Threat Detection & Monitoring Flashcards

Which KQL operator would you use in Microsoft Sentinel to join the SecurityAlert table with the IdentityInfo table to enrich alerts with user department information?

Answer: join

The KQL 'join' operator merges rows from two tables based on a matching key, enabling enrichment of alerts with identity data.

A security engineer is configuring Microsoft Defender for Identity. Which on-premises component is required to collect and forward Active Directory signals?

Answer: MDI sensor

The Microsoft Defender for Identity sensor is installed on domain controllers to capture AD traffic and forward it to the Defender for Identity cloud service.

You need to detect when a user's account is used to sign in from two geographically distant locations within an impossibly short time. Which Microsoft Entra ID Protection risk detection covers this?

Answer: Atypical travel

The 'Atypical travel' risk detection identifies sign-ins from geographically distant locations where travel between them would be impossible given the time elapsed.

In Microsoft Defender for Cloud, what does a 'Secure Score' represent?

Answer: A percentage reflecting how many security recommendations have been implemented

Secure Score in Defender for Cloud measures the percentage of security recommendations that have been remediated, giving a posture health percentage.

An analyst is reviewing a Microsoft Sentinel incident and sees multiple alerts grouped together. What determines whether alerts are grouped into the same incident?

Answer: Alert grouping settings in the analytics rule

Alert grouping is configured within the analytics rule settings, allowing similar alerts to be merged into a single incident based on entity matching criteria.

Which Microsoft Sentinel feature allows you to import external threat intelligence feeds and use those indicators in analytics rules?

Answer: Threat Intelligence data connectors

Threat Intelligence data connectors in Sentinel ingest IoC feeds (TAXII or flat file) into the ThreatIntelligenceIndicator table for use in detection rules.

A SOC analyst receives a high-severity alert about a suspicious process injection. Which Defender for Endpoint action should the analyst take FIRST to preserve forensic evidence while containing the threat?

Answer: Isolate the device

Isolating the device cuts off network access while keeping the device online for investigation, preserving evidence without removing the endpoint from management.