Microsoft Security Operations Analyst - SC-200무료 덤프문제 풀어보기
You need to implement the Microsoft Sentinel NRT rule for monitoring the designated break glass account.
The solution must meet the Microsoft Sentinel requirements.
How should you complete the query? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
The solution must meet the Microsoft Sentinel requirements.
How should you complete the query? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
정답:
Explanation:
For a near-real-time (NRT) analytics rule that detects sign-ins by a designated break-glass account, the most direct and performant pattern is to filter SigninLogs by joining to a Microsoft Sentinel watchlist that contains the protected account(s). Sentinel exposes watchlists to KQL through the helper function _GetWatchlist( ' < watchlist-name > ' ), which returns a table with standard columns (including SearchKey) plus any custom columns you imported. Using join kind=inner ensures the result set includes only those SigninLogs rows whose UserPrincipalName matches an entry in the watchlist-ideal for alerting on a high-value account without post-filtering.
The completed query is:
SigninLogs | join kind=inner (_GetWatchlist( ' breakglass_account ' )) on $left.UserPrincipalName == $right.
SearchKey
This approach satisfies the requirement to implement an NRT rule for the break-glass account because:
NRT rules support KQL with joins and watchlists and are optimized for rapid evaluation over fresh data.
Using a watchlist lets SecOps adjust monitored accounts without editing the rule-minimizing administrative effort and aligning with least-privilege operations (no extra permissions beyond watchlist management).
The inner join pattern reduces noise by returning only matched events, which are then turned into alerts
/incidents by the NRT rule.
Thus, select join and GetWatchlist, and join UserPrincipalName to the watchlist's SearchKey.
You have an Azure subscription that is linked to a hybrid Azure AD tenant and contains a Microsoft Sentinel workspace named Sentinel1.
You need to enable User and Entity Behavior Analytics (UEBA) for Sentinel 1 and configure UEBA to use data collected from Active Directory Domain Services (AD OS).
What should you do? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
You need to enable User and Entity Behavior Analytics (UEBA) for Sentinel 1 and configure UEBA to use data collected from Active Directory Domain Services (AD OS).
What should you do? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
정답:
Explanation:
To the AD DS domain controllers, deploy: Microsoft Defender for Identity sensors For Sentinel1, configure: The Security Events data source To enable User and Entity Behavior Analytics (UEBA) in Microsoft Sentinel using data from on-premises Active Directory Domain Services (AD DS), you must collect detailed identity and authentication events.
This requires integration with Microsoft Defender for Identity (MDI) - the native tool designed to monitor domain controller traffic and send identity telemetry to Microsoft Sentinel.
According to Microsoft documentation:
"To collect signals from your on-premises Active Directory domain controllers, install Microsoft Defender for Identity sensors directly on each domain controller or on a dedicated server." These sensors capture Windows event logs and network authentication data (Kerberos, NTLM, LDAP) and send the information securely to Defender for Identity cloud service.
The Azure Connected Machine agent and Azure Monitor agent do not provide the specialized identity telemetry required by UEBA. Therefore, the correct deployment is the Microsoft Defender for Identity sensors.
After integrating Defender for Identity, you must connect the right data source in Microsoft Sentinel.
The Security Events data source ingests domain controller event logs (such as sign-ins, account management, and group membership changes) that UEBA relies on for behavioral baselines and anomaly detection.
Microsoft Sentinel UEBA documentation confirms:
"UEBA uses data from identity-related data sources, such as SecurityEvents and Azure Active Directory sign- ins, to build user and entity profiles and detect anomalies." The Audit Logs and Signin Logs tables are specific to Azure AD and cloud identity events - not on-premises AD DS domain controllers.
# Final Configuration:
Deploy Microsoft Defender for Identity sensors to the domain controllers.
Configure The Security Events data source for Sentinel1.
You have a Microsoft Sentinel workspace that has User and Entity Behavior Analytics (UEBA) enabled.
You need to identify all the log entries that relate to security-sensitive user actions performed on a server named Server1. The solution must meet the following requirements:
* Only include security-sensitive actions by users that are NOT members of the IT department.
* Minimize the number of false positives.
How should you complete the query? To answer, select the appropriate options in the answer area. NOTE:
Each correct selection is worth one point.
You need to identify all the log entries that relate to security-sensitive user actions performed on a server named Server1. The solution must meet the following requirements:
* Only include security-sensitive actions by users that are NOT members of the IT department.
* Minimize the number of false positives.
How should you complete the query? To answer, select the appropriate options in the answer area. NOTE:
Each correct selection is worth one point.
정답:
Explanation:
In Microsoft Sentinel with UEBA enabled, user-enrichment data about identities (such as Department, Title, and Account/SID mappings) is written to the IdentityInfo table. Microsoft guidance recommends joining your security telemetry (for example, SecurityEvent) with IdentityInfo to filter or scope results by organizational attributes like department. To meet the requirement "only include security-sensitive actions by users that are NOT members of the IT department", you enrich the Windows security events with IdentityInfo and then filter Department !~ " IT " (or equivalent).
To minimize noise and duplicated rows when joining many-to-one identity records, Sentinel KQL best practices recommend using join kind=innerunique. This join returns at most one matching row from the right table for each row on the left, which helps reduce false positives that can arise from duplicate or stale identity records while still ensuring matches are required (i.e., inner). After enriching, you continue your query logic (for example, restricting to Server1 and the subset of security-sensitive event IDs or an UEBA-derived mapping) to identify only the relevant actions.
Therefore, the correct completions are to use join kind=innerunique and join to IdentityInfo to apply the department filter and lower false positives.
You have a Microsoft 365 E5 subscription that uses Microsoft SharePoint Online.
You delete users from the subscription.
You need to be notified if the deleted users downloaded numerous documents from SharePoint Online sites during the month before their accounts were deleted.
What should you use?
You delete users from the subscription.
You need to be notified if the deleted users downloaded numerous documents from SharePoint Online sites during the month before their accounts were deleted.
What should you use?
정답: D
Your company stores the data for every project in a different Azure subscription. All the subscriptions use the same Azure Active Directory (Azure AD) tenant.
Every project consists of multiple Azure virtual machines that run Windows Server. The Windows events of the virtual machines are stored in a Log Analytics workspace in each machine's respective subscription.
You deploy Azure Sentinel to a new Azure subscription.
You need to perform hunting queries in Azure Sentinel to search across all the Log Analytics workspaces of all the subscriptions.
Which two actions should you perform? Each correct answer presents part of the solution.
NOTE: Each correct selection is worth one point.
Every project consists of multiple Azure virtual machines that run Windows Server. The Windows events of the virtual machines are stored in a Log Analytics workspace in each machine's respective subscription.
You deploy Azure Sentinel to a new Azure subscription.
You need to perform hunting queries in Azure Sentinel to search across all the Log Analytics workspaces of all the subscriptions.
Which two actions should you perform? Each correct answer presents part of the solution.
NOTE: Each correct selection is worth one point.
정답: A,B
설명: (Fast2test 회원만 볼 수 있음)
You need to implement Microsoft Sentinel queries for Contoso and Fabrikam to meet the technical requirements.
What should you include in the solution? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
What should you include in the solution? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
정답:
Explanation:
In Microsoft Sentinel, each workspace acts as a logical container for security data and analytics. When integrating Sentinel across organizations or environments-such as between Contoso and Fabrikam-each Azure subscription needs at least one Log Analytics workspace that Sentinel can attach to. This workspace becomes the data repository for logs and analytics rules.
Therefore, Fabrikam requires a minimum of one Log Analytics workspace to onboard Microsoft Sentinel and begin collecting and analyzing data. Multiple workspaces may be used for isolation or region-specific requirements, but one is sufficient for a functional deployment.
To query and correlate data between multiple workspaces or tenants, Sentinel uses the workspace() KQL function. This function allows cross-workspace queries, letting you pull data from different Sentinel instances for investigation or threat correlation. For example:
union workspace( " FabrikamWorkspace " ).SecurityEvent, workspace( " ContosoWorkspace " ).
SecurityEvent
| summarize count() by Account
This KQL syntax enables cross-tenant or cross-subscription correlation when Defender or Sentinel workspaces are connected through proper permissions (e.g., Azure Lighthouse or cross-tenant data access).
# Final Answers:
Minimum number of Log Analytics workspaces: 1
Query element required to correlate data between tenants: workspace
You have a Microsoft Sentinel workspace that contains a custom workbook named Workbook1.
You need to create a visual based on the SecuntyEvent table. The solution must meet the following requirements:
* Identify the number of security events ingested during the past week.
* Display the count of events by day in a timechart
What should you add to Workbook1?
You need to create a visual based on the SecuntyEvent table. The solution must meet the following requirements:
* Identify the number of security events ingested during the past week.
* Display the count of events by day in a timechart
What should you add to Workbook1?
정답: D
설명: (Fast2test 회원만 볼 수 있음)
You have the following SQL query.
정답:
Explanation:
The UserName field is set as the account entity. # Yes
The watchlist cannot be updated after it is created. # No
The IPList variable is set as the IP address entity. # No
In Microsoft Sentinel analytics rules, entity mapping is done by assigning special alias fields in the query result such as AccountCustomEntity, HostCustomEntity, and IPCustomEntity. In the provided KQL, the final line explicitly maps AccountCustomEntity = UserName and HostCustomEntity = Computer, which sets UserName as the account entity and Computer as the host entity. No mapping is provided for an IP entity; the query defines let IPList = _GetWatchlist( ' Bad_IPs ' ); to retrieve a watchlist named Bad_IPs and then uses it only for filtering (SourceIP in (IPList) or DestinationIP in (IPList)). Because IPList is a dataset used for comparison and not assigned to IPCustomEntity, it is not set as the IP address entity. Additionally, Microsoft Sentinel watchlists are editable-you can upload new files, append, or replace data after creation-so the statement that a watchlist cannot be updated is false.