Your company uses Azure Sentinel.
A new security analyst reports that she cannot assign and dismiss incidents in Azure
Sentinel. You need to resolve the issue for the analyst. The solution must use the principle
of least privilege. Which role should you assign to the analyst?

A company uses Azure Sentinel.
You need to create an automated threat response.
What should you use?

You have two Azure subscriptions that use Microsoft Defender for Cloud.
You need to ensure that specific Defender for Cloud security alerts are suppressed at the
root management group level. The solution must minimize administrative effort.
What should you do in the Azure portal?

You have a Microsoft 365 tenant that uses Microsoft Exchange Online and Microsoft
Defender for Office 365.
What should you use to identify whether zero-hour auto purge (ZAP) moved an email
message from the mailbox of a user?

You use Azure Security Center.
You receive a security alert in Security Center.
You need to view recommendations to resolve the alert in Security Center.
What should you do?

You are investigating an incident by using Microsoft 365 Defender.
You need to create an advanced hunting query to count failed sign-in authentications on
three devices named CFOLaptop. CEOLaptop, and COOLaptop.
How should you complete the query? To answer, select the appropriate options in the
answer area.
NOTE Each correct selection is worth one point

You have an Azure subscription that contains a Log Analytics workspace.
You need to enable just-in-time (JIT) VM access and network detections for Azure
resources.
Where should you enable Azure Defender?

You are investigating an incident by using Microsoft 365 Defender.
You need to create an advanced hunting query to detect failed sign-in authentications on
three devices named CFOLaptop, CEOLaptop, and COOLaptop.
How should you complete the query? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.