You need to configure DC1 to meet the business requirements.
Which four actions should you perform in sequence? To answer, move the appropriate actions from the list of actions to the answer area and arrange them in the correct order.

Correct Answer:

1 - Provide global administrator credentials to the litware.com Azure AD tenant.
2 - Create an instance of Microsoft Defender for Identity.
3 - Provide domain administrator credentials to the litware.com Active Directory domain.
4 - Install the sensor on DC1.
Explanation:
Step 1: log in to https://portal.atp.azure.com as a global admin
Step 2: Create the instance
Step 3. Connect the instance to Active Directory
Step 4. Download and install the sensor.
Reference:
https://docs.microsoft.com/en-us/defender-for-identity/install-step1
https://docs.microsoft.com/en-us/defender-for-identity/install-step4

Comment: *

Name: *

Email: *

Verification: *

You have an Azure subscription that has Azure Defender enabled for all supported resource types.
You create an Azure logic app named LA1.
You plan to use LA1 to automatically remediate security risks detected in Azure Security Center.
You need to test LA1 in Security Center.
What should you do? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.

Correct Answer:

Reference:
https://docs.microsoft.com/en-us/azure/security-center/workflow-automation#create-a-logic-app-and-define-when-it-should-automatically-run

Comment: *

Name: *

Email: *

Verification: *

Your company uses Microsoft Sentinel
A new security analyst reports that she cannot assign and resolve incidents in Microsoft Sentinel.
You need to ensure that the analyst can assign and resolve incidents. The solution must use the principle of least privilege.
Which role should you assign to the analyst?

• A.Microsoft Sentinel Responder
• B.Logic App Contributor
• C.Microsoft Sentinel Reader
• D.Microsoft Sentinel Contributor

Comment: *

Name: *

Email: *

Verification: *

You have an Azure Sentinel deployment.
You need to query for all suspicious credential access activities.
Which three actions should you perform in sequence? To answer, move the appropriate actions from the list of actions to the answer area and arrange them in the correct order.

Correct Answer:

Explanation:

According to Microsoft Sentinel documentation, Hunting is a proactive feature that allows analysts to query raw security data for indicators of compromise (IoCs), suspicious patterns, and potential threats. When an analyst needs to query for suspicious credential access activities, they should use the Hunting page in the Microsoft Sentinel portal.
The correct sequence is as follows:
* From Azure Sentinel, select Hunting.This step opens the Hunting dashboard, which provides access to all prebuilt and custom hunting queries. Each query corresponds to specific tactics and techniques aligned with the MITRE ATT&CK framework.
* Filter by tactics.Since the goal is to find suspicious credential access, you should filter the hunting queries by the Credential Access tactic. This narrows the view to only the queries related to credential theft or misuse activities.
* Select Run All Queries.Once filtered, running all relevant hunting queries executes them against your connected data sources (e.g., Defender for Endpoint, Azure AD logs, etc.) to identify suspicious credential activity patterns.
Why not the other options?
* Select New Query is used to create a custom hunting query, not to search existing suspicious credential access detections.
* From Azure Sentinel, select Notebooks is for advanced visualization and correlation using Jupyter, not for tactical hunting queries.
Final Correct Sequence:
## From Azure Sentinel, select Hunting
## Filter by tactics
## Select Run All Queries

Comment: *

Name: *

Email: *

Verification: *

You have a Microsoft 365 subscription that uses Microsoft Defender for Endpoint Plan 2 and contains a Windows device named Device!.
You initiated a live response session on Device1.
You need to run a command that will download a 250-MB file named File! .exe from the live response library to Device1. The solution must ensure that Filel.exe is downloaded as a background process.
How should you complete the live response command? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.

Correct Answer:

Explanation:

Comment: *

Name: *

Email: *

Verification: *