5.3. Practice Questions

Answers and rationales follow all ten questions. Mixed domains, exam voice.

Q1. Your SOC analysts must be able to view and manage Microsoft Sentinel incidents and run existing playbooks on them, but must not create or modify playbooks or analytics rules. You need to assign roles following the principle of least privilege. Which roles should you assign? A) Microsoft Sentinel Responder and Microsoft Sentinel Playbook Operator B) Microsoft Sentinel Contributor and Logic App Contributor C) Microsoft Sentinel Reader and Microsoft Sentinel Automation Contributor D) Microsoft Sentinel Contributor and Microsoft Sentinel Playbook Operator

Q2. A company sends CEF logs from 40 firewalls to Microsoft Sentinel. Analysts report that some firewall events appear twice, in both the CommonSecurityLog and Syslog tables, and ingestion costs have increased. What should you do? A) Replace the Azure Monitor Agent with the Log Analytics agent on the forwarder B) Configure the Syslog and CEF data collection rules to use different facilities C) Move the Syslog table to the data lake tier D) Add a second log forwarder behind a load balancer

Q3. You create a Defender XDR custom detection rule from this query: DeviceProcessEvents | where FileName =~ "certutil.exe" and ProcessCommandLine has "urlcache" | summarize count() by DeviceId. The rule must isolate affected devices automatically. The wizard won't allow the Isolate device action. What should you change? A) Set the rule frequency to Continuous (NRT) B) Replace =~ with == C) Return Timestamp and ReportId with DeviceId, for example with arg_max(Timestamp, ReportId) D) Scope the rule to all device groups

Q4. A Sentinel analytics rule creates one incident for every failed sign-in from the same IP address during a password spray, flooding the queue. You need to consolidate related alerts into a single incident without missing detections. What should you configure? A) An alert tuning rule that hides the alerts B) Suppression for 24 hours after the rule fires C) Alert grouping in the rule's incident settings, grouping alerts when the IP entity matches D) Convert the rule to an NRT rule

Q5. Two Sentinel automation rules trigger when an incident is created. Rule A raises severity to High for incidents from the "Ransomware precursor" analytics rule. Rule B runs a paging playbook when severity equals High. Ransomware precursor incidents are not paging the on-call engineer. What is the most likely cause? A) Rule B runs before Rule A B) The playbook lacks a managed identity C) Automation rules can't change severity D) Paging playbooks require an alert trigger

Q6. A user fell for an adversary-in-the-middle phishing page. Microsoft Entra ID Protection shows the user's session token being used from an unfamiliar IP address. You need to stop the attacker's access immediately. What should you do first? A) Reset the user's password B) Run a full antivirus scan on the user's device C) Add the attacker's IP to the Tenant Allow/Block List D) Revoke the user's sessions and confirm the user compromised

Q7. During a ransomware investigation, you must preserve forensic evidence from a server before remediating it, and the server must stop communicating with the network except for Defender for Endpoint. In which order should you perform the actions? A) Run antivirus scan, then collect investigation package B) Isolate device, then collect investigation package C) Collect investigation package, then remediate and reimage D) Restrict app execution, then reimage

Q8. Legal asks you to identify which email messages an attacker read in a compromised executive mailbox over the last two weeks. Which data source provides this information? A) Message trace in Exchange Online B) Content search in Microsoft Purview eDiscovery C) MailItemsAccessed records in Microsoft Purview Audit D) Microsoft Graph activity logs

Q9. A threat report published today lists an IP address used for command and control. Your organization keeps three years of firewall logs in the Microsoft Sentinel data lake tier. You need to search the full history for the IP and make any matches available to analytics rules, with the least administrative effort. What should you use? A) A summary rule with a one-day bin size B) A Sentinel hunting query marked as a favorite C) An advanced hunting query in Defender XDR D) A one-time KQL job that writes results to an analytics tier table

Q10. You need to identify which over-permissioned accounts or groups sit on the largest number of attack paths to your SQL data stores, so you can remove the most risk with the fewest changes. What should you use? A) The incident graph of the most recent SQL-related incident B) A Sentinel workbook showing failed SQL logons C) The MITRE ATT&CK coverage page in Sentinel D) The choke points to SQL data stores scenario in the hunting graph

Answers.

A1: A. Responder manages incidents and Playbook Operator runs playbooks without editing them, which is the least-privilege pair (2.1.1). B and D include Contributor-level authoring rights the requirement forbids. C's Automation Contributor is for the Sentinel service account, not users, and Reader can't manage incidents.

A2: B. Duplicate ingestion happens when the Syslog and CEF connectors collect the same facility; separating facilities removes the overlap (2.2.3). A reintroduces a retired agent, C hides the symptom while breaking any Syslog-based detection, and D adds capacity without removing duplication.

A3: C. Custom detections need Timestamp and, for Defender for Endpoint tables, DeviceId and ReportId from the same event to map entities and enable device actions; arg_max keeps them through the aggregation (2.5.1). NRT frequency wouldn't fix missing columns, == changes case sensitivity only, and scope doesn't add required columns.

A4: C. Alert grouping combines related alerts from the same rule into one incident, optionally when mapped entities match (2.5.2). A hides alerts entirely (and tuning targets Defender alerts), B stops detection for a period and could miss activity, and NRT changes latency, not grouping.

A5: A. Automation rules run sequentially, and a later rule evaluates the incident after earlier rules change it; if B runs first, severity isn't High yet (2.6.1). The managed identity would affect the playbook's actions, not whether it's launched, and automation rules can change severity.

A6: D. The attacker holds a token, not necessarily the password; revoking sessions invalidates refresh tokens, and confirming compromise raises user risk so risk-based policies apply (3.2.2). A password reset alone leaves the stolen token usable, and an antivirus scan and an IP block entry don't end the session.

A7: B. Isolation stops network spread while keeping the Defender for Endpoint connection, and the investigation package can still be collected from an isolated device before any remediation (3.4.2). C collects evidence but leaves the server communicating until remediation; A scans before preserving evidence; D destroys evidence.

A8: C. MailItemsAccessed records which messages were accessed by sync or bind operations, the standard way to scope what an attacker read (3.5.1). Message trace shows delivery, Content search finds content but not access, and Graph activity logs show API requests only if exported beforehand and don't cover all mail clients.

A9: D. A one-time KQL job runs over data lake history and promotes matches to an analytics-tier table that rules can query (4.3.2). Summary rules aggregate going forward on a schedule; hunting queries and advanced hunting don't search lake history across three years.

A10: D. The choke point scenario finds nodes that appear in the most paths to SQL data stores, directly answering "fewest changes, most risk removed" (4.2.1). The incident graph shows only what happened in one incident, workbooks show logons rather than reachability, and ATT&CK coverage measures detections, not permissions.