DRAG DROP (Drag and Drop is not supported)You have an Azure subscription that contains two users named User1 and User2 and a Microsoft Sentinel workspace named workspace1.You need to ensure that the users can perform the following tasks in workspace1:-User1 must be able to dismiss incidents and assign incidents to users.-User2 must be able to modify analytics rules.The solution must use the principle of least privilege.Which role should you assign to each user? To answer, drag the appropriate roles to the correct users. Each role may be used once, more than once, or not at all. You may need to drag the split bar between panes or scroll to view content.Note: Each correct selection is worth one point.Select and Place:
Answer(s): A
Box 1: Microsoft Sentinel Responder User1 must be able to dismiss incidents and assign incidents to users.Azure RoleRoles and permissions for working in Microsoft Sentinel Microsoft Sentinel-specific rolesAll Microsoft Sentinel built-in roles grant read access to the data in your Microsoft Sentinel workspace.Microsoft Sentinel Reader can view data, incidents, workbooks, and other Microsoft Sentinel resources.*-> Microsoft Sentinel Responder can, in addition to the above, manage incidents (assign, dismiss, etc.).*-> Microsoft Sentinel Contributor can, in addition to the above, create and edit workbooks, analytics rules, and other Microsoft Sentinel resources.Microsoft Sentinel Playbook Operator can list, view, and manually run playbooks.Microsoft Sentinel Automation Contributor allows Microsoft Sentinel to add playbooks to automation rules. It isn't meant for user accounts.Box 2: Microsoft Sentinel Contributor User2 must be able to modify analytics rules.
https://learn.microsoft.com/en-us/azure/sentinel/roles
You have a Microsoft Sentinel workspace that uses the Microsoft 365 Defender data connector.From Microsoft Sentinel, you investigate a Microsoft 365 incident.You need to update the incident to include an alert generated by Microsoft Defender for Cloud Apps.What should you use?
Add alerts using the entity timeline (Preview) (see steps 5 to 7 below) The entity timeline, as featured in the new incident experience (now in Preview), presents all the entities in a particular incident investigation. When an entity in the list is selected, a miniature entity page is displayed in a side panel.1. From the Microsoft Sentinel navigation menu, select Incidents.2. Select an incident to investigate. In the incident details panel, select View full details.3. In the incident page, select the Entities tab.4. Select an entity from the list.5. In the entity page side panel, select the Timeline card.6. Select an alert external to the open incident. These are indicated by a grayed-out shield icon and a dotted-line color band representing the severity. Select the plus-sign icon on the right end of that alert.7. Confirm adding the alert to the incident by selecting OK. You'll receive a notification confirming the adding of the alert to the incident, or explaining why it was not added.You'll see that the added alert now appears in the open incident's Timeline widget in the Overview tab, with a full-color shield icon and a solid-line color band like any other alert in the incident.The added alert is now a full part of the incident, and any entities in the added alert (that weren't already part of the incident) have also become part of the incident. You can now explore those entities' timelines for their other alerts that are now eligible to be added to the incident.Note: Microsoft Sentinel's Microsoft 365 Defender incident integration allows you to stream all Microsoft 365 Defender incidents into Microsoft Sentinel and keep them synchronized between both portals. Incidents from Microsoft 365 Defender include all associated alerts, entities, and relevant information, providing you with enough context to perform triage and preliminary investigation in Microsoft Sentinel. Once in Sentinel, incidents will remain bi-directionally synced with Microsoft 365 Defender, allowing you to take advantage of the benefits of both portals in your incident investigation.Working with Microsoft 365 Defender incidents in Microsoft Sentinel and bi-directional sync Microsoft 365 Defender incidents will appear in the Microsoft Sentinel incidents queue with the product name Microsoft 365 Defender, and with similar details and functionality to any other Sentinel incidents. Each incident contains a link back to the parallel incident in the Microsoft 365 Defender portal.
https://learn.microsoft.com/en-us/azure/sentinel/relate-alerts-to-incidents https://learn.microsoft.com/en-us/azure/sentinel/microsoft-365-defender-sentinel-integration
You have a Microsoft Sentinel workspace.You investigate an incident that has the following entities:-A user account named User1-An IP address of 192.168.10.200-An Azure virtual machine named VM1-An on-premises server named Server1You need to label an entity as an indicator of compromise (IoC) directly by using the incidents page.Which entity can you label?
Add entities to threat intelligence in Microsoft Sentinel When investigating an incident, you examine entities and their context as an important part of understanding the scope and nature of the incident. In the course of the investigation, you may discover a domain name, URL, file, or IP address in the incident that should be labeled and tracked as an indicator of compromise (IOC), a threat indicator.For example, you may discover an IP address performing port scans across your network, or functioning as a command and control node, sending and/or receiving transmissions from large numbers of nodes in your network.Microsoft Sentinel allows you to flag these types of entities as malicious, right from within your incident investigation, and add it to your threat indicator lists. You'll then be able to view the added indicators both in Logs and in the Threat Intelligence blade, and use them across your Microsoft Sentinel workspace.
https://learn.microsoft.com/en-us/azure/sentinel/add-entity-to-threat-intelligence
You have a Microsoft Sentinel workspace that has User and Entity Behavior Analytics (UEBA) enabled for Signin Logs.You need to ensure that failed interactive sign-ins are detected. The solution must minimize administrative effort.What should you use?
Answer(s): C
HOTSPOT (Drag and Drop is not supported)You have an Azure subscription that is linked to a hybrid Microsoft Entra tenant and contains a Microsoft Sentinel workspace named Sentinel1.You need to enable User and Entity Behavior Analytics (UEBA) for Sentinel1 and configure UEBA to use data collected from Active Directory Domain Services (AD DS).What should you do? To answer, select the appropriate options in the answer area.Note: Each correct selection is worth one point.Hot Area:
Box 1: Microsoft Defender for Identity sensors To the AD DS domain, deploy Microsoft Defender for Identity UEBA is integrated with Microsoft Sentinel through the use of the Microsoft Defender for Identity and Microsoft Cloud App Security connectors. These connectors allow UEBA data to be imported into Sentinel for analysis and investigation.Box 2: The Security Events data source What data does Defender for Identity collect? Defender for Identity collects and stores information from your configured servers, such as domain controllers, member servers, and so on. Data is stored in a database specific to the service for administration, tracking, and reporting purposes.Information collected includes:Network traffic to and from domain controllers, such as Kerberos authentication, NTLM authentication, or DNS queries. *-> Security logs, such as Windows security events. Active Directory information, such as structure, subnets, or sites. Entity information, such as names, email addresses, and phone numbers.
https://learn.microsoft.com/en-us/azure/sentinel/identify-threats-with-entity-behavior-analytics https://learn.microsoft.com/en-us/azure/sentinel/enable-entity-behavior-analytics https://learn.microsoft.com/en-us/defender-for-identity/technical-faq
HOTSPOT (Drag and Drop is not supported)You have a Microsoft Sentinel workspace that contains a custom workbook.You need to query the number of daily security alerts. The solution must meet the following requirements:-Identify alerts that occurred during the last 30 days.-Display the results in a timechart.How should you complete the query? To answer, select the appropriate options in the answer area.Note: Each correct selection is worth one point.Hot Area:
Box 1: summarize Use where, summarize and top to limit the volume that you display.Box 2: bin bin() Rounds values down to an integer multiple of a given bin size.Used frequently in combination with summarize by .... If you have a scattered set of values, they'll be grouped into a smaller set of specific values.The bin() and floor() functions are equivalentIncorrect: * make-series operator Create series of specified aggregated values along a specified axis.Syntax T | make-series [MakeSeriesParameters] [Column =] Aggregation [default = DefaultValue] [, ...] on AxisColumn [from start] [to end] step step [by [Column =] GroupExpression [, ...]]Syntax bin(value,roundTo)Example: Pad a table with null bins When there are rows for bins with no corresponding row in the table, we recommend to pad the table with those bins. The following query looks at strong wind storm events in California for a week in April. However, there are no events on some of the days.let Start = datetime('2007-04-07'); let End = Start + 7d; StormEvents | where StartTime between (Start .. End) | where State == "CALIFORNIA" and EventType == "Strong Wind" | summarize PropertyDamage=sum(DamageProperty) by bin(StartTime, 1d)* range operator Examples Generates a single-column table of values.Syntax range columnName from start to stop step stepExample The following example creates a table with entries for the current time stamp extended over the past seven days, once a day.range LastWeek from ago(7d) to now() step 1d
https://learn.microsoft.com/en-us/azure/data-explorer/kusto/query/renderoperator https://learn.microsoft.com/en-us/azure/data-explorer/kusto/query/binfunction
HOTSPOT (Drag and Drop is not supported)You have four Azure subscriptions. One of the subscriptions contains a Microsoft Sentinel workspace.You need to deploy Microsoft Sentinel data connectors to collect data from the subscriptions by using Azure Policy. The solution must ensure that the policy will apply to new and existing resources in the subscriptions.Which type of connectors should you provision, and what should you use to ensure that all the resources are monitored? To answer, select the appropriate options in the answer area.Note: Each correct selection is worth one point.Hot Area:
Box 1: Diagnostic settings Connector type:Azure Policy managed diagnostic settings-based connectors This section covers prerequisites and general installation instructions for the group of data connectors that use Azure Policy managed diagnostic settings-based connections.Box 2: A remediation task Use: Prerequisites To ingest data into Microsoft Sentinel:You must have read and write permissions on the Microsoft Sentinel workspace.To use Azure Policy to apply a log streaming policy to your resources, you must have the Owner role for the policy assignment scope.Data connector specific requirements:Instructions (see step 3c below) Connectors of this type use Azure Policy to apply a single diagnostic settings configuration to a collection of resources of a single type, defined as a scope. You can see the log types ingested from a given resource type on the left side of the connector page for that resource, under Data types.1. From the Microsoft Sentinel navigation menu, select Data connectors.2. Select your resource type from the data connectors gallery, and then select Open Connector Page on the preview pane.3. In the Configuration section of the connector page, expand any expanders you see there and select the Launch Azure Policy Assignment wizard button.The policy assignment wizard opens, ready to create a new policy, with a policy name pre-populated.a) In the Basics tab, select the button with the three dots under Scope to choose your subscription (and, optionally, a resource group). You can also add a description. b. In the Parameters tab: * details omitted* c) The policy will be applied to resources added in the future. To apply the policy on your existing resources as well, select the Remediation tab and mark the Create a remediation task check box.a) In the Review + create tab, click Create. Your policy is now assigned to the scope you chose.
https://learn.microsoft.com/en-us/azure/sentinel/connect-services-diagnostic-setting-based
You have 50 Microsoft Sentinel workspaces.You need to view all the incidents from all the workspaces on a single page in the Azure portal. The solution must minimize administrative effort.Which page should you use in the Azure portal?
Post your Comments and Discuss Microsoft SC-200 exam prep with other Community members:
Our website is free, but we have to fight against AI bots and content theft. We're sorry for the inconvenience caused by these security measures. You can access the rest of the SC-200 content, but please register or login to continue.