Topic 3: Misc. Questions
You have a Microsoft 365 subscription. The subscription contains 500 Windows 11 devices
that are onboarded to Microsoft Defender for Endpoint.
You need to perform the following actions in Microsoft Defender XDR:
• For your company's finance department, populate random endpoints with fake cached
credentials.
• Ensure That an incident is created in Microsoft Defender XDR if an attacker attempts to
use the fake cached credentials.
The solution must ensure that the fake cached credentials are planted only on endpoints of
the finance department.
Which three actions should you perform in sequence? To answer, move the appropriate
actions from the list of actions to the answer area and arrange them in the correct order.
NOTE: More than one order of answer choices is correct. You will receive credit for any of
the correct orders you select.
Explanation:
✅ Why this sequence is correct
The requirement is to plant fake cached credentials (an advanced lure) only on finance department endpoints and generate an incident if an attacker attempts to use them.
Step 1: Assign a device tag
Before you can limit the scope of the deception rule, you must identify which devices should receive the lures. You do this by assigning a specific device tag (e.g., "Finance") to the finance department's endpoints.
Step 2: Create an advanced lure
Next, you create an advanced lure. According to Microsoft documentation, "Advanced lures use custom detection rules to produce high-fidelity alerts when attackers interact with the lures." This is the specific type of lure that will plant fake cached credentials and listen for interactions from attackers.
Step 3: Set Deception to On (Advanced features)
Finally, you enable deception in the Defender for Endpoint settings. You navigate to Settings > Endpoints > Advanced features and set the Deception toggle to On. This enables Defender for Endpoint to push the lures to the tagged devices and to generate incidents when the fake credentials are used.
❌ Why other actions are incorrect
Create a device group
Deception rules only support scoping to "all devices" or "devices with specific tags". Device groups are not supported for limiting deception scope.
Create a custom detection rule
While advanced lures rely on custom detection logic, the rule is created automatically by the "advanced lure" wizard. You do not create a separate custom detection rule manually.
Create a basic lure
Basic lures do not plant fake cached credentials — they only create simple decoys. The requirement specifically states "fake cached credentials," which requires an advanced lure.
Configure a Honeytoken account (Identities settings)
This is a Microsoft Defender for Identity feature for planting fake user accounts in AD DS, not for planting fake cached credentials on endpoints.
📌 References
Microsoft Learn: "To scope a deception rule to specific devices, first assign a device tag to those devices"
Microsoft Learn: "Advanced lures can plant fake network shares and fake cached credentials"
Microsoft Learn: "Lures are planted only after you turn on Deception in the Advanced features section"
You have a Microsoft 365 subscription
You need to identify all the security principals that submitted requests to change or delete
groups. How should you complete the KQL query? To answer, select the appropriate
options in the answer area.
NOTE: Each correct selection is worth one point.
Explanation:
Technical Analysis
This query targets the administrative logs that track directory-level changes within Microsoft Entra ID.
AuditLogs (The Data Source):
The AuditLogs table stores activity related to your tenant's configuration and object management. While SigninLogs tracks authentication and SecurityEvent tracks local OS activity, AuditLogs is the primary destination for lifecycle events (Create, Update, Delete) of groups, users, and applications.
OperationName (The Filter):
Update group: This operation is logged whenever a group's properties (like name, description, or membership type) are changed.
Delete group:This operation is logged when a group is removed from the tenant.
The in operator allows you to search for multiple specific operation strings simultaneously, making the query efficient and readable.
Key Log Fields for Investigation
Once you run this query, the following columns will provide the "who" and "what":
InitiatedBy: Contains the identity (UserPrincipalName or Service Principal ID) of the security principal that submitted the request.
TargetResources: Provides details about the specific group that was changed or deleted.
Result: Confirms if the operation was successful or failed.
References
Microsoft Learn:
Audit logs in Microsoft Entra ID
You have a Microsoft Sentinel workspace that has User and Entity Behavior Analytics
(UEBA) enabled.
You need to identify all the log entries that relate to security-sensitive user actions
performed on a server named Server1. The solution must meet the following requirements:
• Only include security-sensitive actions by users that are NOT members of the IT
department.
• Minimize the number of false positives.
How should you complete the query? To answer, select the appropriate options in the
answer area. NOTE: Each correct selection is worth one point.
Explanation:
>Technical Analysis
This query leverages the high-fidelity data provided by the User and Entity Behavior Analytics (UEBA) engine in Microsoft Sentinel.
BehaviorAnalytics (Table):
The BehaviorAnalytics table is the core output of the UEBA engine. It is superior to raw SecurityEvent or AuditLogs for this task because it identifies "anomalous" or "sensitive" actions that have already been enriched and scored.
ActivityType == "SecuritySensitiveAction" (Precision):
By filtering specifically for SecuritySensitiveAction, you target events that Microsoft Sentinel has already categorized as high-risk (such as group membership changes, permission overrides, or security configuration modifications). This directly addresses the requirement to minimize false positives by ignoring routine system logs.
UserDepartment != "IT" (Metadata Filter):
One of the key advantages of UEBA is that it enriches log entries with user metadata from Microsoft Entra ID. The BehaviorAnalytics table contains a UserDepartment column, allowing you to filter out IT personnel without needing a complex join to the IdentityInfo table, which significantly simplifies the query.
References
Microsoft Learn:
BehaviorAnalytics table reference
You have a Microsoft 365 E5 subscription that uses Microsoft Defender XDR and contains
two users named User1 and User2.
You need to ensure that the users can perform searches by using the Microsoft Purview
portal. The solution must meet the following requirements:
• Ensure that User1 can search the Microsoft Purview Audit service logs and review the
Microsoft Purview Audit service configuration.
• Ensure that User2 can search Microsoft Exchange Online mailboxes.
• Follow the principle of least privilege.
To which Microsoft Purview role group should you add each user? To answer, select the
appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Explanation:
Permissions in Microsoft Purview are managed through role groups that grant access to specific compliance and auditing tools.
User1 (Audit Search & Configuration):
Requirement: Search audit logs and review audit configuration.
Reasoning: While the "Audit Reader" role allows searching logs, reviewing and managing th/eAudit service configuration (such as turning auditing on/off or managing log retention policies) requires elevated permissions. The Organization Management role group includes the "Audit Logs" and "Organization Configuration" roles, making it the least privileged group that covers both requirements.
User2 (Search Exchange Online Mailboxes):
Requirement: Search Microsoft Exchange Online mailboxes.
Reasoning: The eDiscovery Manager role group is specifically designed for users who need to perform content searches across different locations, including Exchange mailboxes, SharePoint sites, and OneDrive for Business. It provides the "Reviewer" and "Search and Purge" capabilities necessary for discovery without granting broad administrative control over the entire Purview organization.
Key Role Group Differences
Audit Manager: Primarily focused on viewing and managing audit logs but may not have the full organizational configuration rights required for User1's specific "review configuration" task.
Compliance Administrator: A high-level role that has broad access to all compliance features; usually exceeds the "least privilege" requirement for a user who only needs to perform mailbox searches.
References
Microsoft Learn: Permissions in the Microsoft Purview compliance portal
Microsoft Learn: Assign eDiscovery permissions in Microsoft Purview
You have an Azure subscription named Sub1 that contains the resources shown in the
following table.
You plan to configure Rule1 to trigger Lapp1 when an incident is generated.
You need to recommend the role-based access control (RBAC) role that you should assign
to WS1, and the scope at which should you assign the role. The solution must follow the
principle of least privilege.
What should you recommend? To answer, select the appropriate options in the answer
area.
NOTE: Each correct selection is worth one point.
Explanation:
Technical Analysis
This configuration ensures that Microsoft Sentinel has the necessary permissions to interact with automation resources while adhering to the principle of least privilege.
Microsoft Sentinel Automation Contributor (Role):
This is a specialized, "built-in" role designed specifically for this scenario. It grants Microsoft Sentinel the permissions required to run playbooks and automate responses to incidents.
Unlike the standard "Logic App Contributor" role, which allows full management (editing/deleting) of logic apps, the Automation Contributor role is scoped to the execution and management within the context of Sentinel.
RG2 (Scope):
According to the table provided in the exhibit, Lapp1 (the Logic App) is located in resource group RG2.
Assigning the role at the RG2 level ensures that Sentinel can trigger any playbook within that specific group without having unnecessary permissions across the entire subscription (Sub1) or other unrelated resource groups (RG1).
Key Workflow
When an incident is generated in WS1 that matches the criteria of Rule1, Sentinel uses this RBAC assignment to "reach into" RG2 and signal Lapp1 to begin its workflow (e.g., sending a Slack message, isolating a host, or blocking a user).
References
Microsoft Learn: Authenticate Sentinel to Microsoft Defender XDR to run playbooks
Microsoft Learn: Microsoft Sentinel RBAC roles
| Page 4 out of 37 Pages |