QUESTION: 8

You have the following advanced hunting query in Microsoft 365 Defender.
You need to receive an alert when any process disables System Restore on a device managed by Microsoft Defender during the last 24 hours.
Which two actions should you perform? Each correct answer presents part of the solution.
Note: Each correct selection is worth one point.

Create a detection rule.
Create a suppression rule.
Add | order by Timestamp to the query.
Replace DeviceProcessEvents with DeviceNetworkEvents.
Add DeviceId and ReportId to the output of the query.

Answer(s): A,E

Reference:

https://docs.microsoft.com/en-us/windows/security/threat-protection/microsoft-defender-atp/custom-detection-rules

Reveal Solution Next Question

QUESTION: 8

Your company stores the data of every project in a different Azure subscription. All the subscriptions use the same Azure Active Directory (Azure AD) tenant.
Every project consists of multiple Azure virtual machines that run Windows Server. The Windows events of the virtual machines are stored in a Log Analytics workspace in each machine's respective subscription.
You deploy Azure Sentinel to a new Azure subscription.
You need to perform hunting queries in Azure Sentinel to search across all the Log Analytics workspaces of all the subscriptions.
Which two actions should you perform? Each correct answer presents part of the solution.
Note: Each correct selection is worth one point.

Add the Security Events connector to the Azure Sentinel workspace.
Create a query that uses the workspace expression and the union operator.
Use the alias statement.
Create a query that uses the resource expression and the alias operator.
Add the Azure Sentinel solution to each workspace.

Answer(s): B,E

Reference:

https://docs.microsoft.com/en-us/azure/sentinel/extend-sentinel-across-workspaces-tenants

Reveal Solution Next Question

QUESTION: 9

HOTSPOT
-
You have a Microsoft Sentinel workspace that contains a custom workbook named Workbook1.
You need to create a visual in Workbook1 that will display the logon count for accounts that have logon event IDs of 4624 and 4634.
How should you complete the query? To answer, select the appropriate options in the answer area.
Note: Each correct selection is worth one point.

See Explanation section for answer.

Answer(s): A

Explanation:

Reveal Solution Next Question

QUESTION: 9

You have a Microsoft 365 subscription that uses Microsoft Defender XDR.
You are investigating an attacker that is known to use the Microsoft Graph API as an attack vector. The attacker performs the tactics shown the following table.

You need to search for malicious activities in your organization.
Which tactics can you analyze by using the MicrosoftGraphActivityLogs table?

Tactic2 only
Tactic1 and Tactic2 only
Tactic2 and Tactic3 only
Tactic1, Tactic2, and Tactic3

Answer(s): D

Reveal Solution Next Question

Free SC-200 Exam Braindumps (page: 19)

QUESTION: 8

Reference:

QUESTION: 8

Reference:

QUESTION: 9

Explanation:

QUESTION: 9