- (Topic 4)
You have a Microsoft 365 subscription. The subscription uses Microsoft 365 Defender and has data loss prevention (DLP) policies that have aggregated alerts configured.
You need to identify the impacted entities in an aggregated alert.
What should you review in the DIP alert management dashboard of the Microsoft Purview compliance portal?

1. A. the Details tab of the alert
2. B. Management log
3. C. the Sensitive Info Types tab of the alert
4. D. the Events tab of the alert

Correct Answer: B

- (Topic 4)
Your company uses Azure Sentinel.
A new security analyst reports that she cannot assign and dismiss incidents in Azure Sentinel. You need to resolve the issue for the analyst. The solution must use the principle of least privilege. Which role should you assign to the analyst?

1. A. Azure Sentinel Responder
2. B. Logic App Contributor
3. C. Azure Sentinel Contributor
4. D. Azure Sentinel Reader

Correct Answer: A
Reference:
https://docs.microsoft.com/en-us/azure/sentinel/roles

- (Topic 3)
You need to ensure that the processing of incidents generated by rulequery1 meets the Microsoft Sentinel requirements.
What should you create first?

1. A. a playbook with an incident trigger
2. B. a playbook with an entity trigger
3. C. an Azure Automation rule
4. D. a playbook with an alert trigger

Correct Answer: A

- (Topic 4)
Your company has a single office in Istanbul and a Microsoft 365 subscription.
The company plans to use conditional access policies to enforce multi-factor authentication (MFA).
You need to enforce MFA for all users who work remotely. What should you include in the solution?

1. A. a fraud alert
2. B. a user risk policy
3. C. a named location
4. D. a sign-in user policy

Correct Answer: C
Reference:
https://docs.microsoft.com/en-us/azure/active-directory/conditional-access/location- condition

HOTSPOT - (Topic 4)
You have a Microsoft 365 E5 subscription.
You plan to perform cross-domain investigations by using Microsoft 365 Defender.
You need to create an advanced hunting query to identify devices affected by a malicious email attachment.
How should you complete the query? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.

Solution:


Does this meet the goal?

1. A. Yes
2. B. No

Correct Answer: A