Question 1

You have an Azure subscription that uses Microsoft Defender for Cloud. You need to filter the security alerts view to show the following alerts:

* Unusual user accessed a key vault

* Log on from an unusual location

* Impossible travel activity

Which severity should you use?

Options :

A : Informational

B : Low

C : Medium

D : High

Answer: C

Question 2

You have 50 Microsoft Sentinel workspaces.

You need to view all the incidents from all the workspaces on a single page in the Azure portal. The solution must minimize administrative effort.

Which page should you use in the Azure portal?

Options :

A : Microsoft Sentinel - Incidents

B : Microsoft Sentinel - Workbooks

C : Microsoft Sentinel

D : Log Analytics workspaces

Answer: D

Question 3

You have an Azure subscription that contains a Microsoft Sentinel workspace. The workspace contains a Microsoft Defender for Cloud data connector.

You need to customize which details will be included when an alert is created for a specific event.

What should you do?

Options :

A : Modify the properties of the connector.

B : Create a Data Collection Rule (DCR).

C : Create a scheduled query rule.

D : Enable User and Entity Behavior Analytics (UEBA)

Answer: D

Question 4

You need to assign a role-based access control (RBAC) role to admin1 to meet the Azure Sentinel requirements and the business requirements.
Which role should you assign?

Options :

A : Automation Operator

B : Automation Runbook Operator

C : Azure Sentinel Contributor

D : Logic App Contributor

Answer: C

Question 5

A company uses Azure Sentinel.
You need to create an automated threat response.
What should you use?

Options :

A : a data connector

B : a playbook

C : a workbook

D : a Microsoft incident creation rule

Answer: B