{ "title": "Security Quiz 3", "totalQuestions": 50, "extractedAt": "2026-07-26T17:02:57.066Z", "questions": [ { "number": 1, "question": "A global organization is planning a Microsoft Sentinel deployment across multiple Azure regions. Which architectural constraint regarding Log Analytics workspaces is most critical for long-term data residency and cost management?", "options": [ { "label": "A", "text": "A single Sentinel instance can only aggregate data from one region.", "isCorrect": false, "rationale": "Sentinel can aggregate data across regions, but it involves cross-region egress costs and potential compliance violations." }, { "label": "B", "text": "Cross-region querying requires the use of Azure Lighthouse for data access.", "isCorrect": false, "rationale": "Lighthouse is for cross-tenant management; cross-region queries within a tenant use the standard $workspace()$ KQL function." }, { "label": "C", "text": "Workspaces cannot be moved between regions after creation.", "isCorrect": true, "rationale": "Region selection is fixed at creation, making it the hardest architectural decision to reverse if data residency requirements change." }, { "label": "D", "text": "Log Analytics workspaces must reside in the same region as the resources they monitor.", "isCorrect": false, "rationale": "Resources can send logs to a workspace in a different region, though this usually incurs cross-region bandwidth charges." } ], "hint": "Consider the permanence of physical storage location settings in Azure Monitor.", "correctAnswer": "C" }, { "number": 2, "question": "An analyst needs to create and manage automation playbooks in Microsoft Sentinel. Which specific Azure RBAC role is required beyond the Microsoft Sentinel Contributor role to accomplish this?", "options": [ { "label": "A", "text": "Microsoft Sentinel Automation Contributor", "isCorrect": false, "rationale": "This role is typically used by the Sentinel service principal to execute playbooks, rather than for human authoring." }, { "label": "B", "text": "Logic App Contributor", "isCorrect": true, "rationale": "Playbooks are built on Azure Logic Apps, which is a separate resource type requiring its own specific contributor permissions." }, { "label": "C", "text": "Automation Job Operator", "isCorrect": false, "rationale": "This role pertains to Azure Automation accounts, which are distinct from the Logic Apps used for Sentinel playbooks." }, { "label": "D", "text": "Managed Identity Operator", "isCorrect": false, "rationale": "While managed identities are used for authentication, authoring the workflow itself requires access to the Logic App resource." } ], "hint": "Recall the underlying Azure service that powers Sentinel's orchestration workflows.", "correctAnswer": "B" }, { "number": 3, "question": "When onboarding Microsoft Sentinel, which type of workspace is explicitly prohibited for selection during the initial setup process?", "options": [ { "label": "A", "text": "Workspaces configured with the 'Auxiliary' data plan.", "isCorrect": false, "rationale": "Sentinel is layered on the workspace itself; specific table plans within the workspace are managed separately." }, { "label": "B", "text": "Workspaces already linked to an Azure DevOps repository.", "isCorrect": false, "rationale": "Source control integration is a feature of Sentinel that can be configured after the workspace is selected." }, { "label": "C", "text": "Workspaces located in a different subscription than the Sentinel resource.", "isCorrect": false, "rationale": "Sentinel can be enabled on a workspace in any subscription, provided the user has sufficient permissions." }, { "label": "D", "text": "The default workspace auto-created by Microsoft Defender for Cloud.", "isCorrect": true, "rationale": "The system-generated default MDC workspace is not eligible for Sentinel; a custom workspace must be created first." } ], "hint": "Think about the specialized, system-managed containers used for basic security posture.", "correctAnswer": "D" }, { "number": 4, "question": "How does the Microsoft Sentinel 'Workspace Manager' differ from Azure Lighthouse in a multi-tenant security operations environment?", "options": [ { "label": "A", "text": "Workspace Manager is required for cross-tenant querying in KQL.", "isCorrect": false, "rationale": "Cross-tenant querying is enabled by Lighthouse's delegated access, not by content management tools." }, { "label": "B", "text": "Lighthouse is limited to Azure resources, while Workspace Manager supports on-premises servers.", "isCorrect": false, "rationale": "Both can manage on-premises resources that have been onboarded to Azure via Azure Arc." }, { "label": "C", "text": "Workspace Manager is agent-based, whereas Lighthouse is agentless.", "isCorrect": false, "rationale": "Both features are platform-level capabilities and do not rely on local agents for operation." }, { "label": "D", "text": "Workspace Manager handles content distribution, while Lighthouse enables cross-tenant access.", "isCorrect": true, "rationale": "Workspace Manager pushes artifacts like analytics rules to member workspaces, whereas Lighthouse provides the delegated permissions to reach those tenants." } ], "hint": "Distinguish between the mechanism for granting access and the mechanism for pushing configuration.", "correctAnswer": "D" }, { "number": 5, "question": "A security engineer is calculating the potential Secure Score increase in Microsoft Defender for Cloud. If a control contains four recommendations for a single resource, when will the points for that control be awarded?", "options": [ { "label": "A", "text": "Only after all four recommendations are remediated for that resource.", "isCorrect": true, "rationale": "MDC scoring is all-or-nothing per resource within a control; partial remediation does not grant score improvements." }, { "label": "B", "text": "When the recommendation is moved to 'Report-only' or 'Preview' status.", "isCorrect": false, "rationale": "Preview recommendations do not impact the Secure Score until they reach General Availability." }, { "label": "C", "text": "After the most severe (Critical) recommendation in the control is fixed.", "isCorrect": false, "rationale": "Severity helps with prioritization, but the scoring logic requires all mapped recommendations to be resolved." }, { "label": "D", "text": "Points are awarded proportionally as each recommendation is completed.", "isCorrect": false, "rationale": "Score improvements are not incremental; the control must be fully satisfied for the resource to count as healthy." } ], "hint": "Reflect on the 'Healthy' vs 'Unhealthy' status requirements for resource scoring.", "correctAnswer": "A" }, { "number": 6, "question": "Which mechanism does Microsoft Defender for Cloud use to ensure 'secretless' authentication when connecting to AWS environments?", "options": [ { "label": "A", "text": "OIDC Identity Federation with AWS STS.", "isCorrect": true, "rationale": "MDC uses OpenID Connect to establish trust with AWS Security Token Service, exchanging temporary, short-lived credentials for scans." }, { "label": "B", "text": "Manual rotation of AWS Access Keys via Azure Automation.", "isCorrect": false, "rationale": "Manual rotation still involves persistent secrets; OIDC eliminates the need for durable keys entirely." }, { "label": "C", "text": "Pre-shared keys stored in Azure Key Vault.", "isCorrect": false, "rationale": "Storing long-lived secrets in Key Vault is a legacy approach and contradicts the 'secretless' architecture." }, { "label": "D", "text": "Azure Bastion tunneling to AWS IAM endpoints.", "isCorrect": false, "rationale": "Bastion is used for RDP/SSH access to VMs, not for cloud-to-cloud API management authentication." } ], "hint": "Look for the industry-standard protocol used for federated identity trust between cloud providers.", "correctAnswer": "A" }, { "number": 7, "question": "In Microsoft Defender External Attack Surface Management (EASM), which asset state is used for resources that are connected to your organization's infrastructure but are owned and managed by third parties, such as CDNs?", "options": [ { "label": "A", "text": "Requires Investigation", "isCorrect": false, "rationale": "This state is for low-confidence connections that need manual review to determine ownership." }, { "label": "B", "text": "Candidate", "isCorrect": false, "rationale": "Candidate is the default state for newly discovered assets until they are manually investigated and promoted." }, { "label": "C", "text": "Monitor Only", "isCorrect": false, "rationale": "Monitor Only is for related entities like franchises where you want visibility but do not own the remediation." }, { "label": "D", "text": "Dependency", "isCorrect": true, "rationale": "The Dependency state tracks external risks that support your infrastructure but are outside your direct control." } ], "hint": "Consider the term used for external services your environment relies upon.", "correctAnswer": "D" }, { "number": 8, "question": "Which Microsoft Sentinel feature is specifically designed to handle unstructured log data from legacy Linux hosts that do not support standardized formats like CEF?", "options": [ { "label": "A", "text": "Content Hub Solutions", "isCorrect": false, "rationale": "Solutions package artifacts, but the actual logic for interpreting unstructured text resides in the parser." }, { "label": "B", "text": "Data Collection Rules (DCR)", "isCorrect": false, "rationale": "While DCRs define what data to collect, they do not normalize the unstructured text into a queryable schema." }, { "label": "C", "text": "KQL Parsers", "isCorrect": true, "rationale": "Because raw Syslog is unstructured text, custom KQL parsers (often following ASIM) are required to map fields for analysis." }, { "label": "D", "text": "Azure Arc for Servers", "isCorrect": false, "rationale": "Arc enables agent installation on non-Azure machines but does not transform the log format itself." } ], "hint": "Think about the component used to normalize raw strings into columns and rows.", "correctAnswer": "C" }, { "number": 9, "question": "A security team is using Microsoft Defender for Cloud's Regulatory Compliance dashboard. They have fixed a non-compliant storage account. How long should they expect to wait before the dashboard reflects this change?", "options": [ { "label": "A", "text": "Approximately 12 hours.", "isCorrect": true, "rationale": "Compliance assessments run on a 12-hour cycle, meaning changes are not reflected instantaneously." }, { "label": "B", "text": "Instantly upon remediation.", "isCorrect": false, "rationale": "Assessment results are cached and updated periodically, not in real-time." }, { "label": "C", "text": "4 hours.", "isCorrect": false, "rationale": "Four hours is the minimum refresh rate for cloud posture scans, but compliance assessments follow a separate 12-hour cycle." }, { "label": "D", "text": "7 days.", "isCorrect": false, "rationale": "Seven days is the typical wait time for data to populate in Purview Compliance Manager, not the MDC dashboard." } ], "hint": "Recall the standard refresh cycle for automated compliance evaluations in Azure.", "correctAnswer": "A" }, { "number": 10, "question": "Which Microsoft Defender for Storage pillar is specifically effective at detecting threats that bypass identity-centric controls like Conditional Access by using validly issued SAS tokens?", "options": [ { "label": "A", "text": "Activity Monitoring", "isCorrect": true, "rationale": "Activity monitoring analyzes operation logs (Tor exit node access, unusual volume) to detect misuse of tokens that are technically valid." }, { "label": "B", "text": "Cloud Security Posture Management (CSPM)", "isCorrect": false, "rationale": "CSPM identifies misconfigurations like public access but does not monitor runtime data-plane activity." }, { "label": "C", "text": "Malware Scanning", "isCorrect": false, "rationale": "Malware scanning focuses on the content of uploaded files, not the authentication signals or access patterns." }, { "label": "D", "text": "Sensitive Data Threat Detection", "isCorrect": false, "rationale": "This pillar prioritizes alerts based on data sensitivity but does not provide the primary detection for SAS misuse." } ], "hint": "Identify the pillar that focuses on behavioral patterns within data-plane and control-plane operations.", "correctAnswer": "A" }, { "number": 11, "question": "Microsoft Sentinel automation rules and playbooks serve different purposes. In which scenario is an automation rule insufficient, necessitating the use of a playbook?", "options": [ { "label": "A", "text": "Changing an incident's severity from 'Medium' to 'High'.", "isCorrect": false, "rationale": "Changing metadata like severity is a built-in action that automation rules can perform natively." }, { "label": "B", "text": "Assigning a specific security analyst as the owner of an incident.", "isCorrect": false, "rationale": "Assignment of ownership is a standard action available within the automation rule configuration." }, { "label": "C", "text": "Adding a 'Compliance' tag to an incident when it is created.", "isCorrect": false, "rationale": "Tagging is a native operation for automation rules and does not require external workflow engines." }, { "label": "D", "text": "Isolating a compromised host via Microsoft Defender for Endpoint.", "isCorrect": true, "rationale": "Automation rules have a fixed, internal action set; external service calls require the Logic App capabilities of a playbook." } ], "hint": "Determine whether the response action stays within Sentinel's portal or reaches out to an external API.", "correctAnswer": "D" }, { "number": 12, "question": "What is the primary technical reason for deploying a 'Linux Forwarder' when connecting on-premises firewalls to Microsoft Sentinel?", "options": [ { "label": "A", "text": "Network appliances often cannot run the Azure Monitor Agent (AMA) directly.", "isCorrect": true, "rationale": "Appliances usually have closed OS environments, so a forwarder host is needed to receive Syslog/CEF and run the AMA." }, { "label": "B", "text": "KQL parsing must occur on-premises to reduce cloud ingestion costs.", "isCorrect": false, "rationale": "KQL parsing typically occurs in the cloud (at query time), not on the forwarder host." }, { "label": "C", "text": "Azure Policy cannot reach resources outside of the Azure fabric.", "isCorrect": false, "rationale": "Azure Arc allows Policy to reach on-premises hosts, but the forwarder's existence is due to agent-compatibility on appliances." }, { "label": "D", "text": "The forwarder provides local encryption before logs leave the on-premises network.", "isCorrect": false, "rationale": "While true, the primary reason is the inability to install agents on proprietary hardware appliances." } ], "hint": "Consider the limitations of proprietary network hardware regarding software agent installation.", "correctAnswer": "A" }, { "number": 13, "question": "An organization is using Microsoft Defender for Containers. Which component is responsible for enforcing 'deny' mode to block non-compliant Kubernetes deployments during admission control?", "options": [ { "label": "A", "text": "The Defender eBPF sensor", "isCorrect": false, "rationale": "The eBPF sensor is used for runtime observation of node/pod behavior, not for pre-deployment admission control." }, { "label": "B", "text": "Azure Policy for Kubernetes (Gatekeeper v3)", "isCorrect": true, "rationale": "Azure Policy uses the Gatekeeper admission controller to intercept and reject non-compliant API server requests." }, { "label": "C", "text": "Microsoft Defender XDR", "isCorrect": false, "rationale": "Defender XDR is a centralized alert and incident console, not an in-cluster enforcement point." }, { "label": "D", "text": "Kubernetes Agentless Operator", "isCorrect": false, "rationale": "This operator is used for agentless configuration scanning via the API server, not for enforcement." } ], "hint": "Look for the tool that bridges Azure governance policies with Kubernetes native admission checkpoints.", "correctAnswer": "B" }, { "number": 14, "question": "In the Microsoft Sentinel 'Continuous Deployment' workflow for repositories, what does the platform validate when a connection is established?", "options": [ { "label": "A", "text": "The RBAC permissions of the person who committed the code to GitHub.", "isCorrect": false, "rationale": "Validation occurs on the repository connection itself, not on individual commits within the external provider." }, { "label": "B", "text": "The existence of the specific data connectors referenced in the content.", "isCorrect": false, "rationale": "Sentinel does not check if the target workspace has the prerequisite connectors enabled before deployment." }, { "label": "C", "text": "The logic and efficiency of the KQL queries.", "isCorrect": false, "rationale": "KQL validation (checking if the query compiles or makes sense) is the user's responsibility, often via separate CI tools." }, { "label": "D", "text": "The structural validity of the ARM templates in the repository.", "isCorrect": true, "rationale": "Sentinel checks if the ARM template is well-formed but does not validate the security logic or KQL syntax within it." } ], "hint": "Differentiate between the structural 'container' of the content and the 'logic' within it.", "correctAnswer": "D" }, { "number": 15, "question": "When configuring Microsoft Defender for Storage, what happens if a storage account exceeds the 10,000 GB (10 TB) monthly malware scanning cap?", "options": [ { "label": "A", "text": "New uploads are blocked until the cap is manually increased.", "isCorrect": false, "rationale": "Uploads are not blocked; they are simply not scanned, creating a temporary security gap." }, { "label": "B", "text": "Scanning pauses for the remainder of the month and an alert is generated.", "isCorrect": true, "rationale": "The cap is a cost-control measure; once reached, new uploads remain unscanned until the next billing cycle." }, { "label": "C", "text": "Azure automatically upgrades the plan to an unlimited tier.", "isCorrect": false, "rationale": "There is no automatic tier upgrade; the cap is strictly enforced as configured in environment settings." }, { "label": "D", "text": "The storage account is moved to a quarantine VNet.", "isCorrect": false, "rationale": "Exceeding a cost cap does not trigger automated network isolation or remediation actions." } ], "hint": "Consider the operational impact of a cost-control setting on a security scanning service.", "correctAnswer": "B" }, { "number": 16, "question": "In the context of Microsoft Defender for Cloud's 'Attack Path Analysis', why might the attack path list be empty in a newly onboarded environment?", "options": [ { "label": "A", "text": "The Defender CSPM plan has not been enabled on the subscription.", "isCorrect": false, "rationale": "While Defender CSPM is required for the feature, the algorithm will still run if the plan is active." }, { "label": "B", "text": "The 12-hour compliance assessment cycle has not yet completed.", "isCorrect": false, "rationale": "Attack path analysis is a posture feature that typically updates within 24 hours but is independent of the compliance dashboard's cycle." }, { "label": "C", "text": "There are no critical vulnerabilities (CVEs) present in the environment.", "isCorrect": false, "rationale": "Paths can be built on misconfigurations or identity risks, not just software vulnerabilities." }, { "label": "D", "text": "No externally exploitable routes to critical assets were found by the algorithm.", "isCorrect": true, "rationale": "An empty list is often a positive sign, indicating that no realistic chains from the internet to internal targets were discovered." } ], "hint": "Interpret the lack of findings as a result of the risk engine's exploitability assessment.", "correctAnswer": "D" }, { "number": 17, "question": "Which specific Microsoft Sentinel connector requires the execution of a 'Remediation Task' via Azure Policy to capture logs from resources created before the connector was enabled?", "options": [ { "label": "A", "text": "Windows Security Events via AMA", "isCorrect": false, "rationale": "While AMA uses DCRs, it does not typically use a Policy 'Remediation Task' in the same way the Activity log pipeline does." }, { "label": "B", "text": "Microsoft Entra ID", "isCorrect": false, "rationale": "Entra ID is a tenant-level service-to-service connector that does not rely on subscription-level Azure Policy." }, { "label": "C", "text": "Microsoft 365 (Office 365)", "isCorrect": false, "rationale": "This connector is service-linked and does not use the Azure Policy remediation mechanism for historical coverage." }, { "label": "D", "text": "Azure Activity", "isCorrect": true, "rationale": "Unlike service-to-service toggles, the Azure Activity connector uses Policy; existing resources must be remediated to start streaming." } ], "hint": "Identify the connector that is fundamentally driven by subscription-level governance policy.", "correctAnswer": "D" }, { "number": 18, "question": "What is a primary distinction between the 'Cloud Secure Score' in the Defender portal and the 'Classic Secure Score' in the Azure portal?", "options": [ { "label": "A", "text": "Cloud Secure Score is updated every 30 minutes, while Classic is updated every 24 hours.", "isCorrect": false, "rationale": "Both scores rely on similar scanning cadences, typically every 24 hours for posture data." }, { "label": "B", "text": "Classic Secure Score is the only one that includes multicloud resources.", "isCorrect": false, "rationale": "Both scores can reflect multicloud data, but the Cloud Secure Score is the primary command center for multicloud posture." }, { "label": "C", "text": "Cloud Secure Score incorporates asset criticality and internet exposure into its weighting.", "isCorrect": true, "rationale": "The newer risk-based score prioritizes findings on internet-exposed or sensitive resources over isolated dev assets." }, { "label": "D", "text": "Classic Secure Score is required for regulatory compliance standards like PCI-DSS.", "isCorrect": false, "rationale": "Compliance standards are mapped to policies; the score is a separate metric of overall hygiene." } ], "hint": "Focus on the shift from 'flat' control-based weighting to 'contextual' risk-based weighting.", "correctAnswer": "C" }, { "number": 19, "question": "An analyst is using 'Cloud Security Explorer' to hunt for risks. They want to find virtual machines with high-severity vulnerabilities that also have a path to a storage account with sensitive data. What is the prerequisite for this relationship-chaining query?", "options": [ { "label": "A", "text": "The Defender CSPM plan must be active.", "isCorrect": true, "rationale": "The 'cloud security graph' that powers multi-hop relationship queries is an advanced feature of the paid Defender CSPM plan." }, { "label": "B", "text": "Sensitive Data Discovery must be manually configured per file.", "isCorrect": false, "rationale": "Sensitive data discovery is agentless and automatic once the feature is enabled in the plan settings." }, { "label": "C", "text": "The Microsoft Sentinel 'Storage' data connector must be enabled.", "isCorrect": false, "rationale": "Explorer queries are based on posture and graph data, not the live logs ingested by Sentinel connectors." }, { "label": "D", "text": "All target VMs must be onboarded to Azure Arc.", "isCorrect": false, "rationale": "Native Azure VMs are supported by default; Arc is only needed for non-Azure machines." } ], "hint": "Identify the paid tier required for advanced graph-based security analysis.", "correctAnswer": "A" }, { "number": 20, "question": "In Microsoft Defender for Containers, how does 'binary drift detection' assist in runtime threat protection?", "options": [ { "label": "A", "text": "It ensures that the Kubernetes API server configuration matches the CIS benchmark.", "isCorrect": false, "rationale": "Configuration hardening is part of posture management, not runtime binary drift detection." }, { "label": "B", "text": "It prevents the creation of pods that use the 'latest' tag.", "isCorrect": false, "rationale": "Enforcing image tagging policies is a function of gated deployment/admission control." }, { "label": "C", "text": "It scans images in the registry for changes to their SHA-256 hashes.", "isCorrect": false, "rationale": "Registry scanning is a vulnerability assessment function, not a runtime drift detection function." }, { "label": "D", "text": "It can block unauthorized processes that were not part of the original container image.", "isCorrect": true, "rationale": "Drift detection identifies and can mitigate processes that deviate from the immutable image baseline." } ], "hint": "Consider the concept of immutability in containerized workloads.", "correctAnswer": "D" }, { "number": 21, "question": "Which Microsoft Sentinel built-in role is the minimum required for an analyst to assign, dismiss, and close incidents, but *not* create new analytics rules?", "options": [ { "label": "A", "text": "Microsoft Sentinel Responder", "isCorrect": true, "rationale": "Responder is the triage role; it can manage incidents but lacks content-authoring rights like creating rules." }, { "label": "B", "text": "Microsoft Sentinel Contributor", "isCorrect": false, "rationale": "While a Contributor can do these tasks, it is not the *minimum* role; it also includes rule-authoring rights." }, { "label": "C", "text": "Microsoft Sentinel Reader", "isCorrect": false, "rationale": "Readers have view-only access and cannot modify incident states or assignments." }, { "label": "D", "text": "Microsoft Sentinel Automation Contributor", "isCorrect": false, "rationale": "This role is for the Sentinel service identity to run playbooks, not for human triage activities." } ], "hint": "Look for the role specifically designed for 'incident response' activities.", "correctAnswer": "A" }, { "number": 22, "question": "When connecting an external solution using 'CEF via AMA', how does the ingestion process differ from 'Syslog via AMA' regarding data parsing?", "options": [ { "label": "A", "text": "CEF is structured and parsed automatically into a dedicated table.", "isCorrect": true, "rationale": "The Common Event Format is pre-structured, allowing Sentinel to automatically populate the CommonSecurityLog table without manual parsers." }, { "label": "B", "text": "CEF logs land in the 'Syslog' table but with an extra '_CEF' suffix.", "isCorrect": false, "rationale": "CEF logs land in the dedicated CommonSecurityLog table, not the unstructured Syslog table." }, { "label": "C", "text": "CEF requires a manually written KQL parser to extract key-value pairs.", "isCorrect": false, "rationale": "Syslog requires manual parsers; CEF's standardized format enables automated parsing." }, { "label": "D", "text": "CEF ingestion uses Logic Apps to transform data before it reaches Log Analytics.", "isCorrect": false, "rationale": "Both methods use the Azure Monitor Agent (AMA) for direct ingestion; Logic Apps are not part of the standard pipe." } ], "hint": "Think about the 'Common' in Common Event Format and its impact on schema mapping.", "correctAnswer": "A" }, { "number": 23, "question": "Which Microsoft Defender for Servers feature uses 'snapshot publishing' to periodically analyze VM disks offline for vulnerabilities without affecting runtime performance?", "options": [ { "label": "A", "text": "Adaptive application controls", "isCorrect": false, "rationale": "This feature uses machine learning on observed runtime behavior to create allowlists." }, { "label": "B", "text": "Microsoft Defender Vulnerability Management (MDVM)", "isCorrect": false, "rationale": "MDVM is the overall solution; agentless scanning is the specific *method* that uses snapshots." }, { "label": "C", "text": "Just-in-time (JIT) VM access", "isCorrect": false, "rationale": "JIT manages NSG rules to temporarily open management ports, not disk analysis." }, { "label": "D", "text": "Agentless scanning", "isCorrect": true, "rationale": "Agentless scanning (Plan 2) analyzes disk snapshots to find software and secrets without needing a local agent." } ], "hint": "Identify the scanning mode that avoids installing software on the target OS.", "correctAnswer": "D" }, { "number": 24, "question": "In Microsoft Sentinel, what is the maximum number of repository connections (e.g., GitHub or Azure DevOps) allowed per workspace?", "options": [ { "label": "A", "text": "5", "isCorrect": true, "rationale": "Sentinel currently enforces a limit of 5 repository connections per workspace." }, { "label": "B", "text": "1", "isCorrect": false, "rationale": "While many organizations use one repo, the technical limit allows for multiple sources of truth." }, { "label": "C", "text": "10", "isCorrect": false, "rationale": "The limit is lower than 10 to ensure manageable deployment overhead within the workspace." }, { "label": "D", "text": "Unlimited", "isCorrect": false, "rationale": "There is a specific capped limit for repository connections to maintain performance and stability." } ], "hint": "This is a specific platform limit mentioned in the deployment prerequisites.", "correctAnswer": "A" }, { "number": 25, "question": "When configuring 'Microsoft Purview Audit' logs in Microsoft Sentinel, which table stores activity related to Microsoft 365 Copilot prompts and responses?", "options": [ { "label": "A", "text": "M365InteractionLogs", "isCorrect": false, "rationale": "This is not a standard Sentinel table; Copilot logs follow the specific naming convention of the service." }, { "label": "B", "text": "AIPromptLogs", "isCorrect": false, "rationale": "While logical, Sentinel uses the 'CopilotActivity' name to align with the Microsoft 365 branding." }, { "label": "C", "text": "CopilotActivity", "isCorrect": true, "rationale": "Sentinel uses a dedicated table for Copilot telemetry to keep it distinct from general Office 365 events." }, { "label": "D", "text": "OfficeActivity", "isCorrect": false, "rationale": "OfficeActivity contains Exchange, SharePoint, and Teams logs, but Copilot has its own dedicated table." } ], "hint": "Look for a table name that directly reflects the specific M365 AI service being audited.", "correctAnswer": "C" }, { "number": 26, "question": "A security engineer must enable Microsoft Defender for Containers on an existing AKS cluster. Which agent is deployed as a 'DaemonSet' to provide runtime threat protection via eBPF?", "options": [ { "label": "A", "text": "The Kubernetes Agentless Operator", "isCorrect": false, "rationale": "This operator enables API-level configuration scanning and does not run as a DaemonSet on every node." }, { "label": "B", "text": "The Azure Connected Machine agent", "isCorrect": false, "rationale": "This agent is for onboarding non-Azure servers to Azure Arc, not for in-cluster container protection." }, { "label": "C", "text": "The Defender sensor", "isCorrect": true, "rationale": "The Defender sensor runs as a DaemonSet to ensure every node has local observation capabilities." }, { "label": "D", "text": "The Log Analytics agent (MMA)", "isCorrect": false, "rationale": "The MMA is legacy/deprecated and does not provide eBPF-based container runtime telemetry." } ], "hint": "Identify the specific runtime observation component for containers.", "correctAnswer": "C" }, { "number": 27, "question": "Which regulatory compliance standard is automatically assigned to an AWS account immediately upon connecting it to Microsoft Defender for Cloud?", "options": [ { "label": "A", "text": "AWS Well-Architected Framework", "isCorrect": false, "rationale": "This is a design framework; MDC uses technical security standards for automated posture scoring." }, { "label": "B", "text": "CIS Amazon Web Services Foundations Benchmark", "isCorrect": false, "rationale": "While supported, it is not the auto-assigned default that appears with the initial connection." }, { "label": "C", "text": "AWS Foundational Security Best Practices", "isCorrect": true, "rationale": "This standard is the default benchmark for AWS posture assessments in MDC, along with the MCSB." }, { "label": "D", "text": "PCI-DSS v4.0", "isCorrect": false, "rationale": "Regulatory standards like PCI must be manually added; they are not auto-assigned upon connection." } ], "hint": "Recall the built-in standard that provides the baseline for AWS security findings.", "correctAnswer": "C" }, { "number": 28, "question": "In the Microsoft Sentinel 'Data Tiering' model, which plan provides lower ingestion costs but limited query capability and is intended for high-volume compliance data?", "options": [ { "label": "A", "text": "Archive", "isCorrect": false, "rationale": "Archive is synonymous with long-term retention but is not the name of the granular table plan." }, { "label": "B", "text": "Auxiliary", "isCorrect": true, "rationale": "The Auxiliary plan is designed for high-volume logs that are rarely queried but required for long-term retention." }, { "label": "C", "text": "Analytics", "isCorrect": false, "rationale": "The Analytics plan is the standard 'hot' tier for real-time hunting and alerting." }, { "label": "D", "text": "Long-term Retention", "isCorrect": false, "rationale": "This is a state of data (cold), not a table plan (tier) that defines ingestion costs and query limits." } ], "hint": "Look for the plan name that suggests it is 'supplemental' or secondary to active analytics.", "correctAnswer": "B" }, { "number": 29, "question": "A user reported an MFA prompt as suspicious using the 'Report Suspicious Activity' feature. What is the immediate impact on that user's risk level in Microsoft Entra ID Protection?", "options": [ { "label": "A", "text": "The user is automatically set to High User Risk.", "isCorrect": true, "rationale": "Reporting an unexpected prompt is a strong indicator of credential compromise, triggering a High risk state." }, { "label": "B", "text": "The user's account is instantly disabled.", "isCorrect": false, "rationale": "The risk level is increased; disabling the account depends on whether a corresponding risk-based policy is active." }, { "label": "C", "text": "The user is placed in a 'Monitor Only' group for 24 hours.", "isCorrect": false, "rationale": "The system takes immediate detection action (High risk) rather than a delayed monitoring-only approach." }, { "label": "D", "text": "The user's MFA methods are purged.", "isCorrect": false, "rationale": "Methods are retained, but the user is flagged so that admins or policies can force a remediation (like a password reset)." } ], "hint": "Consider the severity of an end-user reporting their own credentials as being used by an attacker.", "correctAnswer": "A" }, { "number": 30, "question": "When using 'Azure Activity' logs in Microsoft Sentinel, what is the primary destination table for these events?", "options": [ { "label": "A", "text": "AuditLogs", "isCorrect": false, "rationale": "AuditLogs is the primary table for Entra ID directory management, not for Azure resource management." }, { "label": "B", "text": "ActivityLog_CL", "isCorrect": false, "rationale": "The _CL suffix is for custom logs, but Azure Activity is a native, built-in log type." }, { "label": "C", "text": "SecurityEvent", "isCorrect": false, "rationale": "SecurityEvent is used for Windows OS security logs, not for platform-level ARM operations." }, { "label": "D", "text": "AzureActivity", "isCorrect": true, "rationale": "Sentinel uses a dedicated, system-named table for all subscription-level control-plane events." } ], "hint": "The table name is identical to the connector name.", "correctAnswer": "D" }, { "number": 31, "question": "In the Microsoft Defender for Storage 'Malware Scanning' configuration, what is the impact of reaching the monthly GB scanning cap?", "options": [ { "label": "A", "text": "The storage account is automatically throttled to 10% of normal bandwidth.", "isCorrect": false, "rationale": "Throttling is not used for cost-cap enforcement; the security feature simply pauses." }, { "label": "B", "text": "Blobs uploaded after the cap is reached remain unscanned until the next month.", "isCorrect": true, "rationale": "The service stops processing new blobs to prevent unexpected costs, leaving a gap in coverage." }, { "label": "C", "text": "Additional scanning is billed at a 50% premium rate.", "isCorrect": false, "rationale": "The cap is a hard limit for the current month unless the admin manually increases it." }, { "label": "D", "text": "An automated playbook is triggered to move unscanned blobs to a private container.", "isCorrect": false, "rationale": "There is no default automation to quarantine unscanned blobs; the system only alerts the admin." } ], "hint": "Identify the risk of cost-control measures on continuous security monitoring.", "correctAnswer": "B" }, { "number": 32, "question": "What is the specific role of 'Azure Connected Machine agent' (azcmagent) when connecting an on-premises Windows server to Microsoft Sentinel using the AMA?", "options": [ { "label": "A", "text": "It replaces the need for the Windows Event Forwarding service.", "isCorrect": false, "rationale": "WEF can still be used for centralized collection; the Arc agent is for direct per-host management." }, { "label": "B", "text": "It acts as a local proxy for all HTTPS traffic to Log Analytics.", "isCorrect": false, "rationale": "While it supports proxies, its primary function is identity and resource projection into Azure." }, { "label": "C", "text": "It registers the server as an Azure Arc-enabled resource.", "isCorrect": true, "rationale": "Arc is the prerequisite for managing non-Azure servers; the agent creates the Azure identity for the host." }, { "label": "D", "text": "It provides the local database for storing KQL query results.", "isCorrect": false, "rationale": "The agent facilitates management and connectivity; query results are stored in the cloud workspace." } ], "hint": "Think about how non-Azure machines are 'projected' into the Azure Resource Manager.", "correctAnswer": "C" }, { "number": 33, "question": "Which Microsoft Defender for Cloud capability provides 'outside-in' discovery of shadow IT and forgotten subdomains without requiring any agents or seeds?", "options": [ { "label": "A", "text": "Attack Path Analysis", "isCorrect": false, "rationale": "Attack path analysis models internal and external risks but relies on known inventory as its starting point." }, { "label": "B", "text": "Agentless Scanning", "isCorrect": false, "rationale": "Agentless scanning analyzes the content of known VMs/containers, not the discovery of unknown internet-facing infrastructure." }, { "label": "C", "text": "Foundational CSPM", "isCorrect": false, "rationale": "Foundational CSPM only assesses resources that are already known and onboarded to your Azure subscriptions." }, { "label": "D", "text": "Defender External Attack Surface Management (EASM)", "isCorrect": true, "rationale": "EASM crawls the public internet to find assets linked to your organization via recursive discovery." } ], "hint": "Look for the tool that views your organization from the perspective of an internet-based attacker.", "correctAnswer": "D" }, { "number": 34, "question": "In the Microsoft Sentinel 'Repository' connection process, which Azure DevOps authentication conflict often necessitates the use of an 'InPrivate' browser window?", "options": [ { "label": "A", "text": "Implicit authentication using the current Azure portal session credentials.", "isCorrect": true, "rationale": "Azure DevOps uses the active browser session, which might be tied to a different identity than the intended DevOps org." }, { "label": "B", "text": "The need to install the 'Azure-Sentinel' GitHub App.", "isCorrect": false, "rationale": "GitHub App installation is specific to GitHub; DevOps uses implicit Azure credentials." }, { "label": "C", "text": "The 800-deployment limit on the target Resource Group.", "isCorrect": false, "rationale": "Deployment limits are a server-side resource constraint, not an authentication/browser session issue." }, { "label": "D", "text": "The requirement for a secondary hardware-based MFA token.", "isCorrect": false, "rationale": "MFA is handled by the identity provider and does not specifically require an incognito window for the Sentinel connection." } ], "hint": "Consider how SSO browser sessions can interfere when managing multiple tenants or organizations.", "correctAnswer": "A" }, { "number": 35, "question": "A security analyst is investigating an 'Impossible Travel' alert for a user. Which table in Microsoft Sentinel should they query to see that user's specific activity in SharePoint and Exchange Online?", "options": [ { "label": "A", "text": "SigninLogs", "isCorrect": false, "rationale": "SigninLogs shows the authentication event, but not the specific file downloads or email actions that followed." }, { "label": "B", "text": "OfficeActivity", "isCorrect": true, "rationale": "OfficeActivity is the central table for user and admin actions across core M365 workloads like SharePoint and Exchange." }, { "label": "C", "text": "SecurityAlert", "isCorrect": false, "rationale": "SecurityAlert holds the alert record itself, not the raw evidence of SharePoint or Exchange activity." }, { "label": "D", "text": "AuditLogs", "isCorrect": false, "rationale": "AuditLogs tracks directory management (user/group changes) but not workload-level data access." } ], "hint": "Recall the table name that consolidates core Microsoft 365 productivity workload telemetry.", "correctAnswer": "B" }, { "number": 36, "question": "Which Microsoft Defender for Cloud feature enables 'Just-in-Time' access to management ports by temporarily modifying Network Security Group (NSG) rules?", "options": [ { "label": "A", "text": "Adaptive Network Hardening", "isCorrect": false, "rationale": "Hardening recommends permanent rule changes based on traffic patterns, while JIT is for temporary, on-demand access." }, { "label": "B", "text": "Azure Firewall Premium", "isCorrect": false, "rationale": "Azure Firewall is a central network appliance; JIT specifically targets the NSGs associated with individual VMs." }, { "label": "C", "text": "Defender for Servers Plan 2", "isCorrect": true, "rationale": "JIT VM Access is a premium feature included in the Defender for Servers Plan 2 tier." }, { "label": "D", "text": "Foundational CSPM", "isCorrect": false, "rationale": "Foundational CSPM provides visibility into open ports but does not include the automated JIT enforcement mechanism." } ], "hint": "Identify the specific server protection plan that includes advanced management port protection.", "correctAnswer": "C" }, { "number": 37, "question": "When building a custom Microsoft Sentinel playbook, what is the primary architectural reason to choose an 'Alert' trigger instead of an 'Incident' trigger?", "options": [ { "label": "A", "text": "Alert-triggered playbooks are processed with lower latency than incident-triggered ones.", "isCorrect": false, "rationale": "Both triggers have similar latency; the choice is driven by where the security logic is centralized (Alert vs Incident)." }, { "label": "B", "text": "Incident triggers do not support the ingestion of custom entities from third-party logs.", "isCorrect": false, "rationale": "Incident triggers include all grouped alerts and their associated entities, including custom ones." }, { "label": "C", "text": "Logic Apps 'Consumption' plans only support Alert triggers.", "isCorrect": false, "rationale": "Logic App Consumption plans support both Sentinel Alert and Incident triggers." }, { "label": "D", "text": "The workspace is onboarded to the Defender portal, where incident creation is disabled in Sentinel.", "isCorrect": true, "rationale": "When Sentinel is in the Defender portal, XDR handles incidents; playbooks must target alerts to run before XDR grouping." } ], "hint": "Think about the impact of Microsoft Defender XDR taking over incident management.", "correctAnswer": "D" }, { "number": 38, "question": "Which Microsoft Defender for Key Vault detection category specifically targets 'brute force' or 'anomalous' access patterns consistent with credential theft?", "options": [ { "label": "A", "text": "Exfiltration", "isCorrect": false, "rationale": "Exfiltration is the removal of data; the Key Vault plan detects the 'access' that precedes the exfiltration of secrets." }, { "label": "B", "text": "Persistence", "isCorrect": false, "rationale": "Persistence refers to maintaining access over time; Key Vault alerts focus on the moment of credential retrieval or abuse." }, { "label": "C", "text": "Credential Access", "isCorrect": true, "rationale": "Defender for Key Vault alerts map to the MITRE ATT&CK 'Credential Access' tactic, focusing on stolen secret misuse." }, { "label": "D", "text": "Discovery", "isCorrect": false, "rationale": "While reconnaissance (Discovery) occurs, the plan's core value is detecting the actual unauthorized access to secrets." } ], "hint": "Identify the MITRE ATT&CK tactic that describes gaining access to secrets and keys.", "correctAnswer": "C" }, { "number": 39, "question": "A security engineer is configuring a 'Custom Table' in Microsoft Sentinel for proprietary application logs. Which column is mandatory for all Log Analytics tables and drives time-range filtering?", "options": [ { "label": "A", "text": "Timestamp", "isCorrect": false, "rationale": "While a common field name, Log Analytics specifically requires the name 'TimeGenerated' for its primary time index." }, { "label": "B", "text": "EventTime", "isCorrect": false, "rationale": "This is a descriptive name, but the platform's backend requires the 'TimeGenerated' property." }, { "label": "C", "text": "TimeGenerated", "isCorrect": true, "rationale": "TimeGenerated is a system-required column (datetime) used by the platform for all time-based partitioning and querying." }, { "label": "D", "text": "IngestionTime", "isCorrect": false, "rationale": "IngestionTime is a system property, but TimeGenerated is the one used for the primary query time filter." } ], "hint": "Recall the specific property name used to track when an event occurred in Azure Monitor.", "correctAnswer": "C" }, { "number": 40, "question": "What is the primary technical distinction between 'Syslog' and 'Common Event Format (CEF)' logs when viewed in Microsoft Sentinel?", "options": [ { "label": "A", "text": "Syslog is transported over TCP, while CEF is limited to UDP.", "isCorrect": false, "rationale": "Both can use TCP or UDP as their underlying transport protocol." }, { "label": "B", "text": "CEF is encrypted in transit, while Syslog is always cleartext.", "isCorrect": false, "rationale": "Encryption depends on the transport configuration (e.g., Syslog-over-TLS), not the log format itself." }, { "label": "C", "text": "CEF is structured with key-value pairs, while Syslog is an unstructured text string.", "isCorrect": true, "rationale": "CEF provides a standardized schema that allows for automatic parsing into specific columns." }, { "label": "D", "text": "Syslog is used only for Windows, while CEF is used only for Linux.", "isCorrect": false, "rationale": "Both are predominantly Linux/Network appliance formats; Windows uses its own Event Log format." } ], "hint": "Focus on how the internal 'content' of the log message is organized.", "correctAnswer": "C" }, { "number": 41, "question": "In Microsoft Defender for Cloud, what is 'Manual Attestation' used for within the Regulatory Compliance dashboard?", "options": [ { "label": "A", "text": "To authorize the installation of the Azure Arc agent on a remote server.", "isCorrect": false, "rationale": "Agent installation is a technical deployment step, not a compliance reporting/attestation task." }, { "label": "B", "text": "To bypass high-severity alerts that are confirmed as false positives.", "isCorrect": false, "rationale": "False positives are handled via suppression rules, not via the compliance attestation mechanism." }, { "label": "C", "text": "To override the Secure Score for a specific unhealthy resource.", "isCorrect": false, "rationale": "Secure Score is calculated automatically based on technical assessments and cannot be manually attested." }, { "label": "D", "text": "To mark process-oriented or non-automated controls as compliant.", "isCorrect": true, "rationale": "Some controls (like user training) cannot be scanned and require an administrator to confirm compliance manually." } ], "hint": "Think about controls that involve human processes rather than technical configurations.", "correctAnswer": "D" }, { "number": 42, "question": "A security team needs to monitor 'Managed Identity' sign-ins in Microsoft Sentinel. Which specific table should they query for these events?", "options": [ { "label": "A", "text": "ManagedIdentityActivity", "isCorrect": false, "rationale": "This is not a standard Sentinel table; sign-ins are stored in tables prefixed with 'AAD'." }, { "label": "B", "text": "AADServicePrincipalSignInLogs", "isCorrect": false, "rationale": "Managed identities are a type of service principal, but Entra ID provides a more granular table specifically for them." }, { "label": "C", "text": "AADManagedIdentitySignInLogs", "isCorrect": true, "rationale": "The Microsoft Entra ID connector splits different sign-in types into dedicated tables; this is the one for managed identities." }, { "label": "D", "text": "SigninLogs", "isCorrect": false, "rationale": "SigninLogs is primarily for interactive user sign-ins; managed identities have their own dedicated table." } ], "hint": "Identify the table name that combines the identity type with the 'AAD' prefix.", "correctAnswer": "C" }, { "number": 43, "question": "Which Microsoft Defender for Cloud plan tier is required to access 'Attack Path Analysis' and 'Cloud Security Explorer'?", "options": [ { "label": "A", "text": "Defender CSPM", "isCorrect": true, "rationale": "These 'smart' analysis features are exclusive to the paid Defender CSPM tier." }, { "label": "B", "text": "Foundational CSPM", "isCorrect": false, "rationale": "Foundational is the free tier and includes basic recommendations but not graph-based analysis." }, { "label": "C", "text": "Microsoft Sentinel Contributor", "isCorrect": false, "rationale": "Sentinel is for threat detection (SIEM); the attack path engine is a posture management (CSPM) feature." }, { "label": "D", "text": "Defender for Servers Plan 2", "isCorrect": false, "rationale": "While Plan 2 includes vulnerability assessment, the advanced posture analysis requires the specific CSPM plan." } ], "hint": "Distinguish between the free 'foundational' posture features and the advanced 'paid' ones.", "correctAnswer": "A" }, { "number": 44, "question": "When configuring a repository connection in Microsoft Sentinel, what is the impact of the '800 deployments' limit in an Azure resource group?", "options": [ { "label": "A", "text": "New content deployments from the repository will fail once the limit is reached.", "isCorrect": true, "rationale": "Every content push is a deployment; exceeding the quota requires cleaning up the deployment history in the RG." }, { "label": "B", "text": "The repository will switch to 'Read-Only' mode for all analytics rules.", "isCorrect": false, "rationale": "The limit impacts the *deployment engine's* ability to create resources, not the operational mode of the rules." }, { "label": "C", "text": "Sentinel will stop ingesting logs from the connected repository.", "isCorrect": false, "rationale": "Repositories do not ingest logs; they deploy artifacts (rules, workbooks). Log ingestion is unaffected." }, { "label": "D", "text": "The repository will automatically disconnect from the Sentinel workspace.", "isCorrect": false, "rationale": "The connection remains, but the actual 'deployments' (pushes) to the workspace will result in errors." } ], "hint": "Consider the resource group history as a finite pool for deployment metadata.", "correctAnswer": "A" }, { "number": 45, "question": "Microsoft Defender for Cloud uses 'Adaptive Application Controls'. How does this feature determine which applications to allow on a server?", "options": [ { "label": "A", "text": "By scanning the OS registry for 'Run' and 'RunOnce' keys.", "isCorrect": false, "rationale": "Adaptive controls monitor the actual execution of binaries at the OS level, not just their persistence settings." }, { "label": "B", "text": "By using machine learning to analyze the observed behavior of the machine over time.", "isCorrect": true, "rationale": "MDC learns the 'normal' software profile of the server and generates an allowlist based on that history." }, { "label": "C", "text": "By checking if the software is digitally signed by a trusted Microsoft CA.", "isCorrect": false, "rationale": "While signing is a signal, adaptive controls look at *all* executed software, not just signed binaries." }, { "label": "D", "text": "By comparing installed software against the Microsoft Cloud Security Benchmark.", "isCorrect": false, "rationale": "The benchmark provides general hardening rules, but adaptive controls are machine-specific." } ], "hint": "Think about a behavioral 'learning' phase that builds a custom profile for each server.", "correctAnswer": "B" }, { "number": 46, "question": "In the context of 'Microsoft Sentinel Workspace Manager', what is a 'Member Workspace'?", "options": [ { "label": "A", "text": "A workspace that only has 'Microsoft Sentinel Reader' permissions.", "isCorrect": false, "rationale": "The term refers to the management relationship, not a specific RBAC role assigned to the workspace." }, { "label": "B", "text": "A workspace that is used exclusively for archiving 'Auxiliary' data.", "isCorrect": false, "rationale": "Member workspaces are typically active Sentinel instances that need operational content like rules." }, { "label": "C", "text": "A workspace that is physically located in the same region as the Sentinel hub.", "isCorrect": false, "rationale": "Member workspaces can be in any region; Workspace Manager handles the cross-region distribution logic." }, { "label": "D", "text": "A workspace that receives content (analytics rules, workbooks) pushed from a central workspace.", "isCorrect": true, "rationale": "Workspace Manager uses a hub-and-spoke model to distribute security artifacts to multiple spokes (members)." } ], "hint": "Recall the 'hub and spoke' distribution model for Sentinel artifacts.", "correctAnswer": "D" }, { "number": 47, "question": "What is the primary technical function of the 'OIDC Identity Provider' when onboarding an AWS account to Microsoft Defender for Cloud?", "options": [ { "label": "A", "text": "It provides a local DNS server in AWS for reaching Azure endpoints.", "isCorrect": false, "rationale": "OIDC is for identity trust, not for network resolution or DNS services." }, { "label": "B", "text": "It allows AWS to trust a specific Microsoft-managed Entra ID application.", "isCorrect": true, "rationale": "The OIDC provider is the trust bridge that enables AWS to accept tokens from Azure without shared secrets." }, { "label": "C", "text": "It acts as the primary MFA gateway for AWS console logins.", "isCorrect": false, "rationale": "OIDC in this context is for programmatic service-to-service access (MDC scanning), not human logins." }, { "label": "D", "text": "It encrypts the S3 buckets during the posture assessment scan.", "isCorrect": false, "rationale": "Encryption is a storage setting; OIDC is the authentication mechanism for the scan itself." } ], "hint": "Consider how trust is established between two different identity systems (Entra ID and AWS IAM).", "correctAnswer": "B" }, { "number": 48, "question": "Which Microsoft Defender for Cloud plan specifically addresses 'Prompt Injection' and 'Jailbreak' attempts in generative AI applications?", "options": [ { "label": "A", "text": "Defender for APIs", "isCorrect": false, "rationale": "While AI is often accessed via APIs, 'prompt injection' is a logic attack on the model itself, not a protocol attack." }, { "label": "B", "text": "Defender for App Service", "isCorrect": false, "rationale": "App Service protection covers general web attacks (SQLi, XSS) but lacks specific models for AI manipulation." }, { "label": "C", "text": "Defender for AI Services", "isCorrect": true, "rationale": "This specialized plan protects Azure OpenAI and AI Model Inference deployments from AI-specific attack vectors." }, { "label": "D", "text": "Defender CSPM", "isCorrect": false, "rationale": "CSPM identifies the *exposure* of AI resources (posture) but does not detect runtime manipulation attempts." } ], "hint": "Identify the workload-protection plan designed for Large Language Model (LLM) security.", "correctAnswer": "C" }, { "number": 49, "question": "An organization is using 'Azure Arc' to connect on-premises servers to Microsoft Defender for Cloud. Which agent component must be installed locally on the server to register it as an Azure resource?", "options": [ { "label": "A", "text": "Microsoft Defender for Endpoint (MDE) sensor", "isCorrect": false, "rationale": "While used by Defender for Servers, MDE is not the component that establishes the Arc-resource identity." }, { "label": "B", "text": "Azure Monitor Agent (AMA)", "isCorrect": false, "rationale": "The AMA is for log collection; it is typically deployed *after* the machine is already Arc-enabled." }, { "label": "C", "text": "Azure Connected Machine agent (azcmagent)", "isCorrect": true, "rationale": "The azcmagent is the core Arc component that handles the server's identity and heartbeat within Azure." }, { "label": "D", "text": "Dependency Agent", "isCorrect": false, "rationale": "The Dependency Agent is for service map visualization, not for the initial Arc registration." } ], "hint": "Look for the agent name that emphasizes 'connecting' a machine to the cloud.", "correctAnswer": "C" }, { "number": 50, "question": "In Microsoft Sentinel, how does 'Just-in-Time (JIT) VM Access' interact with Network Security Groups (NSGs)?", "options": [ { "label": "A", "text": "It uses Azure Bastion to bypass the NSG entirely.", "isCorrect": false, "rationale": "JIT manages NSG rules directly; Bastion is an alternative access method that can complement but does not replace JIT." }, { "label": "B", "text": "It migrates the VM to a dedicated 'Management VNet' when access is requested.", "isCorrect": false, "rationale": "JIT operates at the NSG layer and does not involve re-homing or migrating the VM resource." }, { "label": "C", "text": "It creates temporary, high-priority 'Allow' rules for specific source IPs.", "isCorrect": true, "rationale": "JIT automates the creation and subsequent removal of permissive NSG rules on a time-limited basis." }, { "label": "D", "text": "It permanently blocks all traffic on port 22 and 3389.", "isCorrect": false, "rationale": "JIT blocks the ports by default but allows for authorized, temporary exceptions." } ], "hint": "Focus on the mechanism of 'temporary' and 'dynamic' rule modification.", "correctAnswer": "C" } ] }