You need to implement Azure Sentinel queries for Contoso and Fabrikam to meet the
technical requirements.
What should you include in the solution? To answer, select the appropriate options in the
answer area.
NOTE: Each correct selection is worth one point.

You use Azure Sentinel.
You need to use a built-in role to provide a security analyst with the ability to edit the
queries of custom Azure Sentinel workbooks. The solution must use the principle of least
privilege.
Which role should you assign to the analyst?

You need to create the analytics rule to meet the Azure Sentinel requirements.
What should you do? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.

A company wants to analyze by using Microsoft 365 Apps.
You need to describe the connected experiences the company can use.
Which connected experiences should you describe? To answer, drag the appropriate
connected experiences to the correct description. Each connected experience may be used
once, more than once, or not at all. You may need to drag the split between panes or scroll
to view content.
NOTE: Each correct selection is worth one point.

You receive an alert from Azure Defender for Key Vault.
You discover that the alert is generated from multiple suspicious IP addresses.
You need to reduce the potential of Key Vault secrets being leaked while you investigate
the issue. The solution must be implemented as soon as possible and must minimize the
impact on legitimate users.
What should you do first?

You need to use an Azure Resource Manager template to create a workflow automation
that will trigger an automatic remediation when specific security alerts are received by
Azure Security Center.
How should you complete the portion of the template that will provision the required Azure
resources? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.

You are informed of an increase in malicious email being received by users.
You need to create an advanced hunting query in Microsoft 365 Defender to identify
whether the accounts of the email recipients were compromised. The query must return the
most recent 20 sign-ins performed by the recipients within an hour of receiving the known
malicious email.
How should you complete the query? To answer, select the appropriate options in the
answer area.
NOTE: Each correct selection is worth one point.

You have two Azure subscriptions that use Microsoft Defender for Cloud.
You need to ensure that specific Defender for Cloud security alerts are suppressed at the
root management group level. The solution must minimize administrative effort.
What should you do in the Azure portal?