Your company stores the data for every project in a different Azure subscription. All the subscriptions use the same Azure Active Directory (Azure AD) tenant.
Every project consists of multiple Azure virtual machines that run Windows Server. The Windows events of the virtual machines are stored in a Log Analytics workspace in each machine's respective subscription.
You deploy Azure Sentinel to a new Azure subscription.
You need to perform hunting queries in Azure Sentinel to search across all the Log Analytics workspaces of all the subscriptions.
Which two actions should you perform? Each correct answer presents part of the solution.
NOTE: Each correct selection is worth one point.

• A.Add the Security Events connector to the Azure Sentinel workspace.
• B.Create a query that uses the workspace expression and the union operator.
• C.Use the alias statement.
• D.Create a query that uses the resource expression and the alias operator.
• E.Add the Azure Sentinel solution to each workspace.

Comment: *

Name: *

Email: *

Verification: *

You have a Microsoft Sentinel workspace that contains the following incident.
Brute force attack against Azure Portal analytics rule has been triggered.
You need to identify the geolocation information that corresponds to the incident.
What should you do?

• A.From Overview, review the Potential malicious events map.
• B.From Incidents, review the details of the iPCustomEntity entity associated with the incident.
• C.From Incidents, review the details of the AccouncCuscomEntity entity associated with the incident.
• D.From Investigation, review insights on the incident entity.

Comment: *

Name: *

Email: *

Verification: *

You have an Azure subscription that contains a Log Analytics workspace.
You need to enable just-in-time (JIT) VM access and network detections for Azure resources.
Where should you enable Azure Defender?

• A.at the subscription level
• B.at the workspace level
• C.at the resource level

Comment: *

Name: *

Email: *

Verification: *

You plan to connect an external solution that will send Common Event Format (CEF) messages to Azure Sentinel.
You need to deploy the log forwarder.
Which three actions should you perform in sequence? To answer, move the appropriate actions form the list of actions to the answer area and arrange them in the correct order.

Correct Answer:

1 - Download and install the Log Analytics agent.
2 - Set the Log Analytics agent to listen on port 25226 and forward the CEF messages to A zure Sentinel.
3 - Configure the syslog daemon.Restart the syslog daemon and the Log Analytics agent.
Reference:
https://docs.microsoft.com/en-us/azure/sentinel/connect-cef-agent?tabs=rsyslog

Comment: *

Name: *

Email: *

Verification: *

You manage the security posture of an Azure subscription that contains two virtual machines name vm1 and vm2.
The secure score in Azure Security Center is shown in the Security Center exhibit. (Click the Security Center tab.)

Azure Policy assignments are configured as shown in the Policies exhibit. (Click the Policies tab.)

For each of the following statements, select Yes if the statement is true. Otherwise, select No.
NOTE: Each correct selection is worth one point.

Correct Answer:

Explanation

Reference:
https://techcommunity.microsoft.com/t5/azure-security-center/security-control-restrict-unauthorized-network-acc
https://techcommunity.microsoft.com/t5/azure-security-center/security-control-secure-management-ports/ba-p/15

Comment: *

Name: *

Email: *

Verification: *