DRAG DROP (Drag and Drop is not supported)You have a Microsoft Sentinel workspace that contains a Microsoft Entra ID data connector.You need to associate a bookmark with a Microsoft Entra-related incident.What should you do? To answer, drag the appropriate blades to the correct tasks. Each blade may be used once, more than once, or not at all. You may need to drag the split bar between panes or scroll to view content.Note: Each correct selection is worth one point.Select and Place:
Answer(s): A
Box 1: Hunting blade Create a bookmarkAdd a bookmark 1. In the Azure portal, navigate to Microsoft Sentinel > Threat management > Hunting to run queries for suspicious and anomalous behavior.2. Select one of the hunting queries and on the right, in the hunting query details, select Run Query.3. Select View query results. For example:This action opens the query results in the Logs pane.4. From the log query results list, use the checkboxes to select one or more rows that contain the information you find interesting.5. Select Add bookmark:6. On the right, in the Add bookmark pane, optionally, update the bookmark name, add tags, and notes to help you identify what was interesting about the item.7. Etc.Box 2: Hunting blade Associate a bookmark with incidentYou can also create an incident from one or more bookmarks, or add one or more bookmarks to an existing incident. Select a checkbox to the left of any bookmarks you want to use, and then select Incident actions > Create new incident or Add to existing incident. Triage and investigate the incident like any other.Note: Add bookmarks to a new or existing incident 1. In the Azure portal, navigate to Microsoft Sentinel > Threat management > Hunting > Bookmarks tab, and select the bookmark or bookmarks you want to add to an incident.2. Select Incident actions from the command bar:3. Select either Create new incident or Add to existing incident, as appropriate. Then:For a new incident: Optionally update the details for the incident, and then select Create. For adding a bookmark to an existing incident: Select one incident, and then select Add.To view the bookmark within the incident: Navigate to Microsoft Sentinel > Threat management > Incidents and select the incident with your bookmark. Select View full details, and then select the Bookmarks tab.
https://learn.microsoft.com/en-us/azure/sentinel/bookmarks https://learn.microsoft.com/en-us/azure/sentinel/hunting
HOTSPOT (Drag and Drop is not supported)You have an Azure subscription that contains a guest user named User1 and a Microsoft Sentinel workspace named workspace1.You need to ensure that User1 can triage Microsoft Sentinel incidents in workspace1. The solution must use the principle of least privilege.Which roles should you assign to User1? To answer, select the appropriate options in the answer area.Note: Each correct selection is worth one point.Hot Area:
Box 1: Microsoft Sentinel Responder Azure RoleRoles and permissions for working in Microsoft Sentinel Microsoft Sentinel-specific roles All Microsoft Sentinel built-in roles grant read access to the data in your Microsoft Sentinel workspace.Microsoft Sentinel Reader can view data, incidents, workbooks, and other Microsoft Sentinel resources.*-> Microsoft Sentinel Responder can, in addition to the above, manage incidents (assign, dismiss, etc.).Microsoft Sentinel Contributor can, in addition to the above, create and edit workbooks, analytics rules, and other Microsoft Sentinel resources.Microsoft Sentinel Playbook Operator can list, view, and manually run playbooks.Microsoft Sentinel Automation Contributor allows Microsoft Sentinel to add playbooks to automation rules. It isn't meant for user accounts.Box 2: Directory readers Azure AD RoleIf you have a guest user that needs to assign incidents, the user must be assigned the Directory Reader role in your Azure AD tenant. Regular (non-guest) users have this role assigned by default.
https://learn.microsoft.com/en-us/azure/sentinel/investigate-cases https://learn.microsoft.com/en-us/azure/sentinel/roles
HOTSPOT (Drag and Drop is not supported)You have an Azure subscription that uses Microsoft Sentinel and contains a user named User1.You need to ensure that User1 can enable User and Entity Behavior Analytics (UEBA) for entity behavior in Microsoft Entra. The solution must use the principle of least privilege.Which roles should you assign to User1? To answer, select the appropriate options in the answer area.Note: Each correct selection is worth one point.Hot Area:
Box 1: Security Administrator Microsoft Entra RoleEnable User and Entity Behavior Analytics (UEBA) in Microsoft Sentinel Prerequisites To enable or disable this feature (these prerequisites are not required to use the feature):Your user must be assigned the Global Administrator or Security Administrator roles in Microsoft Entra.Your user must be assigned at least one of the following Azure roles (Learn more about Azure RBAC):Microsoft Sentinel Contributor at the workspace or resource group levels. Log Analytics Contributor at the resource group or subscription levels. Your workspace must not have any Azure resource locks applied to it. Learn more about Azure resource locking.Box 2: Microsoft Sentinel Contributor Azure Role
https://learn.microsoft.com/en-us/azure/sentinel/enable-entity-behavior-analytics
HOTSPOT (Drag and Drop is not supported)You have an Azure subscription that contains the following resources:-A virtual machine named VM1 that runs Windows Server-A Microsoft Sentinel workspace named Sentinel1 that has User and Entity Behavior Analytics (UEBA) enabledYou have a scheduled query rule named Rule1 that tracks sign-in attempts to VM1.You need to update Rule1 to detect when a user from outside the IT department of your company signs in toVM1. The solution must meet the following requirements:-Utilize UEBA results.-Maximize query performance.-Minimize the number of false positives.How should you complete the rule definition? To answer, select the appropriate options in the answer area.Note: Each correct selection is worth one point.Hot Area:
Box 1: inner Use inner join to minimize false positives.Example: The following query resolves user and peer identifier fields:UserPeerAnalytics| where TimeGenerated > ago(24h)// join to resolve user identifier fields| join kind=inner ( IdentityInfo | where TimeGenerated > ago(14d) | distinct AccountTenantId, AccountObjectId, AccountUPN, AccountDisplayName | extend UserPrincipalNameIdentityInfo = AccountUPN | extend UserNameIdentityInfo = AccountDisplayName | project AccountTenantId, AccountObjectId, UserPrincipalNameIdentityInfo, UserNameIdentityInfo) on $left.AADTenantId == $right.AccountTenantId, $left.UserId == $right.AccountObjectIdBox 2: IdentityInfoIdentityInfo table After you enable UEBA for your Microsoft Sentinel workspace, data from your Azure Active Directory is synchronized to the IdentityInfo table in Log Analytics for use in Microsoft Sentinel. You can embed user data synchronized from your Azure AD in your analytics rules to enhance your analytics to fit your use cases and reduce false positives.The following table describes the user identity data included in the IdentityInfo table in Log Analytics.* AccountObjectId string The Azure Active Directory object ID for the user account.* AccountSID string The on-premises security identifier of the user account.* Etc.
https://techcommunity.microsoft.com/t5/microsoft-sentinel-blog/azure-active-directory-identity-protection-user-account/ba-p/3695968 https://learn.microsoft.com/en-us/azure/sentinel/ueba-reference?source=recommendations#identityinfo-table
DRAG DROP (Drag and Drop is not supported)Your network contains an on-premises Active Directory Domain Services (AD DS) domain that syncs with a Microsoft Entra tenant.You have a Microsoft Sentinel workspace named Sentinel1.You need to enable User and Entity Behavior Analytics (UEBA) for Sentinel1 and collect security events from the AD DS domain.Which three actions should you perform in sequence? To answer, move the appropriate actions from the list of actions to the answer area and arrange them in the correct order.Select and Place:
Step 1: To the AD DS domain, deploy Microsoft Defender for Identity UEBA is integrated with Microsoft Sentinel through the use of the Microsoft Defender for Identity and Microsoft Cloud App Security connectors. These connectors allow UEBA data to be imported into Sentinel for analysis and investigation.Step 2: For Sentinel1, configure the Microsoft Defender for Identity ConnectorStep 3: For Sentinel1, enable UEBA When you enable UEBA, it synchronizes your Azure Active Directory with Microsoft Sentinel, storing the information in an internal database visible through the IdentityInfo table in Log Analytics.Note: How to enable User and Entity Behavior Analytics 1. Go to the Entity behavior configuration page. 2. On the Entity behavior configuration page, switch the toggle to On.3. Mark the check boxes next to the Active Directory source types from which you want to synchronize user entities with Microsoft Sentinel.Active Directory on-premises (Preview) Azure Active Directory To sync user entities from on-premises Active Directory, your Azure tenant must be onboarded to Microsoft Defender for Identity (either standalone or as part of Microsoft 365 Defender) and you must have the MDI sensor installed on your Active Directory domain controller.4. Mark the check boxes next to the data sources on which you want to enable UEBA.5. Select Apply. If you accessed this page through the Entity behavior page, you will be returned there.
https://learn.microsoft.com/en-us/azure/sentinel/identify-threats-with-entity-behavior-analytics https://learn.microsoft.com/en-us/azure/sentinel/enable-entity-behavior-analytics
You have a Microsoft Sentinel workspace.You enable User and Entity Behavior Analytics (UEBA) by using Audit Logs and Signin Logs.The following entities are detected in the Azure AD tenant:-App name: App1-IP address: 192.168.1.2-Computer name: Device1-Used client app: Microsoft Edge-Email address: user1@company.com-Sign-in URL: https://www.company.comWhich entities can be investigated by using UEBA?
Answer(s): B
BehaviorAnalytics table The following table describes the behavior analytics data displayed on each entity details page in Microsoft Sentinel. * SourceIPAddress The IP address from which activity was initiated.* SourceDevice The hostname of the device that initiated the activity.* Etc. The following table describes the user identity data included in the IdentityInfo table in Log Analytics. * MailAddress The primary email address of the user account.* Etc. ActivityInsights field The following tables describe the enrichments featured in the ActivityInsights dynamic field in the BehaviorAnalytics table:Action PerformedApp usedBrowser UsedEtc.Note: UEBA enrichments The BehaviorAnalytics table is where UEBA's output information is stored. - The UsersInsights and DevicesInsights fields contain entity information from Active Directory / Azure AD and Microsoft Threat Intelligence sources. - The ActivityInsights field contains entity information based on the behavioral profiles built by Microsoft Sentinel's entity behavior analytics.The IdentityInfo table is where identity information synchronized to UEBA from Azure Active Directory (and from on-premises Active Directory via Microsoft Defender for Identity) is stored.Note 2: UEBA data sources* Azure Active Directory, Audit logs ApplicationManagement DirectoryManagement GroupManagement Device RoleManagement UserManagementCategory* Azure Active Directory, Sign-in logs All Events* Etc.Note 2: Sentinel User and Entity Behavior Analytics works by aggregating multiple Azure data sources and finds rarities and outliers within those sources. The data sources are:Azure AD Audit Logs (User and group management activity) Azure Activity (Common Azure operational event logs) Security Events (Windows Security Event Log events) SignInLogs (Authentication Activity)
https://learn.microsoft.com/en-us/azure/sentinel/ueba-reference https://www.frankcardinale.com/2022/08/03/microsoft-sentinel-ueba/
HOTSPOT (Drag and Drop is not supported)You have an Azure subscription that contains a Microsoft Sentinel workspace.You need to create a hunting query using Kusto Query Language (KQL) that meets the following requirements:-Identifies an anomalous number of changes to the rules of a network security group (NSG) made by the same security principal.-Automatically associates the security principal with a Microsoft Sentinel entity.How should you complete the query? To answer, select the appropriate options in the answer area.Note: Each correct selection is worth one point.Hot Area:
Microsoft Sentinel hunting query OperationNameValue ActivityStatusValue EventSubmissionTimeStampMicrosoft Sentinel hunting query AccountCustomEntityBox 1: AzureActivityThe AzureActivity table includes data from many services, including Microsoft Sentinel. To filter in only data from Microsoft Sentinel, start your query with the following code:| where OperationNameValue startswith "MICROSOFT.SECURITYINSIGHTS"For example, to find out who was the last user to edit a particular analytics rule, use the following query (replacing xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx with the rule ID of the rule you want to check):AzureActivity | where OperationNameValue startswith "MICROSOFT.SECURITYINSIGHTS/ALERTRULES/WRITE" | where Properties contains "alertRules/xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx" | project Caller , TimeGenerated , PropertiesBox 2: whereExample: Find all actions taken by a specific user in the last 24 hours The following AzureActivity table query lists all actions taken by a specific Azure AD user in the last 24 hours.AzureActivity | where OperationNameValue contains "SecurityInsights" | where Caller == "[AzureAD username]" | where TimeGenerated > ago(1d)
https://learn.microsoft.com/en-us/azure/sentinel/audit-sentinel-data
HOTSPOT (Drag and Drop is not supported)You have a Microsoft Sentinel workspace.You need to configure a report visual for a custom workbook. The solution must meet the following requirements:-The count and usage trend of AppDisplayName must be included.-The TrendList column must be useable in a sparkline visual.How should you complete the KQL query? To answer, select the appropriate options in the answer area.Note: Each correct selection is worth one point.Hot Area:
Box 1: joinIncorrect: * let Not the correct syntax for let. Example: let timeRange = 1d;* lookup To support a lookup from an external file, KQL offers the "exernaldata" operator. Unlike lookup implementation in other SIEM products, externaldata is not a lookup operator. Instead, externaldata enables using files as if they were Azure Sentinel tables, allowing pre-processing of the file before performing the lookup, such as filtering and parsing. I will demonstrate each in the examples below.Box 2: make-series The make-series operator create series of specified aggregated values along a specified axis.Syntax T | make-series [MakeSeriesParameters] [Column =] Aggregation [default = DefaultValue] [, ...] on AxisColumn [from start] [to end] step step [by [Column =] GroupExpression [, ...]]Incorrect: * render Example of usage: render timechart title = "Syslog by time"* make_bag() Returns a property bag of dynamic values within the group* mv-expand mv-expand, or multi-value expand, at its most basic, takes a dynamic array of data and expands it out to multiple rows. When we use mv-expand, KQL expands out the dynamic data, and simply duplicates any non-dynamic data. Leaving us with multiple rows to use in our queries.mv-expand is essentially the opposite of summarize operators such as make_list and make_set. With those we are creating arrays, mv-expand we are reversing that, and expanding arrays.Example: SigninLogs | project TimeGenerated, UserPrincipalName, Location, ConditionalAccessPolicies | mv-expand ConditionalAccessPolicies
https://learnsentinel.blog/2023/05/15/have-a-json-headache-in-kql-try-mv-expand-or-mv-apply/ https://learn.microsoft.com/en-us/azure/data-explorer/kusto/query/make-seriesoperator
Post your Comments and Discuss Microsoft SC-200 exam prep with other Community members:
Our website is free, but we have to fight against AI bots and content theft. We're sorry for the inconvenience caused by these security measures. You can access the rest of the SC-200 content, but please register or login to continue.