SC-200 試験問題を無料オンラインアクセス

You have a Microsoft Sentinel workspace.
You have a query named Query1 as shown in the following exhibit.

You plan to create a custom parser named Parser 1. You need to use Query1 in Parser1. What should you do first?

• A.Remove line 5.
• B.In line 3, replace the ' contains operator with the !has operator.
• C.Remove line 2.
• D.In line 4. remove the TimeGenerated predicate.

You have a Microsoft Sentinel workspace.
You need to create a KQL query that will identify successful sign-ins from multiple countries during the last three hours.
How should you complete the query? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point

正解：

Explanation:

Below is the completed KQL that meets the requirement (successful sign-ins from multiple countries in the last 3 hours), using the ASIM authentication schema commonly used in Microsoft Sentinel:
let timeframe = ago(3h);
let threshold = 5;
imAuthentication
| where TimeGenerated > timeframe
| where EventType == " Logon " and EventResult == " Success "
| where isnotempty(SrcGeoCountry)
| summarize
StartTime = min(TimeGenerated),
EndTime = max(TimeGenerated),
Vendors = make_set(EventVendor),
Products = make_set(EventProduct),
NumOfCountries = dcount(SrcGeoCountry)
by TargetUserId, TargetUserPrincipalName, TargetUserType
| where NumOfCountries > threshold
* Blade/source: imAuthentication (ASIM parser) normalizes authentication data across sources in Sentinel, letting you query sign-ins consistently.
* Filters: EventType == " Logon " and EventResult == " Success " restrict to successful logons.
* Geo dimension: SrcGeoCountry is the normalized source country field for the sign-in.
* Logic: We look back 3 hours , count distinct countries per user with dcount(SrcGeoCountry) , and keep only users exceeding a chosen threshold (e.g., > 5 ).
This delivers exactly "successful sign-ins from multiple countries during the last three hours," ready for use in a hunting query or to form a scheduled analytics rule.

You use Azure Defender.
You have an Azure Storage account that contains sensitive information.
You need to run a PowerShell script if someone accesses the storage account from a suspicious IP address.
Which two actions should you perform? Each correct answer presents part of the solution.
NOTE: Each correct selection is worth one point.

• A.From Azure Active Directory (Azure AD), add an app registration.
• B.Create an Azure logic appthat has a manual trigger
• C.Create an Azure logic appthat has an HTTP trigger.
• D.Create an Azure logic app that has an Azure Security Center alert trigger.
• E.From Azure Security Center, enable workflow automation.

You need to implement Microsoft Sentinel queries for Contoso and Fabrikam to meet the technical requirements.
What should you include in the solution? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.

正解：

Explanation:

In Microsoft Sentinel, each workspace acts as a logical container for security data and analytics. When integrating Sentinel across organizations or environments-such as between Contoso and Fabrikam -each Azure subscription needs at least one Log Analytics workspace that Sentinel can attach to. This workspace becomes the data repository for logs and analytics rules.
Therefore, Fabrikam requires a minimum of one Log Analytics workspace to onboard Microsoft Sentinel and begin collecting and analyzing data. Multiple workspaces may be used for isolation or region-specific requirements, but one is sufficient for a functional deployment.
To query and correlate data between multiple workspaces or tenants , Sentinel uses the workspace() KQL function. This function allows cross-workspace queries, letting you pull data from different Sentinel instances for investigation or threat correlation. For example:
union workspace( " FabrikamWorkspace " ).SecurityEvent, workspace( " ContosoWorkspace " ).
SecurityEvent
| summarize count() by Account
This KQL syntax enables cross-tenant or cross-subscription correlation when Defender or Sentinel workspaces are connected through proper permissions (e.g., Azure Lighthouse or cross-tenant data access).
# Final Answers:
* Minimum number of Log Analytics workspaces: 1
* Query element required to correlate data between tenants: workspace

From Azure Sentinel, you open the Investigation pane for a high-severity incident as shown in the following exhibit.

Use the drop-down menus to select the answer choice that completes each statement based on the information presented in the graphic.
NOTE: Each correct selection is worth one point.

正解：

Explanation:
If you hover over the virtual machine named vm1 , you can view the running processes .
If you select Info , you can navigate to the bookmarks related to the incident.