MS-500 試験問題を無料オンラインアクセス

You have an Azure Sentinel workspace that has an Office 365 connector.
You are threat hunting events that have suspicious traffic from specific IP addresses.
You need to save the events and the relevant query results for future reference.
Which three actions should you perform in sequence? To answer, move the appropriate actions from the list of actions to the answer area and arrange them in the correct order.

正解：

Explanation
Graphical user interface, text, application Description automatically generated

Reference:
https://docs.microsoft.com/en-us/azure/sentinel/bookmarks

You have a Microsoft Sentinel workspace that has an Azure Active Directory (Azure AD) connector and an Office 365 connector.
From the workspace, you plan to create an analytics rule that will be based on a custom query and will run a security play.
You need to ensure that you can add the security playbook and the custom query to the rule.
What should you do? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.

正解：

You are evaluating which finance department users will be prompted for Azure MFA credentials.
For each of the following statements, select Yes if the statement is true. Otherwise, select No.
NOTE: Each correct selection is worth one point.

正解：

Explanation
YES, YES, NO.
Named locations can't have a private IP range, look at
https://docs.microsoft.com/en-us/azure/active-directory/conditional-access/location-condition
"User IP address The IP address that is used in policy evaluation is the public IP address of the user. For devices on a private network, this IP address is not the client IP of the user's device on the intranet, it is the address used by the network to connect to the public internet."

You need to recommend a solution for the user administrators that meets the security requirements for auditing.
Which blade should you recommend using from the Azure Active Directory admin center?

• A.Azure AD Identity Protection
• B.Sign-ins
• C.Authentication methods
• D.Access review

Your network contains an on-premises Active Directory domain. The domain contains the servers shown in the following table.

You plan to implement Microsoft Defender for Identity for the domain. You install a Microsoft Defender for Identity standalone sensor on Server 1. You need to monitor the domain by using Microsoft Defender for Identity. What should you do?

• A.Configure port mirroring for Server1.
• B.Configure port mirroring for DCI.
• C.Install the Microsoft Monitoring Agent on Server 1.
• D.Install the Microsoft Monitoring Agent on DC1.