最新的Microsoft Security Operations Analyst (SC-200日本語版) - SC-200日本語免費考試真題

說明：（僅 Fast2test 成員可見）

說明：（僅 Fast2test 成員可見）

說明：（僅 Fast2test 成員可見）

Explanation:

In this scenario, App1 is a custom web app published through Microsoft Entra Application Proxy and authenticated using Active Directory Domain Services (AD DS) . Because it's integrated with Microsoft Entra ID (formerly Azure AD) for access control, the most appropriate and supported way to require MFA for users accessing the application is through Conditional Access .
Microsoft Entra Conditional Access policies evaluate user sign-in conditions such as risk level, device compliance, location, and sensitivity of data before granting access. Specifically, Microsoft's documentation states:
"Conditional Access policies allow administrators to require multi-factor authentication, block access, or enforce specific controls such as app protection or session policies for cloud and on-premises applications integrated with Microsoft Entra ID." Therefore, to make MFA mandatory for users accessing App1, a Conditional Access policy must be created targeting that application.
For the second part, to implement a session policy that controls or monitors user behavior (such as downloading highly confidential documents), the correct choice is Microsoft Defender for Cloud Apps (MDA) . Microsoft's official guidance says:
"Session policies in Microsoft Defender for Cloud Apps provide real-time session controls that enable administrators to monitor and restrict user activity in cloud apps, including download, cut/copy, and upload actions based on sensitivity labels or user risk." These session policies integrate seamlessly with Conditional Access via the "Use Conditional Access App Control" setting to apply continuous access evaluation during a user's session.
Hence, the correct verified configuration is:
* Require MFA: Conditional Access
* Implement session policy: Microsoft Defender for Cloud Apps

Explanation:

When User and Entity Behavior Analytics (UEBA) is enabled in Microsoft Sentinel , it creates several dedicated tables within the Log Analytics workspace to store processed data for behavioral analytics and anomaly detection. Each table serves a specific purpose according to Microsoft documentation.
* BehaviorAnalytics Table - for viewing entity data The BehaviorAnalytics table stores enriched information about entities (such as users, hosts, IP addresses, and applications) and their observed behaviors. Each record includes multiple fields that describe user or entity activities, risk scores, and behavioral baselines. Microsoft Sentinel documentation states:
"Use the BehaviorAnalytics table to view the entity data collected and analyzed by UEBA. This table contains fields for each type of entity, including account, host, and IP data." Therefore, to view the entity data with detailed attributes for each type, you query the BehaviorAnalytics table in KQL.
* Anomalies Table - for assessing rule quality The Anomalies table is used to analyze the results of anomaly detection rules and evaluate their effectiveness. Each record represents an anomaly event generated by UEBA's machine learning or statistical models. Microsoft's UEBA and Sentinel analytics documentation explains:
"Use the Anomalies table to assess the performance and quality of your anomaly detection rules. The table helps you identify how well each rule detects unusual activities and whether it produces false positives." Thus, when you need to measure how well your rules perform (i.e., their quality, hit rate, or alert effectiveness), you use the Anomalies table.
Summary Mapping:
* View entity data # BehaviorAnalytics
* Assess rule quality # Anomalies
This mapping aligns directly with the functionality of UEBA-related tables in Microsoft Sentinel and follows official documentation for analyzing entity behaviors and anomaly rule performance.

Explanation:
Box 1: Owner
Only the Owner can assign initiatives.
Box 2: Contributor
Only the Contributor or the Owner can apply security recommendations.
Reference:
https://docs.microsoft.com/en-us/azure/defender -for-cloud/permissions

說明：（僅 Fast2test 成員可見）

說明：（僅 Fast2test 成員可見）

Explanation:

To summarize security events over the last week and chart them by day , use KQL time binning on the event timestamp. In Sentinel/Log Analytics, bin() groups records into fixed time buckets on a datetime column- here, TimeGenerated . Pair that with a time filter for the past 7 days and render as a timechart. The key pattern is:
SecurityEvent
| where TimeGenerated > = ago(7d)
| summarize Count = count() by bin(TimeGenerated, 1d)
| render timechart
* bin is the correct aggregator for time-based bucketing.
* TimeGenerated is the standard timestamp column used across Sentinel tables for ingestion time.
* Using a 1-day bin shows the daily counts; the where TimeGenerated > = ago(7d) limits results to the past week .
* render timechart visualizes the grouped counts over time.
In the answer area shown, you select bin and TimeGenerated ; (the full query would also include the where line and a 1d bin size to meet the "by day" requirement).

Explanation:

The Fusion analytics rule in Microsoft Sentinel automatically correlates alerts from multiple sources (including Microsoft Defender connectors) to detect multistage attacks . Because Fusion runs continuously and cannot be disabled without losing multi-stage detection, the best practice for temporarily suppressing incidents from a specific connector (like Microsoft Defender) is to use automation rules , not by disabling the Fusion rule itself.
An automation rule can be configured to trigger on specific conditions (such as "When incident is updated" or "When incident is created") and then perform an action like running a playbook that applies suppression logic.
Here's the reasoning:
* Trigger:
* Setting the trigger to "When incident is updated" ensures that the rule evaluates changes to existing incidents-such as enrichment or tagging from Fusion-and provides finer control over suppression, minimizing impact on the Fusion detection pipeline.
* Using "When incident is created" could interfere with Fusion's initial detection process.
* Action:
* The appropriate action is "Run playbook" , which allows automated handling (for example, tagging or closing certain incidents from a specific connector). This requires minimal administrative effort and avoids turning off the Fusion rule.
This configuration ensures that Fusion continues to detect multistage attacks (so detection isn't impacted) while automation handles temporary suppression for specific connectors efficiently.

說明：（僅 Fast2test 成員可見）

Explanation:

說明：（僅 Fast2test 成員可見）