정답:

Explanation:

In Microsoft Defender for Endpoint, the quickest way to enumerate running processes and their open network connections on a Windows device is to use the built-in Investigation package feature from the device page.
Collecting an investigation package executes a set of diagnostics on the endpoint and bundles artifacts- including process lists, network connections (netstat output), services, autoruns, scheduled tasks, and other forensic logs-into a ZIP file. After you trigger Collect investigation package on the device page, the job appears in the Action center; once completed, you open that action and download the package. Finally, extract the ZIP to review the CSV/TXT outputs that show active processes and network connectivity, satisfying the requirement with minimal administrative effort and without initiating a live response session or running interactive commands manually.

정답:

Explanation:

To correlate malicious email attachments with endpoints, Microsoft Defender data schemas expose attachment metadata in EmailAttachmentInfo (including the SHA256 hash) and endpoint file activity in DeviceFileEvents (which also records SHA256 for observed files). The recommended investigation pattern is:
(1) filter email telemetry to the suspected sender and keep only attachments with a populated hash; (2) join that result with endpoint file events on the SHA256 hash to find devices where an identical file (by cryptographic hash) was seen. In KQL, isnotempty(SHA256) ensures you only pass attachments with a valid hash to the join, and join ... on SHA256 performs an exact-match correlation across datasets. This method aligns with Defender's guidance to use hash-based correlation as the most reliable way to match artifacts across different security workloads (email vs. endpoint), since filenames and paths can change, but a cryptographic hash uniquely identifies file content. The final project selects operational fields for response- timestamps, file name and hash, device identifiers/names, message IDs, and sender/recipient-so the SOC can quickly pivot to the impacted devices and the original email that delivered the file.

정답:

Explanation:

To validate a custom ASIM parser output, you test that the parser's resulting table structure complies with the intended ASIM schema. In KQL, the getschema operator produces a tabular representation of the current pipeline's schema (column names, types, order). The invoke operator is then used to call a function on that tabular input. ASIM provides the helper function ASimSchemaTester(), which accepts the schema table and the target schema name and validates that the input conforms (columns exist, types match, required fields are present).
Therefore, the correct construction is to run the parser (here, Parser1), pipe its output to getschema to obtain the schema of the produced table, and then invoke ASimSchemaTester( ' Schema1 ' ) to perform the validation. Other options are not appropriate: evaluate is for plugins; parse extracts fields from strings rather than validate schema; and calling the tester without getschema would not pass the required schema table.
Hence, the correct command is:
Parser1 | getschema | invoke ASimSchemaTester( ' Schema1 ' ).

정답:

Explanation:

According to Microsoft Security Operations and Azure Defender (now Microsoft Defender for Cloud) documentation, to validate that Azure Security Center (ASC) - or Defender for Cloud - is properly configured to detect threats such as sign-ins from suspicious IP addresses, you must enable Defender for the subscription first. This step activates the advanced threat protection features that analyze security signals from Azure resources, including virtual machines and network connections.
Once enabled, Microsoft provides a test alert validation process using a PowerShell script or an executable test file to simulate an alert. The official procedure states that to test the alert generation capability, administrators should copy a provided executable file to a virtual machine onboarded to Defender and rename the file using the naming convention beginning with ASC_AlertTest_ followed by random characters. This allows Defender for Cloud to recognize it as a test event.
After renaming, the executable is run with appropriate arguments to trigger a benign test alert that validates Defender's detection pipeline. This alert verifies that the system correctly monitors VM activity and reports potential threats.
Changing alert severity or renaming files differently does not validate the configuration. Therefore, the correct sequence-confirmed by Microsoft documentation-is:
Enable Azure Defender for the subscription.
Copy and rename the alert test file (ASC_AlertTest_...).
Run the executable file with required arguments to trigger and validate detection.