Microsoft Azure Security Engineer Certification Azure Security Operations and Monitoring 2 — Questions and Answers
Question 1: Which KQL operator is used in Microsoft Sentinel to combine rows from two log tables based on a matching field?
- where
- summarize
- join (Correct answer)
- project
Correct answer: join
The KQL `join` operator merges two tables on specified key columns, supporting kinds like inner, leftouter, and rightouter.
Question 2: What is the primary purpose of Microsoft Sentinel workbooks?
- Author and deploy detection rules
- Automate incident response with Logic Apps
- Visualize and analyze security data through interactive dashboards (Correct answer)
- Configure and manage data connectors
Correct answer: Visualize and analyze security data through interactive dashboards
Sentinel workbooks display KQL query results as charts, tables, and graphs in interactive Azure Monitor Workbook dashboards.
Question 3: Which Microsoft Defender for Cloud feature maps your environment's controls against regulatory frameworks like PCI DSS, NIST, and ISO 27001?
- Secure Score
- Regulatory Compliance dashboard (Correct answer)
- Workload Protections blade
- Security Alerts panel
Correct answer: Regulatory Compliance dashboard
The Regulatory Compliance dashboard shows pass and fail status for each control across selected compliance standards in your environment.
Question 4: Which Microsoft Sentinel feature allows security analysts to proactively search for threats not yet covered by automated analytics rules?
- Workbooks
- Playbooks
- Hunting queries (Correct answer)
- Incident queue
Correct answer: Hunting queries
Hunting queries are KQL queries analysts run interactively to look for suspicious patterns and anomalies without a predefined detection.
Question 5: Which Microsoft Defender for Servers alert type indicates suspicious access to the Azure Instance Metadata Service that could enable credential theft?
- SQL injection attempt detected
- Credential Access - IMDS service abuse (Correct answer)
- Outbound network port scan
- Suspicious cryptomining activity
Correct answer: Credential Access - IMDS service abuse
Defender for Servers alerts on abnormal IMDS queries because attackers on compromised VMs query this endpoint to steal managed identity tokens.
Question 6: What does UEBA stand for in the context of Microsoft Sentinel?
- Unified Enterprise Backup Architecture
- User and Entity Behavior Analytics (Correct answer)
- Unified Event-Based Alerting
- User Environment Baseline Assessment
Correct answer: User and Entity Behavior Analytics
UEBA in Sentinel uses machine learning to baseline normal activity for users, hosts, and IPs, then flags anomalous deviations.
Microsoft Azure Security Engineer Certification Azure Security Operations and Monitoring 2
Which KQL operator is used in Microsoft Sentinel to combine rows from two log tables based on a matching field?