Exam Bundle

A DCR test including critical Event IDs while excluding routine IDs verifies host log selection. It does not show expired threat indicators have stopped producing new matches.

“The VM reports healthy agent and the expected event arrives.” tests A new VM is not producing security events despite the connector being enabled. It does not demonstrate the target outcome of Expired test indicators no longer produce new detections. in the case described. This scenario concerns: A feed supplies expired IOCs that continue generating noisy matches.

This proposed result, “A test JSON event appears with the intended typed custom columns.”, relates to A team has a JSON audit feed with fields not represented by built-in Sentinel tables. It would not prove that Apply indicator validation and expiration-aware handling in the TI ingestion process. met the current requirement. This scenario concerns: A feed supplies expired IOCs that continue generating noisy matches.

Using a table whose schema does not represent the feed does not provide the required mapped custom ingestion.

“Apply carefully scoped filtering in supported AMA data collection rules.” would prioritize A security team wants to ingest only critical Windows events from a noisy fleet. That does not directly address the stated issue: A team has a JSON audit feed with fields not represented by built-in Sentinel tables.

The proposed action “Correct the custom table schema and collection transformation before broad ingestion.” solves A custom log table silently stores numeric response codes as strings. The present requirement is different: A team has a JSON audit feed with fields not represented by built-in Sentinel tables.

“A sample indicator appears only in the intended workspace's TI data.” tests An administrator is importing indicators into the wrong Sentinel workspace. It does not demonstrate the target outcome of A test JSON event appears with the intended typed custom columns. in the case described. This scenario concerns: A team has a JSON audit feed with fields not represented by built-in Sentinel tables.

This proposed result, “A test record retains detection fields but omits the restricted text.”, relates to The SOC wants to exclude sensitive free-text fields before exporting logs to the workspace. It would not prove that Define an appropriate custom table and supported ingestion transformation for the feed. met the current requirement. This scenario concerns: A team has a JSON audit feed with fields not represented by built-in Sentinel tables.

An incident reconstructed from retained event fields is a forensic use test. It does not verify JSON ingestion mapped the controlled custom payload into the intended typed columns.

“Verify Azure Monitor Agent presence and the assigned data collection rule association.” would prioritize A new VM is not producing security events despite the connector being enabled. That does not directly address the stated issue: A custom log table silently stores numeric response codes as strings.

This alternative, “Confirm table ingestion separately from rule configuration and connect the proper detection query.”, is appropriate for A source is producing data but no analytic rule references its custom table. It does not establish the required outcome of A known numeric test event can be queried as the intended numeric type. This scenario concerns: A custom log table silently stores numeric response codes as strings.

The option “Version and validate the transformation and query schema before changing production.” would address The ingestion team changes a custom table's column names and breaks hunts. It is less direct than Correct the custom table schema and collection transformation before broad ingestion. for the case at hand. This scenario concerns: A custom log table silently stores numeric response codes as strings.

“Controlled events appear end to end without granting broad unrelated privileges.” may be appropriate evidence for A newly onboarded Linux server lacks permissions to send events through its collector., but the verification of the current incident must instead show A known numeric test event can be queried as the intended numeric type. This scenario concerns: A custom log table silently stores numeric response codes as strings.

A hunting query still finding renamed fields proves backward-compatible schema migration. It does not establish that a specific numeric custom field is stored and queried as a numeric type.

An event matching an analytic rule tests detection availability, which can succeed even with a mis-typed numeric field. Run a numeric comparison on the known custom test value.

This alternative, “Review AMA service, syslog daemon forwarding and collector connectivity prerequisites.”, is appropriate for A newly onboarded Linux server lacks permissions to send events through its collector. It does not establish the required outcome of A single controlled event appears once rather than twice in the destination table. This scenario concerns: Several data sources send duplicate events under overlapping collectors.

The option “Use an appropriate Azure Policy initiative or assignment to deploy required diagnostics at scale.” would address A new subscription is missing mandatory diagnostic settings for security logs. It is less direct than Audit connector configuration and remove unintended duplicate ingestion paths. for the case at hand. This scenario concerns: Several data sources send duplicate events under overlapping collectors.

Ingestion-health monitoring detects delay or outage but does not remove duplicate collection routes. The controlled event can still be ingested twice until redundant connector/DCR paths are corrected.

“Controlled events appear end to end without granting broad unrelated privileges.” may be appropriate evidence for A newly onboarded Linux server lacks permissions to send events through its collector., but the verification of the current incident must instead show A single controlled event appears once rather than twice in the destination table. This scenario concerns: Several data sources send duplicate events under overlapping collectors.

Filtering critical Windows Event IDs tests selectivity, not event uniqueness. A duplicate ingestion problem requires the same controlled event to appear exactly once in the target table.

“The health view identifies the deliberately disabled test feed.” tests A SOC needs a reliable inventory of which data sources are disconnected. It does not demonstrate the target outcome of A single controlled event appears once rather than twice in the destination table. in the case described. This scenario concerns: Several data sources send duplicate events under overlapping collectors.

The proposed action “Examine source timezone and event-time transformation without overwriting ingestion time.” solves A data connector shows healthy but timestamps are wrong for a source device. The present requirement is different: The SOC must onboard a supported Microsoft Defender source into Sentinel.

The option “Configure supported Azure resource diagnostic settings to the approved Log Analytics destination.” would address A storage resource must send security diagnostics into Sentinel. It is less direct than Choose the matching built-in Microsoft solution or connector and verify its prerequisites. for the case at hand. This scenario concerns: The SOC must onboard a supported Microsoft Defender source into Sentinel.

“Correct the connector destination or target workspace before enabling production rules.” would prioritize An administrator is importing indicators into the wrong Sentinel workspace. That does not directly address the stated issue: The SOC must onboard a supported Microsoft Defender source into Sentinel.

A failed sign-in event proves Windows security telemetry arrives. It does not establish that a Defender incident or alert is represented in the expected unified incident experience.

A resource diagnostic event confirms Azure diagnostic routing, not Defender alert/incident integration with the unified case view.

“A pilot subscription reports compliant and its sample logs reach the target destination.” tests A new subscription is missing mandatory diagnostic settings for security logs. It does not demonstrate the target outcome of A known Defender incident or alert is represented in the expected unified incident experience. in the case described. This scenario concerns: The SOC must onboard a supported Microsoft Defender source into Sentinel.

Timezone and event-time transformation repair incorrect timestamps. They cannot make a detection fire if its source table is empty or its analytic query points to the wrong data.

“Correct the custom table schema and collection transformation before broad ingestion.” would prioritize A custom log table silently stores numeric response codes as strings. That does not directly address the stated issue: A source is producing data but no analytic rule references its custom table.

This alternative, “Monitor connector health and expected ingestion time by table or computer.”, is appropriate for A SOC needs a reliable inventory of which data sources are disconnected. It does not establish the required outcome of A test event is present in the table and matches the controlled analytic rule. This scenario concerns: A source is producing data but no analytic rule references its custom table.

CEF-normalized vendor fields show parsing of a device event. They do not verify that the analytic rule matches the controlled event in its intended source table and time window.

“The normalized event timestamp matches the known test activity.” tests A data connector shows healthy but timestamps are wrong for a source device. It does not demonstrate the target outcome of A test event is present in the table and matches the controlled analytic rule. in the case described. This scenario concerns: A source is producing data but no analytic rule references its custom table.

“An authenticated test request writes the expected row to the custom table.” may be appropriate evidence for A cloud application uses HTTPS to push audit events to a custom ingestion endpoint., but the verification of the current incident must instead show A test event is present in the table and matches the controlled analytic rule. This scenario concerns: A source is producing data but no analytic rule references its custom table.