SC-200 試験問題を無料オンラインアクセス

You have a Microsoft Sentinel workspace.
You need to configure a report visual for a custom workbook. The solution must meet the following requirements:
* The count and usage trend of AppDisplayName must be included
* The TrendList column must be useable in a sparkline visual,
How should you complete the KQL query? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.

正解：

Explanation:

You have an Azure subscription that contains a Microsoft Sentinel workspace.
You need to create and customize a workbook for the Microsoft Entra ID Audit Logs.
Which three actions should you perform in sequence? To answer, move the appropriate actions from the list of actions to the answer area and arrange them in the correct order.

正解：

Explanation:

You have a Microsoft 365 subscription.
You plan to use Microsoft Defender XDR to hunt for email-related threats.
You need to identify sign-ins performed by users within 30 minutes of the users receiving a known malicious email.
How should you complete the KQL query? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.

正解：

Explanation:

You have an Azure subscription that is linked to a hybrid Azure AD tenant and contains a Microsoft Sentinel workspace named Sentinel1.
You need to enable User and Entity Behavior Analytics (UEBA) for Sentinel 1 and configure UEBA to use data collected from Active Directory Domain Services (AD OS).
What should you do? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.

正解：

Explanation:
To the AD DS domain controllers, deploy: Microsoft Defender for Identity sensors For Sentinel1, configure: The Security Events data source To enable User and Entity Behavior Analytics (UEBA) in Microsoft Sentinel using data from on-premises Active Directory Domain Services (AD DS), you must collect detailed identity and authentication events.
This requires integration with Microsoft Defender for Identity (MDI) - the native tool designed to monitor domain controller traffic and send identity telemetry to Microsoft Sentinel.
According to Microsoft documentation:
"To collect signals from your on-premises Active Directory domain controllers, install Microsoft Defender for Identity sensors directly on each domain controller or on a dedicated server." These sensors capture Windows event logs and network authentication data (Kerberos, NTLM, LDAP) and send the information securely to Defender for Identity cloud service.
The Azure Connected Machine agent and Azure Monitor agent do not provide the specialized identity telemetry required by UEBA. Therefore, the correct deployment is the Microsoft Defender for Identity sensors.
After integrating Defender for Identity, you must connect the right data source in Microsoft Sentinel.
The Security Events data source ingests domain controller event logs (such as sign-ins, account management, and group membership changes) that UEBA relies on for behavioral baselines and anomaly detection.
Microsoft Sentinel UEBA documentation confirms:
"UEBA uses data from identity-related data sources, such as SecurityEvents and Azure Active Directory sign- ins, to build user and entity profiles and detect anomalies." The Audit Logs and Signin Logs tables are specific to Azure AD and cloud identity events - not on-premises AD DS domain controllers.
# Final Configuration:
Deploy Microsoft Defender for Identity sensors to the domain controllers.
Configure The Security Events data source for Sentinel1.

You have a Microsoft Sentinel workspace.
You have a KQL query. The query returns Microsoft Sentinel incidents that are stored in the Securitylncident table and occurred during the last 90 days.
You need to create a Microsoft Sentinel workbook that will include a visualization of the query.
To what should you set Data source and Resource type for the workbook? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.

正解：

Explanation:

When you create a Microsoft Sentinel workbook that visualizes data retrieved using a Kusto Query Language (KQL) query, the workbook must use a data source that supports log analytics queries. According to Microsoft Sentinel and Azure Monitor documentation, Logs (Analytics) is the correct data source type for querying tables stored within a Log Analytics workspace, such as the SecurityIncident table. This table is where Microsoft Sentinel stores incident data.
In the workbook configuration, the Resource type determines which service the query context applies to.
Since you are querying Microsoft Sentinel incidents (not general Azure Monitor logs or metrics), you must set the resource type to Microsoft Sentinel. This ensures that the workbook is connected to Sentinel's analytics schema and can display visualizations (charts, metrics, timelines) based on Sentinel's native data tables.
Alternative resource types such as Log Analytics or Workspace could technically access the same data, but Microsoft Sentinel documentation recommends selecting Microsoft Sentinel when the workbook is designed for security operations and incident analysis. This provides tighter integration with the SOC dashboard experience, Sentinel permissions, and security insights views.
# Therefore, the correct selections are:
Data source: Logs (Analytics)
Resource type: Microsoft Sentinel