<< Prev Question Next Question >>

Question 103/117

You have a Microsoft Sentinel workspace.
You enable User and Entity Behavior Analytics (UFBA) by using Audit logs and Signin logs. The following entities are detected in the Azure AD tenant:
* App name: App1
* IP address: 192.168.1.2
* Computer name: Device1
* Used client app: Microsoft Edge
* Email address: [email protected]
* Sign-in URL: https://www.company.com
Which entities can be investigated by using UEBA?

Recent Comments (The most recent comments are at the top.)

sam - Nov 29, 2024

D. app name, computer name, IP address, email address, and used client app only

LEAVE A REPLY

Your email address will not be published. Required fields are marked *

Question List (117q)
Question 1: You have a Microsoft 365 E5 subscription. You plan to perfor...
Question 2: You have a Microsoft 365 subscription that uses Microsoft Pu...
Question 3: Note: This question is part of a series of questions that pr...
1 commentQuestion 4: You have a Microsoft 365 E5 subscription that is linked to a...
1 commentQuestion 5: You have an Azure subscription that uses Microsoft Defender ...
1 commentQuestion 6: You have a playbook in Azure Sentinel. When you trigger the ...
Question 7: You have an Azure subscription that contains two users named...
1 commentQuestion 8: You need to meet the Microsoft Defender for Cloud Apps requi...
1 commentQuestion 9: You have a Microsoft 365 subscription that uses Microsoft De...
1 commentQuestion 10: You have an Azure subscription that contains a Microsoft Sen...
Question 11: A security administrator receives email alerts from Azure De...
Question 12: You have the resources shown in the following table. (Exhibi...
Question 13: You need to complete the query for failed sign-ins to meet t...
Question 14: You have a Microsoft Sentinel workspace. You have a query na...
1 commentQuestion 15: You have a custom detection rule that includes the following...
Question 16: You have a Microsoft 365 subscription that uses Microsoft De...
Question 17: You have an Azure subscription that contains a user named Us...
Question 18: You use Azure Sentinel to monitor irregular Azure activity. ...
1 commentQuestion 19: You have 50 Microsoft Sentinel workspaces. You need to view ...
1 commentQuestion 20: You have a Microsoft 365 E5 subscription that uses Microsoft...
Question 21: You need to implement the Microsoft Sentinel NRT rule for mo...
Question 22: You need to meet the Microsoft Sentinel requirements for col...
Question 23: Your company stores the data for every project in a differen...
1 commentQuestion 24: You use Azure Sentinel. You need to use a built-in role to p...
1 commentQuestion 25: You need to identify which mean time metrics to use to meet ...
Question 26: You need to configure event monitoring for Server1. The solu...
Question 27: Note: This question is part of a series of questions that pr...
Question 28: You open the Cloud App Security portal as shown in the follo...
1 commentQuestion 29: You have an Azure subscription that uses Microsoft Defender ...
Question 30: You have an existing Azure logic app that is used to block A...
Question 31: You have a Microsoft Sentinel workspace named workspace1 tha...
Question 32: You need to use an Azure Sentinel analytics rule to search f...
Question 33: You have a Microsoft Sentinel workspace that has User and En...
Question 34: You purchase a Microsoft 365 subscription. You plan to confi...
1 commentQuestion 35: You have an Azure subscription that uses Microsoft Defender ...
Question 36: You need to recommend a solution to meet the technical requi...
Question 37: You need to add notes to the events to meet the Azure Sentin...
Question 38: You have an Azure subscription that contains an Azure logic ...
Question 39: You have a Microsoft 365 tenant that uses Microsoft Exchange...
Question 40: You provision a Linux virtual machine in a new Azure subscri...
Question 41: You have an Azure Storage account that will be accessed by m...
Question 42: You have an Azure subscription that uses Microsoft Defender ...
Question 43: You create an Azure subscription. You enable Microsoft Defen...
Question 44: You use Azure Defender. You have an Azure Storage account th...
1 commentQuestion 45: You need to assign role-based access control (RBAQ roles to ...
Question 46: You need to implement Azure Sentinel queries for Contoso and...
Question 47: The issue for which team can be resolved by using Microsoft ...
1 commentQuestion 48: You have an Azure subscription that contains a quest user na...
1 commentQuestion 49: You have a Microsoft subscription that has Microsoft Defende...
Question 50: A company wants to analyze by using Microsoft 365 Apps. You ...
Question 51: Your company has an on-premises network that uses Microsoft ...
1 commentQuestion 52: You have an Azure subscription that has Microsoft Defender f...
Question 53: Note: This question is part of a series of questions that pr...
Question 54: You use Microsoft Sentinel. You need to receive an alert in ...
Question 55: You have an Azure subscription named Sub1 and a Microsoft 36...
Question 56: You have an Azure subscription that contains an Microsoft Se...
Question 57: You have a Microsoft Sentinel workspace named Workspace1. Yo...
1 commentQuestion 58: You provision Azure Sentinel for a new Azure subscription. Y...
Question 59: You have a Microsoft 365 subscription that uses Microsoft 36...
1 commentQuestion 60: You have two Azure subscriptions that use Microsoft Defender...
1 commentQuestion 61: You create an Azure subscription named sub1. In sub1, you cr...
Question 62: You have a custom analytics rule to detect threats in Azure ...
Question 63: Note: This question is part of a series of questions that pr...
Question 64: Your network contains an on-premises Active Directory Domain...
1 commentQuestion 65: You have a Microsoft 365 E5 subscription that uses Microsoft...
Question 66: You have a Microsoft Sentinel workspace. You need to prevent...
Question 67: You need to implement the Azure Information Protection requi...
1 commentQuestion 68: You have a Microsoft 365 E5 subscription that uses Microsoft...
Question 69: You have an Azure subscription that contains a virtual machi...
Question 70: You have a third-party security information and event manage...
Question 71: Note: This question is part of a series of questions that pr...
Question 72: Note: This question is part of a series of questions that pr...
Question 73: You receive a security bulletin about a potential attack tha...
Question 74: You have a Microsoft Sentinel workspace You develop a custom...
Question 75: You need to configure the Microsoft Sentinel integration to ...
Question 76: You have a Microsoft 365 subscription that contains the foll...
Question 77: You plan to connect an external solution that will send Comm...
1 commentQuestion 78: You need to minimize the effort required to investigate the ...
Question 79: You have a Microsoft 365 subscription that uses Microsoft 36...
Question 80: You have an Azure subscription that uses Microsoft Defender ...
Question 81: Your company uses Microsoft Sentinel A new security analyst ...
Question 82: You have the following SQL query. (Exhibit)...
Question 83: You have a Microsoft Sentinel workspace named sws1. You need...
1 commentQuestion 84: You need to identify which mean time metrics to use to meet ...
Question 85: You have a Microsoft Sentinel workspace that uses the Micros...
Question 86: You are investigating an incident in Azure Sentinel that con...
Question 87: You need to ensure that the configuration of HuntingQuery1 m...
1 commentQuestion 88: You have an Azure subscription. You need to delegate permiss...
Question 89: You have an Azure subscription that uses Microsoft Defender ...
Question 90: Your company uses line-of-business apps that contain Microso...
1 commentQuestion 91: You need to create an advanced hunting query to investigate ...
Question 92: You have an Azure Sentinel deployment in the East US Azure r...
Question 93: You have a Microsoft 365 subscription that uses Microsoft De...
1 commentQuestion 94: You have a Microsoft Sentinel workspace. You receive multipl...
Question 95: Your company has a single office in Istanbul and a Microsoft...
1 commentQuestion 96: You have a custom Microsoft Sentinel workbook named Workbook...
1 commentQuestion 97: You have an Azure subscription that has Azure Defender enabl...
Question 98: You have an Azure subscription named Sub1 that uses Microsof...
Question 99: You use Azure Security Center. You receive a security alert ...
Question 100: Your company deploys Azure Sentinel. You plan to delegate th...
Question 101: You have a Microsoft Sentinel workspace that contains a cust...
Question 102: You have a Microsoft 365 E5 subscription that uses Microsoft...
1 commentQuestion 103: You have a Microsoft Sentinel workspace. You enable User and...
1 commentQuestion 104: You have a Microsoft 365 E5 subscription that contains 100 L...
Question 105: You have a Microsoft Sentinel workspace. A Microsoft Sentine...
Question 106: You need to create a query to investigate DNS-related activi...
Question 107: You are informed of a new common vulnerabilities and exposur...
Question 108: You have the following KQL query. (Exhibit)...
1 commentQuestion 109: You create a new Azure subscription and start collecting log...
1 commentQuestion 110: You need to ensure that you can run hunting queries to meet ...
1 commentQuestion 111: You have a Microsoft 365 subscription. The subscription uses...
Question 112: You need to implement the Defender for Cloud requirements. W...
1 commentQuestion 113: You have a Microsoft Sentinel workspace named Workspaces You...
Question 114: You have four Azure subscriptions. One of the subscriptions ...
1 commentQuestion 115: You have an Azure subscription that contains an Microsoft Se...
1 commentQuestion 116: You haw the resources shown in the following Table. (Exhibit...
1 commentQuestion 117: You have an Azure subscription that has the enhanced securit...