HOTSPOT (Drag and Drop is not supported)You have a Microsoft Sentinel workspace named Workspace1.You configure Workspace1 to collect DNS events and deploy the Advanced Security Information Model (ASIM) unifying parser for the DNS schema.You need to query the ASIM DNS schema to list all the DNS events from the last 24 hours that have a response code of ‘NXDOMAIN’ and were aggregated by the source IP address in 15-minute intervals. The solution must maximize query performance.How should you complete the query? To answer, select the appropriate options in the answer area.Note: Each correct selection is worth one point.Hot Area:
Answer(s): A
Box 1: _Im_DnsExample: If your data source supports full DNS logging and you've chosen to log multiple segments, adjust your queries to prevent data duplication in Microsoft Sentinel.For example, you might modify your query with the following normalization:KQL_Im_Dns | where SrcIpAddr != "127.0.0.1" and EventSubType == "response"Box 2: | where TimeGenerated > ago(1d) | where ResponseCodeName =~ "NXDOMAIN" Example without filtering parameters would look like this:Kusto_Im_Dns | where TimeGenerated > ago(1d) | where ResponseCodeName =~ "NXDOMAIN" | summarize count() by SrcIpAddr, bin(TimeGenerated,15m)Incorrect: * (starttime=ago(1d), responsecodename='NXDOMAIN' Closing parantheses missing. Correct would be: (starttime=ago(1d), responsecodename='NXDOMAIN') as in the following code:_Im_Dns(starttime=ago(1d), responsecodename='NXDOMAIN') | summarize count() by SrcIpAddr, bin(TimeGenerated,15m)
https://learn.microsoft.com/en-us/azure/sentinel/normalization-schema-dns
HOTSPOT (Drag and Drop is not supported)Your on-premises network contains 100 servers that run Windows Server.You have an Azure subscription that uses Microsoft Sentinel.You need to upload custom logs from the on-premises servers to Microsoft Sentinel.What should you do? To answer, select the appropriate options in the answer area.Note: Each correct selection is worth one point.Hot Area:
Box 1: Log Analytics agent Collect data in custom log formats to Microsoft Sentinel with the Log Analytics agent.Many applications log data to text files instead of standard logging services like Windows Event log or Syslog. You can use the Log Analytics agent to collect data in text files of nonstandard formats from both Windows and Linux computers. Once collected, you can either parse the data into individual fields in your queries or extract the data during collection to individual fields.Box 2 Data connectors page of Microsoft Sentinel Configure the logs to be collected Many device types have their own data connectors appearing in the Data connectors page in Microsoft Sentinel. Some of these connectors require special additional instructions to properly set up log collection in Microsoft Sentinel. These instructions can include the implementation of a parser based on a Kusto function.All connectors listed in Microsoft Sentinel will display any specific instructions on their respective connector pages in the portal, as well as in their sections of the Microsoft Sentinel data connectors reference page.If your product is not listed in the Data connectors page, consult your vendor's documentation for instructions on configuring logging for your device.
https://learn.microsoft.com/en-us/azure/sentinel/connect-custom-logs
You have an Azure subscription that contains a Microsoft Sentinel workspace. The workspace contains a Microsoft Defender for Cloud data connector.You need to customize which details will be included when an alert is created for a specific event.What should you do?
Answer(s): D
You have a Microsoft Sentinel workspace named Workspace1 and 200 custom Advanced Security Information Model (ASIM) parsers based on the DNS schema.You need to make the 200 parsers available in Workspace1. The solution must minimize administrative effort.What should you do first?
Deploy parsers Deploy parsers manually by copying them to the Azure Monitor Log page and saving the query as a function. This method is useful for testing.To deploy a large number of parsers, we recommend using parser ARM templates, as follows:1. Create a YAML file based on the relevant template for each schema and include your query in it. Start with the YAML template relevant for your schema and parser type, filtering or parameter-less.2. Use the ASIM Yaml to ARM template converter to convert your YAML file to an ARM template.3. If deploying an update, delete older versions of the functions using the portal or the function delete PowerShell tool.4. Deploy your template using the Azure portal or PowerShell.
https://learn.microsoft.com/en-us/azure/sentinel/normalization-develop-parsers
HOTSPOT (Drag and Drop is not supported)You have a Microsoft Sentinel workspace.A Microsoft Sentinel incident is generated as shown in the following exhibit.Use the drop-down menus to select the answer choice that completes each statement based on the information presented in the graphic.Note: Each correct selection is worth one point.Hot Area:
Box 1: Investigate 1. To begin an investigation, select a specific incident. On the right, you can see detailed information for the incident including its severity, summary of the number of entities involved, the raw events that triggered this incident, the incident’s unique ID, and any mapped MITRE ATT&CK tactics or techniques.2. To view more details about the alerts and entities in the incident, select View full details in the incident page and review the relevant tabs that summarize the incident information.A page similar to the exhibit will be shown.3. Select Investigate to view the investigation map.Incorrect: * Entities In the Entities tab, you can see all the entities that you mapped as part of the alert rule definition. These are the objects that played a role in the incident, whether they be users, devices, addresses, files, or any other types. * Alerts In the Alerts tab, review the alerts included in this incident. You'll see all relevant information about the alerts – the analytics rules that produced them, the number of results returned per alert, and the ability to run playbooks on the alerts. To drill down even further into the incident, select the number of Events.Use the investigation graph to deep dive To use the investigation graph:1. Select an incident, then select Investigate. This takes you to the investigation graph. The graph provides an illustrative map of the entities directly connected to the alert and each resource connected further.2. Select an entity to open the Entities pane so you can review information on that entity.Box 2: Comments Comment on incidents As a security operations analyst, when investigating an incident you will want to thoroughly document the steps you take, both to ensure accurate reporting to management and to enable seamless cooperation and collaboration amongst coworkers. Microsoft Sentinel gives you a rich commenting environment to help you accomplish this.Another important thing that you can do with comments is enrich your incidents automatically. When you run a playbook on an incident that fetches relevant information from external sources (say, checking a file for malware at VirusTotal), you can have the playbook place the external source's response - along with any other information you define - in the incident's comments.Comments are simple to use. You access them through the Comments tab on the incident details page.Incorrect: * Alerts In the Alerts tab, review the alerts included in this incident. You'll see all relevant information about the alerts – the analytics rules that produced them, the number of results returned per alert, and the ability to run playbooks on the alerts.* Bookmarks In the Bookmarks tab, you'll see any bookmarks you or other investigators have linked to this incident.* Status Status is just set to Open, Closed, etc.
https://learn.microsoft.com/en-us/azure/sentinel/investigate-cases
HOTSPOT (Drag and Drop is not supported)You have a Microsoft Sentinel workspace named sws1.You need to create a query that will detect when a user creates an unusually large numbers of Microsoft Entra user accounts.How should you complete the query? To answer, select the appropriate options in the answer area.Note: Each correct selection is worth one point.Hot Area:
Box 1: AuditLogs You might want to create a query that incorporates data from multiples sources. You can create a query that looks at Azure Active Directory audit logs for new users that were just created, and then checks your Azure logs to see if the user started making role assignment changes within 24 hours of creation. That suspicious activity would show up on this dashboard:AuditLogs | where OperationName == "Add user" | project AddedTime = TimeGenerated, user = tostring(TargetResources[0].userPrincipalName) | join (AzureActivity | where OperationName == "Create role assignment" | project OperationName, RoleAssignmentTime = TimeGenerated, user = Caller) on user | project-away user1Box 2: AzureActivity
https://learn.microsoft.com/en-us/azure/sentinel/get-visibility
You have a Microsoft Sentinel playbook that is triggered by using the Azure Activity connector.You need to create a new near-real-time (NRT) analytics rule that will use the playbook.What should you configure for the rule?
Answer(s): B
You need to visualize Microsoft Sentinel data and enrich the data by using third-party data sources to identify indicators of compromise (IoC).What should you use?
To visualize Azure Sentinel data and enrich it by using third-party data sources to identify indicators of compromise (IoC), you can use notebooks in Azure Sentinel.Notebooks in Azure Sentinel are interactive documents that allow you to run queries, create visualizations, and perform data analysis on your Azure Sentinel data. They also allow you to connect to other data sources, such as third-party threat intelligence feeds, to enrich the data and identify indicators of compromise (IoCs).Once you have connected to the third-party data source, you can use Azure Sentinel notebook to blend the data, and create visualizations, and perform data analysis to identify the potential attack.
https://docs.microsoft.com/en-us/azure/sentinel/notebooks
Post your Comments and Discuss Microsoft SC-200 exam prep with other Community members:
Our website is free, but we have to fight against AI bots and content theft. We're sorry for the inconvenience caused by these security measures. You can access the rest of the SC-200 content, but please register or login to continue.