正解：

Explanation:

To create a query in Microsoft Sentinel (using Kusto Query Language - KQL) that displays the number of daily security alerts over the last 30 days in a timechart, you need to:
Filter the dataset (SecurityAlert) to include only alerts generated in the last 30 days.
Aggregate the number of alerts per provider per day using summarize.
Group those alerts into daily time buckets using bin(TimeGenerated, 1d).
Render the output visually with a timechart.
The correct query structure is:
SecurityAlert
| where TimeGenerated > = ago(30d)
| summarize count() by ProviderName, bin(TimeGenerated, 1d)
| render timechart
summarize # Used to aggregate or count data (e.g., total alerts) by specified fields. In this case, it's needed to count alerts per provider and per day.
bin # Used to group time-based data into evenly spaced intervals (1 day here) for trend visualization. It aligns timestamps to a fixed period boundary (daily).
lookup # Used to enrich data from another table, not aggregation.
project # Used to select specific columns, not to count or group.
make-series # Also used for time-series data but more suited for generating continuous series (useful for missing data handling). Here, bin is simpler and sufficient.
range # Used to create a sequence of numbers or times manually, not for aggregation.
# Final Query Answer:
SecurityAlert
| where TimeGenerated > = ago(30d)
| summarize count() by ProviderName, bin(TimeGenerated, 1d)
| render timechart

正解：

Explanation:

To integrate Microsoft Defender for Cloud with Azure DevOps (AzDO1) for detecting secrets exposed in pipelines, you must connect the two platforms using Microsoft's built-in integration flow that enables Defender for Cloud to scan repositories and pipelines for vulnerabilities and sensitive data exposure.
Here's the correct configuration process:
In the Defender for Cloud portal, you first need to add an environment that represents your Azure DevOps organization.
This step connects Defender for Cloud to the DevOps service, allowing it to monitor repositories, build pipelines, and artifacts.
Navigate to Defender for Cloud # Environment settings # Add environment # Azure DevOps.
You'll then authenticate your Azure DevOps organization (AzDO1) to allow Defender for Cloud to scan your pipelines.
This setup enables Defender for DevOps, a capability within Defender for Cloud, to detect exposed secrets, insecure dependencies, and misconfigurations directly from pipeline activities.
Next, within Azure DevOps (AzDO1), install the Microsoft Defender for DevOps Security Scanner extension from the Azure DevOps Marketplace.
This extension integrates the Defender for Cloud scanning engine into the Azure DevOps pipeline process and enables automatic scanning for:
Hardcoded secrets in YAML pipelines,
Vulnerability findings in open-source dependencies, and
Infrastructure-as-code misconfigurations (for example, ARM, Terraform).
Once installed, the extension automatically works with Defender for Cloud, and any detected secret exposure or security issue is surfaced in Defender for Cloud's "DevOps Security" dashboard.
Configure workflow automation: Applies to automated incident responses, not DevOps integration.
Enable a plan: Refers to enabling Defender plans for specific Azure resource types, not connecting DevOps.
Configure OAuth / Configure security policies: Required for custom integration scenarios, but not for standard Defender-DevOps onboarding.
# Final Correct Answer:
In Defender for Cloud: Add an environment
In AzDO1: Install an extension

正解：

Explanation:

正解：D  🗳️

解説: (Fast2test メンバーにのみ表示されます)