Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.You are configuring Microsoft Sentinel.You need to create an incident in Microsoft Sentinel when a sign-in to an Azure virtual machine from a malicious IP address is detected.Solution: You create a livestream from a query.Does this meet the goal?
Answer(s): B
https://docs.microsoft.com/en-us/azure/sentinel/connect-azure-security-center
HOTSPOT (Drag and Drop is not supported)You need to create a query for a Microsoft Sentinel workbook. The query must meet the following requirements:-List all incidents by incident number.-Only include the most recent log for each incident.How should you complete the query? To answer, select the appropriate options in the answer area.Note: Each correct selection is worth one point.Hot Area:
Answer(s): A
https://www.drware.com/whats-new-soc-operational-metrics-now-available-in-sentinel/
DRAG DROP (Drag and Drop is not supported)You have the resources shown in the following table.You need to prevent duplicate events from occurring in SW1.What should you use for each action? To answer, drag the appropriate resources to the correct actions. Each resource may be used once, more than once, or not at all. You may need to drag the split bar between panes or scroll to view content.Note: Each correct selection is worth one point.Select and Place:
https://docs.microsoft.com/en-us/azure/sentinel/connect-log-forwarder?tabs=rsyslog
You have an Azure subscription that uses Microsoft Sentinel.You need to minimize the administrative effort required to respond to the incidents and remediate the security threats detected by Microsoft Sentinel.Which two features should you use? Each correct answer presents part of the solution.Note: Each correct selection is worth one point.
Answer(s): C,D
https://docs.microsoft.com/en-us/azure/sentinel/tutorial-respond-threats-playbook?tabs=LAC
You have a Microsoft Sentinel workspace named workspace1 that contains custom Kusto queries.You need to create a Python-based Jupyter notebook that will create visuals. The visuals will display the results of the queries and be pinned to a dashboard. The solution must minimize development effort.What should you use to create the visuals?
Answer(s): C
msticpy is a library for InfoSec investigation and hunting in Jupyter Notebooks. It includes functionality to: query log data from multiple sources. enrich the data with Threat Intelligence, geolocations and Azure resource data. extract Indicators of Activity (IoA) from logs and unpack encoded data.MSTICPy reduces the amount of code that customers need to write for Microsoft Sentinel, and provides:Data query capabilities, against Microsoft Sentinel tables, Microsoft Defender for Endpoint, Splunk, and other data sources. Threat intelligence lookups with TI providers, such as VirusTotal and AlienVault OTX. Enrichment functions like geolocation of IP addresses, Indicator of Compromise (IoC) extraction, and WhoIs lookups. Visualization tools using event timelines, process trees, and geo mapping. Advanced analyses, such as time series decomposition, anomaly detection, and clustering.
https://docs.microsoft.com/en-us/azure/sentinel/notebook-get-started https://msticpy.readthedocs.io/en/latest/
HOTSPOT (Drag and Drop is not supported)You have a Microsoft Sentinel workspace named sws1.You need to create a hunting query to identify users that list storage keys of multiple Azure Storage accounts. The solution must exclude users that list storage keys for a single storage account.How should you complete the query? To answer, select the appropriate options in the answer area.Note: Each correct selection is worth one point.Hot Area:
Box 1: AzureActivity The AzureActivity table includes data from many services, including Microsoft Sentinel. To filter in only data from Microsoft Sentinel, start your query with the following code:Box 2: autocluster()Example: description: | 'Listing of storage keys is an interesting operation in Azure which might expose additional secrets and PII to callers as well as granting access to VMs. While there are many benign operations of this type, it would be interesting to see if the account performing this activity or the source IP address from which it is being done is anomalous. The query below generates known clusters of ip address per caller, notice that users which only had single operations do not appear in this list as we cannot learn from it their normal activity (only based on a single event). The activities for listing storage account keys is correlated with this learned clusters of expected activities and activity which is not expected is returned.' AzureActivity | where OperationNameValue =~ "microsoft.storage/storageaccounts/listkeys/action" | where ActivityStatusValue == "Succeeded" | join kind= inner ( AzureActivity | where OperationNameValue =~ "microsoft.storage/storageaccounts/listkeys/action" | where ActivityStatusValue == "Succeeded" | project ExpectedIpAddress=CallerIpAddress, Caller | evaluate autocluster() ) on Caller | where CallerIpAddress != ExpectedIpAddress | summarize StartTime = min(TimeGenerated), EndTime = max(TimeGenerated), ResourceIds = make_set (ResourceId), ResourceIdCount = dcount(ResourceId) by OperationNameValue, Caller, CallerIpAddress | extend timestamp = StartTime, AccountCustomEntity = Caller, IPCustomEntity = CallerIpAddress
https://github.com/Azure/Azure-Sentinel/blob/master/Hunting%20Queries/AzureActivity/ Anomalous_Listing_Of_Storage_Keys.yaml
DRAG DROP (Drag and Drop is not supported)You have a Microsoft Sentinel workspace named workspace1 and an Azure virtual machine named VM1.You receive an alert for suspicious use of PowerShell on VM1.You need to investigate the incident, identify which event triggered the alert, and identify whether the following actions occurred on VM1 after the alert:-The modification of local group memberships-The purging of event logsWhich three actions should you perform in sequence in the Azure portal? To answer, move the appropriate actions from the list of actions to the answer area and arrange them in the correct order.Select and Place:
Step 1: From the Investigation blade, select Insights The Investigation Insights Workbook is designed to assist in investigations of Microsoft Sentinel Incidents or individual IP/Account/Host/URL entities. Step 2: From the Investigation blade, select the entity that represents VM1. The Investigation Insights workbook is broken up into 2 main sections, Incident Insights and Entity Insights.Incident Insights The Incident Insights gives the analyst a view of ongoing Sentinel Incidents and allows for quick access to their associated metadata including alerts and entity information.Entity Insights The Entity Insights allows the analyst to take entity data either from an incident or through manual entry and explore related information about that entity. This workbook presently provides view of the following entity types:IP Address Account Host URLStep 3: From the details pane of the incident, select Investigate. Choose a single incident and click View full details or Investigate.
https://github.com/Azure/Azure-Sentinel/wiki/Investigation-Insights---Overview https://docs.microsoft.com/en-us/azure/sentinel/investigate-cases
You have a Microsoft Sentinel workspace that contains the following incident.Brute force attack against Azure Portal analytics rule has been triggered.You need to identify the geolocation information that corresponds to the incident.What should you do?
Post your Comments and Discuss Microsoft SC-200 exam prep with other Community members:
Our website is free, but we have to fight against AI bots and content theft. We're sorry for the inconvenience caused by these security measures. You can access the rest of the SC-200 content, but please register or login to continue.