HOTSPOT
You need to recommend remediation actions for the Azure Defender alerts for Fabrikam.
What should you recommend for each threat? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Hot Area:

Correct Answer:

Section: [none]
Explanation/Reference:
https://docs.microsoft.com/en-us/azure/key-vault/general/security-features
https://docs.microsoft.com/en-us/azure/key-vault/general/secure-your-key-vault

Comment: *

Name: *

Email: *

Verification: *

Your on-premises network contains 100 servers that run Windows Server.
You have an Azure subscription that uses Microsoft Sentinel.
You need to upload custom logs from the on-premises servers to Microsoft Sentinel.
What should you do? To answer, select the appropriate options m the answer area.

Correct Answer:

Explanation

To upload custom logs from the on-premises servers to Microsoft Sentinel, you should install the Log Analytics agent on each of the 100 servers. The Log Analytics agent is a lightweight agent that runs on the server and allows it to connect to the cloud-based Microsoft Defender Security Center. Once installed, the agent will allow the Microsoft Sentinel service to collect and analyze the custom log data from the servers.

Comment: *

Name: *

Email: *

Verification: *

You need to create the analytics rule to meet the Azure Sentinel requirements.
What should you do? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.

Correct Answer:

Comment: *

Name: *

Email: *

Verification: *

You have a Microsoft 365 subscription that uses Microsoft Purview and contains a Microsoft SharePoint Online site named Site1. Site1 contains the files shown in the following table.

From Microsoft Purview, you create the content search queries shown in the following table.

For each of the following statements, select Yes if the statement is true. Otherwise, select No.
NOTE; Each correct selection is worth one point.

Correct Answer:

Explanation:

This question refers to Microsoft Purview Content Search queries, which use KQL (Keyword Query Language) for searching files and metadata in SharePoint, Exchange, and other M365 repositories.
* Search1: Author:"User1" FileExtension:xlsx
* This query searches for items authored by User1 and with file extension .xlsx.
* In the dataset, only File3.xlsx has the .xlsx extension, but its Author is User3, not User1.
* Therefore, Search1 will not return File3 # answer: No.(Correction after logical review)
* Search2: Author:"User*" and FileExtension:*
* The wildcard User* matches any author name starting with "User" (User1, User2, User3).
* FileExtension:* matches any file type that has an extension.
* Therefore, all three files (File1.docx, File2.docx, File3.xlsx) match this query.
* Hence, Search2 will return File1 # answer: Yes.
* Search3: Author:(User1..3)
* The range (User1..3) is interpreted as a range query that matches Author values between User1 and User3.
* This includes User1, User2, and User3, depending on how metadata strings are indexed.
* Therefore, File2 (authored by User2) is included in this range.
* Hence, Search3 will return File2 # answer: Yes.
# Final Correct Table
Statement
Yes
No
Search1 will return File3
##
Search2 will return File1
##
Search3 will return File2
##
Summary:
* Search1: No (author and extension don't match).
* Search2: Yes (wildcard matches all "User" authors).
* Search3: Yes (range includes User2).
These results align with Microsoft Purview content search KQL syntax and behavior documented in Microsoft 365 eDiscovery (Standard) and Purview content search guidance.

Comment: *

Name: *

Email: *

Verification: *

You are investigating a potential attack that deploys a new ransomware strain.
You plan to perform automated actions on a group of highly valuable machines that contain sensitive information.
You have three custom device groups.
You need to be able to temporarily group the machines to perform actions on the devices. Which three actions should you perform? Each correct answer presents part of the solution. NOTE: Each correct selection is worth one point.

• A.Add a tag to the device group.
• B.Add the device users to the admin role.
• C.Add a tag to the machines.
• D.Create a new device group that has a rank of 1.
• E.Create a new admin role.
• F.Create a new device group that has a rank of 4.

Comment: *

Name: *

Email: *

Verification: *