic Apps
D.Azure Lighthouse
AnswerB

Replicates incidents to a central workspace.

Why this answer

Sentinel Workspace Manager (incident replication) is the correct choice because it provides native, built-in replication of incidents from multiple workspaces to a central workspace without requiring custom code or external automation. This feature ensures that incidents created in regional workspaces are automatically synchronized to a designated central workspace, enabling unified correlation and investigation across regions.

Exam trap

The trap here is that candidates often confuse cross-workspace queries (which allow querying data across workspaces but do not replicate incidents) with the native incident replication feature, leading them to select Option A instead of the correct Workspace Manager solution.

How to eliminate wrong answers

Option A is wrong because cross-workspace queries in KQL allow querying data across multiple workspaces but do not replicate incidents; they require manual querying and do not provide automatic incident synchronization. Option C is wrong because automated export using Logic Apps is a custom, complex solution that introduces latency and maintenance overhead, whereas Sentinel Workspace Manager provides a native, low-latency replication mechanism without additional components. Option D is wrong because Azure Lighthouse enables cross-tenant management and visibility but does not replicate incidents between workspaces; it allows administrators to manage multiple workspaces from a single pane but does not synchronize incident data.

Practice this question →
108
MCQhard

You are configuring Microsoft Defender for Cloud Apps. You need to create a policy that alerts when a user downloads more than 100 files in 10 minutes from SharePoint. Which policy type should you use?

A.Anomaly detection policy
B.Activity policy
C.File policy
D.Cloud discovery policy
AnswerB

Activity policies allow custom conditions like number of downloads in a time window.

Why this answer

Option B is correct because Activity policies in Microsoft Defender for Cloud Apps allow you to define conditions based on a single activity or multiple activities from a user. Option A is for OAuth apps. Option C is for detecting anomalous file sharing.

Option D is for cloud discovery.

Practice this question →
109
MCQeasy

Your SOC team uses Microsoft Sentinel incident management. You need to ensure that when an incident is created, it automatically runs a playbook to gather additional context from threat intelligence sources. What should you create?

A.Workbook that queries threat intelligence.
B.Watchlist that maps to the incident.
C.Automation rule with a trigger on incident creation.
D.Analytics rule that generates an alert.
AnswerC

Automation rules run playbooks on incident creation.

Why this answer

Option C is correct because Microsoft Sentinel automation rules can be configured with a trigger on incident creation to automatically run a playbook. This allows the SOC team to gather additional context from threat intelligence sources without manual intervention, directly addressing the requirement to execute a playbook when an incident is created.

Exam trap

The trap here is that candidates often confuse automation rules with analytics rules, thinking that analytics rules can directly trigger playbooks on incident creation, when in fact automation rules are the dedicated mechanism for incident-triggered playbook execution.

How to eliminate wrong answers

Option A is wrong because a Workbook in Microsoft Sentinel is a visualization and reporting tool that queries data for analysis, not an automated action that runs a playbook upon incident creation. Option B is wrong because a Watchlist is a static reference data source used for correlation and enrichment within analytics rules or queries, not a mechanism to trigger playbooks automatically. Option D is wrong because an Analytics rule generates alerts based on detection logic, but it does not directly trigger a playbook on incident creation; playbook execution on incident creation requires an automation rule, not the analytics rule itself.

Practice this question →
110
MCQmedium

Your security team uses Microsoft Sentinel automation rules to respond to incidents. You need to ensure that critical incidents are automatically assigned to a senior analyst in the Americas time zone and that a Teams message is sent to a specific channel. Which configuration should you use?

A.Use a watchlist to map critical incidents to senior analysts and trigger an email
B.Configure the analytics rule to set the incident owner and add a playbook action
C.Create a custom connector in Power Automate to monitor Sentinel incidents
D.Create a playbook that assigns the incident and sends a Teams message, then attach it to a automation rule
AnswerD

Automation rules run playbooks that can assign incidents and send Teams messages.

Why this answer

Option D is correct because automation rules in Microsoft Sentinel can trigger a playbook when an incident is created or updated. By creating a playbook that assigns the incident to a specific senior analyst (using Microsoft Entra ID or a watchlist for mapping) and sends a Teams message via the Teams connector, then attaching that playbook to an automation rule with conditions for critical severity, you meet both requirements. This approach leverages native Sentinel automation without custom connectors or manual email triggers.

Exam trap

The trap here is that candidates often confuse the capabilities of analytics rules versus automation rules, thinking that analytics rules can directly execute playbooks or set owners, when in fact automation rules are the correct mechanism for triggering playbooks and modifying incident properties after creation.

How to eliminate wrong answers

Option A is wrong because a watchlist alone cannot trigger actions; it is a static data source, and the email action would require a playbook or automation rule, not just a watchlist. Option B is wrong because analytics rules can set the incident owner via the 'Alert Details' configuration, but they cannot directly add a playbook action; playbooks are attached via automation rules, not analytics rules. Option C is wrong because creating a custom connector in Power Automate is unnecessary and overly complex; Sentinel already provides native connectors for Teams and incident management through automation rules and playbooks.

Practice this question →
111
MCQeasy

Your SOC uses Microsoft Sentinel and Microsoft Defender for Cloud Apps. You need to configure a policy that triggers when a user downloads a large number of files from SharePoint Online within a short period. Which policy type should you use?

A.Session policy
B.File policy
C.Anomaly detection policy
D.Activity policy
AnswerD

Activity policies allow custom detection of specific activities like mass downloads.

Why this answer

An activity policy in Microsoft Defender for Cloud Apps is designed to monitor and respond to specific user activities, such as downloading a large number of files from SharePoint Online within a short period. This policy type allows you to set thresholds and triggers based on user actions, making it the correct choice for detecting anomalous download behavior.

Exam trap

The trap here is that candidates often confuse anomaly detection policies (which are predefined and use machine learning) with activity policies (which are customizable and rule-based), leading them to select anomaly detection when a custom threshold-based trigger is required.

How to eliminate wrong answers

Option A is wrong because session policies are used for real-time monitoring and control of user sessions, such as blocking downloads during a session, but they do not trigger based on historical activity thresholds like a large number of downloads over time. Option B is wrong because file policies focus on detecting specific file types, content, or metadata (e.g., sensitive data in files), not on the volume or frequency of file downloads. Option C is wrong because anomaly detection policies in Defender for Cloud Apps use machine learning to detect unusual patterns across users, but they are predefined and cannot be customized to trigger specifically on a high volume of downloads from SharePoint Online within a short period.

Practice this question →
112
MCQhard

Your company uses Microsoft Sentinel as its SIEM and has enabled User and Entity Behavior Analytics (UEBA) to detect insider threats. The UEBA timeline for a user shows several high-risk events, including unusual data exfiltration to an external site and multiple failed logons from a new geographic location. You are asked to create a custom analytics rule that generates an incident when a user exhibits both high-risk behaviors within a 24-hour period. You have the necessary KQL skills. However, when you test the rule, it does not generate any incidents even though the behavior exists. You have confirmed that the UEBA tables (BehaviorAnalytics, IdentityInfo) are populated and that the rule is enabled with a frequency of 1 hour. What is the most likely reason the rule is not firing?

A.The analytics rule is not enabled for the correct workspace.
B.The KQL query is referencing the wrong tables.
C.The UEBA data has not yet been fully processed and may take up to 24 hours to appear in the tables.
D.The rule's frequency is too long; it should be set to 5 minutes.
AnswerC

UEBA data can have a processing delay, causing the rule to not find matching events.

Why this answer

Option D is correct because UEBA data may not be immediately available for querying; there can be a delay (up to 24 hours) before behavior data is fully processed and available in the tables. Option A is wrong because the rule is enabled and the tables are populated. Option B is wrong because the rule is set to run every hour.

Option C is wrong because the rule is using the correct tables.

Practice this question →
113
Multi-Selecthard

Which THREE actions can you perform using Microsoft Sentinel automation rules?

Select 3 answers
A.Create a new analytics rule
B.Add threat intelligence indicators to Sentinel
C.Run a playbook
D.Change the severity of an incident
E.Assign an incident to a specific analyst
AnswersC, D, E

Automation rules can trigger playbooks.

Why this answer

Correct options are A, B, and D. Automation rules can change incident severity, assign incidents, and run playbooks. Option C is done by analytics rule templates, not automation rules.

Option E is done by threat intelligence indicators.

Practice this question →
114
Multi-Selecthard

Which THREE components are required to enable automation in Microsoft Sentinel? (Choose three.)

Select 3 answers
A.Microsoft Power Automate license
B.Playbooks based on Azure Logic Apps
C.Microsoft Entra ID P2 license
D.Managed identity or service principal for authentication
E.Automation rules
AnswersB, D, E

Playbooks contain the actions to execute.

Why this answer

Playbooks based on Azure Logic Apps are required because they provide the workflow automation engine that executes response actions in Microsoft Sentinel. Without a Logic Apps resource to define the steps (e.g., triggers, conditions, and actions), there is no executable automation to run when an incident or alert is generated.

Exam trap

The trap here is that candidates often confuse the licensing requirements for Power Automate (Option A) with the actual compute engine (Azure Logic Apps) needed for playbooks, or they mistakenly think Entra ID P2 (Option C) is required for automation when it is only needed for identity protection features.

Practice this question →
115
Multi-Selectmedium

Which THREE features are available in Microsoft Defender XDR to help automate incident response? (Choose three.)

Select 3 answers
A.Automated investigation and response (AIR)
B.Microsoft Power Automate
C.Advanced hunting
D.Playbooks
E.Microsoft Sentinel fusion rule
AnswersA, C, D

AIR is a core feature of Microsoft Defender XDR.

Why this answer

Automated investigation and response (AIR) in Microsoft Defender XDR automatically runs playbooks on alerts to investigate and remediate threats without manual intervention. It leverages machine learning and security signals across endpoints, email, and identities to contain malicious activity, such as isolating a compromised device or blocking a malicious file, directly within the incident response workflow.

Exam trap

The trap here is that candidates may confuse Microsoft Power Automate as a native Defender XDR feature for automation, when in fact it is an external tool that requires custom configuration and is not part of Defender XDR's built-in automated investigation and response capabilities.

Practice this question →
116
Multi-Selecteasy

You are configuring Microsoft Sentinel to use Microsoft Copilot for Security. Which TWO prerequisites must be met?

Select 2 answers
A.Ensure that the Microsoft Defender XDR tenant is integrated with Copilot for Security.
B.Enable Copilot for Security in the Microsoft Sentinel workspace settings.
C.Deploy Copilot for Security in the same Azure region as the Sentinel workspace.
D.Purchase a Microsoft Sentinel premium license.
E.Provision Security Compute Units (SCUs) in the Copilot for Security portal.
AnswersA, E

Integration is necessary for data access.

Why this answer

Options A and B are correct. Copilot for Security requires the Security Compute Units and the Microsoft Defender XDR integrated tenant. Option C is incorrect because Copilot for Security does not require a premium license.

Option D is incorrect because Copilot for Security is a separate service, not a workspace feature. Option E is incorrect because Copilot for Security is available in multiple regions.

Practice this question →
117
MCQhard

Your organization has multiple offices across the globe and uses Microsoft Sentinel as the primary SIEM. You have deployed Azure Arc on all on-premises servers to manage them centrally. The security team needs to collect Windows Security Events from all servers, including domain controllers, and forward them to Sentinel using the Windows Security Events via AMA connector. The team also wants to minimize administrative overhead when adding new servers. The current environment includes: 500 on-premises Windows servers (200 domain controllers, 300 member servers) managed via Azure Arc, 200 Azure VMs running Windows Server, and a centralized Log Analytics workspace named 'LAW-Security' in the East US region. You have already installed the Azure Monitor Agent (AMA) on all servers via Azure Arc and Azure VMs. However, you notice that security events from domain controllers are not appearing in Sentinel. You have verified that the AMA agent is running and the data collection rule (DCR) is correctly configured to collect Security events. No other issues are present. You need to ensure that security events from domain controllers are collected. What should you do?

A.Reinstall the Windows Security Events via AMA connector in Sentinel.
B.Restart the Azure Monitor Agent on all domain controllers.
C.Recreate the data collection rule with a different namespace.
D.Check the network connectivity from the domain controllers to the Log Analytics workspace endpoint. Ensure that the domain controllers can reach the required URLs.
AnswerD

Domain controllers may have firewall rules that block outbound connectivity to Azure endpoints. The AMA agent needs to send data to the workspace.

Why this answer

Option A is correct because domain controllers often have restricted network access; they need to be able to reach the Log Analytics workspace endpoint. Option B is wrong because the DCR is already correctly configured. Option C is wrong because restarting the agent is not the solution.

Option D is wrong because the connector is already working for other servers.

Practice this question →
118
MCQeasy

Your organization uses Microsoft Sentinel. You need to ensure that an incident is automatically assigned to the appropriate team based on the type of alert. What should you configure?

A.Workbook
B.Playbook
C.Analytics rule
D.Automation rule
AnswerD

Automation rules can assign incidents to owners based on conditions.

Why this answer

Automation rules in Microsoft Sentinel allow you to automatically assign incidents to a specific owner or team based on conditions such as alert type. Option A is correct. Option B is wrong because playbooks can take actions but assignment is typically done by automation rules.

Option C is wrong because workbooks are for visualization. Option D is wrong because analytics rules create alerts, not assign incidents.

Practice this question →
119
Multi-Selecteasy

You are a security operations analyst for a company that uses Microsoft Sentinel. You need to ensure that incidents are automatically assigned to the appropriate team based on the incident type. Which two actions should you take?

Select 2 answers
A.Modify the analytics rule to set the incident owner directly.
B.Create a playbook that assigns incidents based on the incident type.
C.Create a workbook that filters incidents by type and assigns them manually.
D.Define custom details in the analytics rule to include the team name, then use an automation rule to assign.
E.Create an automation rule that uses conditions to set the incident owner.
AnswersD, E

Correct: Custom details can be used to map to teams.

Why this answer

Option D is correct because custom details in an analytics rule allow you to extract and store the team name from the incident data, and then an automation rule can use that custom detail as a condition to automatically assign the incident to the appropriate owner. This approach ensures dynamic assignment based on the incident type without requiring a playbook or manual intervention.

Exam trap

The trap here is that candidates often think a playbook (Option B) is required for any automated action beyond basic alerting, but Microsoft Sentinel's automation rules can directly set incident owners based on conditions without needing a playbook.

Practice this question →
120
Multi-Selectmedium

Your organization uses Microsoft Defender XDR and Microsoft Sentinel in a hybrid deployment. You need to ensure that all incidents from Defender XDR are synchronized to Sentinel and that any changes to incident status in Sentinel are reflected back in Defender XDR. Which THREE components or configurations are required?

Select 3 answers
A.Automation rules that trigger on incident status change and call a playbook to update the other platform.
B.Microsoft Defender XDR data connector in Sentinel.
C.Enable bi-directional incident synchronization in the connector settings.
D.Microsoft Defender for Cloud Apps connector.
E.Configure a mail flow rule in Exchange Online.
AnswersA, B, C

Playbooks can update incidents in both platforms to keep them in sync.

Why this answer

Option A (Microsoft Defender XDR connector) enables incident ingestion. Option C (Bi-directional sync setting) ensures status changes are reflected both ways. Option D (Automation rules) can update status in both platforms.

Option B is for alerts, not incidents. Option E is for email, not sync.

Practice this question →
121
MCQmedium

Refer to the exhibit. You are reviewing an Azure Policy definition intended to block malicious IPs by denying the creation of network security group rules that allow traffic from a list of blocked IPs. However, the policy is not working as expected. What is the most likely reason?

A.The policy mode is incorrect; it should be 'All' instead of 'Microsoft.Network/virtualNetworks'.
B.The parameter 'listOfBlockedIPs' is not used in the policy rule.
C.The effect 'deny' is not supported for this resource type.
D.The policy rule does not evaluate the source IP address; it denies all security rules.
AnswerD

Correct. The condition only checks the resource type, not the IP address.

Why this answer

Option D is correct because the policy rule in the exhibit uses the 'sourceAddressPrefix' condition with the parameter 'listOfBlockedIPs', but it does not include a condition to evaluate the 'sourcePortRange' or 'destinationAddressPrefix'. More critically, the rule denies all security rules regardless of the source IP because the condition logic is flawed: it denies if the source IP is in the blocked list, but it does not also check that the rule is allowing traffic (e.g., direction 'Inbound' and access 'Allow'). Without these additional conditions, the policy incorrectly denies all NSG rules, including those that are not allowing traffic from blocked IPs.

Exam trap

The trap here is that candidates focus on the parameter usage or mode setting, but the real issue is the missing condition logic that fails to restrict the deny effect to only inbound allow rules, causing the policy to deny all security rules indiscriminately.

How to eliminate wrong answers

Option A is wrong because the policy mode 'Microsoft.Network/virtualNetworks' is correct for evaluating network security group rules, which are child resources of virtual networks; changing to 'All' would not fix the logic error. Option B is wrong because the parameter 'listOfBlockedIPs' is indeed used in the policy rule via the 'sourceAddressPrefix' condition, so its absence is not the issue. Option C is wrong because the 'deny' effect is fully supported for network security group rule resources in Azure Policy, as documented in the Azure Policy built-in definitions.

Practice this question →
122
Multi-Selecteasy

Which TWO actions can be performed using Microsoft Sentinel automation rules? (Choose two.)

Select 2 answers
A.Change the severity of an incident
B.Add a tag to an incident
C.Deploy a data connector
D.Modify a watchlist
E.Create a scheduled query rule
AnswersA, B

Automation rules can modify incident severity.

Why this answer

Automation rules in Microsoft Sentinel allow you to automate incident management tasks, including changing the severity of an incident and adding tags. These actions are part of the incident-handling workflow and can be triggered when an incident is created or updated, enabling consistent triage and enrichment without manual intervention.

Exam trap

The trap here is that candidates often confuse automation rules with playbooks or other Sentinel configuration tasks, assuming that any automated action (like deploying connectors or creating rules) can be done via automation rules, when in fact automation rules are strictly for incident management actions.

Practice this question →
123
MCQhard

You are managing a Microsoft Sentinel environment. You need to ensure that incidents are automatically assigned to the appropriate analyst based on the type of attack. The assignment must consider the current workload of each analyst. What should you use?

A.Configure multiple analytics rules, each with a different incident owner.
B.Use an automation rule with a playbook that queries the current incident assignments and assigns to the least busy analyst.
C.Create a watchlist that maps attack types to analyst names and use it in an analytics rule.
D.Create a workbook that shows analyst workload and manually assign.
AnswerB

Automation rules with playbooks can handle dynamic assignment.

Why this answer

Option B is correct because automation rules in Microsoft Sentinel can trigger a playbook (Azure Logic App) that queries the current incident assignments and assigns the incident to the analyst with the fewest active incidents. This satisfies both the attack-type mapping (via the analytics rule that generates the incident) and the workload-balancing requirement, as the playbook can dynamically evaluate workload using Azure Resource Graph or Sentinel's API.

Exam trap

The trap here is that candidates often confuse static assignment (Option A or C) with dynamic assignment, failing to realize that only a playbook can query real-time workload data and make a runtime decision based on it.

How to eliminate wrong answers

Option A is wrong because configuring multiple analytics rules with different incident owners only allows static assignment per rule, not dynamic workload-based assignment; it cannot consider current analyst workload. Option C is wrong because a watchlist can map attack types to analyst names, but using it in an analytics rule only sets a static owner field, not a dynamic assignment based on real-time workload. Option D is wrong because a workbook only provides a visual report of analyst workload; it cannot automate assignment, and manual assignment does not meet the requirement for automatic assignment.

Practice this question →
124
MCQhard

Your SOC uses Microsoft Sentinel and Microsoft Defender XDR. An incident is generated from a Microsoft Defender for Identity alert about a suspicious Kerberos ticket request. The incident is assigned the 'Medium' severity. You want to automatically increase the severity to 'High' if the user is in a privileged role, based on data from Microsoft Entra ID. What is the most efficient way to achieve this?

A.Enable automatic attack disruption in Microsoft Defender XDR to handle the incident.
B.Modify the analytics rule that generates the incident to check user roles during query execution.
C.Create an automation rule in Microsoft Sentinel triggered on incident creation, which runs a playbook that checks Microsoft Entra ID roles and updates the severity accordingly.
D.Create a scheduled analytics rule that queries Microsoft Entra ID audit logs and updates incident severity via a watchlist.
AnswerC

Automation rules with playbooks are designed for this purpose.

Why this answer

Option D is correct because Sentinel automation rules can be triggered on incident creation and can call a playbook (via Azure Logic Apps) to look up user roles in Microsoft Entra ID and then update the incident severity. Option A is wrong because analytics rules generate incidents, not modify existing ones. Option B is wrong because a custom KQL query after ingestion would not update an already created incident.

Option C is wrong because automatic attack disruption is for containing attacks, not adjusting severity.

Practice this question →
125
Multi-Selectmedium

Which TWO actions should you take when configuring Microsoft Sentinel to minimize false positives from an analytics rule?

Select 2 answers
A.Add a playbook to automatically close low-severity alerts
B.Map entities correctly
C.Enable incident creation automatically
D.Adjust the rule's query threshold
E.Configure alert grouping
AnswersB, D

Proper mapping improves alert fidelity.

Why this answer

Option A is correct because tuning thresholds reduces noise. Option D is correct because entity mapping improves accuracy. Option B is wrong because creating incidents is the goal, not reducing false positives directly.

Option C is wrong because alert grouping does not reduce false positives. Option E is wrong because playbooks are for response, not rule tuning.

Practice this question →
126
MCQmedium

Your Microsoft Sentinel workspace ingests logs from multiple sources but you notice that some custom logs are missing in the Log Analytics workspace. You've confirmed that the data connectors are healthy. What is the most likely cause?

A.The custom log table schema does not match the incoming log format.
B.There is a time gap between log generation and ingestion.
C.The workspace has exceeded its daily ingestion limit.
D.The data connectors are not properly configured for custom log ingestion.
AnswerA

Mismatch causes logs to be dropped.

Why this answer

When data connectors are healthy but custom logs are missing, the most common cause is a schema mismatch between the custom log table definition in the Log Analytics workspace and the actual log data being sent. Microsoft Sentinel requires the custom log table's schema (columns, data types, and delimiters) to exactly match the incoming log format; otherwise, the ingestion pipeline drops the records without error. This is because the Log Analytics agent or AMA uses the table schema to parse and transform the data, and any deviation results in silent failures.

Exam trap

The trap here is that candidates assume a healthy data connector guarantees all logs are ingested, but Microsoft tests the nuance that schema mismatches cause silent ingestion failures even when the connector itself is operational.

How to eliminate wrong answers

Option B is wrong because a time gap between log generation and ingestion does not cause logs to be missing; it only delays their appearance in the workspace, and Sentinel can still ingest them later. Option C is wrong because exceeding the daily ingestion limit would cause all log ingestion to stop or be throttled, not just custom logs, and you would see ingestion quota warnings in the workspace. Option D is wrong because the question explicitly states that data connectors are healthy, meaning they are properly configured for custom log ingestion; if they were misconfigured, the connectors would show an unhealthy status or fail to connect.

Practice this question →
127
MCQeasy

Refer to the exhibit. You have an analytics rule in Microsoft Sentinel that uses this KQL query. The rule is configured to run every hour and alert when the result count is greater than 0. Which type of attack is this rule most likely detecting?

A.Privileged account misuse
B.Data exfiltration via sign-in
C.Account takeover from a new location
D.Brute force attack on user accounts
AnswerD

Multiple high-risk sign-ins indicate repeated failed attempts, typical of brute force.

Why this answer

Option A is correct because the query looks for users with high-risk sign-ins (both during and aggregated) and counts them; more than 5 high-risk sign-ins in a day suggests a brute force attempt where many failed attempts lead to high risk. Option B would be more about unusual locations. Option C would be about many downloads.

Option D would be about privilege escalation.

Practice this question →
128
MCQeasy

Your organization uses Microsoft Defender for Cloud Apps to discover shadow IT. You notice that a new cloud app is being used by multiple users but has a risk score of 8. What should you do first to manage the risk?

A.Investigate the app's risk factors and user activity
B.Block the app at the proxy
C.Immediately unsanction the app in Defender for Cloud Apps
D.Create a policy to alert on use of this app
AnswerA

Investigation helps understand the risk before taking action.

Why this answer

A risk score of 8 indicates the app is high-risk, but immediate blocking or unsanctioning could disrupt business operations if the app is legitimate or used for approved purposes. The first step is to investigate the app's risk factors (e.g., data residency, encryption standards, compliance certifications) and user activity (e.g., volume of data uploaded, types of files shared) to understand the actual threat. This aligns with Microsoft's recommended incident response process: assess before acting.

Exam trap

The trap here is that candidates assume a high risk score automatically requires immediate blocking or unsanctioning, but Microsoft's guidance emphasizes investigation first to avoid false positives and ensure business continuity.

How to eliminate wrong answers

Option B is wrong because blocking the app at the proxy without investigation could break legitimate business workflows and bypass the need to understand the app's risk profile; Defender for Cloud Apps uses reverse proxy controls only after assessment. Option C is wrong because immediately unsanctioning the app without investigation may cause unnecessary disruption and ignores the possibility that the app is low-risk despite a high score; unsanctioning should be a deliberate action based on evidence. Option D is wrong because creating a policy to alert on use of the app is a reactive measure that does not address the immediate risk; alerts are useful for ongoing monitoring but not the first step when a high-risk app is already in use.

Practice this question →
129
MCQhard

Your organization uses Microsoft Sentinel and has multiple workspaces for different business units. You need to enable cross-workspace querying for the security operations center (SOC) analysts. What should you do?

A.Configure a data connector for each workspace
B.Use the workspace() expression in KQL queries
C.Enable incident merging across workspaces
D.Create a single workspace and migrate all data
AnswerB

Allows querying multiple workspaces in one query.

Why this answer

The `workspace()` expression in KQL allows a query to reference tables from multiple Log Analytics workspaces within a single query. This enables SOC analysts to perform cross-workspace queries without moving data, which is the correct approach for a multi-workspace Sentinel deployment.

Exam trap

The trap here is that candidates may confuse data collection configuration (data connectors) with query capabilities, or assume that incident merging is the same as cross-workspace querying, when in fact they serve entirely different purposes.

How to eliminate wrong answers

Option A is wrong because configuring a data connector for each workspace ingests data into each workspace separately but does not enable cross-workspace querying; it only ensures data is collected. Option C is wrong because incident merging across workspaces is a feature for correlating alerts into a single incident, not for querying data across workspaces. Option D is wrong because creating a single workspace and migrating all data is an architectural change that may not be feasible or desired, and it is not the recommended method for enabling cross-workspace queries in a multi-workspace environment.

Practice this question →
130
MCQeasy

A security operations center (SOC) uses Microsoft Sentinel. They want to automatically block a user's account when a high-severity incident is created. Which automation action should you use in a playbook?

A.Run a playbook that revokes the user's current sessions using Microsoft Graph API.
B.Run a playbook that resets the user's password.
C.Run a playbook that calls the Microsoft Graph API to disable the user account.
D.Run a playbook that updates a conditional access policy in Microsoft Entra ID.
AnswerC

Disabling the account immediately prevents further access.

Why this answer

Option A is correct because Microsoft Sentinel playbooks can integrate with Microsoft Entra ID to disable a user account. Option B is wrong because resetting password is a different action. Option C is wrong because the playbook does not directly modify Microsoft Defender for Cloud Apps, but could trigger a conditional access policy.

Option D is wrong because revoking sessions is a different action.

Practice this question →
131
MCQeasy

A security operations center (SOC) uses Microsoft Sentinel. You need to ensure that when a high-severity incident is created, an automated email notification is sent to the on-call security engineer. Which automation option should you use?

A.Set an analytics rule to run a KQL query and send email.
B.Create a workbook that emails the on-call engineer daily.
C.Configure a logic app manually triggered by the analyst.
D.Create a playbook that sends an email and associate it with an automation rule that triggers on high-severity incidents.
AnswerD

Playbooks are automated workflows; automation rules run them when incidents match criteria.

Why this answer

Option D is correct because playbooks can be triggered by incidents and include actions like sending emails. Automation rules can trigger playbooks. The other options do not directly send emails.

Practice this question →
132
MCQmedium

Your company uses Microsoft Defender for Cloud Apps. You discover that a user is accessing sensitive data from an unfamiliar IP address. You need to immediately block the user's access to all cloud apps while preserving the session for investigation. What should you do?

A.Use the 'Block' governance action in Defender for Cloud Apps
B.Create a conditional access policy to block the IP
C.Add the IP to the blocked IP address range list
D.Suspend the user from Microsoft Entra ID
AnswerA

Block immediately terminates the session and prevents new access.

Why this answer

The 'Block' governance action in Defender for Cloud Apps immediately blocks the user's access to all cloud apps while preserving the session for investigation. This action is applied directly within the Defender for Cloud Apps portal, allowing you to stop data exfiltration without disrupting the ability to analyze the session logs or alerts. It is the only option that meets the requirement of blocking access while keeping the session intact for forensic review.

Exam trap

The trap here is that candidates often confuse the 'Block' governance action with IP-based blocking or user suspension, not realizing that only the governance action within Defender for Cloud Apps can block access while preserving the session for investigation.

How to eliminate wrong answers

Option B is wrong because creating a conditional access policy in Microsoft Entra ID would block access at the authentication level, but it does not preserve the session for investigation; it terminates the session entirely. Option C is wrong because adding the IP to the blocked IP address range list in Defender for Cloud Apps blocks all traffic from that IP, but it does not target the specific user and does not preserve the session for investigation. Option D is wrong because suspending the user from Microsoft Entra ID disables the user account, which blocks all access and terminates the session, preventing any further investigation of the ongoing session.

Practice this question →
133
Multi-Selecteasy

Which TWO are valid methods to ingest syslog data into Microsoft Sentinel?

Select 2 answers
A.Use the Syslog data connector from the Content hub
B.Configure a syslog forwarder with the Cisco ASIM parser
C.Use the Log Analytics agent to collect syslog from Linux machines
D.Deploy a Splunk Universal Forwarder to send syslog to Sentinel
E.Install a Windows-based syslog collector and forward to Sentinel using the Azure Monitor agent
AnswersA, C

The Syslog connector is a standard method.

Why this answer

Option A is correct because the Syslog data connector available from the Content hub in Microsoft Sentinel provides a direct, built-in method to ingest syslog data from on-premises or cloud-based syslog sources. This connector uses the Log Analytics agent (or the newer Azure Monitor Agent with a Data Collection Rule) to collect syslog messages forwarded by a syslog daemon, typically over UDP port 514 or TCP, and maps them to the Syslog table in Log Analytics. It is the standard, supported approach for syslog ingestion without requiring third-party tools or custom parsers.

Exam trap

The trap here is that candidates confuse data ingestion methods with post-ingestion processing tools (like ASIM parsers) or assume that any universal forwarder (like Splunk's) can send data to Sentinel, when in fact only specific connectors and agents are supported for syslog ingestion.

Practice this question →
134
Multi-Selectmedium

Which TWO actions should you take to improve the performance of Microsoft Sentinel analytics rules that query large datasets?

Select 2 answers
A.Use a time filter in the query to limit the data range.
B.Use a watchlist to pre-filter results.
C.Change the data type of the columns to string.
D.Use summarize operators to aggregate data before performing joins.
E.Simplify the event by removing unused columns using project.
AnswersA, D

Reduces the amount of data scanned.

Why this answer

Option A is correct because applying a time filter (e.g., using the `TimeGenerated` column) in a KQL query restricts the dataset to only the relevant time window, which significantly reduces the amount of data scanned by Microsoft Sentinel. This directly improves query performance by minimizing I/O and processing overhead, especially when analytics rules run against large log tables.

Exam trap

The trap here is that candidates often confuse result-set optimization (like removing columns with `project`) with query-performance optimization, not realizing that the real bottleneck is the amount of raw data scanned from storage.

Practice this question →
135
MCQmedium

Your organization uses Microsoft Sentinel to manage security incidents. You need to ensure that critical incidents are automatically assigned to the senior security analyst on duty. What should you configure?

A.Configure an automation rule with an 'Assign incident' action
B.Modify the analytics rule to set the owner in the incident creation
C.Create a playbook that assigns incidents
D.Use a workbook to filter incidents by severity and assign manually
AnswerA

Automation rules can automatically assign incidents to the appropriate owner.

Why this answer

Option B is correct because automation rules in Microsoft Sentinel can assign incidents to specific users or groups based on conditions. Option A is wrong because playbooks are for automated response actions, not assignment. Option C is wrong because analytics rules generate incidents, not assign them.

Option D is wrong because workbooks are for visualization, not assignment.

Practice this question →
136
MCQmedium

Your organization uses Microsoft Defender XDR. You notice that automated investigations are being blocked for certain devices due to high-severity alerts. You need to ensure that automated actions can proceed for devices with a risk score below 30. What should you configure?

A.Configure a device group with an automated investigation and response rule that excludes devices with a risk score above 30.
B.Disable automated investigation for all devices and rely on manual investigation.
C.Adjust the Microsoft Defender for Cloud Apps policy to allow automated actions for low-risk devices.
D.Modify the attack surface reduction rules to allow automated actions on low-risk devices.
AnswerA

Device groups with AIR rules can control which devices get automated actions based on risk score.

Why this answer

Option A is correct because device groups in Microsoft Defender XDR allow you to scope automated investigation and response (AIR) rules based on device risk scores. By creating a device group that excludes devices with a risk score above 30, you ensure that automated actions proceed only for devices meeting your threshold, directly addressing the requirement.

Exam trap

The trap here is that candidates confuse device groups (which control AIR scope) with other security features like attack surface reduction rules or cloud app policies, leading them to select options that address unrelated controls rather than the correct mechanism for scoping automated investigations.

How to eliminate wrong answers

Option B is wrong because disabling automated investigation entirely would prevent all automated responses, not just for high-risk devices, and contradicts the requirement to allow actions for low-risk devices. Option C is wrong because Microsoft Defender for Cloud Apps policies govern cloud application behavior, not device-level automated investigation and response actions in Defender XDR. Option D is wrong because attack surface reduction rules control exploit mitigation behaviors (e.g., blocking macros or scripts), not the conditional execution of automated investigation actions based on risk scores.

Practice this question →
137
MCQmedium

You are a SOC analyst investigating an incident where a user's credentials were used to access a sensitive SharePoint site from an unusual location. Microsoft Defender for Cloud Apps detected the activity as a suspicious sign-in. You need to create a detection rule that alerts whenever a user accesses SharePoint from a location not in the allowed list. What type of rule should you create in Microsoft Defender for Cloud Apps?

A.App discovery policy.
B.Session policy.
C.Activity policy.
D.Anomaly detection policy.
AnswerC

Activity policies allow you to define conditions like location and trigger alerts.

Why this answer

Activity policies in Defender for Cloud Apps allow you to detect specific user activities that match criteria. Option B is correct. Option A is wrong because anomaly detection policies use machine learning to detect unusual patterns, not specific location-based checks.

Option C is wrong because app discovery policies are for discovering shadow IT. Option D is wrong because session policies are for real-time session control, not detection.

Practice this question →
138
MCQeasy

You are a security analyst at a company that uses Microsoft Sentinel. You need to ensure that only users with a specific tag in Microsoft Entra ID can access the Sentinel workspace. Which Azure feature should you use?

A.Assign Azure RBAC roles with a condition on the tag.
B.Use Microsoft Entra Privileged Identity Management (PIM) to require approval for access.
C.Apply an Azure Policy to deny access if the user does not have the tag.
D.Configure a Conditional Access policy in Microsoft Entra ID.
AnswerD

Conditional Access can require users to have a specific tag to access the Azure portal.

Why this answer

Conditional Access policies in Microsoft Entra ID can enforce access controls based on user attributes, including tags. By configuring a Conditional Access policy that grants access to Microsoft Sentinel only if the user has a specific tag, you can restrict workspace access at the authentication layer before any Azure RBAC evaluation occurs. This is the correct approach because Conditional Access operates at the identity level, directly controlling which users can authenticate to the Sentinel workspace.

Exam trap

The trap here is that candidates often confuse Azure RBAC with Conditional Access, assuming that RBAC conditions on tags can control initial access, when in fact RBAC only controls authorization after authentication, whereas Conditional Access controls authentication itself.

How to eliminate wrong answers

Option A is wrong because Azure RBAC roles with conditions on tags apply to Azure resources after authentication, but they cannot prevent a user from authenticating to the Sentinel workspace; they only control actions post-authentication. Option B is wrong because Privileged Identity Management (PIM) manages just-in-time elevation and approval for privileged roles, not attribute-based access restrictions like tags. Option C is wrong because Azure Policy enforces compliance on Azure resource configurations (e.g., ensuring resources have tags), not on user identity attributes or authentication-level access to a workspace.

Practice this question →
139
MCQhard

Your organization uses Microsoft Sentinel with a hybrid environment including on-premises servers and Azure VMs. You notice that some Windows events from on-premises servers are not being collected in Sentinel. Log Analytics agent is installed on all servers. Other events are collected. What should you check first?

A.Confirm that the workspace key is correctly deployed on the servers.
B.Verify that the Log Analytics agent is running and has network connectivity to Azure.
C.Ensure that the servers are listed in the Azure Arc management pane.
D.Check the Windows Event Log collection configuration in the Log Analytics workspace data collection rules.
AnswerD

Specific event IDs may be filtered out in the configuration.

Why this answer

Option B is correct because missing specific event IDs often indicates a filtering issue in the data collection rules. Option A is incorrect because the agent is healthy if it sends other events. Option C is incorrect because connectivity is likely fine if other events arrive.

Option D is incorrect because the workspace key is used for authentication; if it were wrong, no events would be collected.

Practice this question →
140
MCQmedium

Your organization has a Microsoft Sentinel workspace that ingests data from Microsoft 365 Defender (Defender for Endpoint, Office 365, Identity, Cloud Apps). You have configured a scheduled analytics rule to detect possible privilege escalation based on user activity. The rule runs every 5 minutes and looks at the last 5 minutes of data. Recently, the rule has been generating a high number of false positives. You analyze the alerts and find that they are triggered by legitimate administrative actions. You need to reduce false positives without completely disabling the rule. The rule uses a KQL query that joins the IdentityLogonEvents and CloudAppEvents tables. What should you do?

A.Increase the rule's run frequency to every 30 minutes.
B.Reduce the query's lookback period to 1 minute.
C.Modify the KQL query to exclude events from a list of known administrative user accounts or IP addresses.
D.Add an incident suppression rule that closes incidents from known admin accounts.
AnswerC

Excluding known admins reduces false positives while retaining detection for others.

Why this answer

Option C is correct because tuning the KQL query to exclude known administrative accounts or actions is the best way to reduce false positives. Option A is wrong because increasing the frequency would not reduce false positives. Option B is wrong because suppression can cause missed detections for other users.

Option D is wrong because reducing lookback may miss legitimate events.

Practice this question →
141
Multi-Selectmedium

Which TWO of the following are valid actions that can be performed by an automation rule in Microsoft Sentinel? (Select two.)

Select 2 answers
A.Delete a watchlist
B.Create a task
C.Modify an analytics rule
D.Assign incident to an analyst
E.Run a playbook
AnswersD, E

Automation rules can assign incidents.

Why this answer

Option A and Option C are correct. Automation rules can assign incidents to analysts and run playbooks. Option B is wrong because automation rules do not modify analytics rules.

Option D is wrong because automation rules can close incidents, not just create tasks. Option E is wrong because automation rules do not delete watchlists.

Practice this question →
142
MCQmedium

You are a SOC analyst using Microsoft Defender for Endpoint. You need to investigate a device that is suspected of being compromised. You want to collect a memory dump for offline analysis. Which action should you take from the Microsoft Defender XDR portal?

A.Initiate a live response session and use the 'Collect memory dump' command.
B.Isolate the device from the network to prevent further damage.
C.Run a PowerShell script through live response to copy the memory dump.
D.Run a full antivirus scan on the device.
AnswerA

Live response provides a command to collect a full memory dump.

Why this answer

Microsoft Defender for Endpoint allows you to initiate live response sessions to collect forensic data. Option C is correct. Option A is wrong because antivirus scan does not collect memory dumps.

Option B is wrong because running a PowerShell script through live response is possible, but the direct action to collect a memory dump is using 'Collect memory dump' in live response. Option D is wrong because device isolation does not collect data.

Practice this question →
143
MCQmedium

You are a security operations analyst at a company that uses Microsoft Sentinel. You need to ensure that all incidents generated from Microsoft Defender for Cloud Apps are automatically assigned to the same SOC team. The team uses Microsoft Teams to collaborate. Which configuration should you implement?

A.Create a playbook that assigns the incident to the team and configure an automation rule to run it.
B.Create an automation rule that sets the owner to the team entity.
C.Configure the Microsoft Defender for Cloud Apps connector to assign incidents to the team.
D.Use a logic app to automatically post incidents to a Teams channel and have the team claim them.
AnswerB

Automation rules can set the owner to a team using a managed identity or predefined team.

Why this answer

Option B is correct because automation rules in Microsoft Sentinel can be configured to automatically assign incidents to a specific owner (team) based on conditions like provider. Microsoft Teams integration for collaboration is done via the Teams connector or custom solutions, not directly through automation rules. Automation rules handle assignment, not direct Teams messaging.

Playbooks can post to Teams but assignment is done by automation rules. So B is the most direct and correct answer.

Practice this question →
144
MCQeasy

Your security operations center (SOC) uses Microsoft Sentinel. Analysts need to collaborate on incidents by adding comments and changing severity. Which feature should they use?

A.Hunting
B.Playbooks
C.Workbooks
D.Incident management
AnswerD

Incident management provides commenting and severity changes.

Why this answer

Incident management in Sentinel allows commenting, severity changes, and assignment. Option A is wrong because Playbooks automate responses. Option B is wrong because Workbooks are for dashboards.

Option D is wrong because Hunting is for proactive threat detection.

Practice this question →
145
MCQmedium

Your team uses Microsoft Sentinel to monitor Azure subscriptions. You need to ensure that only users with the 'Microsoft Sentinel Contributor' role can create and edit analytics rules. You want to enforce this using Azure Policy. What should you do?

A.Create an Azure Policy that denies creation of analytics rules if the user doesn't have the 'Microsoft Sentinel Contributor' role.
B.Use Azure Blueprints to assign the 'Microsoft Sentinel Contributor' role to a security group.
C.Assign the 'Microsoft Sentinel Contributor' role to all users at the subscription level.
D.Create a custom role that denies write access to analytics rules.
AnswerA

Correct. Azure Policy can enforce RBAC requirements.

Why this answer

The correct answer is C because Azure Policy can audit or deny role assignments that do not match the allowed roles. Option A is incorrect because RBAC is not enforced by Azure Policy. Option B is incorrect because Azure Policy does not directly manage RBAC.

Option D is incorrect because Azure Blueprints are for deploying environments, not enforcing RBAC.

Practice this question →
146
Multi-Selecthard

Which THREE components are required to use Microsoft Sentinel's automation rules to automatically respond to incidents?

Select 3 answers
A.A playbook created in Azure Logic Apps.
B.An analytics rule generating alerts.
C.The appropriate permissions to run playbooks.
D.An automation rule with conditions and actions.
E.A Microsoft Sentinel workspace.
AnswersC, D, E

Permissions are needed for playbook execution.

Why this answer

Option C is correct because automation rules require appropriate permissions (e.g., Microsoft Sentinel Contributor or Automation Contributor) to execute playbooks. Without these permissions, the automation rule cannot invoke the playbook when an incident is created or updated, even if the rule and playbook are properly configured.

Exam trap

The trap here is that candidates often assume a playbook (Option A) or an analytics rule (Option B) is mandatory for automation rules, but Microsoft Sentinel automation rules can function without either—they only require a workspace, the rule itself, and appropriate permissions to execute actions.

Practice this question →
147
Multi-Selecteasy

Which TWO actions can be taken directly from the Microsoft Defender XDR incident queue? (Select TWO.)

Select 2 answers
A.Isolate a device involved in the incident
B.Modify a data connector's log collection
C.Change the incident status to 'In progress'
D.Create a new analytics rule
E.Create an automation rule
AnswersA, C

Device actions are available from the incident queue.

Why this answer

Option A is correct because the Microsoft Defender XDR incident queue provides direct actions, including device isolation, to contain threats without navigating to separate device management consoles. This capability is built into the incident investigation pane, allowing security analysts to quickly isolate a device involved in an incident from the unified queue.

Exam trap

The trap here is that candidates confuse the Defender XDR incident queue with the broader Microsoft Sentinel workspace, assuming all security operations tasks (like creating rules or modifying data connectors) are available from the incident queue, when in fact only incident-specific response actions are permitted.

Practice this question →
148
MCQhard

Your organization uses Microsoft Purview Compliance Manager to manage compliance activities. You need to assign a specific improvement action to a colleague for implementation. What should you do?

A.In the 'Improvement actions' tab, select the action and click 'Assign'
B.Create a new alert policy to notify the colleague
C.Modify the assessment to include the colleague as an owner
D.Use the 'Assessments' tab to delegate tasks
AnswerA

Improvement actions can be directly assigned to users.

Why this answer

In Microsoft Purview Compliance Manager, improvement actions are the specific tasks that need to be completed to meet compliance controls. Each improvement action can be directly assigned to a colleague by selecting the action in the 'Improvement actions' tab and clicking the 'Assign' button, which allows you to specify the assignee and due date. This is the intended workflow for delegating implementation responsibilities within Compliance Manager.

Exam trap

Microsoft often tests the distinction between assigning a specific improvement action versus modifying assessment ownership or using alert policies, so candidates mistakenly choose options that involve broader permissions or unrelated notification mechanisms instead of the direct assignment feature.

How to eliminate wrong answers

Option B is wrong because alert policies in Microsoft Purview are used to detect and notify about specific activities or threats (e.g., data loss prevention or insider risk events), not to assign improvement actions; they cannot delegate tasks. Option C is wrong because modifying an assessment to add a colleague as an owner changes the ownership of the entire assessment, not the assignment of a specific improvement action; this would give them broad control over the assessment rather than a single task. Option D is wrong because the 'Assessments' tab is used to manage assessments and their controls, not to delegate individual improvement actions; there is no task delegation feature in that tab.

Practice this question →
149
MCQmedium

Refer to the exhibit. You are a security analyst reviewing a KQL query in Microsoft Sentinel. The query is intended to show the count of high-severity malware alerts in the last 24 hours. However, the query returns results only for alerts with exact severity string 'High', but you also need to include 'Informational' severity alerts that are related to malware. What should you modify?

A.Remove the 'summarize' and 'order by' clauses.
B.Remove the 'where AlertName contains "malware"' condition.
C.Change the 'where AlertSeverity == "High"' to 'where AlertSeverity in ("High", "Informational")'.
D.Change 'ago(24h)' to 'ago(48h)'.
AnswerC

This includes both severities.

Why this answer

Option C is correct because the query currently filters only for alerts where AlertSeverity equals 'High', but the requirement is to also include 'Informational' severity alerts related to malware. By changing the condition to 'where AlertSeverity in ("High", "Informational")', the query will return both severity levels while keeping the malware-related filter and the 24-hour time window intact.

Exam trap

The trap here is that candidates may think the issue is with the time range (Option D) or the aggregation (Option A), when the actual problem is a simple missing filter condition for the 'Informational' severity level, which is a common oversight when requirements specify multiple severity values.

How to eliminate wrong answers

Option A is wrong because removing the 'summarize' and 'order by' clauses would only affect the aggregation and sorting of results, not the filtering of severity levels; the query would still exclude 'Informational' alerts. Option B is wrong because removing the 'where AlertName contains "malware"' condition would include all alerts regardless of whether they are related to malware, which violates the requirement to focus on malware alerts. Option D is wrong because changing 'ago(24h)' to 'ago(48h)' would expand the time window to 48 hours, but the requirement specifies the last 24 hours, and this change does not address the missing 'Informational' severity alerts.

Practice this question →
150
Multi-Selectmedium

Which TWO actions should you take to improve the performance of Microsoft Sentinel analytics rules that are running slowly? (Choose two.)

Select 2 answers
A.Assign a higher severity to the rule
B.Reduce the query time window
C.Use summarized data in the query
D.Increase the rule run frequency
E.Add additional entity mapping
AnswersB, C

A smaller time window reduces data scanned.

Why this answer

Reducing the query time window (Option B) directly limits the volume of data the analytics rule must process per execution, which reduces query latency and overall rule execution time. This is a common performance optimization because Sentinel analytics rules run KQL queries against the Log Analytics workspace, and smaller time ranges mean fewer log records to scan.

Exam trap

The trap here is that candidates often confuse rule configuration settings (like severity or frequency) with query performance optimizations, mistakenly thinking that increasing frequency or adding mappings will somehow speed up execution, when in fact they degrade it.

Practice this question →
← PreviousPage 2 of 8 · 554 questions totalNext →

Ready to test yourself?

Try a timed practice session using only Manage Secops Environment questions.

Start 20-question session