SC-100 Security Operations 2

Question 1

A security architect needs to reduce mean time to detect (MTTD) for identity-based attacks across a hybrid environment. Which Microsoft Sentinel feature should be prioritized?

Accepted Answer

Enable User and Entity Behavior Analytics (UEBA) to baseline and detect anomalous identity activity

Answer

UEBA in Microsoft Sentinel uses machine learning to baseline normal behavior and detect anomalous identity activity, directly reducing MTTD for identity-based attacks.

Question 2

During an incident investigation, a SOC analyst discovers that an attacker used a Pass-the-Hash technique to move laterally. Which Microsoft Defender for Identity alert would have flagged this activity?

Accepted Answer

Suspected identity theft using Pass-the-Hash attack

Answer

Microsoft Defender for Identity includes a specific detection for Pass-the-Hash attacks, which alerts when NTLM authentication is used with a stolen hash.

Question 3

An organization wants to automate response to phishing emails detected by Microsoft Defender for Office 365. What is the recommended approach in Microsoft Sentinel?

Accepted Answer

Create a Playbook using Azure Logic Apps triggered by a Sentinel incident with PhishingEmail entity

Answer

Sentinel Playbooks are Azure Logic Apps that can be triggered by incidents and automate responses such as blocking senders or deleting phishing emails.

Question 4

A cybersecurity architect must design a solution to ingest security logs from a third-party firewall into Microsoft Sentinel. Which connector type is most appropriate when no native connector exists?

Accepted Answer

Common Event Format (CEF) connector via a Linux log forwarder

Answer

CEF over Syslog via a Linux forwarder is the standard approach for ingesting logs from third-party network appliances that support CEF output.

Question 5

Which Microsoft Sentinel feature allows a security team to proactively search for threats that have not triggered any alerts?

Accepted Answer

Hunting queries using KQL across historical log data

Answer

Hunting queries in Sentinel allow analysts to proactively search historical data using KQL for indicators of compromise that may not have triggered automated alerts.

(SC-100) Microsoft Cybersecurity Architect Expert Practice Test

(SC-100) Microsoft Cybersecurity Architect Expert Practice Test

SC-100 Security Operations 2