Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

Microsoft Sentinel > Microsoft Sentinel Ninja Cert > Flashcards

Microsoft Sentinel Ninja Cert Flashcards

1
Q

What is the maximum file size of a Watchlist?

A

500MB

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

Which AWS logs can be ingested by the Amazon Web Services S3 connector?

A

AWS GuardDuty
VPC Flow logs
AWS Cloudtrail

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

Which of the following MITRE ATT&CK techniques are classed as Execution?

A

User Execution
Launchctl

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

Which of the following are examples of Watchlist templates?

A

All of the options:
Identity Correlation
Terminated Employees
Service Accounts

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

Which of the following is correct regarding the Search feature?

A

Search jobs use parallel processing to run the search across long time spans, for extremely large data sets.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

Microsoft Sentinel supports the MITRE ATT&CK framework version 9?

A

True

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

What actions will the following xPath query take?
Security!*[System[(EventID=4688)]] and * [EventData[Data[@Name=’ProcessName’]=’C:\Windows\System32\consent.exe’]]

A

Only Security events with Event ID=4688 and a process name of consent.exe will be collected.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

How can you transform data before it is ingested into Microsoft Sentinel?

A

All of these options:
Logstash
Data Collection (DCR) rules
Azure Function

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

If you wanted to create a Microsoft Sentinel solution for Sentinel, where would you find the guide to help you do this?

A

Microsoft Sentinel GitHub Repo

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

Which of the following connectors are support by the SentinelHealth data table?

A

Dynamics 365
Threat Intelligence Platforms
Office ATP
Office 365

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

Automation rules can be triggered by alerts and incidents.

A

False

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

Which of the following tables can have data sent to them by the Custom logs API?

A

WindowsEvents and CommonSecurityLog

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

What KQL operator will specify a type of graph?

A

render

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

Which of the following are properties in the pollingConfig of a CCP connector?

A

auth
auth.authType
request

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

You must manually change Sentinel retention policy to 90 days after creating a new workspace.

A

True

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

Microsoft Sentinel is available in all Azure regions.

A

False

17
Q

Where in Microsoft Sentinel can you enable the Archive feature?

A

Tables

18
Q

How can you query data in an Archive log table?

A

Restoring archived logs
and
Running a search job

19
Q

How do you run a KQL query in a Microsoft Sentinel notebook?

A

Install the MSTICPy or KQLMagic library and use a %kql magic command at the start of a query.

20
Q

Where can you deploy honey tokens in the Microsoft Sentinel deception solution?

A

Azure Key Vault

21
Q

Data Connectors will not always be visible in the Sentinel Data Connectors configuration page until the related solution has been deployed from Content Hub.

A

True

22
Q

What rate can the AMA send data at?

A

5 K EPS

23
Q

Which of the following are considered limitations of a Searchjob?

A

Only able to quert one table at a time
Results are limited to one million records in the record set

24
Q

Why would a security analytst benefit from using Microsoft Sentinel notebooks?

A

Create data visualizations that aren’t provided out-of-the-box in Microsoft Sentinel.
Investigate security incidents at scale
Programmatically scale thret hunts beyound KQL queries
Document security workflows

25
Q

Which of the following are Fusion scenarios?

A

Crypto-mining
Ransomware
Lateral movement

26
Q

Dynamic content in workbooks in Microsoft Sentinel is:

A

The ability for tiles to inherit information from aother tile when a row is selected.

27
Q

You cannot create duplicate connections with the same repository and branch, in a single Microsoft Sentinel workspace.

A

True

28
Q

Which of the following statements are true about the Restore feature?

A

You can delete restored tables without deleting the underlying source archived table.

It is possible to run KQL queries against the data that has been archived only when the data has been restored to the Log Analyics workspace.

A restored log table will be available in the Log Analytics workspace with the suffix *_RST

29
Q

How does Microsoft Sentinel determine who a user’s peers are?

A

Azure AD security group membership

30
Q

Which of the following are limitations of NRT rules?

A

Can reference only one table.

Cannot use unions or joins

Microsoft Sentinel (1 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions