Exam SC-200 topic 7 question 4 discussion

Actual exam question from Microsoft's SC-200

Question #: 4
Topic #: 7

Your on-premises network contains an Active Directory Domain Services (AD DS) forest.

You have a Microsoft Entra tenant that uses Microsoft Defender for Identity. The AD DS forest syncs with the tenant.

You need to create a hunting query that will identify LDAP simple binds to the AD DS domain controllers.

Which table should you query?

A. AADServicePrincipalRiskEvents
B. AADDomainServicesAccountLogon
C. SigninLogs
D. IdentityLogonEvents

Show Suggested Answer

Suggested Answer: D 🗳️

by DChilds at April 25, 2024, 5:52 p.m.

Comments

Submit Cancel

DChilds

Highly Voted 1 year, 3 months ago

Selected Answer: D

Here is a sample query from Microsoft Learn documentation: https://learn.microsoft.com/en-us/azure/azure-monitor/reference/queries/identitylogonevents

upvoted 12 times

rsanx42

1 year, 2 months ago

Agreed.

upvoted 1 times

...

Optimizor_IT

Most Recent 4 months ago

Selected Answer: D

IdentityLogonEvents | where Protocol == "LDAP" | where AuthenticationType == "SimpleBind" or IsEncrypted == false | project TimeGenerated, AccountName, SourceIpAddress, TargetServerName, IsEncrypted

upvoted 1 times

...

talosDevbot

10 months, 2 weeks ago

Selected Answer: D

IdentityLogonEvents table - Table that holds info about authentication activities made through your on-premises Active Directory https://learn.microsoft.com/en-us/azure/azure-monitor/reference/tables/identitylogonevents

upvoted 1 times

...