Q1.A company operates an Azure subscription.
You need to continuously stream the Microsoft Graph activity logs to a third-party security information and event management (SIEM) product located outside the company.
The goal is to keep operational effort as low as possible.
Which destination is best for sending the logs?
Show answer
When sending Microsoft Graph activity logs to an external SIEM, real-time and scalable data ingestion is required.
The best fit for this requirement is Azure Event Hubs.
Event Hubs can continuously stream large volumes of logs and integrates easily with many SIEM products, so management effort is kept to a minimum.
Event Grid is meant for event notifications, storage is meant for archiving, and Log Analytics is meant for analysis, none of which are suited to direct streaming to an external SIEM.
Therefore, Event Hubs is the best choice for SIEM integration.
Diagnostic settings in Azure Monitor – Azure Monitor
Q2.You are newly deploying Azure Sentinel.
To monitor Microsoft Teams and a Linux virtual machine in your Azure environment, you need to configure the appropriate connectors in Azure Sentinel.
The policy is to keep operational effort to a minimum.
Which data connector type should you choose for each workload?
Show answer
Microsoft Teams is part of the Microsoft 365 services, so using the Office 365 connector is the most efficient way to collect its logs.
This lets you obtain audit logs in an integrated manner.
For monitoring the Linux virtual machine, OS-level log collection is required, so you use the Syslog connector.
Syslog is the standard log collection method in Linux environments and can be easily ingested into Sentinel through an agent.
This combination achieves efficient monitoring while minimizing additional configuration.
Microsoft Sentinel data connectors
Q3.You manage an Azure subscription that consists of 100 Linux virtual machines.
You need to configure Microsoft Sentinel to ingest event logs from these virtual machines.
Which three actions should you perform in sequence?
Drag (or tap) the required number of items from the “Options” on the left into the “Answer area” on the right. You can drag items within the answer area to reorder them.
- Add the Syslog connector to the workspace
- Add Microsoft Sentinel to the workspace
- Install the Log Analytics agent on the Linux virtual machines
- Add the Security Events connector to the workspace
- Add a Microsoft Sentinel workbook
- Drag here
Show answer
To collect logs from Linux virtual machines, you first add Microsoft Sentinel to the workspace to enable the monitoring foundation.
Next, you add the Syslog connector, which is the standard log collection method on Linux, to define log ingestion.
Finally, by installing the Log Analytics agent on each virtual machine, logs are actually sent to the workspace.
This order satisfies the dependencies and allows an efficient configuration.
Microsoft Sentinel data connectors
Q4.You have an Azure subscription with the users registered as shown in the following table. (Image 1)
The subscription has Azure Firewall instances configured as shown in the following table. (Image 2)
In addition, you have a Microsoft 365 E5 subscription that can use Microsoft Copilot for Security, and the Copilot for Security roles shown in the following table are assigned to each user. (Image 3)
Each user runs a Copilot for Security session.
For each of the following statements, select “Yes” if it is correct, or “No” if it is not correct.
| User | Role | Scope |
|---|---|---|
| User1 | Contributor | Subscription |
| User2 | Contributor | Subscription |
| User3 | Security Reader | Resource group |
| Name | Log configuration | Destination |
|---|---|---|
| AFW1 | Unstructured logs | Log Analytics |
| AFW2 | Structured intrusion detection and prevention system (IDPS) logs | Azure Event Hubs |
| AFW3 | Structured intrusion detection and prevention system (IDPS) logs | Log Analytics |
| User | Copilot role |
|---|---|
| User1 | Copilot Owner |
| User2 | Copilot Contributor |
| User3 | Copilot Owner |
| Statement | Yes | No | |
|---|---|---|---|
| User1 can obtain the information for AFW1 | |||
| User2 can obtain the information for AFW2 | |||
| User3 can obtain the information for AFW3 |
Show answer
In Copilot for Security, you can directly reference only logs stored in Log Analytics.
Logs sent to Event Hubs are out of scope.
Referencing requires both Azure RBAC and a Copilot role.
User1 has Contributor and Copilot Owner, and because AFW1 uses Log Analytics, the information can be obtained.
For User2, because AFW2 uses Event Hubs, it cannot be referenced from Copilot and cannot be obtained.
User3 can still reference Log Analytics even with Security Reader, so the information for AFW3 can be obtained.
The combination of log destination and permissions is the key decision point.
Microsoft Sentinel data connectors
Q5.You operate an Azure subscription named Sub1.
Sub1 contains a Microsoft Sentinel workspace named SW1 and a virtual machine named VM1 that runs Windows Server.
SW1 collects security logs from VM1 using Windows security events via the AMA connector.
You need to narrow the range of events captured from VM1 so that only audit failure events are collected.
How should you complete the connector’s filter expression?
Show answer
In Windows security events, audit success and failure are distinguished by the Keywords field.
To extract only audit failures, you need to filter using Keywords within the System section.
EventData holds the detailed information of an event and is not suited to determining the audit type.
Therefore, specifying System/Keywords in the filter expression is the correct answer.
This lets you efficiently collect only failure events and reduce unnecessary logs.
Find your Microsoft Sentinel data connector
Q6.You have an Azure subscription that contains 50 virtual machines.
You plan to deploy Microsoft Defender for Cloud.
You need to enable agentless scanning for 40 of those virtual machines.
In this configuration, disk snapshots of the virtual machines must be created and analyzed out-of-band against those snapshots.
How should you configure this?
Show answer
Agentless scanning and disk snapshot analysis are features provided by the Defender CSPM plan.
Therefore, you must first select CSPM as the Defender plan.
Also, when targeting only specific virtual machines, you need to control the scope with policy, and the simplest method is exclusion configuration using tagging.
RBAC is access control and is not suited to controlling scan targets.
By combining CSPM with tags, you can efficiently scan only the required VMs.
Enable agentless scanning for virtual machines – Microsoft Defender for Cloud | Microsoft Learn
Q7.You operate the following environment.
It consists of Azure Sentinel, a Microsoft 365 subscription, Microsoft Defender for Identity, and an Azure Active Directory tenant.
You configure Azure Sentinel to collect security logs from all Active Directory member servers and domain controllers.
Microsoft Defender for Identity is deployed using standalone sensors.
You need to reliably detect when a sensitive group is changed in Active Directory.
Select two actions to perform.
Each choice represents part of the solution.
Show answer
To detect changes to sensitive groups, you must first enable advanced audit policy on the domain controllers to record account management events.
This generates audit logs of group changes.
In addition, to aggregate those logs into Sentinel or Defender for Identity, you configure Windows Event Forwarding so they can be collected centrally.
Changing OU permissions or configuring Microsoft 365 auditing is not directly related to collecting Active Directory security events.
Therefore, these two are the essential requirements for detecting changes.
Find your Microsoft Sentinel data connector
Q8.You have a Microsoft Sentinel workspace that contains the following Advanced Security Information Model (ASIM) parsers.
◆ _Im_ProcessCreate (process creation)
◆ A parser being created
Here you create a new source-specific parser named vimProcessCreate.
You need to modify the parsers so that the following requirements are met.
◆ Call all ProcessCreate parsers.
◆ Normalize fields to the process schema.
Which parser should you modify to meet each requirement?
Drag each option to the matching requirement’s drop zone, or tap to place it. Click a filled zone to send it back. (The same option may be used more than once.)
imProcessCreate
vimProcessCreate
Show answer
ASIM uses unifying parsers and source-specific parsers together.
To call all ProcessCreate parsers, you use _Im_ProcessCreate.
This is a unifying parser that spans multiple data sources and returns standardized results.
On the other hand, to normalize fields to the process schema, you use imProcessCreate.
This normalizes data from an individual source into the ASIM schema.
This combination achieves both unified retrieval and schema normalization.
Normalization and the Advanced Security Information Model (ASIM)
Q9.You have an Azure subscription that contains a resource group named RG1.
RG1 contains a Microsoft Sentinel workspace.
The subscription is associated with a Microsoft Entra tenant that contains a user named User1.
You need to ensure that User1 can deploy and customize Microsoft Sentinel workbook templates.
This configuration must follow the principle of least privilege.
Which role should you assign to User1 on RG1?
Show answer
Microsoft Sentinel workbooks are an Azure Monitor feature, and deploying or editing templates requires the Workbook Contributor role.
This role grants only the permission to create and edit workbooks and does not affect other resources, so it satisfies the principle of least privilege.
Microsoft Sentinel Contributor and Contributor include excessive permissions, and Automation Contributor is intended for playbooks and is inappropriate.
Therefore, assigning the workbook-specific role is the correct answer.
Azure Workbooks overview – Azure Monitor
Q10.You have a Microsoft Sentinel workspace with User and Entity Behavior Analytics (UEBA) enabled.
You need to extract all log entries related to security-significant user actions performed on a server named Server1.
This configuration must meet the following requirements.
◆ Target only security-related actions performed by users who are not members of the IT department.
◆ Minimize the number of false positives.
How should you complete the query?
Show answer
To leverage UEBA, you need to join user attribute information, so you use the IdentityInfo table.
This lets you filter by attributes such as department.
Also, to reduce false positives, you use an inner join that strictly joins only common users.
With leftouter, unnecessary data may be included.
Therefore, joining SecurityEvent and IdentityInfo with an inner join and narrowing to non-IT department members achieves high-precision detection.
Microsoft Sentinel User and Entity Behavior Analytics (UEBA) reference