You have a Microsoft 365 E5 subscription.
You plan to perform cross-domain investigations by using Microsoft 365 Defender.
You need to create an advanced hunting query to identify devices affected by a malicious email attachment.
How should you complete the query? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.

Correct Answer:

Explanation:

Reference:
https://docs.microsoft.com/en-us/microsoft-365/security/mtp/advanced-hunting-query-emails-devices?view=o36

Comment: *

Name: *

Email: *

Verification: *

You need to implement Microsoft Defender for Cloud to meet the Microsoft Defender for Cloud requirements and the business requirements. What should you include in the solution? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.

Correct Answer:

Explanation:

According to Microsoft Defender for Cloud (formerly Azure Security Center) documentation, when integrating servers and virtual machines for security monitoring, the Defender for Cloud data is stored and analyzed in a Log Analytics workspace. Microsoft best practices recommend using an existing workspace when one is already deployed for centralized log collection-especially if it already gathers telemetry from Azure and on-premises resources.
In this case, the existing workspace LA1 already "contains logs and metrics collected from all Azure resources and on-premises servers." This satisfies the business requirement of "all servers must send logs to the same Log Analytics workspace." Creating a new workspace would violate the cost-minimization and centralization requirements. Therefore, LA1 is the correct workspace to use.
For the Windows security events collection setting, Defender for Cloud offers three levels:
* Minimal - collects essential security events only (insufficient for comprehensive monitoring).
* Common - collects a balanced set of security-related events (such as account logon, privilege use, and object access), recommended by Microsoft for most environments.
* All Events - collects every possible security event, which increases data ingestion cost and is typically used only for high-security or regulated environments.
Because Litware Inc. must minimize cost while ensuring a full audit trail of user activities, the Common level provides the optimal balance of visibility and cost efficiency.
Therefore, based on Microsoft Defender for Cloud configuration guidelines:
# Log Analytics workspace to use: LA1
# Windows security events to collect: Common

Comment: *

Name: *

Email: *

Verification: *

You have an Azure Sentinel deployment.
You need to query for all suspicious credential access activities.
Which three actions should you perform in sequence? To answer, move the appropriate actions from the list of actions to the answer area and arrange them in the correct order.

Correct Answer:

Explanation:

According to Microsoft Sentinel documentation, Hunting is a proactive feature that allows analysts to query raw security data for indicators of compromise (IoCs), suspicious patterns, and potential threats. When an analyst needs to query for suspicious credential access activities, they should use the Hunting page in the Microsoft Sentinel portal.
The correct sequence is as follows:
* From Azure Sentinel, select Hunting.This step opens the Hunting dashboard, which provides access to all prebuilt and custom hunting queries. Each query corresponds to specific tactics and techniques aligned with the MITRE ATT&CK framework.
* Filter by tactics.Since the goal is to find suspicious credential access, you should filter the hunting queries by the Credential Access tactic. This narrows the view to only the queries related to credential theft or misuse activities.
* Select Run All Queries.Once filtered, running all relevant hunting queries executes them against your connected data sources (e.g., Defender for Endpoint, Azure AD logs, etc.) to identify suspicious credential activity patterns.
Why not the other options?
* Select New Query is used to create a custom hunting query, not to search existing suspicious credential access detections.
* From Azure Sentinel, select Notebooks is for advanced visualization and correlation using Jupyter, not for tactical hunting queries.
Final Correct Sequence:
## From Azure Sentinel, select Hunting
## Filter by tactics
## Select Run All Queries

Comment: *

Name: *

Email: *

Verification: *

You have a Microsoft 365 E5 subscription.
You plan to perform cross-domain investigations by using Microsoft 365 Defender.
You need to create an advanced hunting query to identify devices affected by a malicious email attachment.
How should you complete the query? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.

Correct Answer:

Reference:
https://docs.microsoft.com/en-us/microsoft-365/security/mtp/advanced-hunting-query-emails-devices?view=o365-worldwide

Comment: *

Name: *

Email: *

Verification: *

You have an existing Azure logic app that is used to block Azure Active Directory (Azure AD) users. The logic app is triggered manually.
You deploy Azure Sentinel.
You need to use the existing logic app as a playbook in Azure Sentinel. What should you do first?

• A.And a new scheduled query rule.
• B.Add a data connector to Azure Sentinel.
• C.Configure a custom Threat Intelligence connector in Azure Sentinel.
• D.Modify the trigger in the logic app.

Comment: *

Name: *

Email: *

Verification: *