Question 1

You have a Microsoft 365 tenant that uses Microsoft Exchange Online and Microsoft Defender for Office 365.

What should you use to identify whether zero-hour auto purge (ZAP) moved an email message from the mailbox of a user?

Options :

A : the Threat Protection Status report in Microsoft Defender for Office 365

B : the mailbox audit log in Exchange

C : the Safe Attachments file types report in Microsoft Defender for Office 365

D : the mail flow report in Exchange

Answer: A

Question 2

You have a Microsoft 365 subscription that uses Microsoft Purview and Microsoft Teams.

You have a team named Team1 that has a project named Project1.

You need to identify any Project1 files that were stored on the team site of Team1 between February 1, 2023, and February 10, 2023.

Which KQL query should you run?

Options :

A : (c:c)(Project1)(date=(2023-02-01)..date=(2023-02-10))

B : AuditLogs -

| where Timestamp between (datetime(2023-02-01)..datetime(2023-02-10))

| where FileName contains “Project1”

C : Project1(c:c)(date=2023-02-01..2023-02-10)

D : AuditLogs -

| where Timestamp > ago(10d)

| where FileName contains “Project1”

Answer: B

Question 3

You have an Azure subscription that has Microsoft Defender for Cloud enabled.

You have a virtual machine named Server1 that runs Windows Server 2022 and is hosted in Amazon Web Services (AWS).

You need to collect logs and resolve vulnerabilities for Server1 by using Defender for Cloud.

What should you install first on Server1?

Options :

A : the Microsoft Monitoring Agent

B : the Azure Monitor agent

C : the Azure Connected Machine agent

D : the Azure Pipelines agent

Answer: B

Question 4

You have an Azure Sentinel workspace.
You need to test a playbook manually in the Azure portal. From where can you run the test in Azure Sentinel?

Options :

A : Playbooks

B : Analytics

C : Threat intelligence

D : Incidents

Answer: D

Question 5

You have an Azure subscription that uses Microsoft Defender for Cloud and contains a storage account named storage1. You receive an alert that there was an unusually high volume of delete operations on the blobs in storage1.

You need to identify which blobs were deleted.

What should you review?

Options :

A : the Azure Storage Analytics logs

B : the activity logs of storage1

C : the alert details

D : the related entities of the alert

Answer: B