Threat Detection & Monitoring Flashcards

Which Microsoft Sentinel feature maps detected threats to the MITRE ATT&CK framework to help analysts understand attacker techniques?

Answer: MITRE ATT&CK coverage blade

The MITRE ATT&CK blade in Microsoft Sentinel visualizes which tactics and techniques your analytics rules cover and which ones have active detections.

An organization wants to detect when an Azure resource is accessed from a Tor exit node IP address. Which Microsoft service provides the IP reputation data to enable this detection?

Answer: Microsoft Threat Intelligence (MSTI)

Microsoft Threat Intelligence (MSTI) provides IP reputation data including Tor exit node classification, which Sentinel and Defender products use for enrichment and detection.

In Microsoft Defender for Endpoint, what is the difference between 'EDR in block mode' and standard EDR?

Answer: EDR in block mode can remediate threats even when a third-party AV is the primary solution

EDR in block mode allows Defender for Endpoint to remediate post-breach artifacts even when a third-party antivirus product is set as the primary AV solution.

A security analyst is reviewing a Defender for Identity alert about a 'Golden Ticket' attack. What does this attack type involve?

Answer: Forging Kerberos TGTs using a compromised KRBTGT account hash

A Golden Ticket attack involves using a stolen KRBTGT hash to forge Kerberos Ticket Granting Tickets (TGTs), granting arbitrary access to any service.

Which Microsoft Sentinel Log Analytics workspace setting should be configured to meet a compliance requirement that security logs must be retained for 7 years?

Answer: Workspace retention and archiving settings

Microsoft Sentinel workspace retention settings allow interactive retention up to 2 years and archival up to 12 years total to meet long-term compliance requirements.

During an incident investigation, you need to collect a forensic memory dump from a compromised Windows endpoint without physically accessing it. Which Defender for Endpoint capability enables this?

Answer: Live response

Live response in Microsoft Defender for Endpoint provides a remote shell to collect files, run scripts, and capture forensic artifacts like memory dumps from endpoints.

A company deploys Microsoft Defender for Cloud across a multi-cloud environment including AWS and GCP. Which feature provides unified security posture management across all three clouds?

Answer: Cloud Security Posture Management (CSPM)

Defender CSPM extends across Azure, AWS, and GCP to provide a unified view of misconfigurations, compliance, and security posture with cross-cloud recommendations.