Free Microsoft Security Operations Analyst practice test

Question 1

Investigation shows a device contained by attack disruption was running an authorized administration tool, not an attack. The device must come back online now. What do you do?

Accepted Answer

Undo the containment action from the Action center

Answer

Reclassify the incident as a false positive

Answer

Wait for the containment to expire on its own

Answer

Offboard and then re-onboard the affected device

Question 2

This hunt should list every message that carried the attachment, but returns only one message per file hash.

```kql
EmailAttachmentInfo
| where Timestamp > ago(1h)
| where Subject == "Document Attachment" and FileName == "Document.pdf"
| join (DeviceFileEvents | where Timestamp > ago(1h)) on SHA256
```

What causes that?

Accepted Answer

The default join flavor deduplicates the left table

Answer

DeviceFileEvents holds one row per unique file

Answer

The time filter on the right table is too narrow

Answer

SHA256 is not a valid key for this join

Question 3

Sentinel ingestion costs have doubled after onboarding verbose firewall logs that are needed for quarterly audits but almost never queried during investigations. What is the appropriate change?

Accepted Answer

Move that table to a lower-cost long-term retention tier

Answer

Stop collecting the firewall logs, since they are not used in investigations

Answer

Reduce the workspace retention period to 30 days for every table

Answer

Filter the logs down to denied connections only before ingestion

Question 4

A device in Defender for Endpoint is confirmed compromised. You need to stop it reaching other systems while keeping the ability to investigate it from the portal. Which action fits?

Accepted Answer

Isolate the device, which blocks network access but keeps Defender connected

Answer

Restrict app execution, which blocks unsigned binaries from running

Answer

Run an antivirus scan, which removes the threat and restores the device

Answer

Collect the investigation package, which gathers artefacts for offline analysis

Question 5

An investigation covers eleven months of activity for one account, and the records are within retention. How do you cover that period in Purview Audit?

Accepted Answer

Run consecutive searches of up to 180 days each

Answer

Export to CSV, which carries no range restriction

Answer

Run one search and let the tool page the results

Answer

Raise the range ceiling in audit settings first

Question 6

This hunting query is meant to find accounts with repeated failed sign-ins followed by a success, but it returns nothing.

```kql
SigninLogs
| where TimeGenerated > ago(1d)
| where ResultType == 0 and ResultType != 0
| summarize count() by UserPrincipalName
```

What is wrong with it?

Accepted Answer

The where clause requires ResultType to be 0 and not 0, so no row can match

Answer

summarize needs a bin() on TimeGenerated before it will return rows

Answer

SigninLogs does not contain a ResultType column, so the filter never matches

Answer

The time filter of one day is too narrow for a spray to appear

Question 7

An access review finds an analyst holding both Microsoft Sentinel Reader and Microsoft Sentinel Contributor on the same resource group. What can that analyst do?

Accepted Answer

Every Contributor action, as the assignments add together

Answer

Only actions listed by both roles, as an intersection

Answer

Nothing, until the conflicting assignments are resolved

Answer

Only Reader actions, with the narrower assignment winning

Question 8

A rule returns one row per affected mailbox, and the SOC wants each mailbox tracked and closed on its own. Which event grouping setting does that?

Accepted Answer

Trigger an alert for each returned event

Answer

Group alerts by all mapped entities

Answer

Set the alert threshold to one result

Answer

Group all events into a single alert

Question 9

Microsoft Sentinel is raising a separate incident for every alert produced by one analytics rule during a password spray, flooding the queue. Which change consolidates them?

Accepted Answer

Enable alert grouping in the rule's incident settings, keyed on entities

Answer

Add a suppression period to the rule so it stops firing after the first alert

Answer

Lower the rule's severity so the alerts stop creating incidents

Answer

Increase the query scheduling interval so the rule runs less often

Question 10

You want every high severity Sentinel incident involving a specific tag to automatically disable the affected account and post to a Teams channel. Which combination does this?

Accepted Answer

An automation rule matching the condition, which runs a playbook

Answer

An analytics rule with the two actions added to its query

Answer

A workbook scheduled to run the actions on a timer

Answer

A watchlist populated with the accounts, which triggers the actions on match

Free Microsoft Security Operations Analyst practice test

Full Security Operations Analyst question bank coming

What this test covers

Other free Microsoft Azure practice tests

Keep reading

Cheat sheets

Compared with