Microsoft Security Operations Analyst Free Sample Questions

The Investigation Graph in Microsoft Sentinel is specifically designed to help analysts visualize and traverse the relationships between entities within an incident. It provides a timeline and an interactive map to understand the scope and sequence of an attack, making it the correct tool for this scenario. Workbooks are for visualization and reporting, Hunting is for proactive threat discovery, and Automation Rules are for automating responses.

In Microsoft Defender for Endpoint, automation levels can be configured per device group. To meet the requirement, you would set the automation level for the 'Standard User Workstations' group to 'Full - remediate threats automatically' and the 'Executive Laptops' group to a lower level, such as 'Semi - require approval for all folders'. This provides the granular control needed for conditional automated responses.

This architecture correctly addresses both requirements. Creating a separate Microsoft Sentinel workspace in each region ensures data is stored locally, satisfying data sovereignty laws. The global SOC team can then use cross-workspace querying capabilities from their primary North American workspace to run KQL queries, hunt for threats, and manage incidents across all regional workspaces, providing a single pane of glass for operations.

The make_set() function is crucial for creating an array (or set) of unique countries a user has logged in from during the 30-day baseline period.

The set_difference() function is used to compare the set of countries from the last 7 days against the baseline set from the previous 30 days, identifying any new countries.

This option is the most precise. Event ID 4688 logs process creation. Filtering for NewProcessName ending in 'vssadmin.exe' correctly identifies the process. Critically, it also checks the CommandLine for the specific arguments 'delete shadows', which is the malicious action. This combination minimizes false positives.

True. An automation rule in Microsoft Sentinel can be configured with multiple actions. If the conditions of the rule are met, it can execute all configured actions, including running several different playbooks in a specified order.

The correct sequence is: 1. put to upload the script file from the analyst's machine to the compromised device. 2. run to execute the uploaded script on the device. 3. get to download the output file generated by the script from the device back to the analyst's machine.

JIT VM access mitigates the risk of brute-force attacks by keeping management ports (like RDP port 3389 and SSH port 22) closed by default. Access is only granted for a limited time to specific IP addresses upon an approved request. This significantly reduces the attack surface of the virtual machine.

Microsoft Sentinel Workbooks, which are based on Azure Monitor Workbooks, are the ideal feature for creating interactive reports and dashboards. They allow for rich visualizations, dynamic filtering, and combining data from multiple sources, which perfectly matches the manager's requirements.

A Session policy is required for this scenario because it can control user activities within a browser session in real-time. The analyst can configure a session policy to filter for 'File Upload' activities to apps with a risk score less than 6 and then apply the 'Block' action. This allows for granular control over in-session activities like uploads, which an Activity policy (for post-activity alerting) or an App discovery policy (for tagging/sanctioning apps) cannot do.

This is the most cost-effective and compliant solution. Setting the interactive retention period to 90 days makes the recent, most relevant data available for high-performance queries. Configuring the total retention to 2555 days (approximately 7 years) moves data older than 90 days to the low-cost Azure Archive storage tier, where it is retained for compliance but can still be queried via search jobs if needed.

Microsoft Defender for Identity provides lateral movement path visualizations. Reviewing these paths for the potentially compromised user is the most effective step to understand the potential blast radius. It shows which sensitive accounts and machines the user could access, helping to validate the severity and scope of the Pass-the-Ticket attack before taking disruptive remediation actions like a password reset.

Data Collection Rules (DCRs) with the Azure Monitor Agent are the modern and correct way to ingest custom text logs. A DCR can be configured to collect the proprietary log file, and a KQL transformation within the DCR can parse the multi-line format and extract the required fields before sending the data to the specified custom table (LegacyApp_CL). This provides a robust and scalable solution.

Hunting bookmarks in Microsoft Sentinel are specifically designed to capture interesting events found during a threat hunt. An analyst can bookmark one or more log entries, which saves the query results, allows for adding tags and notes, mapping to MITRE ATT&CK tactics and techniques, and can be used to initiate an investigation or promote to an incident.

Microsoft Purview DLP policies for Microsoft Teams are designed to work in near real-time. When a user attempts to share sensitive information that violates a policy, the message will be blocked. The user who sent the message will receive a policy tip explaining that the message was blocked because it contains sensitive information, and administrators will see a corresponding alert.

ZAP stands for Zero-hour Auto Purge. It is a protection feature in Defender for Office 365 that detects and neutralizes malicious phishing, spam, or malware messages that have already been delivered to Exchange Online mailboxes. A spike in 'ZAP' events means the system identified threats post-delivery and automatically moved them to the junk folder or quarantine.

The join operator is used in KQL to merge the rows of two tables to form a new table by matching the values of the specified columns from each table. In this case, it correctly joins the two tables on the common SHA256 column.

The Microsoft Sentinel Responder role is designed specifically for this purpose. It grants permissions to perform response actions on incidents, such as assigning, closing, and managing them, without allowing the user to change the configuration of Sentinel itself, like editing analytics rules or data connectors. This follows the principle of least privilege.

Microsoft Defender for Endpoint includes a specific Attack Surface Reduction (ASR) rule named 'Block credential stealing from the Windows local security authority subsystem (lsass.exe)'. Enabling this rule in block mode directly prevents processes from accessing LSASS memory, which is a common technique used by tools like Mimikatz.

This query correctly filters the SecurityAlert table for records within the last day (ago(1d)). It then uses the summarize operator with the count() aggregation function to count the number of rows for each unique AlertName. The by AlertName clause groups the results, producing the desired output of rule names and their corresponding alert counts.