最新的Microsoft Security Operations Analyst (SC-200日本語版) - SC-200日本語免費考試真題

Explanation:
If you hover over the virtual machine named vm1, you can view the running processes.
If you select Info, you can navigate to the bookmarks related to the incident.

說明：（僅 Fast2test 成員可見）

According to Microsoft Security Operations (SecOps) and Azure Sentinel documentation, when you need to create an analytics rule that executes a custom KQL query and automatically initiates a playbook, the correct configuration is to create a Scheduled rule and ensure the playbook includes a trigger.
Here's why:
A Scheduled analytics rule in Microsoft Sentinel (Microsoft Defender XDR portal) is designed for running custom KQL queries at defined intervals (for example, every hour or every few minutes) to detect specific patterns of suspicious activity. When the rule's conditions are met, Sentinel generates alerts that can automatically trigger a playbook for response and automation.
A playbook in Sentinel is an Azure Logic App that automates responses to incidents or alerts. To connect a playbook to an analytics rule, it must include a trigger-specifically, the "Microsoft Sentinel Alert" or
"Incident trigger." This allows the rule to start the playbook automatically when the defined condition is met.
The other options are incorrect because:
Fusion rules are built-in and use Microsoft's machine learning to correlate signals automatically; they can't be used for custom queries.
Microsoft incident creation rules are also built-in and handle alert-to-incident grouping logic, not custom query execution.
A service principal would be needed for permissions (e.g., admin1 configuring playbooks), but not inside the playbook itself.
Diagnostics settings apply to log collection and retention, not rule automation.
Therefore, based on Microsoft Sentinel best practices and documentation:
# Create the rule of type: Scheduled
# Configure the playbook to include: A trigger

Explanation:

Explanation:

In Microsoft Sentinel, when using the Windows Security Events via AMA (Azure Monitor Agent) connector, you can configure an XPath filter expression to control which Windows security events are collected from a connected virtual machine.
Microsoft's documentation specifies that event filtering is based on the EventLog XML schema, and filtering by Keywords allows you to target specific audit categories. In Windows Security logs, events are categorized as follows by their Keywords bitmask:
0x8020000000000000 # Audit Success events
0x8010000000000000 # Audit Failure events
Since the requirement is to collect only audit failure events, the XPath filter must include only the System node (which contains the event header metadata) and filter by the Keywords attribute equal to
0x8010000000000000.
The correct XPath syntax for the filter in this case is:
Security!*[System[Keywords= ' 0x8010000000000000 ' ]]
Explanation of components:
Security!* - Targets the Windows Security event log.
System[...] - Refers to the event's header metadata section (where Keywords, EventID, and Level are stored).
Keywords= ' 0x8010000000000000 ' - Matches only events that have the Audit Failure bit set.
Therefore, only events with Audit Failure outcomes will be collected from VM1, satisfying the requirement to minimize event ingestion and reduce unnecessary log noise.
# Final Answer: Security!*[System[Keywords= ' 0x8010000000000000 ' ]]

說明：（僅 Fast2test 成員可見）

Explanation:

For SQL Server on Azure VMs (VM1), Defender for Cloud's Advanced Threat Protection and Vulnerability Assessment for SQL "on machines" are enabled by registering the instance as a SQL virtual machine using the SQL IaaS Agent extension. This single Azure VM extension onboards the SQL workload, exposes SQL VM resource management, and lights up Defender for SQL (ATP + VA) with minimal admin effort-no separate agents are required on Azure VMs beyond this extension for these features.
For on-premises/Arc servers (Server1), the machine is already Arc-enabled. To protect SQL instances with Defender for Cloud and to surface vulnerability assessment and threat protection signals, you deploy the Azure Arc SQL Server extension (delivered as an Arc "virtual machine extension") to register the instance with Azure. In addition, Arc scenarios use the Azure Monitor Agent (AMA) for data collection and security signal ingestion in Defender for Cloud (the legacy Log Analytics agent is not recommended). This combination satisfies ATP/VA requirements while keeping operations simple and consistent with current agent guidance.
Therefore:
VM1: only the Azure VM extension (SQL IaaS Agent extension).
Server1: AMA + an Azure (Arc) extension (Arc SQL Server extension).

Explanation:

To correlate malicious email attachments with endpoints, Microsoft Defender data schemas expose attachment metadata in EmailAttachmentInfo (including the SHA256 hash) and endpoint file activity in DeviceFileEvents (which also records SHA256 for observed files). The recommended investigation pattern is:
(1) filter email telemetry to the suspected sender and keep only attachments with a populated hash; (2) join that result with endpoint file events on the SHA256 hash to find devices where an identical file (by cryptographic hash) was seen. In KQL, isnotempty(SHA256) ensures you only pass attachments with a valid hash to the join, and join ... on SHA256 performs an exact-match correlation across datasets. This method aligns with Defender's guidance to use hash-based correlation as the most reliable way to match artifacts across different security workloads (email vs. endpoint), since filenames and paths can change, but a cryptographic hash uniquely identifies file content. The final project selects operational fields for response- timestamps, file name and hash, device identifiers/names, message IDs, and sender/recipient-so the SOC can quickly pivot to the impacted devices and the original email that delivered the file.

說明：（僅 Fast2test 成員可見）