Microsoft Azure Security Engineer Certification Azure Security Operations and Monitoring 2

Question 1

Which KQL operator is used in Microsoft Sentinel to combine rows from two log tables based on a matching field?

Accepted Answer

join

Answer

The KQL `join` operator merges two tables on specified key columns, supporting kinds like inner, leftouter, and rightouter.

Question 2

What is the primary purpose of Microsoft Sentinel workbooks?

Accepted Answer

Visualize and analyze security data through interactive dashboards

Answer

Sentinel workbooks display KQL query results as charts, tables, and graphs in interactive Azure Monitor Workbook dashboards.

Question 3

Which Microsoft Defender for Cloud feature maps your environment's controls against regulatory frameworks like PCI DSS, NIST, and ISO 27001?

Accepted Answer

Regulatory Compliance dashboard

Answer

The Regulatory Compliance dashboard shows pass and fail status for each control across selected compliance standards in your environment.

Question 4

Which Microsoft Sentinel feature allows security analysts to proactively search for threats not yet covered by automated analytics rules?

Accepted Answer

Hunting queries

Answer

Hunting queries are KQL queries analysts run interactively to look for suspicious patterns and anomalies without a predefined detection.

Question 5

Which Microsoft Defender for Servers alert type indicates suspicious access to the Azure Instance Metadata Service that could enable credential theft?

Accepted Answer

Credential Access - IMDS service abuse

Answer

Defender for Servers alerts on abnormal IMDS queries because attackers on compromised VMs query this endpoint to steal managed identity tokens.

Microsoft Azure Security Engineer Certification Practice Test

Microsoft Azure Security Engineer Certification Practice Test

Microsoft Azure Security Engineer Certification Azure Security Operations and Monitoring 2