You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: learn-pr/wwl-sci/design-solutions-security-operations/2-design-security-operations-capabilities-hybrid-multicloud-environments.yml
+2-2Lines changed: 2 additions & 2 deletions
Original file line number
Diff line number
Diff line change
@@ -4,10 +4,10 @@ title: Design monitoring to support hybrid and multicloud environments
4
4
metadata:
5
5
title: Design monitoring to support hybrid and multicloud environments
6
6
description: "SC-100 preparatory unit on the topic: Design monitoring to support hybrid and multicloud environments."
Copy file name to clipboardExpand all lines: learn-pr/wwl-sci/design-solutions-security-operations/5-design-solutions-detection-response.yml
+1-1Lines changed: 1 addition & 1 deletion
Original file line number
Diff line number
Diff line change
@@ -4,7 +4,7 @@ title: Design solutions for detection and response that includes extended detect
4
4
metadata:
5
5
title: Design solutions for detection and response that includes extended detection and response (XDR) and security information and event management (SIEM)
6
6
description: "SC-100 preparatory unit on the topic: design solutions for detection and response that includes extended detection and response (XDR) and security information and event management (SIEM)."
Copy file name to clipboardExpand all lines: learn-pr/wwl-sci/design-solutions-security-operations/6-design-solution-security-orchestration-automation-response.yml
+1-1Lines changed: 1 addition & 1 deletion
Original file line number
Diff line number
Diff line change
@@ -4,7 +4,7 @@ title: Design a solution for security orchestration, automation, and response (S
4
4
metadata:
5
5
title: Design a solution for security orchestration, automation, and response (SOAR)
6
6
description: "SC-100 preparatory unit on the topic: design a solution for security orchestration, automation, and response (SOAR)."
Copy file name to clipboardExpand all lines: learn-pr/wwl-sci/design-solutions-security-operations/7-design-security-workflows.yml
+1-1Lines changed: 1 addition & 1 deletion
Original file line number
Diff line number
Diff line change
@@ -4,7 +4,7 @@ title: Design and evaluate security workflows, including incident response, thre
4
4
metadata:
5
5
title: Design and evaluate security workflows, including incident response, threat hunting, and incident management
6
6
description: "SC-100 preparatory unit on the topic: • Design and evaluate security workflows, including incident response, threat hunting, and incident management."
Copy file name to clipboardExpand all lines: learn-pr/wwl-sci/design-solutions-security-operations/8-design-threat-detection-coverage.yml
+2-2Lines changed: 2 additions & 2 deletions
Original file line number
Diff line number
Diff line change
@@ -4,11 +4,11 @@ title: Design and evaluate threat detection coverage by using MITRE ATT&CK matri
4
4
metadata:
5
5
title: Design and evaluate threat detection coverage by using MITRE ATT&CK matrices, including Cloud, Enterprise, Mobile, and ICS
6
6
description: "SC-100 preparatory unit on the topic: Design and evaluate threat detection coverage by using MITRE ATT&CK matrices, including Cloud, Enterprise, Mobile, and ICS."
- content: "What is the function of a Security Operations Center (SOC)?"
31
-
choices:
32
-
- content: "Monitor an organization's security posture, detect and respond to security incidents."
33
-
isCorrect: true
34
-
explanation: "A SOC is responsible for monitoring an organization's security posture, detecting security incidents, and responding effectively to them."
35
-
- content: "Perform security testing and vulnerability assessments"
36
-
isCorrect: false
37
-
explanation: "While security testing is important, a SOC is primarily focused on incident detection, response and prevention."
38
-
- content: "Develop network security policies and procedures"
39
-
isCorrect: false
40
-
explanation: "While policy development is an important part of any security program, a SOC is primarily focused on incident detection, response and prevention."
41
-
- content: "Train employees on security awareness best practices"
42
-
isCorrect: false
43
-
explanation: "While employee training is important, a SOC is primarily focused on incident detection, response and prevention."
44
-
45
-
- content: "Which of the following best describes the function of Azure Monitor?"
46
-
choices:
47
-
- content: "Collects data from various sources and provides insights into the performance and health of applications and infrastructure."
48
-
isCorrect: true
49
-
explanation: "Azure Monitor collects data from various sources including logs, metrics, and trace telemetry, and provides insights into the performance, health, and availability of applications and infrastructure."
50
-
- content: "Provides network security by analyzing and blocking malicious traffic."
51
-
isCorrect: false
52
-
explanation: "While security is an important aspect of cloud services, it is not the primary function of Azure Monitor."
53
-
- content: "Automatically remediates security issues in computing environments."
54
-
isCorrect: false
55
-
explanation: "While automation is a key component of modern security operations, it is not the primary function of Azure Monitor."
56
-
- content: "Allows users to monitor social media and web-based threats."
57
-
isCorrect: false
58
-
explanation: "Azure Monitor is focused on collecting data from Azure resources, logging systems, and other sources, not monitoring social media or web-based threats."
59
-
60
-
- content: "What is XDR in Microsoft Defender XDR?"
61
-
choices:
62
-
- content: "An AI-powered malware scanner that detects and removes malicious files."
63
-
isCorrect: false
64
-
explanation: "While malware detection is part of its capabilities, XDR refers to extended detection and response which is designed to connect multiple security products across an environment and automate threat response in real-time."
65
-
- content: "A cloud-based backup solution for critical data."
66
-
isCorrect: false
67
-
explanation: "Backup solutions are important but the role of XDR is beyond that, focusing on detecting and responding to modern-day cyber-attacks with automated actions."
68
-
- content: "A tool that automates patching of vulnerable systems."
69
-
isCorrect: false
70
-
explanation: "While automated patching is a valuable tool for improving system security, this is not the primary function of XDR."
71
-
- content: "A unified threat detection and response solution."
72
-
isCorrect: true
73
-
explanation: "XDR is a unified platform that provides visibility across endpoints, email, documents, identity, and allows security teams to quickly investigate, respond and remediate threats in a coordinated way."
74
-
75
-
- content: "What is the purpose of the MITRE ATT&CK framework within Microsoft Sentinel?"
76
-
choices:
77
-
- content: "To identify vulnerabilities in Azure environments."
78
-
isCorrect: false
79
-
explanation: "The MITRE ATT&CK framework is used to identify tactics, techniques, and procedures (TTPs) used by attackers to compromise networks and systems. It is not specifically intended for identifying vulnerabilities."
80
-
- content: "To create custom dashboards for tracking security events."
81
-
isCorrect: false
82
-
explanation: "Dashboards are a visualization tool, while MITRE ATT&CK can be used to help organize, prioritize and track against potential threat actor activity mapped against the TTPs."
83
-
- content: "To provide a comprehensive threat intelligence feed."
84
-
isCorrect: false
85
-
explanation: "Threat Intelligence feeds provide context about cyber threats prevalent at the time, however, the MITRE ATT&CK framework is primarily focused on providing a structured knowledge base of adversary tactics and techniques useful to investigators, analysts, and defenders."
86
-
- content: "To map detections and responses to specific adversary tactics and techniques."
87
-
isCorrect: true
88
-
explanation: "The MITRE ATT&CK framework offers a common language used by security teams to describe attacker behavior, test security defenses, and understand whether the implemented security measures are effective at stopping or identifying attacks in real-time."
- content: "What is the function of a Security Operations Center (SOC)?"
31
+
choices:
32
+
- content: "Monitor an organization's security posture, detect, and respond to security incidents."
33
+
isCorrect: true
34
+
explanation: "A SOC is responsible for monitoring an organization's security posture, detecting security incidents, and responding effectively to them."
35
+
- content: "Perform security testing and vulnerability assessments"
36
+
isCorrect: false
37
+
explanation: "While security testing is important, a SOC is primarily focused on incident detection, response, and prevention."
38
+
- content: "Develop network security policies and procedures"
39
+
isCorrect: false
40
+
explanation: "While policy development is an important part of any security program, a SOC is primarily focused on incident detection, response, and prevention."
41
+
- content: "Train employees on security awareness best practices"
42
+
isCorrect: false
43
+
explanation: "While employee training is important, a SOC is primarily focused on incident detection, response, and prevention."
44
+
45
+
- content: "Which of the following best describes the function of Azure Monitor?"
46
+
choices:
47
+
- content: "Collects data from various sources and provides insights into the performance and health of applications and infrastructure."
48
+
isCorrect: true
49
+
explanation: "Azure Monitor collects data from various sources including logs, metrics, and trace telemetry, and provides insights into the performance, health, and availability of applications and infrastructure."
50
+
- content: "Provides network security by analyzing and blocking malicious traffic."
51
+
isCorrect: false
52
+
explanation: "While security is an important aspect of cloud services, it is not the primary function of Azure Monitor."
53
+
- content: "Automatically remediates security issues in computing environments."
54
+
isCorrect: false
55
+
explanation: "While automation is a key component of modern security operations, it is not the primary function of Azure Monitor."
56
+
- content: "Allows users to monitor social media and web-based threats."
57
+
isCorrect: false
58
+
explanation: "Azure Monitor is focused on collecting data from Azure resources, logging systems, and other sources, not monitoring social media or web-based threats."
59
+
60
+
- content: "What is XDR in Microsoft Defender XDR?"
61
+
choices:
62
+
- content: "An AI-powered malware scanner that detects and removes malicious files."
63
+
isCorrect: false
64
+
explanation: "While malware detection is part of its capabilities, XDR refers to extended detection and response, which is designed to connect multiple security products across an environment and automate threat response in real-time."
65
+
- content: "A cloud-based backup solution for critical data."
66
+
isCorrect: false
67
+
explanation: "Backup solutions are important but the role of XDR is beyond that, focusing on detecting and responding to modern-day cyber-attacks with automated actions."
68
+
- content: "A tool that automates patching of vulnerable systems."
69
+
isCorrect: false
70
+
explanation: "While automated patching is a valuable tool for improving system security, this isn't the primary function of XDR."
71
+
- content: "A unified threat detection and response solution."
72
+
isCorrect: true
73
+
explanation: "XDR is a unified platform that provides visibility across endpoints, email, documents, identity, and allows security teams to quickly investigate, respond, and remediate threats in a coordinated way."
74
+
75
+
- content: "What is the purpose of the MITRE ATT&CK framework within Microsoft Sentinel?"
76
+
choices:
77
+
- content: "To identify vulnerabilities in Azure environments."
78
+
isCorrect: false
79
+
explanation: "The MITRE ATT&CK framework is used to identify tactics, techniques, and procedures (TTPs) used by attackers to compromise networks and systems. It is not intended for identifying vulnerabilities."
80
+
- content: "To create custom dashboards for tracking security events."
81
+
isCorrect: false
82
+
explanation: "Dashboards are a visualization tool, while MITRE ATT&CK can be used to help organize, prioritize and track against potential threat actor activity mapped against the TTPs."
83
+
- content: "To provide a comprehensive threat intelligence feed."
84
+
isCorrect: false
85
+
explanation: "Threat Intelligence feeds provide context about cyber threats prevalent at the time, however, the MITRE ATT&CK framework is primarily focused on providing a structured knowledge base of adversary tactics and techniques useful to investigators, analysts, and defenders."
86
+
- content: "To map detections and responses to specific adversary tactics and techniques."
87
+
isCorrect: true
88
+
explanation: "The MITRE ATT&CK framework offers a common language used by security teams to describe attacker behavior, test security defenses, and understand whether the implemented security measures are effective at stopping or identifying attacks in real-time."
0 commit comments