HOTSPOT-You have an Azure subscription that contains a user named User1 and a Microsoft Sentinel workspace named WS1.You deploy Advanced Security Information Model (ASIM) authentication parsers to WS1.You need to use the parsers to query the authentication events generated by User1 during the last 24 hours. The solution must maximize the performance of the query.How should you complete the query? To answer, select the appropriate options in the answer area.NOTE: Each correct selection is worth one point.
You have an Azure subscription that contains a Microsoft Sentinel workspace named WS1 and 100 virtual machines that run Windows Server.You need to configure the collection of Windows Security event logs for ingestion to WS1. The solution must meet the following requirements:• Capture a full user audit trail including user sign-in and user sign-out events.• Minimize the volume of events.• Minimize administrative effort.Which event set should you select?
DRAG DROP-You have a Microsoft 365 E5 subscription that uses Microsoft Exchange Online.You need to identify phishing email messages.Which three cmdlets should you run in sequence? To answer, move the appropriate cmdlets from the list of cmdlets to the answer area and arrange them in the correct order.
DRAG DROP -You plan to connect an external solution that will send Common Event Format (CEF) messages to Azure Sentinel.You need to deploy the log forwarder.Which three actions should you perform in sequence? To answer, move the appropriate actions form the list of actions to the answer area and arrange them in the correct order.Select and Place:
You need to implement the Azure Information Protection requirements.What should you configure first?
You have a Microsoft 365 subscription that contains the following resources:• 100 users that are assigned a Microsoft 365 E5 license• 100 Windows 11 devices that are joined to the Microsoft Entra tenantThe users access their Microsoft Exchange Online mailbox by using Outlook on the web.You need to ensure that if a user account is compromised, the Outlook on the web session token can be revoked. What should you configure?
