Your organization uses Microsoft defender for cloud. In Microsoft defender for cloud, you want to see the topology of your workloads. Which feature of Defender enables you to see it:

Your organization has Microsoft 365 Defender, Microsoft Defender for Endpoint. Your organization need you to do an in-depth investigation and take immediate response action on identified threats in real-time? What should you use:

Which live response basic command is used to Initiates a live response session to the device?

You have Microsoft Defender for Endpoint. In Indicators, which file type and type is used to upload and accepted type?

What types of risks are there in Azure AD?

Your organization has Microsoft Defender for Cloud. You need to protect against identity risk. Your organization’s specialist expertise is in retail and not a security specialist. What can you use to protect against identity risk?

Your organization have Microsoft Defender and Microsoft Cloud App Security. You have sensitive data which contain users details such as card numbers, etc. You plan to create a policy that can help to protect sensitive information. You plan to use a data loss prevention (DLP) policy to protect.

What will you use to detect sensitive information/data, and in which document is it?

Your organization has Microsoft defender for cloud. You need to investigate potential cyberattack, and the sooner you identify better off your organization will be. You are receiving alerts. What will you use to investigate automatically and respond with a set of security playbooks when an alert triggered?

Your organization has a Microsoft 365 subscription that uses Microsoft Defender for Office 365. You have configured Cloud App Security, and you have sensitive information, so you have used DLP to protect. Which type of policy is used?

You have an Azure subscription that has Microsoft Defender for Cloud. You want to safeguards encryption secrets and key. Ex: Passwords. Which service will use for secrets?

Your company has an Azure subscription that uses Microsoft Defender for Cloud. You want to ensure that Microsoft Defender for Cloud covers all resources in Azure subscription by Enabling the Automatic provisioning option. What if you started a new Azure Windows VM without using auto-provisioning? What should you install in the new VM?

You are planning to automate remediation in your subscription. Which Azure technology will be used?

Which render operator is used to creating a visualization of time series in the KQL query?

Your company has an Azure subscription. You have Microsoft Sentinel. Security operations could be included when you use Microsoft Sentinel. Which of the following is not included in Security operations?

Your organization has an Azure subscription, and you want to collect event data from various sources and perform security operations on that data to identify suspicious activity. What service will you plan to use to identify suspicious activity?

You have a Microsoft Sentinel. You can create a query using Kusto Query Language(KQL). Which table will you query to view your indicators?

You have Microsoft Sentinel. Next, you must configure a Linux machine to forward the logs from your security solution to your Microsoft Sentinel workspace. You want to connect an external solution. You plan to use the CEF connector.  What needs to be installed in the Linux machine?

Your organization uses Microsoft Sentinel, and you have a Sentinel workspace. Where can you test in Microsoft Sentinel from, as you want to try a playbook manually in the Azure portal?

When a user attempts to sign in from a location that was never used by the other users in your organization to sign in, you need to receive a security alert when user attempts to sign in from unused location by users in organization. Which anomaly detection policy should you use?

You have an Azure subscription that has Microsoft Defender for cloud enabled for all supported resource types. You need to configure the continuous export of high-severity alerts to enable their retrieval from a third-party security information and event management (SIEM) solution such as Splunk or Qradar.

To which service should you export the alerts?

You have a playbook in Microsoft Sentinel. When you trigger the playbook, it sends an email to a distribution group. You need to modify the playbook to send the email to the owner of the resource instead of the distribution group.

What should you do?

You recently deployed Microsoft Sentinel. You discover that the default Fusion rule does not generate any alerts. You verify that the rule is enabled. You need to ensure that the Fusion rule can generate alerts.

What should you do?

Your company uses Microsoft Sentinel. A new security analyst reports that she cannot assign and dismiss incidents in Microsoft Sentinel. You need to resolve the issue for the analyst. The solution must use the principle of least privileges.

Which role should you assign to the analyst?

You need to create the test rule to meet the requirements for Investigate an incident.

What should you add when you create the rule?