Your company stores the data for every project in a different Azure subscription. All the subscriptions use the same Azure Active Directory (Azure AD) tenant.
Every project consists of multiple Azure virtual machines that run Windows Server. The Windows events of the virtual machines are stored in a Log Analytics workspace in each machine's respective subscription.
You deploy Azure Sentinel to a new Azure subscription.
You need to perform hunting queries in Azure Sentinel to search across all the Log Analytics workspaces of all the subscriptions.
Which two actions should you perform? Each correct answer presents part of the solution.
NOTE: Each correct selection is worth one point.

• A.Add the Security Events connector to the Azure Sentinel workspace.
• B.Create a query that uses the workspace expression and the union operator.
• C.Use the alias statement.
• D.Create a query that uses the resource expression and the alias operator.
• E.Add the Azure Sentinel solution to each workspace.

Comment: *

Name: *

Email: *

Verification: *

You need to recommend remediation actions for the Azure Defender alerts for Fabrikam.
What should you recommend for each threat? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.

Correct Answer:

Explanation

Reference:
https://docs.microsoft.com/en-us/azure/key-vault/general/secure-your-key-vault

Comment: *

Name: *

Email: *

Verification: *

Your company uses Microsoft Defender for Endpoint.
The company has Microsoft Word documents that contain macros. The documents are used frequently on the devices of the company's accounting team.
You need to hide false positive in the Alerts queue, while maintaining the existing security posture.
Which three actions should you perform? Each correct answer presents part of the solution.
NOTE: Each correct selection is worth one point.

• A.Resolve the alert automatically.
• B.Hide the alert.
• C.Create a suppression rule scoped to any device.
• D.Create a suppression rule scoped to a device group.
• E.Generate the alert.

Comment: *

Name: *

Email: *

Verification: *

You open the Cloud App Security portal as shown in the following exhibit.

You need to remediate the risk for the Launchpad app.
Which four actions should you perform in sequence? To answer, move the appropriate actions from the list of actions to the answer area and arrange them in the correct order.

Correct Answer:

Explanation

Reference:
https://docs.microsoft.com/en-us/cloud-app-security/governance-discovery

Comment: *

Name: *

Email: *

Verification: *

You have an Azure Sentinel deployment.
You need to query for all suspicious credential access activities.
Which three actions should you perform in sequence? To answer, move the appropriate actions from the list of actions to the answer area and arrange them in the correct order.

Correct Answer:

1 - From Azure Sentinel, select Hunting.
2 - Filter by tactics.
3 - Select Run All Queries.

Comment: *

Name: *

Email: *

Verification: *