Practice Test #2

extend in KQL is used to add or compute new columns (for example, extend SeverityRank = case(Severity == "High", 3, ...)). While helpful for enriching data before aggregation, extend alone does not group rows or produce totals. A bar chart needs aggregated numeric values per category, so extend is not the key requirement for creating the bar graph output.

bin groups continuous values into buckets, most commonly TimeGenerated into intervals (for example, bin(TimeGenerated, 1h)). This is frequently used for time series charts, but bin by itself does not create a count of records. You still need summarize count() by bin(...) to produce the numeric values that a bar chart can plot.

workspace is used in cross-workspace queries to reference tables in another Log Analytics workspace (for example, workspace("<workspace-id>").SecurityAlert). It helps with data scope, not visualization. Even if you query multiple workspaces, you still need summarize count() (or another aggregation) to generate chartable results.

Microsoft Cloud App Security (now Microsoft Defender for Cloud Apps) focuses on SaaS application discovery, governance, and session/app controls. While it can generate alerts and integrate with Sentinel, it is not the primary tool to visualize Sentinel log data and enrich it with arbitrary third-party data sources for IoC investigation.

Azure Monitor provides the underlying logging, metrics, and Log Analytics workspace that Sentinel uses. However, Azure Monitor alone is not the Sentinel investigation experience for security-specific visualization and enrichment workflows. The question specifically targets Sentinel-centric visualization plus third-party enrichment, which aligns better with notebooks.

Hunting queries in Sentinel use KQL to proactively search and correlate data in Sentinel tables. They are excellent for detection logic and hypothesis-driven searching, but they don’t inherently provide rich visualization and external enrichment workflows. For third-party enrichment and advanced visual analysis, notebooks are the better fit.

Yes is incorrect because Azure AD Identity Protection and Microsoft Defender for Identity serve different purposes. Identity Protection applies risk-based controls to Microsoft Entra ID sign-ins, but it does not configure honeytoken-style or deceptive Active Directory accounts. Since the goal is specifically to configure accounts for attackers to exploit from the Defender for Identity portal, this solution does not meet the goal.

Incorrect. A URL/domain indicator with Action set to Alert only provides detection without prevention. The requirement is to prevent the attack, so “Alert only” does not meet the goal. Additionally, the prompt focuses on an image file artifact, which is better handled by a file-based indicator rather than only monitoring web destinations.

Not the best choice. URL/domain with Alert and block can prevent access to known malicious sites, but it blocks the delivery infrastructure, not the specific malicious image file. If the image can be delivered via email, removable media, or alternate domains/CDNs, a URL/domain block may not stop the attack. The question emphasizes an image file, pointing to a file hash IoC.

Usually incorrect here. Certificate indicators block files signed by a specific certificate (useful for compromised or malicious publishers). Most malicious image files are not signed, and even if they were, the question does not mention a signing certificate. File hash is the appropriate IoC when you have a specific malicious file to block.