You are informed of an increase in malicious email being received by users.
You need to create an advanced hunting query in Microsoft 365 Defender to identify whether the accounts of the email recipients were compromised. The query must return the most recent 20 sign-ins performed by the recipients within an hour of receiving the known malicious email.
How should you complete the query? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.

Correct Answer:

Reference:
https://docs.microsoft.com/en-us/microsoft-365/security/defender/advanced-hunting-query-emails-devices?view=o365-worldwide

Comment: *

Name: *

Email: *

Verification: *

You have an Azure subscription named Sub1 that is linked to a Microsoft Entra tenant named contoso.com.
Contoso.com contains a user named User1. Sub1 contains a Microsoft Sentinel workspace.
You provision a Microsoft Copilot for Security capacity.
You need to ensure that User1 can use Copilot for Security to perform the following tasks:
. Update the data sharing and feedback options.
. Investigate Microsoft Sentinel incidents.
The solution must follow the principle of least privilege.
Which role should you assign to User1 for each task? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point

Correct Answer:

Explanation:
Task
Role
Update the data sharing and feedback options
Security Administrator
Investigate Microsoft Sentinel incidents
Microsoft Sentinel Responder
Microsoft Sentinel built-in roles documentation defines:
Microsoft Sentinel Responder - Can view incidents and perform incident response operations such as assigning, changing severity, or closing incidents.
This role grants the ability to investigate and act on incidents, which includes collaboration with Microsoft Copilot for Security to analyze incidents and run queries within Sentinel.
The Microsoft Sentinel Reader role, on the other hand, can only view incidents but cannot investigate or modify them, making it too restrictive.
The Cloud App Security Administrator role is unrelated to Sentinel incident investigation.
Thus, for investigating Sentinel incidents using Copilot for Security, Microsoft Sentinel Responder is the correct and least-privileged role.
Task
Role to Assign
Update the data sharing and feedback options
Security Administrator
Investigate Microsoft Sentinel incidents
Microsoft Sentinel Responder
* Security Administrator # Required to configure Copilot for Security settings (data sharing & feedback).
* Microsoft Sentinel Responder # Required to actively investigate incidents (least privilege for Sentinel operations).
These align with Microsoft Copilot for Security, Microsoft Sentinel, and Microsoft Entra role-based access control (RBAC) documentation.

Comment: *

Name: *

Email: *

Verification: *

You have a Microsoft Sentinel workspace that has User and Entity Behavior Analytics (UEBA) enabled.
You need to identify all the log entries that relate to security-sensitive user actions performed on a server named Server1. The solution must meet the following requirements:
* Only include security-sensitive actions by users that are NOT members of the IT department.
* Minimize the number of false positives.
How should you complete the query? To answer, select the appropriate options in the answer are a. NOTE: Each correct selection is worth one point.

Correct Answer:

Comment: *

Name: *

Email: *

Verification: *

You create an Azure subscription named sub1.
In sub1, you create a Log Analytics workspace named workspace1.
You enable Azure Security Center and configure Security Center to use workspace1.
You need to ensure that Security Center processes events from the Azure virtual machines that report to workspace1.
What should you do?

• A.In workspace1, install a solution.
• B.In sub1, register a provider.
• C.From Security Center, create a Workflow automation.
• D.In workspace1, create a workbook.

Comment: *

Name: *

Email: *

Verification: *

You need to complete the query for failed sign-ins to meet the technical requirements.
Where can you find the column name to complete the where clause?

• A.Activity log in Azure
• B.Azure Advisor
• C.the query windows of the Log Analytics workspace
• D.Security alerts in Azure Security Center

Comment: *

Name: *

Email: *

Verification: *