You have an Azure subscription that contains the following resources:
A network virtual appliance (NVA) that runs non-Microsoft firewall software and routes all outbound traffic from the virtual machines to the internet
An Azure function that contains a script to manage the firewall rules of the NVA
Azure Security Center standard tier enabled for all virtual machines
An Azure Sentinel workspace
30 virtual machines
You need to ensure that when a high-priority alert is generated in Security Center for a virtual machine, an incident is created in Azure Sentinel and then a script is initiated to configure a firewall rule for the NVA.
How should you configure Azure Sentinel to meet the requirements? To answer, drag the appropriate components to the correct requirements. Each component may be used once, more than once, or not at all. You may need to drag the split bar between panes or scroll to view content.
NOTE: Each correct selection is worth one point.

Correct Answer:

Reference:
https://docs.microsoft.com/en-us/azure/sentinel/create-incidents-from-alerts
https://docs.microsoft.com/en-us/azure/sentinel/connect-azure-security-center

Comment: *

Name: *

Email: *

Verification: *

You have an Azure subscription that contains the virtual machines shown in the following table.

Subnet1 and Subnet2 have a Microsoft.Storage service endpoint configured.
You have an Azure Storage account named storageacc1 that is configured as shown in the following exhibit.

For each of the following statements, select Yes if the statement is true. Otherwise, select No.

Correct Answer:

Reference:
https://docs.microsoft.com/en-gb/azure/storage/common/storage-network-security

Comment: *

Name: *

Email: *

Verification: *

You need to ensure that the Azure AD application registration and consent configurations meet the identity and access requirements.
What should you use in the Azure portal? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.

Correct Answer:

Reference:
https://docs.microsoft.com/en-us/azure/active-directory/manage-apps/configure-user-consent

Comment: *

Name: *

Email: *

Verification: *

You have an Azure subscription.
You need to create and deploy an Azure policy that meets the following requirements:
When a new virtual machine is deployed, automatically install a custom security extension.
Trigger an autogenerated remediation task for non-compliant virtual machines to install the extension.
What should you include in the policy? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.

Correct Answer:

Reference:
https://docs.microsoft.com/en-us/azure/governance/policy/how-to/remediate-resources

Comment: *

Name: *

Email: *

Verification: *

SIMULATION
You plan to connect several Windows servers to the WS11641655 Azure Log Analytics workspace.
You need to ensure that the events in the System event logs are collected automatically to the workspace after you connect the Windows servers.
To complete this task, sign in to the Azure portal and modify the Azure resources.

• A.Azure Monitor can collect events from the Windows event logs or Linux Syslog and performance counters that you specify for longer term analysis and reporting, and take action when a particular condition is detected. Follow these steps to configure collection of events from the Windows system log and Linux Syslog, and several common performance counters to start with.
  Data collection from Windows VM
  1. In the Azure portal, locate the WS11641655 Azure Log Analytics workspace then select Advanced settings.
  
  2. Select Data, and then select Windows Event Logs.
  3. You add an event log by typing in the name of the log. Type System and then select the plus sign +.
  4. In the table, check the severities Error and Warning. (for this question, select all severities to ensure that ALL logs are collected).
  5. Select Save at the top of the page to save the configuration.
• B.Azure Monitor can collect events from the Windows event logs or Linux Syslog and performance counters that you specify for longer term analysis and reporting, and take action when a particular condition is detected. Follow these steps to configure collection of events from the Windows system log and Linux Syslog, and several common performance counters to start with.
  Data collection from Windows VM
  1. In the Azure portal, locate the WS11641655 Azure Log Analytics workspace then select Advanced settings.
  2. Select Data, and then select Windows Event Logs.
  3. You add an event log by typing in the name of the log. Type System and then select the plus sign +.
  4. In the table, check the severities Error and Warning. (for this question, select all severities to ensure that ALL logs are collected).
  5. Select Save at the top of the page to save the configuration.

Comment: *

Name: *

Email: *

Verification: *