HOTSPOT - (Topic 4)
You have an Azure subscription that has Azure Defender enabled for all supported resource types.
You create an Azure logic app named LA1.
You plan to use LA1 to automatically remediate security risks detected in Defenders for Cloud.
You need to test LA1 in Defender for Cloud.
What should you do? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.

Solution:


Does this meet the goal?

1. A. Yes
2. B. No

Correct Answer: A

- (Topic 4)
You have an Azure subscription that uses Microsoft Defender for Cloud and contains 100 virtual machines that run Windows Server.
You need to configure Defender for Cloud to collect event data from the virtual machines. The solution must minimize administrative effort and costs.
Which two actions should you perform? Each correct answer presents part of the solution. NOTE: Each correct selection is worth one point.

1. A. From the workspace created by Defender for Cloud, set the data collection level to Common
2. B. From the Microsoft Endpoint Manager admin center, enable automatic enrollment.
3. C. From the Azure portal, create an Azure Event Grid subscription.
4. D. From the workspace created by Defender for Cloud, set the data collection level to All Events
5. E. From Defender for Cloud in the Azure portal, enable automatic provisioning for the virtual machines.

Correct Answer: DE

- (Topic 4)
You provision a Linux virtual machine in a new Azure subscription.
You enable Azure Defender and onboard the virtual machine to Azure Defender.
You need to verify that an attack on the virtual machine triggers an alert in Azure Defender. Which two Bash commands should you run on the virtual machine? Each correct answer
presents part of the solution.
NOTE: Each correct selection is worth one point.

1. A. cp /bin/echo ./asc_alerttest_662jfi039n
2. B. ./alerttest testing eicar pipe
3. C. cp /bin/echo ./alerttest
4. D. ./asc_alerttest_662jfi039n testing eicar pipe

Correct Answer: AD
Reference:
https://docs.microsoft.com/en-us/azure/security-center/security-center-alert-validation#simulate-alerts-on-your- azure-vms-linux-

- (Topic 3)
You need to implement the Defender for Cloud requirements. Which subscription-level role should you assign to Group1?

1. A. Security Admin
2. B. Owner
3. C. Security Assessment Contributor
4. D. Contributor

Correct Answer: B

- (Topic 4)
You need to deploy the native cloud connector to Account! to meet the Microsoft Defender for Cloud requirements. What should you do in Account! first?

1. A. Create an AWS user for Defender for Cloud.
2. B. Create an Access control (1AM) role for Defender for Cloud.
3. C. Configure AWS Security Hub.
4. D. Deploy the AWS Systems Manager (SSM) agent

Correct Answer: D