You have an Azure Sentinel deployment in the East US Azure region.You create a Log Analytics workspace named LogsWest in the West US Azure region.You need to ensure that you can use scheduled analytics rules in the existing Azure Sentinel deployment to generate alerts based on queries to LogsWest. What should you do first?

Add Microsoft Sentinel to a workspace.

Deploy Azure Data Catalog to the West US Azure region.

Modify the workspace settings of the existing Azure Sentinel deployment.

Add Microsoft Sentinel to a workspace.

Create a data connector in Azure Sentinel.

You create a custom analytics rule to detect threats in Azure Sentinel.You discover that the rule fails intermittently.What are two possible causes of the failures? Each correct answer presents part of the solution.NOTE: Each correct selection is worth one point.

The rule query takes too long to run and times out.

There are connectivity issues between the data sources and Log Analytics

The rule query takes too long to run and times out.

The target workspace was deleted.

Permissions to the data sources of the rule query were modified.

There are connectivity issues between the data sources and Log Analytics

You are investigating an incident in Azure Sentinel that contains more than 127 alerts.You discover eight alerts in the incident that require further investigation.You need to escalate the alerts to another Azure Sentinel administrator.What should you do to provide the alerts to the administrator?

Create a Microsoft incident creation rule

You are configuring Azure Sentinel.You need to send a Microsoft Teams message to a channel whenever an incident representing a sign-in risk event is activated in Azure Sentinel.Which two actions should you perform in Azure Sentinel? Each correct answer presents part of the solution.NOTE: Each correct selection is worth one point.

Enable Entity behavior analytics.

Associate a playbook to the analytics rule that triggered the incident.

Enable Entity behavior analytics.

Associate a playbook to the analytics rule that triggered the incident.

You have the following environment:Azure SentinelA Microsoft 365 subscriptionMicrosoft Defender for IdentityAn Azure Active Directory (Azure AD) tenantYou configure Azure Sentinel to collect security logs from all the Active Directory member servers and domain controllers.You deploy Microsoft Defender for Identity by using standalone sensors.You need to ensure that you can detect when sensitive groups are modified in Active Directory.Which two actions should you perform? Each correct answer presents part of the solution.NOTE: Each correct selection is worth one point.

Configure the Advanced Audit Policy Configuration settings for the domain controllers.

Configure Windows Event Forwarding on the domain controllers.

Configure the Advanced Audit Policy Configuration settings for the domain controllers.

Modify the permissions of the Domain Controllers organizational unit (OU).

Configure auditing in the Microsoft 365 compliance center.

Configure Windows Event Forwarding on the domain controllers.

You have an Azure subscription named Sub1 and a Microsoft 365 subscription. Sub1 is linked to an Azure Active Directory (Azure AD) tenant named contoso.com.You create an Azure Sentinel workspace named workspace1. In workspace1, you activate an Azure AD connector for contoso.com and an Office 365 connector for the Microsoft 365 subscription.You need to use the Fusion rule to detect multi-staged attacks that include suspicious sign-ins to contoso.com followed by anomalous Microsoft Office 365 activity.Which two actions should you perform? Each correct answer present part of the solution.NOTE: Each correct selection is worth one point.

Create custom rule based on the Office 365 connector templates.

Create a Microsoft incident creation rule based on Microsoft Defender for Cloud.

Create custom rule based on the Office 365 connector templates.

Create a Microsoft incident creation rule based on Microsoft Defender for Cloud.

Create a Microsoft Cloud App Security connector.

Create an Azure AD Identity Protection connector.

You need to receive a security alert when a user attempts to sign in from a location that was nevsr used by the other users in your organization to sign in.Which anomaly detection policy should you use?

Activity from infrequent country

Activity from anonymous IP addresses

Activity from infrequent country

You have a Microsoft 365 subscription that uses Microsoft Defender for Office 365.You have Microsoft SharePoint Online sites that contain sensitive documents. The documents contain customer account numbers that each consists of 32 alphanumeric characters.You need to create a data loss prevention (DLP) policy to protect the sensitive documents.What should you use to detect which documents are sensitive?

a hunting query in Microsoft 365 Defender

Your company uses Microsoft Defender for Endpoint.The company has Microsoft Word documents that contain macros. The documents are used frequently on the devices of the company's accounting team.You need to hide false positive in the Alerts queue, while maintaining the existing security posture.Which three actions should you perform? Each correct answer presents part of the solution.NOTE: Each correct selection is worth one point.

Create a suppression rule scoped to any device.

Resolve the alert automatically.

Create a suppression rule scoped to any device.

Create a suppression rule scoped to a device group.

You have the following advanced hunting query in Microsoft 365 Defender. You need to receive an alert when any process disables System Restore on a device managed by Microsoft Defender during the last 24 hours.Which two actions should you perform? Each correct answer presents part of the solution.NOTE: Each correct selection is worth one point.

Add Deviceld and Reportldto the output of the query.

Add | order by Timestamp to the query.

Replace DeviceProcessEvents with DeviceNetworkEvents.

Add Deviceld and Reportldto the output of the query.

You are investigating a potential attack that deploys a new ransomware strain.You plan to perform automated actions on a group of highly valuable machines that contain sensitive information.You have three custom device groups.You need to be able to temporarily group the machines to perform actions on the devices.Which three actions should you perform? Each correct answer presents part of the solution.NOTE: Each correct selection is worth one point.

Assign a tag to the device group.

Create a new device group that has a rank of 1.

Assign a tag to the device group.

Add the device users to the admin role.

Create a new device group that has a rank of 1.

Create a new device group that has a rank of 4.

You receive a security bulletin about a potential attack that uses an image file.You need to create an indicator of compromise (loC) in Microsoft Defender for Endpoint to prevent the attack.Which indicator type should you use?

a file hash indicator that has Action set to Alert and block

a URL/domain indicator that has Action set to Alert only

a URL/domain indicator that has Action set to Alert and block

a file hash indicator that has Action set to Alert and block

a certificate indicator that has Action set to Alert and block

Your company deploys the following services:Microsoft Defender for IdentityMicrosoft Defender for EndpointMicrosoft Defender for Office 365You need to provide a security analyst with the ability to use the Microsoft 365 security center. The analyst must be able to approve and reject pending actions generated by Microsoft Defender for Endpoint. The solution must use the principle of least privilege.Which two roles should assign to the analyst? Each correct answer presents part of the solution.NOTE: Each correct selection is worth one point.

the Active remediation actions role in Microsoft Defender for Endpoint

the Security Reader role in Azure Active Directory (Azure AD)

the Compliance Data Administrator in Azure Active Directory (Azure AD)

the Active remediation actions role in Microsoft Defender for Endpoint

the Security Administrator role in Azure Active Directory (Azure AD)

the Security Reader role in Azure Active Directory (Azure AD)

You need to configure Microsoft Cloud App Security to generate alerts and trigger remediation actions in response to external sharing of confidential files.Which two actions should you perform in the Cloud App Security portal? Each correct answer presents part of the solution.NOTE: Each correct selection is worth one point.

From Settings, select Information Protection, select Azure Information Protection, and then select Automatically scan new files for Azure Information Protection classification labels and content inspection warnings.

From Settings, select Information Protection, select Files, and then enable file monitoring.

From Settings, select Information Protection, select Azure Information Protection, and then select Only scan files for Azure Information Protection classification labels and content inspection warnings from this tenant.

Select Investigate files, and then filter App to Office 365.

Select Investigate files, and then select New policy from search.

From Settings, select Information Protection, select Azure Information Protection, and then select Automatically scan new files for Azure Information Protection classification labels and content inspection warnings.