You are using Microsoft Sentinel.You detect a new threat by using a hunting query. You need to ensure that Microsoft Sentinel automatically detects the threat. The solution must minimize administrative effort. What should you do?
Answer(s): A
You have a Microsoft Sentinel workspace.You have a query named Query1 as shown in the following exhibit. You plan to create a custom parser named Parser1. You need to use Query1 in Parser1. What should you do first?
Answer(s): B
Parsers should not filter by time, as the query using the parser already filters for time. Filtering in KQL is done using the where operator.Note: Unifying parsersWhen using ASIM in your queries, use unifying parsers to combine all sources, normalized to the same schema, and query them using normalized fields. The unifying parser name is _Im_<schema> for built-in parsers and im<schema> for workspace deployed parsers, where <schema> stands for the specific schema it serves.For example, the following query uses the built-in unifying DNS parser to query DNS events using the ResponseCodeName, SrcIpAddr, and TimeGenerated normalized fields:Kusto _Im_Dns(starttime=ago(1d), responsecodename='NXDOMAIN') | summarize count() by SrcIpAddr, bin(TimeGenerated,15m) The example uses filtering parameters, which improve ASIM performance. The same example without filtering parameters would look like this:Kusto _Im_Dns | where TimeGenerated > ago(1d) | where ResponseCodeName =~ "NXDOMAIN" | summarize count() by SrcIpAddr, bin(TimeGenerated,15m)Incorrect: Not D: Select fields in the result set The parser can optionally select fields in the results set. Removing unneeded fields can improve performance and add clarity by avoiding confusing between normalized fields and remaining source fields. The following KQL operators are used to select fields in your results set:* project - Selects fields that existed before, or were created as part of the statement, and removes all other fields. Not recommended for use in a parser, as the parser should not remove any other fields that are not normalized. * project-away - Removes fields. Use project-away for specific fields that you want to remove from the result set. We recommend not removing the original fields that are not normalized from the result set, unless they create confusion or are very large and may have performance implications.If you need to remove specific fields, such as temporary values used during parsing, use project-away to remove them from the results.
https://docs.microsoft.com/en-us/azure/sentinel/normalization-develop-parsers https://docs.microsoft.com/en-us/azure/sentinel/normalization-about-parsers
You have an Azure subscription that uses Microsoft Sentinel.You need to create a custom report that will visualise sign-in information over time. What should you create first?
Once you have connected your data sources to Microsoft Sentinel, you can visualize and monitor the data using the Microsoft Sentinel adoption of Azure Monitor Workbooks, which provides versatility in creating custom dashboards. While the Workbooks are displayed differently in Microsoft Sentinel, it may be useful for you to see how to create interactive reports with Azure Monitor Workbooks. Microsoft Sentinel allows you to create custom workbooks across your data, and also comes with built-in workbook templates to allow you to quickly gain insights across your data as soon as you connect a data source.
https://docs.microsoft.com/en-us/azure/sentinel/monitor-your-data
You have a Microsoft Sentinel workspace.You receive multiple alerts for failed sign-in attempts to an account. You identify that the alerts are false positives. You need to prevent additional failed sign-in alerts from being generated for the account. The solution must meet the following requirements: • Ensure that failed sign-in alerts are generated for other accounts. • Minimize administrative effort What should do?
HOTSPOT (Drag and Drop is not supported)You have a Microsoft 365 E5 subscription that contains two users named User1 and User2. You have the hunting query shown in the following exhibit. The users perform the following actions: • User1 assigns User2 the Global administrator role. • User1 creates a new user named User3 and assigns the user a Microsoft Teams license. • User2 creates a new user named User4 and assigns the user the Security reader role. • User2 creates a new user named User5 and assigns the user the Security operator role. For each of the following statements, select Yes if the statement is true. Otherwise, select No. Note: Each correct selection is worth one point.Hot Area:
Box 1: No User2 already exists. It is not recently created.Box 2: YesBox 3: YesNote: You might want to create a query that incorporates data from multiples sources. You can create a query that looks at Azure Active Directory audit logs for new users that were just created, and then checks your Azure logs to see if the user started making role assignment changes within 24 hours of creation. That suspicious activity would show up on this dashboard:AuditLogs | where OperationName == "Add user" | project AddedTime = TimeGenerated, user = tostring(TargetResources[0].userPrincipalName) | join (AzureActivity | where OperationName == "Create role assignment" | project OperationName, RoleAssignmentTime = TimeGenerated, user = Caller) on user | project-away user1
https://docs.microsoft.com/en-us/azure/sentinel/get-visibility
HOTSPOT (Drag and Drop is not supported)You have the following KQL query. For each of the following statements, select Yes if the statement is true. Otherwise, select No.Note: Each correct selection is worth one point.Hot Area:
Box 1: Yes There is the following code in query: AccountCustomEntity = UserNameBox 2: Yes You edit an existing watchlist instead of deleting and recreating a watchlist.Edit a watchlist item Edit a watchlist to edit or add an item to the watchlist.1. In the Azure portal, go to Microsoft Sentinel and select the appropriate workspace. 2. Under Configuration, select Watchlist. 3. Select the watchlist you want to edit. 4. On the details pane, select Update watchlist > Edit watchlist items. 5. Etc.Box 3: No Watchlists are stored in your Microsoft Sentinel workspace as name-value pairs and are cached for optimal query performance and low latency.
https://docs.microsoft.com/en-us/azure/sentinel/watchlists-manage
HOTSPOT (Drag and Drop is not supported)You have a Microsoft Sentinel workspace. You develop a custom Advanced Security Information Model (ASIM) parser named Parser1 that produces a schema named Schema1. You need to validate Schema1. How should you complete the command? To answer, select the appropriate options in the answer area. Note: Each correct selection is worth one point.Hot Area:
Box 1: getschema Validate the output schema To make sure that your parser produces a valid schema, use the ASIM schema tester by running the following query in the Microsoft Sentinel Logs page:KQL <parser name> | getschema | invoke ASimSchemaTester('<schema>')Box 2: invoke
https://docs.microsoft.com/en-us/azure/sentinel/normalization-develop-parsers
HOTSPOT (Drag and Drop is not supported)You have a Microsoft Sentinel workspace that has User and Entity Behavior Analytics (UEBA) enabled. You need to identify all the log entries that relate to security-sensitive user actions performed on a server named Server1. The solution must meet the following requirements: • Only include security-sensitive actions by users that are NOT members of the IT department. • Minimize the number of false positives. How should you complete the query? To answer, select the appropriate options in the answer area. Note: Each correct selection is worth one point.Hot Area:
Box 1: InneruniqueInnerunique - Returns rows from the left table with distinct values in linked field that have a match in the right table. This is the default unspecified join type.Incorrect: Inner - Returns a single for each combination of matching rows from both tables.Fullouter - Returns all records from both left and right tables, matching or not. Unmatched values will be null.Box 2: BehaviorAnalyticsWhen you turn on UEBA you end up with four new tablesBehaviorAnalytics – this tracks things like logons or group changes, but goes beyond that and measures if the event is uncommon UserAccessAnalytics – tracks users access, such as group membership but also maintains information such as when the access was first granted PeerAccessAnalytics – maintains a list of users closest peers which helps to evaluate potential blast radius IdentityUserInfo – maintains a table of identity info from both on premise and cloud for users
https://docs.microsoft.com/en-us/azure/sentinel/kusto-overview https://learnsentinel.blog/2021/07/29/supercharge-your-queries-with-azure-sentinel-uebas-identityinfo-table/
Post your Comments and Discuss Microsoft SC-200 exam prep with other Community members:
Our website is free, but we have to fight against AI bots and content theft. We're sorry for the inconvenience caused by these security measures. You can access the rest of the SC-200 content, but please register or login to continue.