You have an Azure Sentinel workspace that contains an Azure Active Directory (Azure AD) connector, an Azure Log Analytics query named Query1 and a playbook named Playbook1.
Query1 returns a subset of security events generated by Azure AD.
You plan to create an Azure Sentinel analytic rule based on Query1 that will trigger Playbook1.
You need to ensure that you can add Playbook1 to the new rule.
What should you do? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.

Correct Answer:

Explanation

Reference:
https://docs.microsoft.com/en-us/azure/sentinel/tutorial-detect-threats-custom
https://docs.microsoft.com/en-us/azure/sentinel/tutorial-respond-threats-playbook

Comment: *

Name: *

Email: *

Verification: *

You plan to use Azure Disk Encryption for several virtual machine disks.
You need to ensure that Azure Disk Encryption can retrieve secrets from the KeyVault11641655 Azure key vault.
To complete this task, sign in to the Azure portal and modify the Azure resources.
See the explanation below.

Correct Answer:

Explanation
1. In the Azure portal, type Key Vaults from the search results then select KeyVault11641655. Alternatively, browse to in the left navigation pane.
2. In the Key Vault properties, scroll down to the Access Policies.
3. Select the Azure Disk Encryption for volume encryption

4. Click Save to save the changes.

Comment: *

Name: *

Email: *

Verification: *

You suspect that users are attempting to sign in to resources to which they have no access.
You need to create an Azure Log Analytics query to identify failed user sign-in attempts from the last three days. The results must only show users who had more than five failed sign-in attempts.
How should you configure the query? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.

Correct Answer:

Explanation

The following example identifies user accounts that failed to log in more than five times in the last day, and when they last attempted to log in.
let timeframe = 1d;
SecurityEvent
| where TimeGenerated > ago(1d)
| where AccountType == 'User' and EventID == 4625 // 4625 - failed log in
| summarize failed_login_attempts=count(), latest_failed_login=arg_max(TimeGenerated, Account) by Account
| where failed_login_attempts > 5
| project-away Account1
References:
https://docs.microsoft.com/en-us/azure/azure-monitor/log-query/examples

Comment: *

Name: *

Email: *

Verification: *

You have an Azure subscription that contains the resources shown in the following table.

You need to ensure that ServerAdmins can perform the following tasks:
* Create virtual machines in RG1 only.
* Connect the virtual machines to the existing virtual networks in RG2 only.
The solution must use the principle of least privilege.
Which two role-based access control (RBAC) roles should you assign to ServerAdmins? Each correct answer presents part of the solution.
NOTE: Each correct selection is worth one point.

• A.a custom RBAC role for RG2
• B.the Network Contributor role for RG2
• C.the Contributor role for the subscription
• D.a custom RBAC role for the subscription
• E.the Network Contributor role for RG1
• F.the Virtual Machine Contributor role for RG1

Comment: *

Name: *

Email: *

Verification: *

You need to meet the technical requirements for VNetwork1.
What should you do first?

• A.Create a new subnet on VNetwork1.
• B.Remove the NSGs from Subnet11 and Subnet13.
• C.Associate an NSG to Subnet12.
• D.Configure DDoS protection for VNetwork1.

Comment: *

Name: *

Email: *

Verification: *