Microsoft Certified: Security Operations Analyst Associate - (SC-200) Exam Questions

Reference https://docs.microsoft.com/en-us/defender-for-identity/what-is

Multi-factor authentication is a process where a user is prompted during the sign-in process for an additional form of identification, such as to enter a code on their cellphone or to provide a fingerprint scan.

Reference https://docs.microsoft.com/en-us/azure/active-directory/authentication/concept-mfa-howitworks

Extend is used to add new columns to the result set. You may use it to extract or manipulate information from the sign-in events.

Bin is used to group and categorize data into bins or buckets based on a specified time interval. You can use this to aggregate the count of sign-in events over time.

Count is used to calculate the number of occurrences or records in the dataset. In this case, you can use it to count the number of sign-in events in each bin.

Here's an example query that includes these elements:

SigninLogs
| extend AnomalyDetection = tostring(customDimensions.AnomalyDetection) // Extend to extract anomaly detection information
| summarize Count = count() by bin(TimeGenerated, 1d), AnomalyDetection // Bin timestamp into daily intervals
| project TimeGenerated, AnomalyDetection, Count

This query extends the dataset to include the anomaly detection information, bins the timestamp into daily intervals, counts the number of occurrences for each anomaly detection status in each bin, and projects the relevant columns for visualization. Adjust the query based on your specific needs and the fields available in your sign-in logs.

In simpler terms, use count for bar graphs and bin for time charts.

Reference

https://docs.microsoft.com/en-us/azure/azure-monitor/logs/get-started-queries

The correct answer is A and D because choosing one of the audit options would not be a complete solution on its own to prevent the action.

Normally we add a new audit policy with Add-MpPreference and change the policy to enabled with Set-MpPreference, but in this case, Set-MpPreference can change and create policies too, and Add-MpPreference can only add new policies.

Reference

Enable attack surface reduction rules | Microsoft Learn

Microsoft Defender for Endpoint attack surface reduction rules demonstrations | Microsoft Learn

Troubleshooting mode scenarios in Microsoft Defender for Endpoint | Microsoft Learn

The question states "You need to hide false positive in the Alerts queue". Automatically resolving is not correct solution as that will still show up in the queue.

1. Generate the alert - Used for next step.

2. Create suppression rule for all devices - This is the only setting that exists.

3. Hide the alert - Listed in documentation steps.

Suppression rule can be assigned to a device group in a new unified Microsoft Defender 365 Portal.

Steps: Go to Incidents & alert > Alert. Select an alert then click [...] > Create a suppression rule. From the panel you will have an option to select Device groups under Additional details.

Reference

https://docs.microsoft.com/en-us/windows/security/threat-protection/microsoft-defender-atp/manage-alerts

https://docs.microsoft.com/en-us/microsoft-365/security/defender-endpoint/manage-alerts?view=o365-worldwide#suppress-an-alert-and-create-a-new-suppression-rule

The actual query is the following:

DeviceProcessEvents
| where Timestamp > ago (24h)
//Pivoting for rundll32
| where InitiatingProcessFileName =~ 'rundll32.exe'
//Looking for empty command line
and InitiatingProcessCommandLine !contains " " and InitiatingProcessCommandLine != ""
//Looking for schtasks.exe as the created process
and FileName in~ ('schtasks.exe')
//Disabling system restore
and ProcessCommandLine has 'Change' and ProcessCommandLine has 'SystemRestore'
and ProcessCommandLine has 'disable'
| project Timestamp, AccountName, ProcessCommandLine, DeviceId, ReportId

DeviceId and ReportId are required columns for any custom query.

Reference

https://docs.microsoft.com/en-us/windows/security/threat-protection/microsoft-defender-atp/custom-detection-rules

https://docs.microsoft.com/en-us/microsoft-365/security/defender-endpoint/manage-alerts?view=o365-worldwide#suppress-an-alert-and-create-a-new-suppression-rule

https://docs.microsoft.com/en-us/microsoft-365/security/defender/advanced-hunting-deviceprocessevents-table?view=o365-worldwide

https://docs.microsoft.com/en-us/microsoft-365/security/defender/advanced-hunting-find-ransomware?view=o365-worldwide#turning-off-system-restore

You should add the tag to the devices, then assign the tag to the device group to create a group based on the tags, and then rank it #1 so it takes precedence over the other groups.

Assign a tag to the device group - Tag all machines (as requested), to ensure they can be grouped temporarily.

Add a tag to the machines - Add the tagged machines to the group to be able to perform automated actions on all.

Create a new device group that has a rank of 1 - Ensure has rank of 1, so given tagged machines are added, in case of devices match other groups.

Reference

https://www.drware.com/how-to-use-tagging-effectively-in-microsoft-defender-for-endpoint-part-1/

https://docs.microsoft.com/en-us/microsoft-365/security/defender-endpoint/machine-tags?view=o365-worldwide#add-device-tags-by-setting-a-registry-key-value

https://docs.microsoft.com/en-us/learn/modules/deploy-microsoft-defender-for-endpoints-environment/4-manage-access

Reference

https://docs.microsoft.com/en-us/defender-for-identity/manage-sensitive-honeytoken-accounts

Reference

https://docs.microsoft.com/en-us/defender-for-identity/manage-sensitive-honeytoken-accounts

Reference

https://docs.microsoft.com/en-us/defender-for-identity/manage-sensitive-honeytoken-accounts