HOTSPOT (Drag and Drop is not supported)You have a Microsoft Sentinel workspace. You need to create a KQL query that will identify successful sign-ins from multiple countries during the last three hours. How should you complete the query? To answer, select the appropriate options in the answer area. Note: Each correct selection is worth one point.Hot Area:
Answer(s): A
Box 1: imAuthentication For example, to filter only authentication events from the last day to a specific user, use: imAuthentication (targetusername_has = 'johndoe', starttime = ago(1d), endtime=now())Box 2: SrcGeoCountryExample, User login from different countries within 3 hours (Uses Authentication Normalization).:let timeframe = ago(3h); let threshold = 2; imAuthentication | where TimeGenerated > timeframe | where EventType=='Logon' and EventResult=='Success' | where isnotempty(SrcGeoCountry) | summarize StartTime = min(TimeGenerated), EndTime = max(TimeGenerated), Vendors=make_set (EventVendor), Products=make_set(EventProduct) , NumOfCountries = dcount(SrcGeoCountry) by TargetUserId, TargetUsername, TargetUserType | where NumOfCountries >= threshold | extend timestamp = StartTime, AccountCustomEntity = TargetUsername
https://docs.microsoft.com/en-us/azure/sentinel/authentication-normalization-schema https://techcommunity.microsoft.com/t5/microsoft-sentinel/why-does-the-quot-user-login-from-different-countries-quot-rule/m-p/3278769
HOTSPOT (Drag and Drop is not supported)You have an Azure subscription. You plan to implement a Microsoft Sentinel workspace. You anticipate that you will ingest 20 GB of security log data per day. You need to configure storage for the workspace. The solution must meet the following requirements: • Minimize costs for daily ingested data. • Maximize the data retention period without incurring extra costs. What should you do for each requirement? To answer, select the appropriate options in the answer area.Note: Each correct selection is worth one point.Hot Area:
Box 1: Use a Commitment Tier How you're charged for Microsoft Sentinel Microsoft Sentinel offers flexible pricing based on the types of logs ingested into a workspace. Analytics logs typically make up most of your high security value logs. Basic logs tend to be verbose with low security value.Analytics logs There are two ways to pay for the analytics logs: Pay-As-You-Go and Commitment Tiers. * Pay-As-You-Go is the default model, based on the actual data volume stored and optionally for data retention beyond 90 days. Data volume is measured in GB (10^9 bytes).* Log Analytics and Microsoft Sentinel also have Commitment Tier pricing, formerly called Capacity Reservations, which is more predictable and saves as much as 65% compared to Pay-As-You-Go pricing.Box 2: 90 days You can retain all data ingested into the workspace at no charge for the first 90 days. Retention beyond 90 days is charged per the standard Log Analytics retention prices.
https://docs.microsoft.com/en-us/azure/sentinel/billing?tabs=commitment-tier
HOTSPOT (Drag and Drop is not supported)You have a Microsoft Sentinel workspace named sws1. You plan to create an Azure logic app that will raise an incident in an on-premises IT service management system when an incident is generated in sws1. You need to configure the Microsoft Sentinel connector credentials for the logic app. The solution must meet the following requirements: • Minimize administrative effort. • Use the principle of least privilege. How should you configure the credentials? To answer, select the appropriate options in the answer area.Note: Each correct selection is worth one point.Hot Area:
Box 1: A managed identity Managed Identity for Azure Sentinel Logic Apps connector With the availability of Managed Identity for the Azure Sentinel connector, you can give permissions directly to the playbook (Logic App workflow resource), so Sentinel connector actions will operate on its behalf, as if it were an independent object which has permissions on Azure Sentinel. This lowers the number of identities you have to manage and gives the power to give access directly to the resource that operates.Incorrect: * The service principal connection type allows us to create a registered application and use it as the identity behind the connector. You can define what this app can do, who can access it and what resources can this app access. It’s easy to delete it or replace its credentials if it’s suspected to have been compromised. For these reasons it’s great from a security perspective, but it still requires managing as another identity in the cloud that has credentials and permissions which potentially others can use. * Many would prefer not to authenticate with a user to a tool that generates automated actions. It is harder to audit (for example, using the incident table) which actions have been taken on behalf of a user and which are made by the playbook. It also makes less sense to see, for example, new comments that were generated by a playbook, but appear as if a user is their author. Also, if a user leaves the organization, you need to update all the connections that use its identity.Box 2: Microsoft Sentinel Responder role
https://techcommunity.microsoft.com/t5/microsoft-sentinel-blog/what-s-new-managed-identity-for-azure-sentinel-logic-apps/ba-p/2068204
You have a Microsoft Sentinel workspace.You need to prevent a built-in Advanced Security Information Model (ASIM) parser from being updated automatically.What are two ways to achieve this goal? Each correct answer presents a complete solution.Note: Each correct selection is worth one point.
Answer(s): B,C
B: Replace a built-in, source-specific parser that's used by a unifying parser with a custom, source-specific parser. Replace built-in parsers when you want to:Use a version of the built-in parser other than the one used by default in the unifying parser.Prevent automated updates by preserving the version of the source-specific parser used by the unifying parser.Use a modified version of a built-in parser.C: Use the following process to prevent automatic updates for built-in, source-specific parsers:1. Add the built-in parser version you want to use, such as _Im_Dns_AzureFirewallV02, to the custom unifying parser. For more information, see above, Add a custom parser to a built-in unifying parser.2. Add an exception for the built-in parser. For example, when you want to entirely opt out from automatic updates, and therefore exclude a large number of built-in parsers, add:A record with Any as the SourceSpecificParser field, to exclude all parsers for the CallerContext. A record for Any in the CallerContext and the SourceSpecificParser fields to exclude all built-in parsers.
https://learn.microsoft.com/en-us/azure/sentinel/normalization-manage-parsers
You have a custom Microsoft Sentinel workbook named Workbook1.You need to add a grid to Workbook1. The solution must ensure that the grid contains a maximum of 100 rows.What should you do?
HOTSPOT (Drag and Drop is not supported)You have a Microsoft Sentinel workspace named SW1.You plan to create a custom workbook that will include a time chart.You need to create a query that will identify the number of security alerts per day for each provider.How should you complete the query? To answer, select the appropriate options in the answer area.Note: Each correct selection is worth one point.Hot Area:
Box 1: bin bin() rounds values down to an integer multiple of a given bin size.Used frequently in combination with summarize by .... If you have a scattered set of values, they'll be grouped into a smaller set of specific values.Null values, a null bin size, or a negative bin size will result in null.Alias to floor() function.Syntax bin(value,roundTo)The following expression calculates a histogram of durations, with a bucket size of 1 second:Kusto T | summarize Hits=count() by bin(Duration, 1s)Box 2: render render operator instructs the user agent to render the results of the query in a particular way.Syntax T | render Visualization [with ( PropertyName = PropertyValue [, ...] )] ArgumentsVisualization indicates the kind of visualization to use. The supported values are timechart for example.
https://learn.microsoft.com/en-us/azure/data-explorer/kusto/query/renderoperator? pivots=azuredataexplorer
You have a Microsoft Sentinel workspace named Workspace1.You need to exclude a built-in, source-specific Advanced Security Information Model (ASIM) parser from a built-in unified ASIM parser.What should you create in Workspace1?
Answer(s): B
To support excluding built-in source-specific parsers, ASIM uses a watchlist. Deploy the watchlist to your Microsoft Sentinel workspace from the Microsoft Sentinel GitHub repository.
You have an Azure subscription that contains a Microsoft Sentinel workspace.You need to create a playbook that will run automatically in response to a Microsoft Sentinel alert.What should you create first?
Post your Comments and Discuss Microsoft SC-200 exam prep with other Community members:
Our website is free, but we have to fight against AI bots and content theft. We're sorry for the inconvenience caused by these security measures. You can access the rest of the SC-200 content, but please register or login to continue.