单选题
Overview -
Litware Inc. is a renewable company.
Litware has offices in Boston and Seattle. Litware also has remote users located across
The United States. To access Litware resources, including cloud resources, the remote
Users establish a VPN connection to either office.
Existing Environment -
Identity Environment -
The network contains an Active Directory forest named litware.com that syncs to an
Azure Active Directory (Azure AD) tenant named litware.com.
Microsoft 365 Environment -
Litware has a Microsoft 365 E5 subscription linked to the litware.com Azure AD tenant.
Microsoft Defender for Endpoint is deployed to all computers that run
Windows 10. All Microsoft Cloud App Security built-in anomaly detection policies are
Enabled.
Azure Environment -
Litware has an Azure subscription linked to the litware.com Azure AD tenant. The
Subscription contains resources in the East US Azure region as shown in the following
Table.
Network Environment -
Each Litware office connects directly to the internet and has a site-to-site VPN
Connection to the virtual networks in the Azure subscription.
On-premises Environment -
The on-premises network contains the computers shown in the following table.
Current problems -
Cloud App Security frequently generates false positive alerts when users connect to
Both offices simultaneously.
Planned Changes -
Litware plans to implement the following changes:
Create and configure Azure Sentinel in the Azure subscription.
Validate Azure Sentinel functionality by using Azure AD test user accounts.
Business Requirements -
Litware identifies the following business requirements:
The principle of least privilege must be used whenever possible.
Costs must be minimized, as long as all other requirements are met.
Logs collected by Log Analytics must provide a full audit trail of user activities.
All domain controllers must be protected by using Microsoft Defender for Identity.
Azure Information Protection Requirements
All files that have security labels and are stored on the Windows 10 computers must be
.Data discovery dashboard "€ג available from the Azure Information Protection
Microsoft Defender for Endpoint requirements
All Cloud App Security unsanctioned apps must be blocked on the Windows 10
Computers by using Microsoft Defender for Endpoint.
Microsoft Cloud App Security requirements
Cloud App Security must identify whether a user connection is anomalous based on
Tenant-level data.
Azure Defender Requirements -
All servers must send logs to the same Log Analytics workspace.
Azure Sentinel Requirements -
Litware must meet the following Azure Sentinel requirements:
Integrate Azure Sentinel and Cloud App Security.
Ensure that a user named admin1 can configure Azure Sentinel playbooks.
Create an Azure Sentinel analytics rule based on a custom query. The rule must
Automatically initiate the execution of a playbook.
Add notes to events that represent data access from a specific IP address to provide
The ability to 解析 the IP address when navigating through an investigation graph
While hunting.
Create a test rule that generates alerts when inbound access to Microsoft Office 365 by
The Azure AD test user accounts is detected. Alerts generated by the rule must be
Grouped into individual incidents, with one incident per test user account.QuestionYou
Need to modify the anomaly detection policy settings to meet the Cloud App Security
Requirements.
Which policy should you modify?
2022-08-04
共50道
相关试题
单选题
Note: This question is part of a series of questions that present the same scenario.
Each question in the series contains a unique solution that might meet the stated goals.
Some question sets might have more than one correct solution, while others might not
Have a correct solution.
After you answer a question in this section, you will NOT be able to return to it. As a
Result, these questions will not appear in the review screen.
You are configuring Microsoft Defender for Identity integration with Active Directory.
From the Microsoft Defender for identity portal, you need to configure several accounts
For attackers to exploit.
Solution: From Azure Identity Protection, you configure the sign-in risk policy.
Does this meet the goal?
单选题
You implement Safe Attachments policies in Microsoft Defender for Office 365.
Users report that email messages containing attachments take longer than expected to
Be received.
You need to reduce the amount of time it takes to deliver messages that contain
Attachments without compromising security. The attachments must be scanned for
Malware, and any messages that contain malware must be blocked.
What should you configure in the Safe Attachments policies?
单选题
Note: This question is part of a series of questions that present the same scenario.
Each question in the series contains a unique solution that might meet the stated goals.
Some question sets might have more than one correct solution, while others might not
Have a correct solution.
After you answer a question in this section, you will NOT be able to return to it. As a
Result, these questions will not appear in the review screen.
You use Azure Security Center.
You receive a security alert in Security Center.
You need to view recommendations to resolve the alert in Security Center.
Solution: From Security alerts, you select the alert, select Take Action, and then expand
The Prevent future attacks section.
Does this meet the goal?
单选题
Note: This question is part of a series of questions that present the same scenario.
Each question in the series contains a unique solution that might meet the stated goals.
Some question sets might have more than one correct solution, while others might not
Have a correct solution.
After you answer a question in this section, you will NOT be able to return to it. As a
Result, these questions will not appear in the review screen.
You are configuring Microsoft Defender for Identity integration with Active Directory.
From the Microsoft Defender for identity portal, you need to configure several accounts
For attackers to exploit.
Solution: From Entity tags, you add the accounts as Honeytoken accounts.
Does this meet the goal?
单选题
You need to receive a security alert when a user attempts to sign in from a location that
Was never used by the other users in your organization to sign in.
Which anomaly detection policy should you use?
单选题
You have a Microsoft 365 subscription that uses Microsoft Defender for Office 365.
You have Microsoft SharePoint Online sites that contain sensitive documents. The
Documents contain customer account numbers that each consists of 32 alphanumeric
Characters.
You need to create a data loss prevention (DLP) policy to protect the sensitive
Documents.
What should you use to detect which documents are sensitive?
单选题
Note: This question is part of a series of questions that present the same scenario.
Each question in the series contains a unique solution that might meet the stated goals.
Some question sets might have more than one correct solution, while others might not
Have a correct solution.
After you answer a question in this section, you will NOT be able to return to it. As a
Result, these questions will not appear in the review screen.
You are configuring Microsoft Defender for Identity integration with Active Directory.
From the Microsoft Defender for identity portal, you need to configure several accounts
For attackers to exploit.
Solution: You add the accounts to an Active Directory group and add the group as a
Sensitive group.
Does this meet the goal?
单选题
You receive a security bulletin about a potential attack that uses an image file.
You need to create an indicator of compromise (IoC) in Microsoft Defender for Endpoint
To prevent the attack.
Which indicator type should you use?
