Microsoft Security Operations Analyst Associate (SC-200)

B is correct.

Explanation: When creating a file policy in Microsoft Defender for Cloud Apps, selecting Data Classification Services (DCS) as the content inspection method provides a unified labeling experience across Microsoft 365, Azure Information Protection, and Defender for Cloud Apps. This choice allows administrators to standardize sensitivity classifications across all protected cloud storage workloads.

A is incorrect: Built-in DLP performs content inspection directly within the policy, but it does not provide the recommended unified cross-service labeling experience.

C is incorrect: Conditional Access App Control routes real-time user sessions for inline policy enforcement rather than configuring content inspection methods inside file policies.

D is incorrect: User and entity behavioral analytics is an anomaly detection capability that profiles account activities, not a file content inspection method.

A is correct.

Explanation: Verifying security alert functionality involves executing DNS queries from a member-joined device against the monitored domain controller. To confirm the test succeeded, open that device's details page in the Defender portal and select Timeline. The DNS queries display with the MdiDnsQuery action type, validating that the sensor captured the query.

B is incorrect: The Microsoft.Tri.sensor-Errors.log file resides on the sensor host to troubleshoot service startup failures rather than logging client test queries.

C is incorrect: The Description field on the Sensors tab stores optional administrator notes for the sensor rather than displaying query validation events.

D is incorrect: The About page displays the latest sensor version available for deployment and does not record endpoint query timelines or actions.

B is correct.

Explanation: To enforce real-time controls routed from Microsoft Entra Conditional Access, you must configure a session policy in Microsoft Defender for Cloud Apps. Selecting the message inspection template, setting the application to Send Teams message, enabling Content Inspection, and setting the action to Block prevents data leakage while generating administrator notifications.

A is incorrect: File policies scan stored files at rest or during upload, so they cannot perform real-time text inspection on live chat messages.

C is incorrect: Anomaly detection policies identify deviations from established behavioral baselines rather than inspecting specific message payload contents for real-time blocking.

D is incorrect: Access policies manage initial sign-in conditions like device certificates, but they cannot evaluate and block sensitive text content during an active session.

A is correct.

Explanation: Microsoft Defender for Endpoint communicates to Intune that the device risk level changed. An Intune compliance policy configured with an MDE risk level severity triggers and marks the device as noncompliant. A Microsoft Entra ID Conditional Access policy then blocks user access to corporate apps until remediation occurs.

B is incorrect: Defender for Office 365 protects corporate email and collaboration, not personal mailboxes, so it cannot block endpoint application access.

C is incorrect: Defender for Cloud protects cloud workloads like virtual machines and databases rather than evaluating client endpoint risk to disable identities.

D is incorrect: Deleting or unregistering the device is not the supported workflow; Intune compliance state changes feed Conditional Access to restrict access.

A is correct.

Explanation: Hunt (Tier 3) is a multi-disciplinary team specifically focused on finding attackers who slipped through reactive detections and handling major business-impacting events. These analysts operate in a hypothesis-driven model rather than responding reactively, assist with advanced forensics, continuously refine automation rules, and interface directly with red and purple teams.

B is incorrect: Triage analysts focus on rapid remediation of high-volume reactive alerts requiring quick human judgment rather than conducting hypothesis-driven threat hunting.

C is incorrect: Incident Management leads nontechnical coordination across leadership, legal, and communications rather than conducting proactive technical hunting or refining detection automation.

D is incorrect: Investigation handles complex escalations and monitors sophisticated campaigns; hunting is not their primary function and occurs only during spare time.

C is correct.

Explanation: An effective prompt must incorporate a goal, context, expectations, and a source. This revised prompt successfully identifies the source plugin in Microsoft Defender XDR, specifies the context and target audience for managerial reporting, and defines clear format expectations by requesting a concise paragraph alongside an entity list.

A is incorrect: It uses negative instructions stating what to omit rather than positive directives, and it lacks source specification and target audience formatting.

B is incorrect: Referring to Copilot as an assistant model is discouraged, and the prompt omits necessary context, source references, and structured presentation expectations.

D is incorrect: Using vague urgency terms fails to define the target data source, intended operational context, or specific formatting expectations for management.

A is correct.

Explanation: When workload usage reaches ninety percent of provisioned capacity, Copilot warns analysts to contact the owner to avoid prompt submission disruptions. Administrators address workload spikes by increasing provisioned Security Compute Units or enabling overage SCUs, which deliver flexible, on-demand capacity that is billed only when consumed during unexpected operational surges.

B is incorrect: Deleting past sessions flags session data with a thirty-day retention period, but it does not restore, free, or expand provisioned compute units.

C is incorrect: Changing the preferred workspace merely alters the active user environment and cannot expand available compute capacity or resolve provisioned capacity exhaustion.

D is incorrect: Disabling audit logging stops recording Copilot audit events in Microsoft Purview, but it does not modify SCU capacity limits or prompt quotas.

A is correct.

Explanation: AI agents rely on tools to interact with external environments beyond their foundational language model and system instructions. Knowledge tools provide access to data sources such as search engines or databases, whereas action tools allow the agent to execute tasks like sending emails and updating calendars.

B is incorrect: System prompt instructions define the agent's role and behavior description, but instructions alone cannot interact with databases or dispatch email messages.

C is incorrect: Expanding the model vocabulary enhances linguistic representations during pre-training, but it does not supply external mechanisms for executing real-world actions.

D is incorrect: Knowledge tools only provide data access, meaning they cannot perform transactional actions such as sending emails or updating operational calendars.

A is correct.

Explanation: Security Copilot roles control access to platform capabilities only and do not grant access to underlying security data. Because Copilot operates on behalf of the user without elevating privileges, the analyst must hold an appropriate service-specific role such as Microsoft Sentinel Reader to query workspace incidents through the plugin.

B is incorrect: The Copilot owner role manages platform administration and permissions, but it grants no access to data within Microsoft Sentinel.

C is incorrect: Provisioning more computing capacity increases processing resources, but it cannot resolve authorization failures caused by missing data source permissions.

D is incorrect: Data sharing settings control telemetry and human review for product improvement, without affecting user access rights to Sentinel security logs.

B is correct.

Explanation: The decoder model is trained on known sequences by applying masked attention, which ensures tokens following the current position are deliberately ignored. By evaluating only preceding tokens in context, the transformer compares its next-token prediction against the known token and iteratively adjusts learned weights to reduce prediction error throughout subsequent training iterations.

A is incorrect: Multi-head attention in an encoder block evaluates multiple vector elements in parallel without concealing subsequent tokens across the training sequence.

C is incorrect: Positional encoding supplies sequence order data to initial token vectors rather than restricting which contextual tokens the decoder considers during generation.

D is incorrect: Tokenization divides raw text into vocabulary tokens with unique integer IDs before training without masking upcoming tokens during the decoding phase.

A is correct.

Explanation: Sending an email notice does not close an insider risk case in Microsoft Purview. To change the case status to Closed, the investigator must explicitly select Resolve case and assign a classification of Benign or Confirmed policy violation. This operational action records the reason and logs resolution details into Case notes.

B is incorrect: Escalating to Microsoft Purview eDiscovery (Premium) transfers the case for legal hold and deeper investigation, leaving the case unresolved.

C is incorrect: The notice is logged in Case notes automatically, but recording this communication does not transition the case to Closed status.

D is incorrect: Running a Power Automate flow automates external notifications or ticket generation, but it does not resolve or close the case.

A is correct.

Explanation: The AuditData column in exported CSV files contains record properties stored as JSON. In Excel Power Query Editor, analysts select Transform and choose JSON on the AuditData column, then use the expand icon to promote structured properties into distinct columns before loading the data back into Excel.

B is incorrect: Using Text to Columns to split by commas breaks nested JSON structures and arrays, corrupting properties instead of parsing them into columns.

C is incorrect: The -NoTypeInformation parameter suppresses the CSV type header line only; it does not parse the AuditData JSON payload into distinct fields.

D is incorrect: Filtering on friendly names does not restructure exported data because all audit records still place detailed event attributes inside AuditData as JSON.

A is correct.

Explanation: In Microsoft Purview eDiscovery, condition builder filters are combined using AND logic, which dictates that content must satisfy all specified criteria to be included. When using both the condition builder and a keyword query, Purview applies both sets of criteria to the results, ensuring items meet the keyword terms, Subject/Title filter, and Date filter simultaneously.

B is incorrect: The condition builder combines multiple filters strictly using AND logic rather than OR logic, forcing items to meet every specified rule.

C is incorrect: Purview evaluates both keywords and condition builder filters together; adding manual conditions never disables keyword matching during search execution.

D is incorrect: Purview runs condition builder filters directly against selected sources, never requiring manual conversion into a KeyQL script before running queries.

C is correct.

Explanation: Start in Microsoft Defender when you need to see whether a DLP alert connects to a broader pattern. Defender correlates DLP alerts with signals from endpoints, email, identity, and cloud apps, making it the proper tool when user behavior indicates more than an isolated, one-off policy violation.

A is incorrect: Purview alerts dashboard is used when you know which policy fired and want to inspect the specific match, check content, or tune rules.

B is incorrect: Content explorer is designed strictly to inspect the actual message or file content that triggered the match rather than correlate broad security events.

D is incorrect: Activity explorer is used to filter and compare user activities over time without opening alerts, not to correlate multi-source threat intelligence signals.

A is correct.

Explanation: To query insider risk tables like DataSecurityEvents in Microsoft Defender advanced hunting, users must be assigned the Insider Risk Management Analyst or Investigator role in Microsoft Purview. Holding only a Defender role allows viewing incidents, but accessing underlying Purview behavioral data requires specific Purview role permissions.

B is incorrect: Security Operator is a Microsoft Defender role that provides incident management permissions, but it does not grant access to Purview telemetry tables.

C is incorrect: The Microsoft 365 Compliance Administrator role is not the role required to access advanced hunting tables for insider risk data.

D is incorrect: The Insider Risk Management Analyst role is defined and assigned within Microsoft Purview, not as a Microsoft Defender role.

C is correct.

Explanation: Microsoft Defender for Endpoint uses threat intelligence generated by Microsoft hunters and partner telemetry to identify attacker tools, techniques, and procedures. When these adversary tools appear within behavioral sensor data, this threat intelligence component triggers alerts so security teams can quickly recognize and counter active attack techniques.

A is incorrect: Endpoint behavioral sensors collect and process behavioral signals from the operating system, but they do not identify attacker techniques by themselves.

B is incorrect: Cloud security analytics translates behavioral signals into insights, detections, and recommended responses, but the matching of attacker tools comes from threat intelligence.

D is incorrect: Core Defender Vulnerability Management discovers, assesses, prioritizes, and remediates vulnerabilities and misconfigurations, not attacker tools or techniques observed in sensor data.

A is correct.

Explanation: Microsoft Defender for Endpoint allows creating custom network indicators for IP addresses, URLs, and domains when Network Protection is configured in block mode. However, Classless Inter-Domain Routing (CIDR) notation for IP addresses is explicitly not supported. Indicators only support single external IP addresses rather than CIDR blocks or IP ranges, causing an entry using subnet notation to fail.

B is incorrect: Custom indicators do not support external IP address ranges or CIDR blocks; administrators must specify individual, single external IP addresses instead.

C is incorrect: Network Protection inspects network traffic across browsers, but CIDR notation is fundamentally unsupported regardless of whether connections originate from Microsoft Edge.

D is incorrect: Network Protection fully supports IP address indicators alongside URLs and domains, but entries must be formatted strictly as single IP addresses.

C is correct.

Explanation: Under Live response capabilities, the Advanced commands permission enables analysts to download files from remote devices and execute scripts from the files library. Because Basic commands explicitly excludes file copy and script execution, configuring Advanced commands is strictly necessary to satisfy all required investigation and live remediation capabilities for this tier.

A is incorrect: Basic commands only permit starting sessions and running read-only commands, while explicitly excluding file copy and script execution operations.

B is incorrect: Alerts investigation permits managing alerts, running scans, and collecting investigation packages, but does not authorize live response remote script execution.

D is incorrect: This permission configures alert suppression settings, folder exclusions, and device onboarding, rather than providing interactive live response remediation commands.

C is correct.

Explanation: Custom network indicators is the Advanced features setting that configures devices to allow or block connections to IP addresses, domains, or URLs in your custom indicator lists. Turning on this feature enables endpoint enforcement for your domain and IP entries so network connections are allowed or blocked as configured.

A is incorrect: Live Response provides remote shell connections to investigate devices, but it does not evaluate network traffic or enforce custom network indicators.

B is incorrect: Live Response unsigned script execution only permits unsigned scripts during remote sessions and does not evaluate or block endpoint network traffic.

D is incorrect: Email notifications deliver alert messages to designated recipients, but this setting does not control whether endpoint devices block network connections.

A is correct.

Explanation: Configuring the machine risk score requirement to Clear establishes the most secure compliance posture available in Intune. Under Clear, a device cannot have any existing threats to remain compliant; detecting any threat immediately marks the device noncompliant, enabling Conditional Access to block access to corporate cloud resources.

B is incorrect: The Low level permits devices with low-level threats to remain compliant, allowing devices with active threats to access corporate applications.

C is incorrect: The Medium level allows both low and medium threats without failing compliance, violating the requirement to block devices with any threat.

D is incorrect: The High level is least secure and considers devices with high, medium, or low threats compliant, never blocking devices with threats.

A is correct.

Explanation: In Defender for Cloud, selecting the Simulate button allows you to test the rule and see how many alerts would have been dismissed if active. Alerts matching enabled rules still generate but are automatically set to dismissed, allowing you to review them using the Dismissed filter.

B is incorrect: Disabling the suppression rule prevents it from dismissing alerts and does not calculate the number of alerts that match the specified criteria.

C is incorrect: Suppression rules can only run for up to six months, so configuring an expiration date of one year is not supported.

D is incorrect: Suppression rules set alert states to dismissed rather than deleting them, and scoping to all resources exceeds the single IP address constraint.

A is correct.

Explanation: Under Defender for Key Vault remediation guidance, when traffic source cannot be verified and the source is an unauthorized or suspicious user, you must perform immediate mitigation. For key vaults configured with Azure RBAC, the first immediate mitigation step is navigating to Access control (IAM) to remove the principal's role assignment.

B is incorrect: Vault access policies represent the legacy authorization model, whereas this key vault specifically uses Azure RBAC role assignments to manage access.

C is incorrect: Rotating credentials occurs during the later Take action phase after immediate mitigation is established and affected secrets have been fully identified.

D is incorrect: Contacting an owner applies only when traffic originates from known tenant entities, not when traffic sources are unfamiliar and unverified.

A is correct.

Explanation: Defender for Cloud relies on security initiatives composed of individual Azure Policy definitions to assess your resources against baseline requirements. When an individual policy evaluates a resource and determines that it fails the specified conditions, Defender for Cloud generates an actionable security recommendation to harden that resource.

B is incorrect: The regulatory compliance dashboard displays mapped compliance assessment status and downloadable reports rather than evaluating resource configurations to trigger new recommendations.

C is incorrect: Workbooks provide visual reporting across multiple data sources, but they do not assess resource conditions or produce security recommendations directly.

D is incorrect: Secure score aggregates security findings into a single percentage, but it does not evaluate compliance conditions or create the recommendations.

B is correct.

Explanation: Asset inventory utilizes Azure Resource Graph to perform scalable multi-subscription queries using Kusto Query Language. Selecting the option to export the query to Azure Resource Graph Explorer enables you to refine, modify, and save the underlying KQL query. This allows analysts to perform complex discovery queries beyond basic portal filters.

A is incorrect: Exporting to a CSV file downloads the filtered inventory list, but it does not allow editing or saving the KQL query.

C is incorrect: Selecting Trigger Logic App executes preconfigured automated logic apps on selected resources instead of modifying or saving the resource query.

D is incorrect: Selecting Add non-Azure servers launches the onboarding workflow for external machines rather than opening the resource query for KQL editing.

A is correct.

Explanation: Defender CSPM queries AWS resource APIs multiple times per day to refresh posture recommendations. When CloudTrail logs read events for export to an external SIEM, these API calls increase ingestion charges. Filtering out read-only calls generated by the CspmMonitorAws role eliminates unnecessary log volume without impairing security assessments.

B is incorrect: Disabling Defender for Servers removes protection from EC2 instances, while the posture queries originate from the Defender CSPM plan.

C is incorrect: Modifying the connector scan interval controls periodic environment discovery but does not eliminate read-only posture API calls from CloudTrail exports.

D is incorrect: Switching to Default access grants broader future permissions to Defender for Cloud and does not suppress or filter CloudTrail API events.

B is correct.

Explanation: The union operator merges all rows from SecurityEvent and SigninLogs into a single unified dataset across the selected time window. Piping that combined dataset directly into summarize count() calculates the total row count across both tables in one row. Finally, the project operator retains only the calculated count_ column, satisfying all stated query requirements.

A is incorrect: This statement summarizes only the SigninLogs table inside parentheses, returning all individual SecurityEvent rows alongside one single SigninLogs count row.

C is incorrect: This query aggregates only the SecurityEvent table before performing the union, which appends all individual SigninLogs rows rather than calculating a combined count.

D is incorrect: This syntax omits the required pipe operator between tables and references count_ without first generating that column using a summarize count() aggregation step.

A is correct.

Explanation: The extract function matches a regular expression against a text string and outputs a specified capture group substring. The documented unit query demonstrates using extend with capture group 2 on tolower(Account) to pull out the account name from between domain backslash and at-sign delimiters, successfully assigning the extracted value directly to a newly calculated column.

B is incorrect: The parse operator in relaxed mode evaluates regular string constant delimiters rather than extracting numbered regular expression capture groups from text.

C is incorrect: The mv-expand operator expands multi-value arrays into separate records instead of evaluating regular expression capture groups across unstructured string fields.

D is incorrect: The externaldata operator ingests external storage artifacts into query tables rather than parsing regular expression groups from existing log columns.

A is correct.

Explanation: The bin() function rounds values down to an integer multiple of the given bin size, grouping scattered TimeGenerated values into daily buckets. Combining this generated time series with the summarize operator and piping to a render operator with a type of timechart produces the required time-series visualization.

B is incorrect: Grouping by Account and rendering a barchart displays comparative account frequencies rather than aggregating scattered event volume into a daily time series.

C is incorrect: Summarizing by raw TimeGenerated leaves scattered timestamps ungrouped, and the piechart visualization displays category slices rather than a time-series line graph.

D is incorrect: The arg_max() function filters for the most recent computer event rather than compiling continuous aggregated record counts over time for graphical display.

B is correct.

Explanation: When no join flavor is specified, KQL defaults to innerunique, which matches only a single row from the left side for each key value. Configuring kind=inner alters this behavior to generate a row in the output for every combination of matching rows from both the left and right tables.

A is incorrect: The leftsemi flavor returns only records from the left side that have matches, without generating rows for every combination of matching pairs.

C is incorrect: The leftanti flavor returns only records from the left table that have no matches on the right, excluding matching rows completely.

D is incorrect: The fullouter flavor includes unmatched rows from both tables populated with nulls, rather than restricting the output exclusively to matching row combinations.

D is correct.

Explanation: The leftanti join flavor filters the dataset to return only records from the left side that do not have matching values on the right side. Because the scenario requires isolating logon accounts that lack corresponding logoff events, kind=leftanti returns exactly those unmatched left records while omitting accounts with matches.

A is incorrect: The leftsemi flavor returns left-side records that have matching right-side records, which is the exact opposite of the requested filtering behavior.

B is incorrect: The leftouter flavor returns all left-side records including matches, populating unmatched right-side columns with null values instead of filtering to unmatched accounts.

C is incorrect: The rightanti flavor returns records from the right side that lack matches on the left, which returns unmatched logoffs rather than logons.

D is correct.

Explanation: When connecting a workspace to Defender XDR, active Microsoft security incident creation rules are deactivated automatically to avoid duplicate incidents. This automated change applies specifically to incident creation rules for Microsoft alerts, ensuring that native security alerts stream consistently through the main Microsoft Defender XDR data connector rather than triggering redundant, parallel incidents across Sentinel and Defender.

A is incorrect: Defender XDR alert ingestion is not blocked; all alerts stream directly from the main Defender XDR connector to ensure consistency.

B is incorrect: Deactivation applies only to Microsoft security incident creation rules; other analytics rules like scheduled and near-real-time rules remain unaffected.

C is incorrect: The Microsoft Sentinel Contributor role, not Microsoft Sentinel Reader, is assigned to Microsoft Threat Protection and WindowsDefenderATP subscription apps.

A is correct.

Explanation: Microsoft Defender for Cloud is recommended when an organization needs to evaluate security posture, maintain policy compliance, and identify security misconfigurations. To bring these insights into centralized security operations, Microsoft Sentinel can ingest Defender for Cloud alerts directly through a dedicated data connector, uniting posture management with SIEM capabilities.

B is incorrect: Workbooks visualize existing log data via KQL queries, but they do not assess posture compliance or ingest Defender for Cloud alerts.

C is incorrect: Logic Apps playbooks execute automated response actions after alerts trigger, rather than assessing cloud security posture or checking compliance misconfigurations.

D is incorrect: TAXII data connectors ingest external threat intelligence feeds into Sentinel, rather than checking environmental security posture or compliance misconfigurations.

A is correct.

Explanation: You connect data connectors in Microsoft Sentinel by first installing Content hub solutions. After installation, administrators can add connectors such as Azure activity logs by selecting a button, whereas syslog requires additional configuration. Installing the solutions provides the connector interfaces needed to ingest data from both cloud and on-premises sources.

B is incorrect: Scheduled analytics alerts evaluate data that is already ingested, so they cannot establish ingestion connections for Azure activity or syslog.

C is incorrect: Workbooks provide visual dashboards based on KQL queries of ingested logs, rather than providing connectors to ingest new log sources.

D is incorrect: Playbooks run automated response workflows using Logic Apps after alerts trigger, rather than managing the ingestion of data from sources.

C is correct.

Explanation: The region setting determines where ingested data is physically stored, directly impacting compliance and data governance. Workspaces cannot be moved from one region to another after creation. To correct the region, the administrator must create a new Log Analytics workspace in the required region and add Microsoft Sentinel to that new workspace.

A is incorrect: Log Analytics workspaces cannot move from region to region, making an Azure resource move operation impossible for this scenario.

B is incorrect: The region parameter is permanently established during workspace creation and cannot be modified afterwards in the Basics configuration settings.

D is incorrect: Changing the workspace name changes only the displayed resource label and does not alter where ingested log records are stored.

A is correct.

Explanation: When the Defender portal displays the This page has a new home notification under Threat intelligence, selecting Open Intel management redirects you to the Intel management page. From that consolidated destination, you can select the Add new button, choose the indicator type, and apply the required values.

B is incorrect: The Add new button is found on the redirected Intel management page rather than on the initial transition notice screen.

C is incorrect: Querying tables in Logs allows you to view existing threat indicators but does not provide an interface to add new indicators.

D is incorrect: Selecting Apply is the final step completed inside the New indicator panel after choosing the indicator type and entering required fields.

A is correct.

Explanation: The Threat Intelligence Upload API ingests threat intelligence STIX objects directly at the workspace level and requires write permissions. To authorize automated ingestion, you must assign the Microsoft Sentinel Contributor role directly to the registered Microsoft Entra application under Access control (IAM) on the target Log Analytics workspace.

B is incorrect: The Microsoft Sentinel Reader role provides read-only access and cannot grant the write permissions necessary to ingest STIX indicator objects.

C is incorrect: Application Developer is a Microsoft Entra directory role used for creating app registrations, not an Azure role for workspace ingestion.

D is incorrect: Granting Contributor to user groups provides interactive permissions for personnel, but it does not authenticate the external application submitting indicators.

A is correct.

Explanation: In the Microsoft Defender portal, viewing connected agent hosts requires selecting the workspace, choosing Log Analytics settings, and opening the workspace. Within the Log Analytics workspace navigation menu, selecting Settings, clicking Agents, and opening the Linux tab displays all connected Linux hosts reporting with an installed agent.

B is incorrect: The Data connectors page and its Data Types section indicate destination tables receiving ingested data, not the inventory of connected hosts.

C is incorrect: The Instructions tab outlines prerequisites and data source setup steps rather than displaying the live inventory of connected Windows or Linux hosts.

D is incorrect: Selecting Workspace settings under Configuration represents the Azure portal navigation path, and Workbooks does not provide the host agent connection list.

B is correct.

Explanation: Microsoft Sentinel requires specific connection fields on the Threat intelligence - TAXII connector page to pull threat indicators. You must enter a friendly name for the server, the API root URL, the Collection ID, a username, and a password, then select Add to establish communication with the external TAXII server.

A is incorrect: Application ID, access tokens, and workspace ID are parameters required for the Threat Intelligence Upload API rather than TAXII connections.

C is incorrect: An OAuth 2.0 client secret and workspace ID belong to custom Upload API configurations, whereas TAXII requires basic server credentials.

D is incorrect: The TAXII connector page does not accept tenant or subscription IDs, requiring an API root URL, collection ID, and user credentials.

A is correct.

Explanation: Ingesting indicators from Microsoft Defender Threat Intelligence requires installing the Threat Intelligence solution from Content hub in Microsoft Sentinel. Once you install this solution, the Defender Threat Intelligence data connector appears under Data connectors. You can then open the connector page and select Connect to start ingesting high-fidelity indicators.

B is incorrect: The TAXII connector pulls indicators from external TAXII servers and cannot enable or make available the Defender Threat Intelligence connector.

C is incorrect: Assigning Microsoft Sentinel Contributor permissions to a registered application is required for the Upload API, not for displaying this connector.

D is incorrect: Running a Kusto query inspects existing indicators within the workspace, but it cannot install solutions or make missing connectors available.

D is correct.

Explanation: Legacy connectors only stream alerts and cause incidents in both portals to require independent management while omitting raw log data. Deploying the Microsoft Defender XDR connector removes these legacy limitations by ingesting raw data for hunting and synchronizing incidents bidirectionally between the Microsoft Defender portal and Microsoft Sentinel.

A is incorrect: The Microsoft Defender for Cloud connector streams cloud workload alerts rather than replacing endpoint connectors or ingesting endpoint raw event data.

B is incorrect: Microsoft Defender for Identity is another legacy connector subject to identical alert-only limitations and separate incident management in both consoles.

C is incorrect: The Microsoft Defender for IoT connector connects IoT alerts and recommendations instead of addressing endpoint raw log ingestion and incident duplication.

B is correct.

Explanation: In Azure Logic Apps, each step can receive outputs produced by preceding steps using dynamic content. The trigger When a response to a Microsoft Sentinel alert is triggered outputs dynamic properties including Entities. Selecting Entities from the Dynamic content list automatically maps the alert's entity list into the action.

A is incorrect: Manual entry hardcodes static values, preventing the action from dynamically processing the distinct entity outputs generated by each incoming alert trigger.

C is incorrect: Cloning makes a copy of an existing logic app as a template but cannot populate action inputs with runtime trigger data.

D is incorrect: Update Schema updates the logic app schema after major structural changes rather than supplying runtime property outputs into an action.

A is correct.

Explanation: In Microsoft Sentinel, after opening the incident details pane for the virtual machine deletion incident, selecting Actions and then Run playbook (Preview) opens the Run playbook on incident page. From there, on the Playbooks tab, you can locate your ClosingIncident playbook and select Run to trigger the automated response actions manually against that specific incident.

B is incorrect: Navigating to Automation and selecting Create with an incident trigger creates a new playbook instead of running an existing one.

C is incorrect: Using Settings to configure Playbook permissions grants Sentinel access to the workspace resource group rather than triggering playbooks on incidents.

D is incorrect: Analytics settings govern rule creation for generating incidents rather than manually invoking an existing playbook from an open incident pane.

A is correct.

Explanation: The built-in unifying parser _Im_Dns combines all workspace sources normalized to the DNS schema into one view. Supplying the filtering parameters starttime and responsecodename filters records before parsing to maximize query performance. The subsequent summarize operator aggregates the normalized SrcIpAddr and TimeGenerated fields as requested.

B is incorrect: Filtering records after parsing forces the parser to process unneeded data, which degrades query performance compared to using built-in filtering parameters.

C is incorrect: The vimDnsInfobloxNIOS function is a source-specific parser, meaning it retrieves only Infoblox activity rather than combining all workspace DNS event sources.

D is incorrect: Querying the Syslog table directly bypasses data normalization, failing to use normalized field names and ignoring DNS events logged in other tables.

A is correct.

Explanation: In the New Parameter configuration pane for a Drop down parameter, setting Get data from to Query allows the administrator to execute a Log Analytics query, such as AzureActivity | summarize by Level. This retrieves the distinct event levels directly from ingested log telemetry to populate the dropdown choices.

B is incorrect: The Set a parameter value action belongs to links steps rather than supplying dynamic dropdown parameter values from log query results.

C is incorrect: Enabling Limit multiple selections restricts choices rather than retrieving and populating event level data dynamically from workspace activity logs.

D is incorrect: Hiding the parameter in reading mode conceals the control from viewers rather than connecting it to log data to populate values.

A is correct.

Explanation: The entity page timeline displays alerts only when the specific entity is defined as a mapped entity. When organizations create custom alerts using analytics rules, proper entity mapping must be configured within the rules. Without correct entity mapping, Microsoft Sentinel cannot correlate custom rule alerts with the user entity timeline.

B is incorrect: Modifying rule execution frequency alters alert generation intervals, but it cannot associate generated alerts with an entity lacking proper mapping.

C is incorrect: Anomaly rule templates detect unusual behavior independently and cannot convert unmapped custom analytics alerts into entity page timeline items.

D is incorrect: Exporting audit logs does not configure Sentinel analytical alert schemas, which depend on internal entity mapping to display timeline entries.

A is correct.

Explanation: In Microsoft Sentinel threat hunting, keeping a hypothesis time-bound ensures analysts specify exact log timeframes such as the last day or week. Documenting the specific execution time and period covered informs team members of completed work, directly preventing analysts from repeating the same hunt on an identical dataset.

B is incorrect: Keeping hunts achievable ensures the organization possesses sufficient data and expertise to locate results, rather than tracking covered time ranges.

C is incorrect: Keeping the scope narrow prevents overly broad investigations like vague logon anomalies, but does not track hunted historical time windows.

D is incorrect: Keeping hunts useful and efficient targets weak detection areas and realistic threat models, but does not address duplicate timeframe coverage.

A is correct.

Explanation: Notebooks consist of two primary components, and the kernel is specifically responsible for parsing and executing the code. In Microsoft Sentinel, the kernel runs on an Azure virtual machine. To handle execution bottlenecks caused by complex machine learning models, administrators can select licensing options that provide more powerful virtual machines.

B is incorrect: The browser-based interface is only used to enter queries and view results, but it does not execute notebook code.

C is incorrect: The msticpy package provides specialized security hunting and investigation tools, but it does not provide the compute execution engine.

D is incorrect: The Microsoft Sentinel Community GitHub repository hosts downloadable sample notebooks and does not provide compute capacity for parsing execution.

B is correct.

Explanation: Bookmarks preserve relevant hunting query results along with contextual notes and tags for collaboration. When an analyst selects a bookmark, using the Incident actions button allows them to create a new incident directly from that finding, making it immediately manageable on the Incidents page alongside other security incidents.

A is incorrect: Marking a query as a favorite only configures it to run automatically on page open, without preserving individual events or creating incidents.

C is incorrect: Mapping entities in a custom query defines data schema relationships, but it does not save individual event findings or generate new incidents.

D is incorrect: Filtering by MITRE tactics narrows available queries, but re-executing a query does not preserve specific records or escalate findings to the queue.

A is correct.

Explanation: In Microsoft Sentinel, simulated coverage highlights detections that are available, but not currently configured, in your workspace. Selecting Hunting queries from the Simulated rules drop-down menu and choosing the Hunting queries View link jumps to the Hunting page, displaying a filtered list of available queries associated with the selected technique.

B is incorrect: Default active scheduled query rules display detections already running in the workspace rather than identifying hunting queries that are available but not yet configured.

C is incorrect: Enabling the threat scenarios slider filters the matrix by selected scenarios and automatically disables the simulated rules drop-down menu needed to view unconfigured queries.

D is incorrect: Creating bookmarks preserves investigation findings from executed queries instead of locating available, unconfigured hunting queries mapped to a technique in the coverage matrix.

B is correct.

Explanation: Developing an effective threat hunting hypothesis requires keeping the scope narrow and time-bound while defining actionable outcomes. Checking accounts that executed cmd.exe during the last day without running it during the prior week restricts the timeframe, focuses on a specific executable, and establishes clear baseline comparison criteria.

A is incorrect: Hunting broadly for unusual sign-in activity across all tenant logs fails to narrow the scope or specify measurable result meanings.

C is incorrect: Hunting for global threats targeting unrelated industries wastes effort on techniques that do not align with your specific threat model.

D is incorrect: Searching all suspicious actions since inception lacks time boundaries and creates an impossibly broad scope that prevents efficient threat hunting.