(function() {
  var extra = [
  {
    "id": "sc200-207",
    "type": "single",
    "domain": {
      "en": "Mitigate Threats Using Microsoft Defender XDR",
      "de": "Bedrohungen mit Microsoft Defender XDR mindern"
    },
    "difficulty": "medium",
    "scenario": {
      "en": "The SOC lead wants one owner for a case spanning email, identity, and endpoint signals.",
      "de": "Die SOC-Leitung möchte einen Verantwortlichen für einen Fall, der E-Mail-, Identitäts- und Endpunktsignale umfasst."
    },
    "question": {
      "en": "Which Microsoft Defender XDR view should an analyst open first to review one correlated case that already combines phishing, risky sign-ins, and endpoint malware?",
      "de": "Welche Microsoft-Defender-XDR-Ansicht sollte ein Analyst zuerst öffnen, um einen korrelierten Fall zu prüfen, der bereits Phishing, riskante Anmeldungen und Endpunkt-Malware kombiniert?"
    },
    "options": [
      {
        "id": "A",
        "text": {
          "en": "Incident page",
          "de": "Vorfallsseite"
        }
      },
      {
        "id": "B",
        "text": {
          "en": "Threat analytics",
          "de": "Threat Analytics"
        }
      },
      {
        "id": "C",
        "text": {
          "en": "Secure score",
          "de": "Secure Score"
        }
      },
      {
        "id": "D",
        "text": {
          "en": "Simulation training",
          "de": "Simulationstraining"
        }
      }
    ],
    "correct": [
      "A"
    ],
    "explanation": {
      "en": "The incident page is the unified investigation surface for correlated alerts, entities, evidence, and response actions across Defender XDR workloads.",
      "de": "Die Vorfallsseite ist die einheitliche Untersuchungsansicht für korrelierte Warnungen, Entitäten, Beweise und Reaktionsmaßnahmen über Defender-XDR-Workloads hinweg."
    },
    "hint": {
      "en": "Pick the unified case view rather than a posture or training feature.",
      "de": "Wählen Sie die einheitliche Fallansicht und nicht eine Posture- oder Trainingsfunktion."
    },
    "reference": "https://learn.microsoft.com/en-us/defender-xdr/investigate-incidents"
  },
  {
    "id": "sc200-208",
    "type": "single",
    "domain": {
      "en": "Mitigate Threats Using Microsoft Defender XDR",
      "de": "Bedrohungen mit Microsoft Defender XDR mindern"
    },
    "difficulty": "medium",
    "scenario": {
      "en": "A manager wants to review who approved a remediation action and whether it succeeded.",
      "de": "Ein Manager möchte prüfen, wer eine Behebungsmaßnahme genehmigt hat und ob sie erfolgreich war."
    },
    "question": {
      "en": "Where should a responder verify whether automated remediation actions are pending approval or already completed?",
      "de": "Wo sollte ein Responder prüfen, ob automatisierte Behebungsmaßnahmen auf Genehmigung warten oder bereits abgeschlossen sind?"
    },
    "options": [
      {
        "id": "A",
        "text": {
          "en": "Incident queue",
          "de": "Vorfallswarteschlange"
        }
      },
      {
        "id": "B",
        "text": {
          "en": "Action center",
          "de": "Action Center"
        }
      },
      {
        "id": "C",
        "text": {
          "en": "Recommendations page",
          "de": "Empfehlungsseite"
        }
      },
      {
        "id": "D",
        "text": {
          "en": "Microsoft Secure Score",
          "de": "Microsoft Secure Score"
        }
      }
    ],
    "correct": [
      "B"
    ],
    "explanation": {
      "en": "The Action center provides centralized tracking of pending, completed, and approved response actions across investigations.",
      "de": "Das Action Center bietet eine zentrale Nachverfolgung ausstehender, abgeschlossener und genehmigter Reaktionsmaßnahmen über Untersuchungen hinweg."
    },
    "hint": {
      "en": "Think of the audit and execution hub for remediation actions.",
      "de": "Denken Sie an den Audit- und Ausführungshub für Behebungsmaßnahmen."
    },
    "reference": "https://learn.microsoft.com/en-us/defender-endpoint/automated-investigations"
  },
  {
    "id": "sc200-209",
    "type": "single",
    "domain": {
      "en": "Mitigate Threats Using Microsoft Defender XDR",
      "de": "Bedrohungen mit Microsoft Defender XDR mindern"
    },
    "difficulty": "easy",
    "scenario": null,
    "question": {
      "en": "Which automated investigation remediation level keeps a human approval gate before actions are applied?",
      "de": "Welche Behebungsstufe der automatisierten Untersuchung behält einen menschlichen Genehmigungsschritt bei, bevor Maßnahmen angewendet werden?"
    },
    "options": [
      {
        "id": "A",
        "text": {
          "en": "Full automation",
          "de": "Vollständige Automatisierung"
        }
      },
      {
        "id": "B",
        "text": {
          "en": "Semi - require approval",
          "de": "Teilweise - Genehmigung erforderlich"
        }
      },
      {
        "id": "C",
        "text": {
          "en": "Passive mode",
          "de": "Passiver Modus"
        }
      },
      {
        "id": "D",
        "text": {
          "en": "Audit only connector",
          "de": "Nur-Audit-Connector"
        }
      }
    ],
    "correct": [
      "B"
    ],
    "explanation": {
      "en": "Semi automation lets investigation run automatically while analysts approve pending remediation actions before execution.",
      "de": "Die teilweise Automatisierung lässt die Untersuchung automatisch laufen, während Analysten ausstehende Behebungsmaßnahmen vor der Ausführung genehmigen."
    },
    "hint": {
      "en": "Choose the setting that balances automation with change control.",
      "de": "Wählen Sie die Einstellung, die Automatisierung mit Änderungskontrolle verbindet."
    },
    "reference": "https://learn.microsoft.com/en-us/defender-endpoint/automated-investigations"
  },
  {
    "id": "sc200-210",
    "type": "single",
    "domain": {
      "en": "Mitigate Threats Using Microsoft Defender XDR",
      "de": "Bedrohungen mit Microsoft Defender XDR mindern"
    },
    "difficulty": "hard",
    "scenario": {
      "en": "Tier 2 analysts suspect an attacker is launching obfuscated PowerShell from multiple endpoints.",
      "de": "Tier-2-Analysten vermuten, dass ein Angreifer von mehreren Endpunkten aus verschleiertes PowerShell startet."
    },
    "question": {
      "en": "Which Advanced Hunting query best finds PowerShell processes that used EncodedCommand during the last day?",
      "de": "Welche Advanced-Hunting-Abfrage findet am besten PowerShell-Prozesse, die in den letzten 24 Stunden EncodedCommand verwendet haben?"
    },
    "options": [
      {
        "id": "A",
        "text": {
          "en": "DeviceProcessEvents | where Timestamp > ago(1d) | where FileName =~ 'powershell.exe' | where ProcessCommandLine has 'EncodedCommand'",
          "de": "DeviceProcessEvents | where Timestamp > ago(1d) | where FileName =~ 'powershell.exe' | where ProcessCommandLine has 'EncodedCommand'"
        }
      },
      {
        "id": "B",
        "text": {
          "en": "DeviceFileEvents | where Timestamp > ago(1d) | where FileName =~ 'powershell.exe' | summarize count() by SHA256",
          "de": "DeviceFileEvents | where Timestamp > ago(1d) | where FileName =~ 'powershell.exe' | summarize count() by SHA256"
        }
      },
      {
        "id": "C",
        "text": {
          "en": "EmailEvents | where Timestamp > ago(1d) | where Subject has 'EncodedCommand'",
          "de": "EmailEvents | where Timestamp > ago(1d) | where Subject has 'EncodedCommand'"
        }
      },
      {
        "id": "D",
        "text": {
          "en": "AlertEvidence | where Timestamp > ago(1d) | where EvidenceRole == 'EncodedCommand'",
          "de": "AlertEvidence | where Timestamp > ago(1d) | where EvidenceRole == 'EncodedCommand'"
        }
      }
    ],
    "correct": [
      "A"
    ],
    "explanation": {
      "en": "DeviceProcessEvents contains process execution details, and filtering ProcessCommandLine for EncodedCommand is the most direct hunting approach.",
      "de": "DeviceProcessEvents enthält Details zur Prozessausführung, und das Filtern von ProcessCommandLine nach EncodedCommand ist der direkteste Hunting-Ansatz."
    },
    "hint": {
      "en": "Start with the table that records process launches and command lines.",
      "de": "Beginnen Sie mit der Tabelle, die Prozessstarts und Befehlszeilen aufzeichnet."
    },
    "reference": "https://learn.microsoft.com/en-us/defender-xdr/advanced-hunting-overview"
  },
  {
    "id": "sc200-211",
    "type": "single",
    "domain": {
      "en": "Mitigate Threats Using Microsoft Defender XDR",
      "de": "Bedrohungen mit Microsoft Defender XDR mindern"
    },
    "difficulty": "hard",
    "scenario": {
      "en": "The SOC received threat intel that a paste site is being used for command-and-control instructions.",
      "de": "Das SOC hat Threat Intelligence erhalten, dass eine Paste-Site für Command-and-Control-Anweisungen verwendet wird."
    },
    "question": {
      "en": "Which Advanced Hunting query best shows devices that contacted a suspicious paste site during the last 24 hours?",
      "de": "Welche Advanced-Hunting-Abfrage zeigt am besten Geräte, die in den letzten 24 Stunden eine verdächtige Paste-Site kontaktiert haben?"
    },
    "options": [
      {
        "id": "A",
        "text": {
          "en": "DeviceNetworkEvents | where Timestamp > ago(24h) | where RemoteUrl has 'pastebin' | project Timestamp, DeviceName, InitiatingProcessFileName, RemoteUrl",
          "de": "DeviceNetworkEvents | where Timestamp > ago(24h) | where RemoteUrl has 'pastebin' | project Timestamp, DeviceName, InitiatingProcessFileName, RemoteUrl"
        }
      },
      {
        "id": "B",
        "text": {
          "en": "DeviceProcessEvents | where Timestamp > ago(24h) | where FileName has 'pastebin'",
          "de": "DeviceProcessEvents | where Timestamp > ago(24h) | where FileName has 'pastebin'"
        }
      },
      {
        "id": "C",
        "text": {
          "en": "EmailEvents | where Timestamp > ago(24h) | where RecipientEmailAddress has 'pastebin'",
          "de": "EmailEvents | where Timestamp > ago(24h) | where RecipientEmailAddress has 'pastebin'"
        }
      },
      {
        "id": "D",
        "text": {
          "en": "AlertInfo | where Timestamp > ago(24h) | where Title has 'pastebin'",
          "de": "AlertInfo | where Timestamp > ago(24h) | where Title has 'pastebin'"
        }
      }
    ],
    "correct": [
      "A"
    ],
    "explanation": {
      "en": "DeviceNetworkEvents is the hunting table for outbound connections. Filtering on RemoteUrl and projecting the initiating process gives the needed network context.",
      "de": "DeviceNetworkEvents ist die Hunting-Tabelle für ausgehende Verbindungen. Das Filtern nach RemoteUrl und die Ausgabe des initiierenden Prozesses liefern den benötigten Netzwerkkontext."
    },
    "hint": {
      "en": "Choose the network-events table, not process or email metadata.",
      "de": "Wählen Sie die Tabelle für Netzwerkereignisse und nicht Prozess- oder E-Mail-Metadaten."
    },
    "reference": "https://learn.microsoft.com/en-us/defender-xdr/advanced-hunting-overview"
  },
  {
    "id": "sc200-212",
    "type": "single",
    "domain": {
      "en": "Mitigate Threats Using Microsoft Defender XDR",
      "de": "Bedrohungen mit Microsoft Defender XDR mindern"
    },
    "difficulty": "medium",
    "scenario": {
      "en": "Analysts validated the query in multiple incidents and no longer want to run it manually.",
      "de": "Analysten haben die Abfrage in mehreren Vorfällen bestätigt und möchten sie nicht länger manuell ausführen."
    },
    "question": {
      "en": "A hunting query repeatedly finds malicious behavior and the SOC wants scheduled alerts. What should you create next?",
      "de": "Eine Hunting-Abfrage findet wiederholt bösartiges Verhalten und das SOC möchte geplante Warnungen. Was sollten Sie als Nächstes erstellen?"
    },
    "options": [
      {
        "id": "A",
        "text": {
          "en": "A custom detection rule",
          "de": "Eine benutzerdefinierte Erkennungsregel"
        }
      },
      {
        "id": "B",
        "text": {
          "en": "A secure score initiative",
          "de": "Eine Secure-Score-Initiative"
        }
      },
      {
        "id": "C",
        "text": {
          "en": "A mailbox transport rule",
          "de": "Eine Transportregel für Postfächer"
        }
      },
      {
        "id": "D",
        "text": {
          "en": "A retention policy",
          "de": "Eine Aufbewahrungsrichtlinie"
        }
      }
    ],
    "correct": [
      "A"
    ],
    "explanation": {
      "en": "Custom detections operationalize Advanced Hunting logic by running it on a schedule and generating alerts when conditions are met.",
      "de": "Benutzerdefinierte Erkennungen operationalisieren Advanced-Hunting-Logik, indem sie sie nach Zeitplan ausführen und bei erfüllten Bedingungen Warnungen erzeugen."
    },
    "hint": {
      "en": "Move proven hunting logic into scheduled detection.",
      "de": "Überführen Sie bewährte Hunting-Logik in eine geplante Erkennung."
    },
    "reference": "https://learn.microsoft.com/en-us/defender-xdr/custom-detection-rules"
  },
  {
    "id": "sc200-213",
    "type": "single",
    "domain": {
      "en": "Mitigate Threats Using Microsoft Defender XDR",
      "de": "Bedrohungen mit Microsoft Defender XDR mindern"
    },
    "difficulty": "medium",
    "scenario": {
      "en": "A compromised laptop is off VPN, but Defender for Endpoint is still connected and you need to collect artifacts quickly.",
      "de": "Ein kompromittiertes Notebook ist nicht per VPN verbunden, aber Defender for Endpoint ist noch erreichbar, und Sie müssen schnell Artefakte sammeln."
    },
    "question": {
      "en": "Which Defender for Endpoint capability lets an analyst run remote response commands on a device without opening RDP?",
      "de": "Welche Defender-for-Endpoint-Funktion ermöglicht es einem Analysten, Remote-Response-Befehle auf einem Gerät auszuführen, ohne RDP zu öffnen?"
    },
    "options": [
      {
        "id": "A",
        "text": {
          "en": "Live response",
          "de": "Live Response"
        }
      },
      {
        "id": "B",
        "text": {
          "en": "Simulation training",
          "de": "Simulationstraining"
        }
      },
      {
        "id": "C",
        "text": {
          "en": "Secure score",
          "de": "Secure Score"
        }
      },
      {
        "id": "D",
        "text": {
          "en": "Cloud Discovery",
          "de": "Cloud Discovery"
        }
      }
    ],
    "correct": [
      "A"
    ],
    "explanation": {
      "en": "Live response provides a secure command-line session for investigation and remediation actions on supported devices.",
      "de": "Live Response stellt eine sichere Befehlszeilensitzung für Untersuchungs- und Behebungsmaßnahmen auf unterstützten Geräten bereit."
    },
    "hint": {
      "en": "Think of the remote shell-like responder feature.",
      "de": "Denken Sie an die responderähnliche Remote-Shell-Funktion."
    },
    "reference": "https://learn.microsoft.com/en-us/defender-endpoint/live-response"
  },
  {
    "id": "sc200-214",
    "type": "single",
    "domain": {
      "en": "Mitigate Threats Using Microsoft Defender XDR",
      "de": "Bedrohungen mit Microsoft Defender XDR mindern"
    },
    "difficulty": "medium",
    "scenario": {
      "en": "Malware has been contained, but the SOC wants offline evidence to confirm persistence mechanisms.",
      "de": "Die Malware wurde eingedämmt, aber das SOC möchte Offline-Beweise, um Persistenzmechanismen zu bestätigen."
    },
    "question": {
      "en": "Which device action is best when the SOC wants a packaged set of endpoint investigation artifacts for deeper analysis?",
      "de": "Welche Geräteaktion ist am besten geeignet, wenn das SOC ein gebündeltes Paket von Endpunkt-Untersuchungsartefakten für eine tiefergehende Analyse benötigt?"
    },
    "options": [
      {
        "id": "A",
        "text": {
          "en": "Collect investigation package",
          "de": "Untersuchungspaket sammeln"
        }
      },
      {
        "id": "B",
        "text": {
          "en": "Hide alert",
          "de": "Warnung ausblenden"
        }
      },
      {
        "id": "C",
        "text": {
          "en": "Dismiss recommendation",
          "de": "Empfehlung verwerfen"
        }
      },
      {
        "id": "D",
        "text": {
          "en": "Create watchlist",
          "de": "Watchlist erstellen"
        }
      }
    ],
    "correct": [
      "A"
    ],
    "explanation": {
      "en": "Collect investigation package gathers forensic and diagnostic artifacts from the device for analyst review.",
      "de": "Untersuchungspaket sammeln erfasst forensische und diagnostische Artefakte vom Gerät zur Auswertung durch Analysten."
    },
    "hint": {
      "en": "Choose the action built for artifact collection, not alert suppression.",
      "de": "Wählen Sie die für die Artefaktsammlung gedachte Aktion und nicht die Unterdrückung von Warnungen."
    },
    "reference": "https://learn.microsoft.com/en-us/defender-endpoint/respond-machine-alerts"
  },
  {
    "id": "sc200-215",
    "type": "single",
    "domain": {
      "en": "Mitigate Threats Using Microsoft Defender XDR",
      "de": "Bedrohungen mit Microsoft Defender XDR mindern"
    },
    "difficulty": "easy",
    "scenario": {
      "en": "Ransomware behavior is spreading laterally and the affected laptop must be contained immediately.",
      "de": "Ransomware-Verhalten breitet sich lateral aus, und das betroffene Notebook muss sofort eingedämmt werden."
    },
    "question": {
      "en": "Which response action best contains a compromised endpoint while still allowing Defender services to communicate with it?",
      "de": "Welche Reaktionsmaßnahme dämmt einen kompromittierten Endpunkt am besten ein und erlaubt Defender-Diensten dennoch die Kommunikation mit ihm?"
    },
    "options": [
      {
        "id": "A",
        "text": {
          "en": "Isolate device",
          "de": "Gerät isolieren"
        }
      },
      {
        "id": "B",
        "text": {
          "en": "Offboard device",
          "de": "Gerät ausbinden"
        }
      },
      {
        "id": "C",
        "text": {
          "en": "Delete indicator",
          "de": "Indikator löschen"
        }
      },
      {
        "id": "D",
        "text": {
          "en": "Close incident",
          "de": "Vorfall schließen"
        }
      }
    ],
    "correct": [
      "A"
    ],
    "explanation": {
      "en": "Device isolation blocks most network traffic while preserving the Defender management channel for investigation and remediation.",
      "de": "Die Geräteisolierung blockiert den Großteil des Netzwerkverkehrs und erhält gleichzeitig den Defender-Verwaltungskanal für Untersuchung und Behebung."
    },
    "hint": {
      "en": "Pick the containment action for the endpoint itself.",
      "de": "Wählen Sie die Eindämmungsmaßnahme direkt für den Endpunkt."
    },
    "reference": "https://learn.microsoft.com/en-us/defender-endpoint/respond-machine-alerts"
  },
  {
    "id": "sc200-216",
    "type": "single",
    "domain": {
      "en": "Mitigate Threats Using Microsoft Defender XDR",
      "de": "Bedrohungen mit Microsoft Defender XDR mindern"
    },
    "difficulty": "medium",
    "scenario": null,
    "question": {
      "en": "What is the best way to block a known malicious file hash across the tenant?",
      "de": "Wie blockieren Sie am besten einen bekannten schädlichen Dateihash im gesamten Mandanten?"
    },
    "options": [
      {
        "id": "A",
        "text": {
          "en": "Create a custom file indicator",
          "de": "Einen benutzerdefinierten Dateiindikator erstellen"
        }
      },
      {
        "id": "B",
        "text": {
          "en": "Create a bookmark",
          "de": "Ein Lesezeichen erstellen"
        }
      },
      {
        "id": "C",
        "text": {
          "en": "Run a workbook",
          "de": "Ein Workbook ausführen"
        }
      },
      {
        "id": "D",
        "text": {
          "en": "Disable automation",
          "de": "Automatisierung deaktivieren"
        }
      }
    ],
    "correct": [
      "A"
    ],
    "explanation": {
      "en": "A custom file indicator can enforce block or alert actions for known malicious files across devices.",
      "de": "Ein benutzerdefinierter Dateiindikator kann Blockierungs- oder Warnaktionen für bekannte schädliche Dateien über Geräte hinweg durchsetzen."
    },
    "hint": {
      "en": "Use the IOC control designed for known bad artifacts.",
      "de": "Verwenden Sie die IOC-Steuerung für bekannte schädliche Artefakte."
    },
    "reference": "https://learn.microsoft.com/en-us/defender-endpoint/respond-machine-alerts"
  },
  {
    "id": "sc200-217",
    "type": "single",
    "domain": {
      "en": "Mitigate Threats Using Microsoft Defender XDR",
      "de": "Bedrohungen mit Microsoft Defender XDR mindern"
    },
    "difficulty": "medium",
    "scenario": {
      "en": "The CISO asks for context on a new malware family that appears in several recent incidents.",
      "de": "Der CISO bittet um Kontext zu einer neuen Malware-Familie, die in mehreren aktuellen Vorfällen auftaucht."
    },
    "question": {
      "en": "Which Defender XDR experience is best for understanding campaign-level context, affected industries, and recommended mitigations for an active threat?",
      "de": "Welche Defender-XDR-Funktion eignet sich am besten, um kampagnenbezogenen Kontext, betroffene Branchen und empfohlene Gegenmaßnahmen für eine aktive Bedrohung zu verstehen?"
    },
    "options": [
      {
        "id": "A",
        "text": {
          "en": "Threat analytics",
          "de": "Threat Analytics"
        }
      },
      {
        "id": "B",
        "text": {
          "en": "Action center",
          "de": "Action Center"
        }
      },
      {
        "id": "C",
        "text": {
          "en": "Device inventory",
          "de": "Gerätebestand"
        }
      },
      {
        "id": "D",
        "text": {
          "en": "Mailbox audit log",
          "de": "Postfachüberwachungsprotokoll"
        }
      }
    ],
    "correct": [
      "A"
    ],
    "explanation": {
      "en": "Threat analytics provides curated intelligence about active campaigns, associated tactics, exposure, and recommended actions.",
      "de": "Threat Analytics liefert kuratierte Informationen zu aktiven Kampagnen, zugehörigen Taktiken, Exposition und empfohlenen Maßnahmen."
    },
    "hint": {
      "en": "Choose the curated intelligence view rather than the response queue.",
      "de": "Wählen Sie die kuratierte Intelligence-Ansicht und nicht die Reaktionswarteschlange."
    },
    "reference": "https://learn.microsoft.com/en-us/defender-xdr/investigate-incidents"
  },
  {
    "id": "sc200-218",
    "type": "single",
    "domain": {
      "en": "Mitigate Threats Using Microsoft Defender XDR",
      "de": "Bedrohungen mit Microsoft Defender XDR mindern"
    },
    "difficulty": "hard",
    "scenario": {
      "en": "A phishing run bypassed user suspicion, and analysts want to identify all delivered messages from the same domain.",
      "de": "Eine Phishing-Welle wurde von Benutzern übersehen, und Analysten möchten alle zugestellten Nachrichten von derselben Domäne identifizieren."
    },
    "question": {
      "en": "Which Advanced Hunting query best finds emails delivered from the spoofed domain fabrikam-support.com during the last seven days?",
      "de": "Welche Advanced-Hunting-Abfrage findet am besten E-Mails, die in den letzten sieben Tagen von der gespooften Domäne fabrikam-support.com zugestellt wurden?"
    },
    "options": [
      {
        "id": "A",
        "text": {
          "en": "EmailEvents | where Timestamp > ago(7d) | where SenderFromDomain =~ 'fabrikam-support.com' | where DeliveryLocation has 'Inbox' | project Timestamp, RecipientEmailAddress, Subject",
          "de": "EmailEvents | where Timestamp > ago(7d) | where SenderFromDomain =~ 'fabrikam-support.com' | where DeliveryLocation has 'Inbox' | project Timestamp, RecipientEmailAddress, Subject"
        }
      },
      {
        "id": "B",
        "text": {
          "en": "DeviceNetworkEvents | where RemoteUrl has 'fabrikam-support.com'",
          "de": "DeviceNetworkEvents | where RemoteUrl has 'fabrikam-support.com'"
        }
      },
      {
        "id": "C",
        "text": {
          "en": "CloudAppEvents | where Application == 'Exchange Online' and ActionType == 'MailItemsAccessed'",
          "de": "CloudAppEvents | where Application == 'Exchange Online' and ActionType == 'MailItemsAccessed'"
        }
      },
      {
        "id": "D",
        "text": {
          "en": "IdentityLogonEvents | where AccountDomain =~ 'fabrikam-support.com'",
          "de": "IdentityLogonEvents | where AccountDomain =~ 'fabrikam-support.com'"
        }
      }
    ],
    "correct": [
      "A"
    ],
    "explanation": {
      "en": "EmailEvents is the correct table for message delivery hunting. Filtering by SenderFromDomain and DeliveryLocation finds delivered mail from the spoofed domain.",
      "de": "EmailEvents ist die richtige Tabelle für das Hunting nach Nachrichtenzustellung. Das Filtern nach SenderFromDomain und DeliveryLocation findet zugestellte E-Mails von der gespooften Domäne."
    },
    "hint": {
      "en": "Start with email telemetry, not endpoint or identity tables.",
      "de": "Beginnen Sie mit E-Mail-Telemetrie und nicht mit Endpunkt- oder Identitätstabellen."
    },
    "reference": "https://learn.microsoft.com/en-us/defender-xdr/advanced-hunting-overview"
  },
  {
    "id": "sc200-219",
    "type": "single",
    "domain": {
      "en": "Mitigate Threats Using Microsoft Defender XDR",
      "de": "Bedrohungen mit Microsoft Defender XDR mindern"
    },
    "difficulty": "hard",
    "scenario": {
      "en": "The SOC has confirmed the phishing URL and now needs a user list for containment and password resets.",
      "de": "Das SOC hat die Phishing-URL bestätigt und benötigt nun eine Benutzerliste für Eindämmung und Kennwortrücksetzungen."
    },
    "question": {
      "en": "Which Advanced Hunting query best identifies users who clicked a suspicious URL in email during the last seven days?",
      "de": "Welche Advanced-Hunting-Abfrage identifiziert am besten Benutzer, die in den letzten sieben Tagen auf eine verdächtige URL in E-Mails geklickt haben?"
    },
    "options": [
      {
        "id": "A",
        "text": {
          "en": "UrlClickEvents | where Timestamp > ago(7d) | where Url has 'login-contoso.net' | project Timestamp, AccountUpn, Url",
          "de": "UrlClickEvents | where Timestamp > ago(7d) | where Url has 'login-contoso.net' | project Timestamp, AccountUpn, Url"
        }
      },
      {
        "id": "B",
        "text": {
          "en": "EmailEvents | where Subject has 'login-contoso.net'",
          "de": "EmailEvents | where Subject has 'login-contoso.net'"
        }
      },
      {
        "id": "C",
        "text": {
          "en": "DeviceProcessEvents | where ProcessCommandLine has 'login-contoso.net'",
          "de": "DeviceProcessEvents | where ProcessCommandLine has 'login-contoso.net'"
        }
      },
      {
        "id": "D",
        "text": {
          "en": "AlertEvidence | where EvidenceRole == 'Url' | project DeviceName",
          "de": "AlertEvidence | where EvidenceRole == 'Url' | project DeviceName"
        }
      }
    ],
    "correct": [
      "A"
    ],
    "explanation": {
      "en": "UrlClickEvents records user interaction with links from email and is the most direct source for investigating who clicked a malicious URL.",
      "de": "UrlClickEvents erfasst Benutzerinteraktionen mit Links aus E-Mails und ist die direkteste Quelle, um zu untersuchen, wer auf eine schädliche URL geklickt hat."
    },
    "hint": {
      "en": "Use the table built for Safe Links and click activity.",
      "de": "Verwenden Sie die Tabelle für Safe-Links- und Klickaktivitäten."
    },
    "reference": "https://learn.microsoft.com/en-us/defender-xdr/advanced-hunting-overview"
  },
  {
    "id": "sc200-220",
    "type": "single",
    "domain": {
      "en": "Mitigate Threats Using Microsoft Defender XDR",
      "de": "Bedrohungen mit Microsoft Defender XDR mindern"
    },
    "difficulty": "medium",
    "scenario": {
      "en": "Executives must keep browser access to SharePoint Online, but unmanaged devices must not download sensitive files.",
      "de": "Führungskräfte sollen Browserzugriff auf SharePoint Online behalten, aber nicht verwaltete Geräte dürfen keine sensiblen Dateien herunterladen."
    },
    "question": {
      "en": "Which Defender for Cloud Apps control is best when the SOC wants to block file downloads from a sanctioned SaaS app on unmanaged devices?",
      "de": "Welche Defender-for-Cloud-Apps-Steuerung ist am besten geeignet, wenn das SOC Dateidownloads aus einer genehmigten SaaS-App auf nicht verwalteten Geräten blockieren möchte?"
    },
    "options": [
      {
        "id": "A",
        "text": {
          "en": "Session policy",
          "de": "Sitzungsrichtlinie"
        }
      },
      {
        "id": "B",
        "text": {
          "en": "Access review",
          "de": "Zugriffsüberprüfung"
        }
      },
      {
        "id": "C",
        "text": {
          "en": "Secure score recommendation",
          "de": "Secure-Score-Empfehlung"
        }
      },
      {
        "id": "D",
        "text": {
          "en": "Watchlist",
          "de": "Watchlist"
        }
      }
    ],
    "correct": [
      "A"
    ],
    "explanation": {
      "en": "Session policies can enforce real-time access controls such as blocking or monitoring downloads in sanctioned cloud apps.",
      "de": "Sitzungsrichtlinien können Echtzeitzugriffskontrollen wie das Blockieren oder Überwachen von Downloads in genehmigten Cloud-Apps durchsetzen."
    },
    "hint": {
      "en": "Think real-time session governance for unmanaged devices.",
      "de": "Denken Sie an Echtzeit-Sitzungsgovernance für nicht verwaltete Geräte."
    },
    "reference": "https://learn.microsoft.com/en-us/defender-cloud-apps/policies"
  },
  {
    "id": "sc200-221",
    "type": "single",
    "domain": {
      "en": "Mitigate Threats Using Microsoft Defender XDR",
      "de": "Bedrohungen mit Microsoft Defender XDR mindern"
    },
    "difficulty": "hard",
    "scenario": {
      "en": "Identity risk review shows one user in multiple investigations, and the SOC wants a fast alert-centric view.",
      "de": "Die Identitätsrisikoprüfung zeigt einen Benutzer in mehreren Untersuchungen, und das SOC möchte eine schnelle alarmzentrierte Ansicht."
    },
    "question": {
      "en": "Which Advanced Hunting query best lists alerts where the affected account is alexw?",
      "de": "Welche Advanced-Hunting-Abfrage listet am besten Warnungen auf, bei denen das betroffene Konto alexw ist?"
    },
    "options": [
      {
        "id": "A",
        "text": {
          "en": "AlertEvidence | where Timestamp > ago(7d) | where AccountName =~ 'alexw' | project Timestamp, AlertId, Title, DeviceName, AccountName",
          "de": "AlertEvidence | where Timestamp > ago(7d) | where AccountName =~ 'alexw' | project Timestamp, AlertId, Title, DeviceName, AccountName"
        }
      },
      {
        "id": "B",
        "text": {
          "en": "DeviceInfo | where DeviceName =~ 'alexw'",
          "de": "DeviceInfo | where DeviceName =~ 'alexw'"
        }
      },
      {
        "id": "C",
        "text": {
          "en": "EmailEvents | where RecipientEmailAddress =~ 'alexw' | project Subject",
          "de": "EmailEvents | where RecipientEmailAddress =~ 'alexw' | project Subject"
        }
      },
      {
        "id": "D",
        "text": {
          "en": "CloudAppEvents | where Application =~ 'alexw'",
          "de": "CloudAppEvents | where Application =~ 'alexw'"
        }
      }
    ],
    "correct": [
      "A"
    ],
    "explanation": {
      "en": "AlertEvidence links alerts to related entities such as accounts and devices, making it the right place to pivot from a user to associated alerts.",
      "de": "AlertEvidence verknüpft Warnungen mit zugehörigen Entitäten wie Konten und Geräten und ist daher der richtige Ausgangspunkt, um von einem Benutzer zu zugehörigen Warnungen zu wechseln."
    },
    "hint": {
      "en": "Pivot from the account into alert evidence, not asset inventory.",
      "de": "Wechseln Sie vom Konto in die Alarmbelege und nicht in den Bestandskatalog."
    },
    "reference": "https://learn.microsoft.com/en-us/defender-xdr/advanced-hunting-overview"
  },
  {
    "id": "sc200-222",
    "type": "single",
    "domain": {
      "en": "Mitigate Threats Using Microsoft Defender XDR",
      "de": "Bedrohungen mit Microsoft Defender XDR mindern"
    },
    "difficulty": "hard",
    "scenario": {
      "en": "Responders suspect password spraying against local and domain accounts on endpoints.",
      "de": "Responder vermuten Password-Spraying gegen lokale und Domänenkonten auf Endpunkten."
    },
    "question": {
      "en": "Which Advanced Hunting query best summarizes failed device logons by account during the last day?",
      "de": "Welche Advanced-Hunting-Abfrage fasst fehlgeschlagene Geräteanmeldungen nach Konto in den letzten 24 Stunden am besten zusammen?"
    },
    "options": [
      {
        "id": "A",
        "text": {
          "en": "DeviceLogonEvents | where Timestamp > ago(1d) | where ActionType == 'LogonFailed' | summarize FailedLogons=count() by AccountName | order by FailedLogons desc",
          "de": "DeviceLogonEvents | where Timestamp > ago(1d) | where ActionType == 'LogonFailed' | summarize FailedLogons=count() by AccountName | order by FailedLogons desc"
        }
      },
      {
        "id": "B",
        "text": {
          "en": "DeviceProcessEvents | where FileName == 'winlogon.exe' | summarize count() by AccountName",
          "de": "DeviceProcessEvents | where FileName == 'winlogon.exe' | summarize count() by AccountName"
        }
      },
      {
        "id": "C",
        "text": {
          "en": "EmailEvents | summarize count() by RecipientEmailAddress",
          "de": "EmailEvents | summarize count() by RecipientEmailAddress"
        }
      },
      {
        "id": "D",
        "text": {
          "en": "DeviceNetworkEvents | summarize count() by RemoteIP",
          "de": "DeviceNetworkEvents | summarize count() by RemoteIP"
        }
      }
    ],
    "correct": [
      "A"
    ],
    "explanation": {
      "en": "DeviceLogonEvents captures endpoint logon outcomes, and summarizing ActionType == LogonFailed by AccountName highlights brute-force targets.",
      "de": "DeviceLogonEvents erfasst Anmeldeergebnisse auf Endpunkten, und das Zusammenfassen von ActionType == LogonFailed nach AccountName hebt Brute-Force-Ziele hervor."
    },
    "hint": {
      "en": "Use the logon table and summarize failures by account.",
      "de": "Verwenden Sie die Anmeldetabelle und fassen Sie die Fehler nach Konto zusammen."
    },
    "reference": "https://learn.microsoft.com/en-us/defender-xdr/advanced-hunting-overview"
  },
  {
    "id": "sc200-223",
    "type": "multiple",
    "domain": {
      "en": "Mitigate Threats Using Microsoft Defender XDR",
      "de": "Bedrohungen mit Microsoft Defender XDR mindern"
    },
    "difficulty": "medium",
    "scenario": null,
    "question": {
      "en": "Which actions are available directly from a Microsoft Defender for Endpoint device page? Select all that apply.",
      "de": "Welche Aktionen sind direkt über eine Microsoft-Defender-for-Endpoint-Geräteseite verfügbar? Wählen Sie alle zutreffenden Antworten aus."
    },
    "options": [
      {
        "id": "A",
        "text": {
          "en": "Isolate device",
          "de": "Gerät isolieren"
        }
      },
      {
        "id": "B",
        "text": {
          "en": "Run antivirus scan",
          "de": "Antivirusscan ausführen"
        }
      },
      {
        "id": "C",
        "text": {
          "en": "Collect investigation package",
          "de": "Untersuchungspaket sammeln"
        }
      },
      {
        "id": "D",
        "text": {
          "en": "Reset the user's Entra ID password",
          "de": "Das Entra-ID-Kennwort des Benutzers zurücksetzen"
        }
      }
    ],
    "correct": [
      "A",
      "B",
      "C"
    ],
    "explanation": {
      "en": "Endpoint device pages expose device-focused response actions such as isolation, antivirus scan, and investigation package collection. Password reset is not a device-page action.",
      "de": "Geräteseiten für Endpunkte bieten gerätebezogene Reaktionsmaßnahmen wie Isolierung, Antivirusscan und das Sammeln eines Untersuchungspakets. Eine Kennwortrücksetzung ist keine Aktion der Geräteseite."
    },
    "hint": {
      "en": "Pick the actions centered on the device itself.",
      "de": "Wählen Sie die Aktionen, die sich direkt auf das Gerät beziehen."
    },
    "reference": "https://learn.microsoft.com/en-us/defender-endpoint/respond-machine-alerts"
  },
  {
    "id": "sc200-224",
    "type": "multiple",
    "domain": {
      "en": "Mitigate Threats Using Microsoft Defender XDR",
      "de": "Bedrohungen mit Microsoft Defender XDR mindern"
    },
    "difficulty": "medium",
    "scenario": null,
    "question": {
      "en": "Which statements about custom detections in Defender XDR are true? Select all that apply.",
      "de": "Welche Aussagen zu benutzerdefinierten Erkennungen in Defender XDR sind richtig? Wählen Sie alle zutreffenden Antworten aus."
    },
    "options": [
      {
        "id": "A",
        "text": {
          "en": "They are based on Advanced Hunting queries",
          "de": "Sie basieren auf Advanced-Hunting-Abfragen"
        }
      },
      {
        "id": "B",
        "text": {
          "en": "They can run on a schedule",
          "de": "Sie können nach einem Zeitplan ausgeführt werden"
        }
      },
      {
        "id": "C",
        "text": {
          "en": "They can generate alerts when query conditions are met",
          "de": "Sie können Warnungen erzeugen, wenn Abfragebedingungen erfüllt sind"
        }
      },
      {
        "id": "D",
        "text": {
          "en": "They directly rewrite mailbox content without any response workflow",
          "de": "Sie schreiben Postfachinhalte direkt ohne Reaktionsworkflow um"
        }
      }
    ],
    "correct": [
      "A",
      "B",
      "C"
    ],
    "explanation": {
      "en": "Custom detections are scheduled alerting logic built from hunting queries. They do not directly edit mailbox contents as part of their core function.",
      "de": "Benutzerdefinierte Erkennungen sind geplante Warnlogik auf Basis von Hunting-Abfragen. Sie bearbeiten nicht direkt Postfachinhalte als Kernfunktion."
    },
    "hint": {
      "en": "Think scheduled detection logic, not arbitrary content modification.",
      "de": "Denken Sie an geplante Erkennungslogik und nicht an beliebige Inhaltsänderung."
    },
    "reference": "https://learn.microsoft.com/en-us/defender-xdr/custom-detection-rules"
  },
  {
    "id": "sc200-225",
    "type": "single",
    "domain": {
      "en": "Mitigate Threats Using Microsoft Defender XDR",
      "de": "Bedrohungen mit Microsoft Defender XDR mindern"
    },
    "difficulty": "easy",
    "scenario": {
      "en": "Several analysts work in shifts and management wants consistent case ownership.",
      "de": "Mehrere Analysten arbeiten in Schichten, und das Management möchte eine konsistente Fallzuständigkeit."
    },
    "question": {
      "en": "Which Defender XDR area should a SOC lead use to assign ownership and track status for open incidents?",
      "de": "Welchen Bereich von Defender XDR sollte eine SOC-Leitung verwenden, um Zuständigkeiten zuzuweisen und den Status offener Vorfälle zu verfolgen?"
    },
    "options": [
      {
        "id": "A",
        "text": {
          "en": "Incidents queue",
          "de": "Vorfallswarteschlange"
        }
      },
      {
        "id": "B",
        "text": {
          "en": "Advanced Hunting",
          "de": "Advanced Hunting"
        }
      },
      {
        "id": "C",
        "text": {
          "en": "Threat analytics",
          "de": "Threat Analytics"
        }
      },
      {
        "id": "D",
        "text": {
          "en": "Secure score",
          "de": "Secure Score"
        }
      }
    ],
    "correct": [
      "A"
    ],
    "explanation": {
      "en": "The incidents queue is the case-management entry point for sorting, assigning, and tracking Defender XDR incidents.",
      "de": "Die Vorfallswarteschlange ist der Einstiegspunkt für das Fallmanagement, um Defender-XDR-Vorfälle zu sortieren, zuzuweisen und nachzuverfolgen."
    },
    "hint": {
      "en": "Use the case queue rather than the raw query experience.",
      "de": "Verwenden Sie die Fallwarteschlange und nicht die reine Abfrageoberfläche."
    },
    "reference": "https://learn.microsoft.com/en-us/defender-xdr/investigate-incidents"
  },
  {
    "id": "sc200-226",
    "type": "single",
    "domain": {
      "en": "Mitigate Threats Using Microsoft Defender XDR",
      "de": "Bedrohungen mit Microsoft Defender XDR mindern"
    },
    "difficulty": "medium",
    "scenario": null,
    "question": {
      "en": "Which page is best for seeing all remediation actions across the tenant in one place?",
      "de": "Welche Seite eignet sich am besten, um alle Behebungsmaßnahmen im Mandanten an einem Ort zu sehen?"
    },
    "options": [
      {
        "id": "A",
        "text": {
          "en": "Action center",
          "de": "Action Center"
        }
      },
      {
        "id": "B",
        "text": {
          "en": "Device inventory",
          "de": "Gerätebestand"
        }
      },
      {
        "id": "C",
        "text": {
          "en": "Threat analytics",
          "de": "Threat Analytics"
        }
      },
      {
        "id": "D",
        "text": {
          "en": "Cloud Discovery",
          "de": "Cloud Discovery"
        }
      }
    ],
    "correct": [
      "A"
    ],
    "explanation": {
      "en": "The Action center centralizes response actions so analysts can review scope, state, and approval information across investigations.",
      "de": "Das Action Center zentralisiert Reaktionsmaßnahmen, damit Analysten Umfang, Status und Genehmigungsinformationen über Untersuchungen hinweg prüfen können."
    },
    "hint": {
      "en": "Look for the tenant-wide response action dashboard.",
      "de": "Suchen Sie nach dem mandantenweiten Dashboard für Reaktionsmaßnahmen."
    },
    "reference": "https://learn.microsoft.com/en-us/defender-endpoint/automated-investigations"
  },
  {
    "id": "sc200-227",
    "type": "single",
    "domain": {
      "en": "Mitigate Threats Using Microsoft Defender XDR",
      "de": "Bedrohungen mit Microsoft Defender XDR mindern"
    },
    "difficulty": "hard",
    "scenario": {
      "en": "An intrusion set is known to drop short-lived PowerShell loaders into user temp folders before execution.",
      "de": "Eine Angreifergruppe ist dafür bekannt, kurzlebige PowerShell-Loader vor der Ausführung in Benutzer-Temp-Ordner abzulegen."
    },
    "question": {
      "en": "Which Advanced Hunting query best finds PowerShell script files created in user temp folders during the last day?",
      "de": "Welche Advanced-Hunting-Abfrage findet am besten PowerShell-Skriptdateien, die in den letzten 24 Stunden in Benutzer-Temp-Ordnern erstellt wurden?"
    },
    "options": [
      {
        "id": "A",
        "text": {
          "en": "DeviceFileEvents | where Timestamp > ago(1d) | where FileName endswith '.ps1' | where FolderPath contains '\\AppData\\Local\\Temp\\' | project Timestamp, DeviceName, FolderPath, FileName, InitiatingProcessFileName",
          "de": "DeviceFileEvents | where Timestamp > ago(1d) | where FileName endswith '.ps1' | where FolderPath contains '\\AppData\\Local\\Temp\\' | project Timestamp, DeviceName, FolderPath, FileName, InitiatingProcessFileName"
        }
      },
      {
        "id": "B",
        "text": {
          "en": "DeviceNetworkEvents | where RemoteUrl endswith '.ps1'",
          "de": "DeviceNetworkEvents | where RemoteUrl endswith '.ps1'"
        }
      },
      {
        "id": "C",
        "text": {
          "en": "EmailEvents | where Subject endswith '.ps1'",
          "de": "EmailEvents | where Subject endswith '.ps1'"
        }
      },
      {
        "id": "D",
        "text": {
          "en": "CloudAppEvents | where ActionType == 'FileUploaded' and FileName endswith '.ps1'",
          "de": "CloudAppEvents | where ActionType == 'FileUploaded' and FileName endswith '.ps1'"
        }
      }
    ],
    "correct": [
      "A"
    ],
    "explanation": {
      "en": "DeviceFileEvents tracks file creations and modifications on endpoints, so it is the correct table for suspicious script creation in temp paths.",
      "de": "DeviceFileEvents verfolgt Dateierstellungen und -änderungen auf Endpunkten und ist daher die richtige Tabelle für verdächtige Skripterstellung in Temp-Pfaden."
    },
    "hint": {
      "en": "Choose the endpoint file telemetry table.",
      "de": "Wählen Sie die Tabelle für Endpunkt-Dateitelemetrie."
    },
    "reference": "https://learn.microsoft.com/en-us/defender-xdr/advanced-hunting-overview"
  },
  {
    "id": "sc200-228",
    "type": "single",
    "domain": {
      "en": "Mitigate Threats Using Microsoft Defender XDR",
      "de": "Bedrohungen mit Microsoft Defender XDR mindern"
    },
    "difficulty": "medium",
    "scenario": {
      "en": "Threat intel confirms a credential-harvesting domain used in the current campaign.",
      "de": "Threat Intelligence bestätigt eine Domäne zum Abgreifen von Anmeldedaten, die in der aktuellen Kampagne verwendet wird."
    },
    "question": {
      "en": "Which indicator type is best for blocking outbound access to a confirmed malicious website from managed endpoints?",
      "de": "Welcher Indikatortyp eignet sich am besten, um ausgehenden Zugriff auf eine bestätigte bösartige Website von verwalteten Endpunkten zu blockieren?"
    },
    "options": [
      {
        "id": "A",
        "text": {
          "en": "URL/domain indicator",
          "de": "URL-/Domänenindikator"
        }
      },
      {
        "id": "B",
        "text": {
          "en": "File hash indicator",
          "de": "Dateihash-Indikator"
        }
      },
      {
        "id": "C",
        "text": {
          "en": "User tag",
          "de": "Benutzertag"
        }
      },
      {
        "id": "D",
        "text": {
          "en": "Bookmark",
          "de": "Lesezeichen"
        }
      }
    ],
    "correct": [
      "A"
    ],
    "explanation": {
      "en": "A URL/domain indicator is the proper IOC control for enforcing block or alert behavior on malicious sites or domains.",
      "de": "Ein URL-/Domänenindikator ist die passende IOC-Steuerung, um Blockier- oder Warnverhalten für bösartige Websites oder Domänen durchzusetzen."
    },
    "hint": {
      "en": "Block the site with the network-focused IOC type.",
      "de": "Blockieren Sie die Website mit dem netzwerkorientierten IOC-Typ."
    },
    "reference": "https://learn.microsoft.com/en-us/defender-endpoint/respond-machine-alerts"
  },
  {
    "id": "sc200-229",
    "type": "multiple",
    "domain": {
      "en": "Mitigate Threats Using Microsoft Defender XDR",
      "de": "Bedrohungen mit Microsoft Defender XDR mindern"
    },
    "difficulty": "medium",
    "scenario": null,
    "question": {
      "en": "Which indicator types can Defender for Endpoint use for custom IOC management? Select all that apply.",
      "de": "Welche Indikatortypen kann Defender for Endpoint für die benutzerdefinierte IOC-Verwaltung verwenden? Wählen Sie alle zutreffenden Antworten aus."
    },
    "options": [
      {
        "id": "A",
        "text": {
          "en": "File hashes",
          "de": "Dateihashes"
        }
      },
      {
        "id": "B",
        "text": {
          "en": "IP addresses",
          "de": "IP-Adressen"
        }
      },
      {
        "id": "C",
        "text": {
          "en": "URLs or domains",
          "de": "URLs oder Domänen"
        }
      },
      {
        "id": "D",
        "text": {
          "en": "Teams chat reactions",
          "de": "Teams-Chat-Reaktionen"
        }
      }
    ],
    "correct": [
      "A",
      "B",
      "C"
    ],
    "explanation": {
      "en": "Defender for Endpoint supports IOC management for common technical indicators such as file hashes, IPs, and URLs/domains. Chat reactions are unrelated.",
      "de": "Defender for Endpoint unterstützt die IOC-Verwaltung für gängige technische Indikatoren wie Dateihashes, IPs und URLs/Domänen. Chat-Reaktionen sind nicht relevant."
    },
    "hint": {
      "en": "Select the standard security indicators, not collaboration metadata.",
      "de": "Wählen Sie die üblichen Sicherheitsindikatoren und nicht Kollaborationsmetadaten."
    },
    "reference": "https://learn.microsoft.com/en-us/defender-endpoint/respond-machine-alerts"
  },
  {
    "id": "sc200-230",
    "type": "single",
    "domain": {
      "en": "Mitigate Threats Using Microsoft Defender XDR",
      "de": "Bedrohungen mit Microsoft Defender XDR mindern"
    },
    "difficulty": "medium",
    "scenario": {
      "en": "The SOC wants to understand how widely a suspicious subject line was delivered before starting remediation.",
      "de": "Das SOC möchte verstehen, wie weit eine verdächtige Betreffzeile zugestellt wurde, bevor mit der Behebung begonnen wird."
    },
    "question": {
      "en": "Which Defender for Office 365 experience is best for tracing a phishing campaign across recipients, subject lines, and delivery actions?",
      "de": "Welche Defender-for-Office-365-Ansicht eignet sich am besten, um eine Phishing-Kampagne über Empfänger, Betreffzeilen und Zustellaktionen hinweg nachzuverfolgen?"
    },
    "options": [
      {
        "id": "A",
        "text": {
          "en": "Threat Explorer",
          "de": "Threat Explorer"
        }
      },
      {
        "id": "B",
        "text": {
          "en": "Action center",
          "de": "Action Center"
        }
      },
      {
        "id": "C",
        "text": {
          "en": "Secure score",
          "de": "Secure Score"
        }
      },
      {
        "id": "D",
        "text": {
          "en": "Cloud Security Explorer",
          "de": "Cloud Security Explorer"
        }
      }
    ],
    "correct": [
      "A"
    ],
    "explanation": {
      "en": "Threat Explorer is designed for message-centric investigation across recipients, threats, actions, and delivery details in Defender for Office 365.",
      "de": "Threat Explorer ist für nachrichtenorientierte Untersuchungen über Empfänger, Bedrohungen, Aktionen und Zustellungsdetails in Defender for Office 365 konzipiert."
    },
    "hint": {
      "en": "Pick the message investigation view.",
      "de": "Wählen Sie die Ansicht zur Nachrichtenuntersuchung."
    },
    "reference": "https://learn.microsoft.com/en-us/defender-xdr/investigate-incidents"
  },
  {
    "id": "sc200-231",
    "type": "single",
    "domain": {
      "en": "Mitigate Threats Using Microsoft Defender XDR",
      "de": "Bedrohungen mit Microsoft Defender XDR mindern"
    },
    "difficulty": "hard",
    "scenario": {
      "en": "A takedown request is in progress, and the SOC must identify every user who received the malicious link.",
      "de": "Eine Takedown-Anfrage läuft, und das SOC muss jeden Benutzer identifizieren, der den schädlichen Link erhalten hat."
    },
    "question": {
      "en": "Which Advanced Hunting query best lists recipients of messages that contained the URL login-contoso.net?",
      "de": "Welche Advanced-Hunting-Abfrage listet am besten Empfänger von Nachrichten auf, die die URL login-contoso.net enthielten?"
    },
    "options": [
      {
        "id": "A",
        "text": {
          "en": "EmailUrlInfo | where Timestamp > ago(7d) | where Url has 'login-contoso.net' | join kind=inner (EmailEvents | project NetworkMessageId, RecipientEmailAddress, Subject) on NetworkMessageId | project Timestamp, RecipientEmailAddress, Subject, Url",
          "de": "EmailUrlInfo | where Timestamp > ago(7d) | where Url has 'login-contoso.net' | join kind=inner (EmailEvents | project NetworkMessageId, RecipientEmailAddress, Subject) on NetworkMessageId | project Timestamp, RecipientEmailAddress, Subject, Url"
        }
      },
      {
        "id": "B",
        "text": {
          "en": "DeviceNetworkEvents | where RemoteUrl has 'login-contoso.net' | project DeviceName",
          "de": "DeviceNetworkEvents | where RemoteUrl has 'login-contoso.net' | project DeviceName"
        }
      },
      {
        "id": "C",
        "text": {
          "en": "AlertEvidence | where Title has 'login-contoso.net' | project AlertId",
          "de": "AlertEvidence | where Title has 'login-contoso.net' | project AlertId"
        }
      },
      {
        "id": "D",
        "text": {
          "en": "DeviceFileEvents | where FileName has 'login-contoso.net'",
          "de": "DeviceFileEvents | where FileName has 'login-contoso.net'"
        }
      }
    ],
    "correct": [
      "A"
    ],
    "explanation": {
      "en": "EmailUrlInfo holds URL details from messages, and joining to EmailEvents on NetworkMessageId brings in recipient and subject context.",
      "de": "EmailUrlInfo enthält URL-Details aus Nachrichten, und der Join mit EmailEvents über NetworkMessageId liefert Empfänger- und Betreffkontext."
    },
    "hint": {
      "en": "Correlate URL telemetry with email message metadata.",
      "de": "Korrelieren Sie URL-Telemetrie mit E-Mail-Nachrichtenmetadaten."
    },
    "reference": "https://learn.microsoft.com/en-us/defender-xdr/advanced-hunting-overview"
  },
  {
    "id": "sc200-232",
    "type": "single",
    "domain": {
      "en": "Mitigate Threats Using Microsoft Defender XDR",
      "de": "Bedrohungen mit Microsoft Defender XDR mindern"
    },
    "difficulty": "medium",
    "scenario": null,
    "question": {
      "en": "Which feature should you use when a proven hunting query must start creating alerts without manual analyst execution?",
      "de": "Welche Funktion sollten Sie verwenden, wenn eine bewährte Hunting-Abfrage Warnungen erzeugen soll, ohne dass Analysten sie manuell ausführen?"
    },
    "options": [
      {
        "id": "A",
        "text": {
          "en": "Custom detection",
          "de": "Benutzerdefinierte Erkennung"
        }
      },
      {
        "id": "B",
        "text": {
          "en": "Bookmark",
          "de": "Lesezeichen"
        }
      },
      {
        "id": "C",
        "text": {
          "en": "Watchlist",
          "de": "Watchlist"
        }
      },
      {
        "id": "D",
        "text": {
          "en": "Sensitivity label",
          "de": "Vertraulichkeitsbezeichnung"
        }
      }
    ],
    "correct": [
      "A"
    ],
    "explanation": {
      "en": "Custom detections are the alerting path for scheduled Advanced Hunting logic in Defender XDR.",
      "de": "Benutzerdefinierte Erkennungen sind der Warnpfad für geplante Advanced-Hunting-Logik in Defender XDR."
    },
    "hint": {
      "en": "Turn a recurring hunt into a scheduled detection.",
      "de": "Verwandeln Sie eine wiederkehrende Suche in eine geplante Erkennung."
    },
    "reference": "https://learn.microsoft.com/en-us/defender-xdr/custom-detection-rules"
  },
  {
    "id": "sc200-233",
    "type": "single",
    "domain": {
      "en": "Mitigate Threats Using Microsoft Defender XDR",
      "de": "Bedrohungen mit Microsoft Defender XDR mindern"
    },
    "difficulty": "medium",
    "scenario": {
      "en": "Security governance wants visibility into unsanctioned SaaS usage before deciding which apps to sanction or block.",
      "de": "Die Sicherheitsgovernance möchte Einblick in nicht genehmigte SaaS-Nutzung, bevor entschieden wird, welche Apps genehmigt oder blockiert werden."
    },
    "question": {
      "en": "Which Defender for Cloud Apps feature should an analyst use to discover shadow IT from firewall and proxy logs?",
      "de": "Welche Defender-for-Cloud-Apps-Funktion sollte ein Analyst verwenden, um Shadow IT aus Firewall- und Proxyprotokollen zu erkennen?"
    },
    "options": [
      {
        "id": "A",
        "text": {
          "en": "Cloud Discovery",
          "de": "Cloud Discovery"
        }
      },
      {
        "id": "B",
        "text": {
          "en": "Threat analytics",
          "de": "Threat Analytics"
        }
      },
      {
        "id": "C",
        "text": {
          "en": "Device isolation",
          "de": "Geräteisolierung"
        }
      },
      {
        "id": "D",
        "text": {
          "en": "Regulatory compliance",
          "de": "Regulatorische Compliance"
        }
      }
    ],
    "correct": [
      "A"
    ],
    "explanation": {
      "en": "Cloud Discovery analyzes traffic logs to identify cloud app usage, categorize risk, and surface unsanctioned services.",
      "de": "Cloud Discovery analysiert Verkehrsprotokolle, um die Nutzung von Cloud-Apps zu identifizieren, Risiken zu kategorisieren und nicht genehmigte Dienste sichtbar zu machen."
    },
    "hint": {
      "en": "Choose the shadow-IT discovery capability.",
      "de": "Wählen Sie die Funktion zur Shadow-IT-Erkennung."
    },
    "reference": "https://learn.microsoft.com/en-us/defender-cloud-apps/set-up-cloud-discovery"
  },
  {
    "id": "sc200-234",
    "type": "single",
    "domain": {
      "en": "Mitigate Threats Using Microsoft Defender XDR",
      "de": "Bedrohungen mit Microsoft Defender XDR mindern"
    },
    "difficulty": "medium",
    "scenario": {
      "en": "The SOC wants to detect possible exfiltration from SharePoint Online without defining a static threshold for every department.",
      "de": "Das SOC möchte mögliche Exfiltration aus SharePoint Online erkennen, ohne für jede Abteilung einen statischen Schwellenwert zu definieren."
    },
    "question": {
      "en": "Which Defender for Cloud Apps policy type is best for detecting unusually large download activity by a user?",
      "de": "Welcher Richtlinientyp in Defender for Cloud Apps eignet sich am besten, um ungewöhnlich große Downloadaktivität eines Benutzers zu erkennen?"
    },
    "options": [
      {
        "id": "A",
        "text": {
          "en": "Anomaly detection policy",
          "de": "Richtlinie zur Anomalieerkennung"
        }
      },
      {
        "id": "B",
        "text": {
          "en": "Session policy",
          "de": "Sitzungsrichtlinie"
        }
      },
      {
        "id": "C",
        "text": {
          "en": "Activity log retention rule",
          "de": "Regel zur Aufbewahrung von Aktivitätsprotokollen"
        }
      },
      {
        "id": "D",
        "text": {
          "en": "Analytics rule",
          "de": "Analyseregel"
        }
      }
    ],
    "correct": [
      "A"
    ],
    "explanation": {
      "en": "Anomaly detection policies are designed to surface unusual behavior patterns such as mass download activity that deviates from normal user behavior.",
      "de": "Richtlinien zur Anomalieerkennung sind dafür vorgesehen, ungewöhnliche Verhaltensmuster wie Massendownloads aufzudecken, die vom normalen Benutzerverhalten abweichen."
    },
    "hint": {
      "en": "Look for behavior-baselined detection, not real-time session control.",
      "de": "Suchen Sie nach verhaltensbasierten Erkennungen und nicht nach Echtzeit-Sitzungssteuerung."
    },
    "reference": "https://learn.microsoft.com/en-us/defender-cloud-apps/policies"
  },
  {
    "id": "sc200-235",
    "type": "single",
    "domain": {
      "en": "Mitigate Threats Using Microsoft Defender XDR",
      "de": "Bedrohungen mit Microsoft Defender XDR mindern"
    },
    "difficulty": "hard",
    "scenario": {
      "en": "An insider-risk review needs a quick ranking of who downloaded the most from sanctioned SaaS apps today.",
      "de": "Eine Insider-Risk-Prüfung benötigt eine schnelle Rangliste, wer heute am meisten aus genehmigten SaaS-Apps heruntergeladen hat."
    },
    "question": {
      "en": "Which Advanced Hunting query best shows users who performed download activity in cloud apps during the last day?",
      "de": "Welche Advanced-Hunting-Abfrage zeigt am besten Benutzer, die in den letzten 24 Stunden Download-Aktivitäten in Cloud-Apps durchgeführt haben?"
    },
    "options": [
      {
        "id": "A",
        "text": {
          "en": "CloudAppEvents | where Timestamp > ago(1d) | where ActionType has 'Download' | summarize Downloads=count() by AccountDisplayName, Application | order by Downloads desc",
          "de": "CloudAppEvents | where Timestamp > ago(1d) | where ActionType has 'Download' | summarize Downloads=count() by AccountDisplayName, Application | order by Downloads desc"
        }
      },
      {
        "id": "B",
        "text": {
          "en": "DeviceFileEvents | where FileName has 'Download' | summarize count() by DeviceName",
          "de": "DeviceFileEvents | where FileName has 'Download' | summarize count() by DeviceName"
        }
      },
      {
        "id": "C",
        "text": {
          "en": "IdentityLogonEvents | summarize count() by Application",
          "de": "IdentityLogonEvents | summarize count() by Application"
        }
      },
      {
        "id": "D",
        "text": {
          "en": "EmailEvents | where Subject has 'Download' | summarize count() by RecipientEmailAddress",
          "de": "EmailEvents | where Subject has 'Download' | summarize count() by RecipientEmailAddress"
        }
      }
    ],
    "correct": [
      "A"
    ],
    "explanation": {
      "en": "CloudAppEvents captures activity within cloud applications, making it the right place to summarize user download activity by app.",
      "de": "CloudAppEvents erfasst Aktivitäten innerhalb von Cloudanwendungen und ist daher der richtige Ort, um Download-Aktivitäten von Benutzern nach App zusammenzufassen."
    },
    "hint": {
      "en": "Use cloud app activity telemetry, not endpoint file naming.",
      "de": "Verwenden Sie Telemetrie zu Cloud-App-Aktivitäten und nicht Dateinamen auf Endpunkten."
    },
    "reference": "https://learn.microsoft.com/en-us/defender-xdr/advanced-hunting-overview"
  },
  {
    "id": "sc200-236",
    "type": "multiple",
    "domain": {
      "en": "Mitigate Threats Using Microsoft Defender XDR",
      "de": "Bedrohungen mit Microsoft Defender XDR mindern"
    },
    "difficulty": "medium",
    "scenario": null,
    "question": {
      "en": "What information can analysts review directly on a Defender XDR incident page? Select all that apply.",
      "de": "Welche Informationen können Analysten direkt auf einer Defender-XDR-Vorfallsseite prüfen? Wählen Sie alle zutreffenden Antworten aus."
    },
    "options": [
      {
        "id": "A",
        "text": {
          "en": "Correlated alerts",
          "de": "Korrelierte Warnungen"
        }
      },
      {
        "id": "B",
        "text": {
          "en": "Affected entities and evidence",
          "de": "Betroffene Entitäten und Beweise"
        }
      },
      {
        "id": "C",
        "text": {
          "en": "Response actions taken",
          "de": "Durchgeführte Reaktionsmaßnahmen"
        }
      },
      {
        "id": "D",
        "text": {
          "en": "Azure invoice line items",
          "de": "Azure-Rechnungspositionen"
        }
      }
    ],
    "correct": [
      "A",
      "B",
      "C"
    ],
    "explanation": {
      "en": "Incident pages combine related alerts, impacted entities, evidence, and response history. Billing data is unrelated.",
      "de": "Vorfallsseiten kombinieren zusammengehörige Warnungen, betroffene Entitäten, Beweise und den Reaktionsverlauf. Abrechnungsdaten sind nicht relevant."
    },
    "hint": {
      "en": "Choose investigation data, not finance data.",
      "de": "Wählen Sie Untersuchungsdaten und keine Finanzdaten."
    },
    "reference": "https://learn.microsoft.com/en-us/defender-xdr/investigate-incidents"
  },
  {
    "id": "sc200-237",
    "type": "single",
    "domain": {
      "en": "Mitigate Threats Using Microsoft Sentinel",
      "de": "Bedrohungen mit Microsoft Sentinel mindern"
    },
    "difficulty": "easy",
    "scenario": null,
    "question": {
      "en": "Which Sentinel connector is used to ingest Microsoft Defender XDR alerts and incidents?",
      "de": "Welcher Sentinel-Connector wird verwendet, um Warnungen und Vorfälle aus Microsoft Defender XDR zu erfassen?"
    },
    "options": [
      {
        "id": "A",
        "text": {
          "en": "Microsoft Defender XDR connector",
          "de": "Microsoft-Defender-XDR-Connector"
        }
      },
      {
        "id": "B",
        "text": {
          "en": "Office data connector",
          "de": "Office-Datenconnector"
        }
      },
      {
        "id": "C",
        "text": {
          "en": "TAXII connector",
          "de": "TAXII-Connector"
        }
      },
      {
        "id": "D",
        "text": {
          "en": "Watchlist connector",
          "de": "Watchlist-Connector"
        }
      }
    ],
    "correct": [
      "A"
    ],
    "explanation": {
      "en": "The Microsoft Defender XDR connector integrates Defender alerts and related security signals into Sentinel.",
      "de": "Der Microsoft-Defender-XDR-Connector integriert Defender-Warnungen und zugehörige Sicherheitssignale in Sentinel."
    },
    "hint": {
      "en": "Pick the connector named for the source suite.",
      "de": "Wählen Sie den Connector, der nach der Quellsuite benannt ist."
    },
    "reference": "https://learn.microsoft.com/en-us/azure/sentinel/work-with-data-connectors"
  },
  {
    "id": "sc200-238",
    "type": "single",
    "domain": {
      "en": "Mitigate Threats Using Microsoft Sentinel",
      "de": "Bedrohungen mit Microsoft Sentinel mindern"
    },
    "difficulty": "medium",
    "scenario": {
      "en": "You want to onboard a common data source and also deploy its matching dashboards and detections quickly.",
      "de": "Sie möchten eine gängige Datenquelle onboarden und zugleich die dazugehörigen Dashboards und Erkennungen schnell bereitstellen."
    },
    "question": {
      "en": "Which Sentinel feature should you use to install packaged content such as analytics rules, workbooks, connectors, and playbooks from Microsoft or partners?",
      "de": "Welche Sentinel-Funktion sollten Sie verwenden, um paketierte Inhalte wie Analyseregeln, Workbooks, Connectoren und Playbooks von Microsoft oder Partnern zu installieren?"
    },
    "options": [
      {
        "id": "A",
        "text": {
          "en": "Content hub",
          "de": "Content Hub"
        }
      },
      {
        "id": "B",
        "text": {
          "en": "Investigation graph",
          "de": "Untersuchungsgraph"
        }
      },
      {
        "id": "C",
        "text": {
          "en": "Incident queue",
          "de": "Vorfallswarteschlange"
        }
      },
      {
        "id": "D",
        "text": {
          "en": "Secure score",
          "de": "Secure Score"
        }
      }
    ],
    "correct": [
      "A"
    ],
    "explanation": {
      "en": "Content hub is the solution catalog used to discover and deploy packaged Sentinel content.",
      "de": "Der Content Hub ist der Lösungskatalog, mit dem paketierte Sentinel-Inhalte gefunden und bereitgestellt werden."
    },
    "hint": {
      "en": "Choose the solution catalog, not the investigation surface.",
      "de": "Wählen Sie den Lösungskatalog und nicht die Untersuchungsoberfläche."
    },
    "reference": "https://learn.microsoft.com/en-us/azure/sentinel/sentinel-solutions-catalog"
  },
  {
    "id": "sc200-239",
    "type": "single",
    "domain": {
      "en": "Mitigate Threats Using Microsoft Sentinel",
      "de": "Bedrohungen mit Microsoft Sentinel mindern"
    },
    "difficulty": "medium",
    "scenario": {
      "en": "Analysts have manually confirmed the same suspicious pattern across several investigations.",
      "de": "Analysten haben dasselbe verdächtige Muster in mehreren Untersuchungen manuell bestätigt."
    },
    "question": {
      "en": "A hunting query has proven accurate and should now generate incidents automatically. What should you create?",
      "de": "Eine Hunting-Abfrage hat sich als genau erwiesen und soll nun automatisch Vorfälle erzeugen. Was sollten Sie erstellen?"
    },
    "options": [
      {
        "id": "A",
        "text": {
          "en": "Analytics rule",
          "de": "Analyseregel"
        }
      },
      {
        "id": "B",
        "text": {
          "en": "Bookmark",
          "de": "Lesezeichen"
        }
      },
      {
        "id": "C",
        "text": {
          "en": "Workbook",
          "de": "Workbook"
        }
      },
      {
        "id": "D",
        "text": {
          "en": "Watchlist",
          "de": "Watchlist"
        }
      }
    ],
    "correct": [
      "A"
    ],
    "explanation": {
      "en": "Analytics rules operationalize hunting logic into scheduled or near-real-time detection that can create alerts and incidents.",
      "de": "Analyseregeln operationalisieren Hunting-Logik in eine geplante oder nahezu Echtzeit-Erkennung, die Warnungen und Vorfälle erzeugen kann."
    },
    "hint": {
      "en": "Move validated hunt logic into production detection.",
      "de": "Überführen Sie bestätigte Hunting-Logik in die produktive Erkennung."
    },
    "reference": "https://learn.microsoft.com/en-us/azure/sentinel/create-analytics-rules"
  },
  {
    "id": "sc200-240",
    "type": "single",
    "domain": {
      "en": "Mitigate Threats Using Microsoft Sentinel",
      "de": "Bedrohungen mit Microsoft Sentinel mindern"
    },
    "difficulty": "medium",
    "scenario": {
      "en": "Credential abuse from a privileged account must raise an incident within minutes, not on a longer schedule.",
      "de": "Missbrauch von Anmeldedaten eines privilegierten Kontos muss innerhalb von Minuten und nicht in einem längeren Zeitplan einen Vorfall auslösen."
    },
    "question": {
      "en": "Which analytics rule type is best when analysts need the lowest possible detection latency for high-confidence events?",
      "de": "Welcher Typ von Analyseregel eignet sich am besten, wenn Analysten die geringstmögliche Erkennungslatenz für Ereignisse mit hoher Vertrauenswürdigkeit benötigen?"
    },
    "options": [
      {
        "id": "A",
        "text": {
          "en": "Near real-time (NRT)",
          "de": "Near real-time (NRT)"
        }
      },
      {
        "id": "B",
        "text": {
          "en": "Scheduled",
          "de": "Geplant"
        }
      },
      {
        "id": "C",
        "text": {
          "en": "Fusion",
          "de": "Fusion"
        }
      },
      {
        "id": "D",
        "text": {
          "en": "Workbook",
          "de": "Workbook"
        }
      }
    ],
    "correct": [
      "A"
    ],
    "explanation": {
      "en": "NRT rules are designed for low-latency detection on high-fidelity signals when waiting for the normal scheduled interval is undesirable.",
      "de": "NRT-Regeln sind für latenzarme Erkennung bei Signalen mit hoher Genauigkeit gedacht, wenn das Warten auf das normale geplante Intervall unerwünscht ist."
    },
    "hint": {
      "en": "Choose the rule type optimized for fast alerting.",
      "de": "Wählen Sie den Regeltyp, der für schnelle Alarmierung optimiert ist."
    },
    "reference": "https://learn.microsoft.com/en-us/azure/sentinel/create-analytics-rules"
  },
  {
    "id": "sc200-241",
    "type": "single",
    "domain": {
      "en": "Mitigate Threats Using Microsoft Sentinel",
      "de": "Bedrohungen mit Microsoft Sentinel mindern"
    },
    "difficulty": "medium",
    "scenario": null,
    "question": {
      "en": "Which Sentinel capability automatically correlates multi-stage attack signals from different analytics into a single high-fidelity incident?",
      "de": "Welche Sentinel-Funktion korreliert automatisch mehrstufige Angriffssignale aus verschiedenen Analysen zu einem einzelnen Vorfall mit hoher Genauigkeit?"
    },
    "options": [
      {
        "id": "A",
        "text": {
          "en": "Fusion",
          "de": "Fusion"
        }
      },
      {
        "id": "B",
        "text": {
          "en": "Bookmarking",
          "de": "Lesezeichen"
        }
      },
      {
        "id": "C",
        "text": {
          "en": "Watchlists",
          "de": "Watchlists"
        }
      },
      {
        "id": "D",
        "text": {
          "en": "Content hub",
          "de": "Content Hub"
        }
      }
    ],
    "correct": [
      "A"
    ],
    "explanation": {
      "en": "Fusion uses correlation and machine learning to combine related signals from different sources into prioritized incidents.",
      "de": "Fusion verwendet Korrelation und Machine Learning, um zusammengehörige Signale aus verschiedenen Quellen zu priorisierten Vorfällen zusammenzuführen."
    },
    "hint": {
      "en": "Pick the automated correlation engine.",
      "de": "Wählen Sie die automatische Korrelations-Engine."
    },
    "reference": "https://learn.microsoft.com/en-us/azure/sentinel/create-analytics-rules"
  },
  {
    "id": "sc200-242",
    "type": "single",
    "domain": {
      "en": "Mitigate Threats Using Microsoft Sentinel",
      "de": "Bedrohungen mit Microsoft Sentinel mindern"
    },
    "difficulty": "medium",
    "scenario": null,
    "question": {
      "en": "UEBA anomalies in Sentinel are primarily based on what?",
      "de": "Worauf basieren UEBA-Anomalien in Sentinel hauptsächlich?"
    },
    "options": [
      {
        "id": "A",
        "text": {
          "en": "Historical behavior of entities and peers",
          "de": "Historisches Verhalten von Entitäten und Peers"
        }
      },
      {
        "id": "B",
        "text": {
          "en": "Only analyst comments",
          "de": "Nur Analystenkommentare"
        }
      },
      {
        "id": "C",
        "text": {
          "en": "Workbook color themes",
          "de": "Workbook-Farbdesigns"
        }
      },
      {
        "id": "D",
        "text": {
          "en": "Watchlist size",
          "de": "Größe der Watchlist"
        }
      }
    ],
    "correct": [
      "A"
    ],
    "explanation": {
      "en": "UEBA compares current activity to baselines for users and other entities, often including peer-group behavior.",
      "de": "UEBA vergleicht aktuelle Aktivitäten mit Baselines für Benutzer und andere Entitäten und berücksichtigt häufig auch das Verhalten von Peer-Gruppen."
    },
    "hint": {
      "en": "Think behavioral baseline plus peer comparison.",
      "de": "Denken Sie an Verhaltensbaseline plus Peer-Vergleich."
    },
    "reference": "https://learn.microsoft.com/en-us/azure/sentinel/identify-threats-with-entity-behavior-analytics"
  },
  {
    "id": "sc200-243",
    "type": "single",
    "domain": {
      "en": "Mitigate Threats Using Microsoft Sentinel",
      "de": "Bedrohungen mit Microsoft Sentinel mindern"
    },
    "difficulty": "medium",
    "scenario": {
      "en": "A single incident spans suspicious sign-ins, endpoints, and a malicious IP address, and the analyst wants to follow the connections quickly.",
      "de": "Ein einzelner Vorfall umfasst verdächtige Anmeldungen, Endpunkte und eine bösartige IP-Adresse, und der Analyst möchte die Zusammenhänge schnell nachvollziehen."
    },
    "question": {
      "en": "Which Sentinel investigation experience should an analyst use to pivot through related entities such as accounts, hosts, IPs, and alerts?",
      "de": "Welche Sentinel-Untersuchungsansicht sollte ein Analyst verwenden, um über zugehörige Entitäten wie Konten, Hosts, IPs und Warnungen zu pivotieren?"
    },
    "options": [
      {
        "id": "A",
        "text": {
          "en": "Investigation graph",
          "de": "Untersuchungsgraph"
        }
      },
      {
        "id": "B",
        "text": {
          "en": "Content hub",
          "de": "Content Hub"
        }
      },
      {
        "id": "C",
        "text": {
          "en": "Cost analysis",
          "de": "Kostenanalyse"
        }
      },
      {
        "id": "D",
        "text": {
          "en": "Usage reports",
          "de": "Nutzungsberichte"
        }
      }
    ],
    "correct": [
      "A"
    ],
    "explanation": {
      "en": "The investigation graph lets analysts navigate the relationships between alerts and mapped entities during incident investigation.",
      "de": "Der Untersuchungsgraph ermöglicht Analysten, während der Vorfallsuntersuchung die Beziehungen zwischen Warnungen und zugeordneten Entitäten zu durchlaufen."
    },
    "hint": {
      "en": "Choose the relationship view for entities.",
      "de": "Wählen Sie die Beziehungsansicht für Entitäten."
    },
    "reference": "https://learn.microsoft.com/en-us/azure/sentinel/investigate-cases"
  },
  {
    "id": "sc200-244",
    "type": "single",
    "domain": {
      "en": "Mitigate Threats Using Microsoft Sentinel",
      "de": "Bedrohungen mit Microsoft Sentinel mindern"
    },
    "difficulty": "medium",
    "scenario": {
      "en": "The SOC wants all incidents from a VIP analytics rule to be tagged and assigned to the Tier 3 queue automatically.",
      "de": "Das SOC möchte, dass alle Vorfälle aus einer VIP-Analyseregel automatisch markiert und der Tier-3-Warteschlange zugewiesen werden."
    },
    "question": {
      "en": "Which Sentinel capability should you use to automatically tag, assign, or change severity on incidents as soon as they are created?",
      "de": "Welche Sentinel-Funktion sollten Sie verwenden, um Vorfälle automatisch zu taggen, zuzuweisen oder ihre Schwere zu ändern, sobald sie erstellt werden?"
    },
    "options": [
      {
        "id": "A",
        "text": {
          "en": "Automation rule",
          "de": "Automatisierungsregel"
        }
      },
      {
        "id": "B",
        "text": {
          "en": "Workbook",
          "de": "Workbook"
        }
      },
      {
        "id": "C",
        "text": {
          "en": "Watchlist",
          "de": "Watchlist"
        }
      },
      {
        "id": "D",
        "text": {
          "en": "Data connector",
          "de": "Datenconnector"
        }
      }
    ],
    "correct": [
      "A"
    ],
    "explanation": {
      "en": "Automation rules handle incident orchestration such as assignment, tagging, severity changes, and playbook invocation.",
      "de": "Automatisierungsregeln übernehmen die Vorfallsorchestrierung wie Zuweisung, Tagging, Schweregradänderungen und das Auslösen von Playbooks."
    },
    "hint": {
      "en": "Pick the incident orchestration feature.",
      "de": "Wählen Sie die Funktion zur Vorfallsorchestrierung."
    },
    "reference": "https://learn.microsoft.com/en-us/azure/sentinel/automate-incident-handling-with-automation-rules"
  },
  {
    "id": "sc200-245",
    "type": "single",
    "domain": {
      "en": "Mitigate Threats Using Microsoft Sentinel",
      "de": "Bedrohungen mit Microsoft Sentinel mindern"
    },
    "difficulty": "medium",
    "scenario": {
      "en": "An incident should trigger a ticket, a Teams notification, and a call to an external enrichment service.",
      "de": "Ein Vorfall soll ein Ticket, eine Teams-Benachrichtigung und einen Aufruf an einen externen Enrichment-Dienst auslösen."
    },
    "question": {
      "en": "Which component actually executes a multi-step workflow such as notifying Teams, enriching an incident, and opening a ticket?",
      "de": "Welche Komponente führt tatsächlich einen mehrstufigen Workflow aus, etwa das Benachrichtigen in Teams, die Anreicherung eines Vorfalls und das Öffnen eines Tickets?"
    },
    "options": [
      {
        "id": "A",
        "text": {
          "en": "Playbook",
          "de": "Playbook"
        }
      },
      {
        "id": "B",
        "text": {
          "en": "Bookmark",
          "de": "Lesezeichen"
        }
      },
      {
        "id": "C",
        "text": {
          "en": "Watchlist",
          "de": "Watchlist"
        }
      },
      {
        "id": "D",
        "text": {
          "en": "Fusion",
          "de": "Fusion"
        }
      }
    ],
    "correct": [
      "A"
    ],
    "explanation": {
      "en": "In Sentinel, playbooks are Logic Apps workflows that perform automated response and enrichment steps.",
      "de": "In Sentinel sind Playbooks Logic-App-Workflows, die automatisierte Reaktions- und Anreicherungsschritte ausführen."
    },
    "hint": {
      "en": "Use the Logic App-based automation component.",
      "de": "Verwenden Sie die Logic-App-basierte Automatisierungskomponente."
    },
    "reference": "https://learn.microsoft.com/en-us/azure/sentinel/automation/playbook-triggers-actions"
  },
  {
    "id": "sc200-246",
    "type": "single",
    "domain": {
      "en": "Mitigate Threats Using Microsoft Sentinel",
      "de": "Bedrohungen mit Microsoft Sentinel mindern"
    },
    "difficulty": "medium",
    "scenario": null,
    "question": {
      "en": "Which Sentinel feature should analysts use to save interesting query results during hunting and return to them later?",
      "de": "Welche Sentinel-Funktion sollten Analysten verwenden, um interessante Abfrageergebnisse während des Huntings zu speichern und später darauf zurückzukommen?"
    },
    "options": [
      {
        "id": "A",
        "text": {
          "en": "Bookmark",
          "de": "Lesezeichen"
        }
      },
      {
        "id": "B",
        "text": {
          "en": "Automation rule",
          "de": "Automatisierungsregel"
        }
      },
      {
        "id": "C",
        "text": {
          "en": "Data connector",
          "de": "Datenconnector"
        }
      },
      {
        "id": "D",
        "text": {
          "en": "Retention lock",
          "de": "Aufbewahrungssperre"
        }
      }
    ],
    "correct": [
      "A"
    ],
    "explanation": {
      "en": "Bookmarks preserve useful hunt findings with context so analysts can revisit or share them during investigations.",
      "de": "Lesezeichen bewahren nützliche Hunting-Ergebnisse mit Kontext, sodass Analysten sie während Untersuchungen erneut aufrufen oder teilen können."
    },
    "hint": {
      "en": "Think saved hunt findings, not detection logic.",
      "de": "Denken Sie an gespeicherte Hunting-Ergebnisse und nicht an Erkennungslogik."
    },
    "reference": "https://learn.microsoft.com/en-us/azure/sentinel/hunting"
  },
  {
    "id": "sc200-247",
    "type": "single",
    "domain": {
      "en": "Mitigate Threats Using Microsoft Sentinel",
      "de": "Bedrohungen mit Microsoft Sentinel mindern"
    },
    "difficulty": "hard",
    "scenario": null,
    "question": {
      "en": "Which KQL snippet correctly references a watchlist named vipusers?",
      "de": "Welcher KQL-Ausschnitt referenziert eine Watchlist namens vipusers korrekt?"
    },
    "options": [
      {
        "id": "A",
        "text": {
          "en": "_GetWatchlist('vipusers')",
          "de": "_GetWatchlist('vipusers')"
        }
      },
      {
        "id": "B",
        "text": {
          "en": "Get-Watchlist('vipusers')",
          "de": "Get-Watchlist('vipusers')"
        }
      },
      {
        "id": "C",
        "text": {
          "en": "Watchlist('vipusers')",
          "de": "Watchlist('vipusers')"
        }
      },
      {
        "id": "D",
        "text": {
          "en": "load_watchlist('vipusers')",
          "de": "load_watchlist('vipusers')"
        }
      }
    ],
    "correct": [
      "A"
    ],
    "explanation": {
      "en": "Sentinel watchlists are queried in KQL with the _GetWatchlist function.",
      "de": "Sentinel-Watchlists werden in KQL mit der Funktion _GetWatchlist abgefragt."
    },
    "hint": {
      "en": "Use the built-in Sentinel watchlist function name.",
      "de": "Verwenden Sie den integrierten Funktionsnamen für Sentinel-Watchlists."
    },
    "reference": "https://learn.microsoft.com/en-us/azure/sentinel/watchlists-queries"
  },
  {
    "id": "sc200-248",
    "type": "single",
    "domain": {
      "en": "Mitigate Threats Using Microsoft Sentinel",
      "de": "Bedrohungen mit Microsoft Sentinel mindern"
    },
    "difficulty": "hard",
    "scenario": {
      "en": "The SOC is investigating password spray activity against cloud identities.",
      "de": "Das SOC untersucht Password-Spray-Aktivitäten gegen Cloud-Identitäten."
    },
    "question": {
      "en": "Which KQL query best summarizes failed Entra ID sign-ins by user and IP address during the last day?",
      "de": "Welche KQL-Abfrage fasst fehlgeschlagene Entra-ID-Anmeldungen nach Benutzer und IP-Adresse in den letzten 24 Stunden am besten zusammen?"
    },
    "options": [
      {
        "id": "A",
        "text": {
          "en": "SigninLogs | where TimeGenerated > ago(1d) | where ResultType != 0 | summarize FailedAttempts=count() by UserPrincipalName, IPAddress | order by FailedAttempts desc",
          "de": "SigninLogs | where TimeGenerated > ago(1d) | where ResultType != 0 | summarize FailedAttempts=count() by UserPrincipalName, IPAddress | order by FailedAttempts desc"
        }
      },
      {
        "id": "B",
        "text": {
          "en": "SecurityEvent | where EventID == 4625 | summarize count() by Computer",
          "de": "SecurityEvent | where EventID == 4625 | summarize count() by Computer"
        }
      },
      {
        "id": "C",
        "text": {
          "en": "AzureActivity | where ActivityStatusValue == 'Failure' | summarize count() by Caller",
          "de": "AzureActivity | where ActivityStatusValue == 'Failure' | summarize count() by Caller"
        }
      },
      {
        "id": "D",
        "text": {
          "en": "Heartbeat | summarize count() by Computer",
          "de": "Heartbeat | summarize count() by Computer"
        }
      }
    ],
    "correct": [
      "A"
    ],
    "explanation": {
      "en": "SigninLogs contains Entra ID sign-in telemetry, and ResultType != 0 isolates failures for summarization by user and source IP.",
      "de": "SigninLogs enthält Entra-ID-Anmeldetelemetrie, und ResultType != 0 isoliert Fehler für die Zusammenfassung nach Benutzer und Quell-IP."
    },
    "hint": {
      "en": "Use the sign-in table and summarize by user plus IP.",
      "de": "Verwenden Sie die Anmeldetabelle und fassen Sie nach Benutzer plus IP zusammen."
    },
    "reference": "https://learn.microsoft.com/en-us/azure/sentinel/hunting"
  },
  {
    "id": "sc200-249",
    "type": "single",
    "domain": {
      "en": "Mitigate Threats Using Microsoft Sentinel",
      "de": "Bedrohungen mit Microsoft Sentinel mindern"
    },
    "difficulty": "hard",
    "scenario": {
      "en": "An analyst wants to confirm whether a domain controller is receiving a burst of failed sign-ins.",
      "de": "Ein Analyst möchte bestätigen, ob ein Domänencontroller eine Welle fehlgeschlagener Anmeldungen erhält."
    },
    "question": {
      "en": "Which KQL query best finds Windows failed logons (Event ID 4625) during the last six hours?",
      "de": "Welche KQL-Abfrage findet am besten Windows-Fehlanmeldungen (Ereignis-ID 4625) in den letzten sechs Stunden?"
    },
    "options": [
      {
        "id": "A",
        "text": {
          "en": "SecurityEvent | where TimeGenerated > ago(6h) | where EventID == 4625 | project TimeGenerated, Computer, Account, IPAddress",
          "de": "SecurityEvent | where TimeGenerated > ago(6h) | where EventID == 4625 | project TimeGenerated, Computer, Account, IPAddress"
        }
      },
      {
        "id": "B",
        "text": {
          "en": "SigninLogs | where ResultType != 0 | project UserPrincipalName",
          "de": "SigninLogs | where ResultType != 0 | project UserPrincipalName"
        }
      },
      {
        "id": "C",
        "text": {
          "en": "AzureActivity | where OperationNameValue has '4625'",
          "de": "AzureActivity | where OperationNameValue has '4625'"
        }
      },
      {
        "id": "D",
        "text": {
          "en": "SecurityAlert | where AlertName has '4625'",
          "de": "SecurityAlert | where AlertName has '4625'"
        }
      }
    ],
    "correct": [
      "A"
    ],
    "explanation": {
      "en": "SecurityEvent is the correct table for Windows security events collected into Sentinel, including Event ID 4625.",
      "de": "SecurityEvent ist die richtige Tabelle für Windows-Sicherheitsereignisse, die in Sentinel erfasst werden, einschließlich Ereignis-ID 4625."
    },
    "hint": {
      "en": "Look for the Windows event log table.",
      "de": "Suchen Sie nach der Tabelle für Windows-Ereignisprotokolle."
    },
    "reference": "https://learn.microsoft.com/en-us/azure/sentinel/hunting"
  },
  {
    "id": "sc200-250",
    "type": "single",
    "domain": {
      "en": "Mitigate Threats Using Microsoft Sentinel",
      "de": "Bedrohungen mit Microsoft Sentinel mindern"
    },
    "difficulty": "hard",
    "scenario": {
      "en": "The cloud team suspects a compromised admin account deleted resources in a production subscription.",
      "de": "Das Cloud-Team vermutet, dass ein kompromittiertes Administratorkonto Ressourcen in einem Produktionsabonnement gelöscht hat."
    },
    "question": {
      "en": "Which KQL query best finds Azure resource delete operations by caller during the last day?",
      "de": "Welche KQL-Abfrage findet am besten Löschvorgänge an Azure-Ressourcen nach Aufrufer in den letzten 24 Stunden?"
    },
    "options": [
      {
        "id": "A",
        "text": {
          "en": "AzureActivity | where TimeGenerated > ago(1d) | where OperationNameValue has 'delete' | project TimeGenerated, Caller, OperationNameValue, ResourceGroup, ActivityStatusValue",
          "de": "AzureActivity | where TimeGenerated > ago(1d) | where OperationNameValue has 'delete' | project TimeGenerated, Caller, OperationNameValue, ResourceGroup, ActivityStatusValue"
        }
      },
      {
        "id": "B",
        "text": {
          "en": "Heartbeat | where Computer has 'delete'",
          "de": "Heartbeat | where Computer has 'delete'"
        }
      },
      {
        "id": "C",
        "text": {
          "en": "SecurityEvent | where EventID == 4726",
          "de": "SecurityEvent | where EventID == 4726"
        }
      },
      {
        "id": "D",
        "text": {
          "en": "SigninLogs | where AppDisplayName has 'delete'",
          "de": "SigninLogs | where AppDisplayName has 'delete'"
        }
      }
    ],
    "correct": [
      "A"
    ],
    "explanation": {
      "en": "AzureActivity stores Azure control-plane operations, making it the right source for delete operations on Azure resources.",
      "de": "AzureActivity speichert Azure-Control-Plane-Operationen und ist damit die richtige Quelle für Löschvorgänge an Azure-Ressourcen."
    },
    "hint": {
      "en": "Use the Azure control-plane activity table.",
      "de": "Verwenden Sie die Tabelle für Azure-Control-Plane-Aktivitäten."
    },
    "reference": "https://learn.microsoft.com/en-us/azure/sentinel/hunting"
  },
  {
    "id": "sc200-251",
    "type": "single",
    "domain": {
      "en": "Mitigate Threats Using Microsoft Sentinel",
      "de": "Bedrohungen mit Microsoft Sentinel mindern"
    },
    "difficulty": "hard",
    "scenario": {
      "en": "The SOC wants to know whether a security agent stopped reporting on critical servers.",
      "de": "Das SOC möchte wissen, ob ein Sicherheitsagent auf kritischen Servern nicht mehr meldet."
    },
    "question": {
      "en": "Which KQL query best identifies machines that have not sent a heartbeat in over one hour?",
      "de": "Welche KQL-Abfrage identifiziert am besten Maschinen, die seit mehr als einer Stunde keinen Heartbeat gesendet haben?"
    },
    "options": [
      {
        "id": "A",
        "text": {
          "en": "Heartbeat | summarize LastSeen=max(TimeGenerated) by Computer | where LastSeen < ago(1h)",
          "de": "Heartbeat | summarize LastSeen=max(TimeGenerated) by Computer | where LastSeen < ago(1h)"
        }
      },
      {
        "id": "B",
        "text": {
          "en": "SecurityEvent | summarize LastSeen=max(TimeGenerated) by Computer",
          "de": "SecurityEvent | summarize LastSeen=max(TimeGenerated) by Computer"
        }
      },
      {
        "id": "C",
        "text": {
          "en": "SigninLogs | summarize LastSeen=max(TimeGenerated) by UserPrincipalName",
          "de": "SigninLogs | summarize LastSeen=max(TimeGenerated) by UserPrincipalName"
        }
      },
      {
        "id": "D",
        "text": {
          "en": "AzureActivity | summarize LastSeen=max(TimeGenerated) by Caller",
          "de": "AzureActivity | summarize LastSeen=max(TimeGenerated) by Caller"
        }
      }
    ],
    "correct": [
      "A"
    ],
    "explanation": {
      "en": "Heartbeat is the table designed to show agent/workspace check-ins, and summarizing the latest TimeGenerated by computer reveals stale hosts.",
      "de": "Heartbeat ist die Tabelle, die für Agent-/Workspace-Check-ins gedacht ist, und die Zusammenfassung des letzten TimeGenerated nach Computer zeigt inaktive Hosts."
    },
    "hint": {
      "en": "Use the heartbeat table and compare the latest timestamp.",
      "de": "Verwenden Sie die Heartbeat-Tabelle und vergleichen Sie den neuesten Zeitstempel."
    },
    "reference": "https://learn.microsoft.com/en-us/azure/sentinel/hunting"
  },
  {
    "id": "sc200-252",
    "type": "multiple",
    "domain": {
      "en": "Mitigate Threats Using Microsoft Sentinel",
      "de": "Bedrohungen mit Microsoft Sentinel mindern"
    },
    "difficulty": "medium",
    "scenario": null,
    "question": {
      "en": "What are valid uses of Sentinel watchlists? Select all that apply.",
      "de": "Wofür können Sentinel-Watchlists sinnvoll verwendet werden? Wählen Sie alle zutreffenden Antworten aus."
    },
    "options": [
      {
        "id": "A",
        "text": {
          "en": "Enrich query results with business context",
          "de": "Abfrageergebnisse mit Geschäftskontext anreichern"
        }
      },
      {
        "id": "B",
        "text": {
          "en": "Filter out trusted values from detections",
          "de": "Vertrauenswürdige Werte aus Erkennungen herausfiltern"
        }
      },
      {
        "id": "C",
        "text": {
          "en": "Join external reference data into analytics",
          "de": "Externe Referenzdaten in Analysen einbinden"
        }
      },
      {
        "id": "D",
        "text": {
          "en": "Store all raw firewall logs for long-term retention",
          "de": "Alle Roh-Firewallprotokolle für die Langzeitaufbewahrung speichern"
        }
      }
    ],
    "correct": [
      "A",
      "B",
      "C"
    ],
    "explanation": {
      "en": "Watchlists are reference datasets for enrichment and filtering, not a substitute for raw log storage.",
      "de": "Watchlists sind Referenzdatensätze für Anreicherung und Filterung und kein Ersatz für die Speicherung von Rohprotokollen."
    },
    "hint": {
      "en": "Think reference data, not bulk log retention.",
      "de": "Denken Sie an Referenzdaten und nicht an Massenprotokollspeicherung."
    },
    "reference": "https://learn.microsoft.com/en-us/azure/sentinel/watchlists-queries"
  },
  {
    "id": "sc200-253",
    "type": "single",
    "domain": {
      "en": "Mitigate Threats Using Microsoft Sentinel",
      "de": "Bedrohungen mit Microsoft Sentinel mindern"
    },
    "difficulty": "medium",
    "scenario": {
      "en": "The team wants one detection pattern to work across multiple firewall vendors with minimal query changes.",
      "de": "Das Team möchte, dass ein Erkennungsmuster mit minimalen Abfrageänderungen über mehrere Firewall-Anbieter hinweg funktioniert."
    },
    "question": {
      "en": "Why would a SOC use ASIM in Microsoft Sentinel?",
      "de": "Warum sollte ein SOC ASIM in Microsoft Sentinel verwenden?"
    },
    "options": [
      {
        "id": "A",
        "text": {
          "en": "To normalize different source schemas into common fields",
          "de": "Um unterschiedliche Quellschemata in gemeinsame Felder zu normalisieren"
        }
      },
      {
        "id": "B",
        "text": {
          "en": "To replace all data connectors",
          "de": "Um alle Datenconnectoren zu ersetzen"
        }
      },
      {
        "id": "C",
        "text": {
          "en": "To calculate Azure invoices",
          "de": "Um Azure-Rechnungen zu berechnen"
        }
      },
      {
        "id": "D",
        "text": {
          "en": "To disable entity mapping",
          "de": "Um das Entity Mapping zu deaktivieren"
        }
      }
    ],
    "correct": [
      "A"
    ],
    "explanation": {
      "en": "ASIM provides a normalized schema layer so analytics and hunting can work more consistently across different data sources.",
      "de": "ASIM bietet eine normalisierte Schemaschicht, sodass Analysen und Hunting konsistenter über verschiedene Datenquellen hinweg funktionieren."
    },
    "hint": {
      "en": "Pick the normalization benefit.",
      "de": "Wählen Sie den Vorteil der Normalisierung."
    },
    "reference": "https://learn.microsoft.com/en-us/azure/sentinel/normalization"
  },
  {
    "id": "sc200-254",
    "type": "single",
    "domain": {
      "en": "Mitigate Threats Using Microsoft Sentinel",
      "de": "Bedrohungen mit Microsoft Sentinel mindern"
    },
    "difficulty": "medium",
    "scenario": null,
    "question": {
      "en": "Why is entity mapping important when creating analytics rules in Sentinel?",
      "de": "Warum ist Entity Mapping wichtig, wenn Analyseregeln in Sentinel erstellt werden?"
    },
    "options": [
      {
        "id": "A",
        "text": {
          "en": "It links alerts to entities for investigation and correlation",
          "de": "Es verknüpft Warnungen mit Entitäten für Untersuchung und Korrelation"
        }
      },
      {
        "id": "B",
        "text": {
          "en": "It increases retention automatically",
          "de": "Es erhöht die Aufbewahrung automatisch"
        }
      },
      {
        "id": "C",
        "text": {
          "en": "It disables automation rules",
          "de": "Es deaktiviert Automatisierungsregeln"
        }
      },
      {
        "id": "D",
        "text": {
          "en": "It imports watchlists",
          "de": "Es importiert Watchlists"
        }
      }
    ],
    "correct": [
      "A"
    ],
    "explanation": {
      "en": "Entity mapping lets Sentinel attach accounts, hosts, IPs, and other entities to alerts so analysts can investigate relationships more effectively.",
      "de": "Entity Mapping ermöglicht es Sentinel, Konten, Hosts, IPs und andere Entitäten an Warnungen anzuhängen, damit Analysten Beziehungen effektiver untersuchen können."
    },
    "hint": {
      "en": "Think investigation context and relationship building.",
      "de": "Denken Sie an Untersuchungskontext und Beziehungsaufbau."
    },
    "reference": "https://learn.microsoft.com/en-us/azure/sentinel/create-analytics-rules"
  },
  {
    "id": "sc200-255",
    "type": "multiple",
    "domain": {
      "en": "Mitigate Threats Using Microsoft Sentinel",
      "de": "Bedrohungen mit Microsoft Sentinel mindern"
    },
    "difficulty": "medium",
    "scenario": null,
    "question": {
      "en": "Which items can be deployed from Sentinel Content hub solutions? Select all that apply.",
      "de": "Welche Elemente können aus Sentinel-Content-Hub-Lösungen bereitgestellt werden? Wählen Sie alle zutreffenden Antworten aus."
    },
    "options": [
      {
        "id": "A",
        "text": {
          "en": "Data connectors",
          "de": "Datenconnectoren"
        }
      },
      {
        "id": "B",
        "text": {
          "en": "Analytics rules",
          "de": "Analyseregeln"
        }
      },
      {
        "id": "C",
        "text": {
          "en": "Workbooks",
          "de": "Workbooks"
        }
      },
      {
        "id": "D",
        "text": {
          "en": "Physical smart cards",
          "de": "Physische Smartcards"
        }
      }
    ],
    "correct": [
      "A",
      "B",
      "C"
    ],
    "explanation": {
      "en": "Content hub solutions can include deployment artifacts such as connectors, analytics, and workbooks. Physical hardware is outside its scope.",
      "de": "Content-Hub-Lösungen können Bereitstellungsartefakte wie Connectoren, Analysen und Workbooks enthalten. Physische Hardware gehört nicht dazu."
    },
    "hint": {
      "en": "Select packaged Sentinel content, not hardware.",
      "de": "Wählen Sie paketierte Sentinel-Inhalte und keine Hardware."
    },
    "reference": "https://learn.microsoft.com/en-us/azure/sentinel/sentinel-solutions-catalog"
  },
  {
    "id": "sc200-256",
    "type": "single",
    "domain": {
      "en": "Mitigate Threats Using Microsoft Sentinel",
      "de": "Bedrohungen mit Microsoft Sentinel mindern"
    },
    "difficulty": "hard",
    "scenario": {
      "en": "The SOC manager wants to know which integrated products are generating the most alert volume.",
      "de": "Der SOC-Manager möchte wissen, welche integrierten Produkte das höchste Warnvolumen erzeugen."
    },
    "question": {
      "en": "Which KQL query best counts alerts by provider during the last day?",
      "de": "Welche KQL-Abfrage zählt Warnungen nach Anbieter in den letzten 24 Stunden am besten?"
    },
    "options": [
      {
        "id": "A",
        "text": {
          "en": "SecurityAlert | where TimeGenerated > ago(1d) | summarize AlertCount=count() by ProviderName | order by AlertCount desc",
          "de": "SecurityAlert | where TimeGenerated > ago(1d) | summarize AlertCount=count() by ProviderName | order by AlertCount desc"
        }
      },
      {
        "id": "B",
        "text": {
          "en": "Heartbeat | summarize count() by Computer",
          "de": "Heartbeat | summarize count() by Computer"
        }
      },
      {
        "id": "C",
        "text": {
          "en": "SigninLogs | summarize count() by AppDisplayName",
          "de": "SigninLogs | summarize count() by AppDisplayName"
        }
      },
      {
        "id": "D",
        "text": {
          "en": "AzureActivity | summarize count() by Caller",
          "de": "AzureActivity | summarize count() by Caller"
        }
      }
    ],
    "correct": [
      "A"
    ],
    "explanation": {
      "en": "SecurityAlert is the correct table for alert records, and ProviderName groups them by originating source or provider.",
      "de": "SecurityAlert ist die richtige Tabelle für Warnungsdatensätze, und ProviderName gruppiert sie nach Herkunftsquelle oder Anbieter."
    },
    "hint": {
      "en": "Use the alert table, then summarize by provider.",
      "de": "Verwenden Sie die Alert-Tabelle und fassen Sie anschließend nach Anbieter zusammen."
    },
    "reference": "https://learn.microsoft.com/en-us/azure/sentinel/hunting"
  },
  {
    "id": "sc200-257",
    "type": "single",
    "domain": {
      "en": "Mitigate Threats Using Microsoft Sentinel",
      "de": "Bedrohungen mit Microsoft Sentinel mindern"
    },
    "difficulty": "medium",
    "scenario": null,
    "question": {
      "en": "When configuring a scheduled analytics rule, why is the query lookback period often set longer than the run frequency?",
      "de": "Warum wird bei einer geplanten Analyseregel der Abfrage-Rückblickszeitraum häufig länger als die Ausführungsfrequenz eingestellt?"
    },
    "options": [
      {
        "id": "A",
        "text": {
          "en": "To reduce the chance of missing late-arriving events",
          "de": "Um die Wahrscheinlichkeit zu verringern, verspätet eintreffende Ereignisse zu verpassen"
        }
      },
      {
        "id": "B",
        "text": {
          "en": "To disable entity mapping",
          "de": "Um Entity Mapping zu deaktivieren"
        }
      },
      {
        "id": "C",
        "text": {
          "en": "To force all alerts to low severity",
          "de": "Um alle Warnungen auf niedrige Schwere zu setzen"
        }
      },
      {
        "id": "D",
        "text": {
          "en": "To replace playbooks",
          "de": "Um Playbooks zu ersetzen"
        }
      }
    ],
    "correct": [
      "A"
    ],
    "explanation": {
      "en": "A slightly longer lookback window helps capture late-arriving data and avoid gaps between scheduled executions.",
      "de": "Ein etwas längeres Rückblicksfenster hilft, verspätet eintreffende Daten zu erfassen und Lücken zwischen geplanten Ausführungen zu vermeiden."
    },
    "hint": {
      "en": "Think about data delay and coverage, not alert severity.",
      "de": "Denken Sie an Datenverzögerung und Abdeckung und nicht an Warnschwere."
    },
    "reference": "https://learn.microsoft.com/en-us/azure/sentinel/create-analytics-rules"
  },
  {
    "id": "sc200-258",
    "type": "single",
    "domain": {
      "en": "Mitigate Threats Using Microsoft Sentinel",
      "de": "Bedrohungen mit Microsoft Sentinel mindern"
    },
    "difficulty": "medium",
    "scenario": {
      "en": "A noisy brute-force rule fires many times against the same account and host within minutes.",
      "de": "Eine laute Brute-Force-Regel löst innerhalb von Minuten oft gegen dasselbe Konto und denselben Host aus."
    },
    "question": {
      "en": "Which analytics-rule setting helps reduce duplicate incidents when repeated alerts come from the same entities in a short period?",
      "de": "Welche Einstellung einer Analyseregel hilft, doppelte Vorfälle zu reduzieren, wenn wiederholte Warnungen von denselben Entitäten in kurzer Zeit kommen?"
    },
    "options": [
      {
        "id": "A",
        "text": {
          "en": "Alert grouping / incident grouping",
          "de": "Warnungsgruppierung / Vorfallsgruppierung"
        }
      },
      {
        "id": "B",
        "text": {
          "en": "Retention lock",
          "de": "Aufbewahrungssperre"
        }
      },
      {
        "id": "C",
        "text": {
          "en": "Workspace purge",
          "de": "Workspace-Bereinigung"
        }
      },
      {
        "id": "D",
        "text": {
          "en": "Query formatting",
          "de": "Abfrageformatierung"
        }
      }
    ],
    "correct": [
      "A"
    ],
    "explanation": {
      "en": "Grouping related alerts into fewer incidents reduces analyst noise when the same attack pattern triggers repeatedly.",
      "de": "Das Gruppieren zusammengehöriger Warnungen zu weniger Vorfällen reduziert Analystenrauschen, wenn dasselbe Angriffsmuster wiederholt auslöst."
    },
    "hint": {
      "en": "Choose the feature that groups related detections together.",
      "de": "Wählen Sie die Funktion, die zusammengehörige Erkennungen bündelt."
    },
    "reference": "https://learn.microsoft.com/en-us/azure/sentinel/create-analytics-rules"
  },
  {
    "id": "sc200-259",
    "type": "single",
    "domain": {
      "en": "Mitigate Threats Using Microsoft Sentinel",
      "de": "Bedrohungen mit Microsoft Sentinel mindern"
    },
    "difficulty": "medium",
    "scenario": null,
    "question": {
      "en": "Why does the order of automation rules matter in Microsoft Sentinel?",
      "de": "Warum ist die Reihenfolge von Automatisierungsregeln in Microsoft Sentinel wichtig?"
    },
    "options": [
      {
        "id": "A",
        "text": {
          "en": "Rules run in sequence and can stop further processing",
          "de": "Regeln werden der Reihe nach ausgeführt und können weitere Verarbeitung stoppen"
        }
      },
      {
        "id": "B",
        "text": {
          "en": "Rules change data retention billing",
          "de": "Regeln ändern die Abrechnung der Datenaufbewahrung"
        }
      },
      {
        "id": "C",
        "text": {
          "en": "Rules replace connectors",
          "de": "Regeln ersetzen Connectoren"
        }
      },
      {
        "id": "D",
        "text": {
          "en": "Rules determine query syntax",
          "de": "Regeln bestimmen die Abfragesyntax"
        }
      }
    ],
    "correct": [
      "A"
    ],
    "explanation": {
      "en": "Automation rules are evaluated in order, so higher-priority rules can set attributes or stop later rules from running.",
      "de": "Automatisierungsregeln werden der Reihe nach ausgewertet, sodass Regeln mit höherer Priorität Attribute setzen oder spätere Regeln am Ausführen hindern können."
    },
    "hint": {
      "en": "Think processing order and control flow.",
      "de": "Denken Sie an Verarbeitungsreihenfolge und Kontrollfluss."
    },
    "reference": "https://learn.microsoft.com/en-us/azure/sentinel/automate-incident-handling-with-automation-rules"
  },
  {
    "id": "sc200-260",
    "type": "single",
    "domain": {
      "en": "Mitigate Threats Using Microsoft Sentinel",
      "de": "Bedrohungen mit Microsoft Sentinel mindern"
    },
    "difficulty": "medium",
    "scenario": {
      "en": "The SOC wants consistent collaboration without relying on analysts to click manual actions.",
      "de": "Das SOC möchte konsistente Zusammenarbeit, ohne dass Analysten manuelle Aktionen auslösen müssen."
    },
    "question": {
      "en": "You want a Teams notification to run automatically every time a high-severity incident is created. What is the best design?",
      "de": "Sie möchten, dass jedes Mal automatisch eine Teams-Benachrichtigung ausgelöst wird, wenn ein Vorfall mit hoher Schwere erstellt wird. Was ist das beste Design?"
    },
    "options": [
      {
        "id": "A",
        "text": {
          "en": "Use an automation rule to trigger a playbook",
          "de": "Eine Automatisierungsregel verwenden, um ein Playbook auszulösen"
        }
      },
      {
        "id": "B",
        "text": {
          "en": "Use a bookmark with a note",
          "de": "Ein Lesezeichen mit Notiz verwenden"
        }
      },
      {
        "id": "C",
        "text": {
          "en": "Use a workbook tile",
          "de": "Eine Workbook-Kachel verwenden"
        }
      },
      {
        "id": "D",
        "text": {
          "en": "Use a watchlist upload",
          "de": "Einen Watchlist-Upload verwenden"
        }
      }
    ],
    "correct": [
      "A"
    ],
    "explanation": {
      "en": "Automation rules decide when to react to incidents, and playbooks perform the Teams notification workflow.",
      "de": "Automatisierungsregeln entscheiden, wann auf Vorfälle reagiert wird, und Playbooks führen den Teams-Benachrichtigungsworkflow aus."
    },
    "hint": {
      "en": "Combine incident orchestration with a Logic App workflow.",
      "de": "Kombinieren Sie Vorfallsorchestrierung mit einem Logic-App-Workflow."
    },
    "reference": "https://learn.microsoft.com/en-us/azure/sentinel/automate-incident-handling-with-automation-rules"
  },
  {
    "id": "sc200-261",
    "type": "single",
    "domain": {
      "en": "Mitigate Threats Using Microsoft Sentinel",
      "de": "Bedrohungen mit Microsoft Sentinel mindern"
    },
    "difficulty": "hard",
    "scenario": {
      "en": "A detection should focus on truly unknown source IPs and ignore branch office egress addresses.",
      "de": "Eine Erkennung soll sich auf wirklich unbekannte Quell-IP-Adressen konzentrieren und die Egress-Adressen der Niederlassungen ignorieren."
    },
    "question": {
      "en": "Which KQL query best excludes trusted IP addresses stored in a watchlist named trustedips from sign-in analysis?",
      "de": "Welche KQL-Abfrage schließt vertrauenswürdige IP-Adressen aus einer Watchlist namens trustedips am besten von der Anmeldeanalyse aus?"
    },
    "options": [
      {
        "id": "A",
        "text": {
          "en": "let trusted = _GetWatchlist('trustedips') | project SearchKey; SigninLogs | where IPAddress !in (trusted) | summarize Attempts=count() by IPAddress",
          "de": "let trusted = _GetWatchlist('trustedips') | project SearchKey; SigninLogs | where IPAddress !in (trusted) | summarize Attempts=count() by IPAddress"
        }
      },
      {
        "id": "B",
        "text": {
          "en": "SigninLogs | where IPAddress !contains 'trustedips'",
          "de": "SigninLogs | where IPAddress !contains 'trustedips'"
        }
      },
      {
        "id": "C",
        "text": {
          "en": "trustedips | join SigninLogs on IPAddress",
          "de": "trustedips | join SigninLogs on IPAddress"
        }
      },
      {
        "id": "D",
        "text": {
          "en": "SecurityEvent | where Computer !in ('trustedips')",
          "de": "SecurityEvent | where Computer !in ('trustedips')"
        }
      }
    ],
    "correct": [
      "A"
    ],
    "explanation": {
      "en": "Using _GetWatchlist to project SearchKey and filtering SigninLogs with !in is the correct Sentinel pattern for excluding trusted reference values.",
      "de": "Die Verwendung von _GetWatchlist zur Projektion von SearchKey und das Filtern von SigninLogs mit !in ist das korrekte Sentinel-Muster, um vertrauenswürdige Referenzwerte auszuschließen."
    },
    "hint": {
      "en": "Load the watchlist first, then filter the sign-in table.",
      "de": "Laden Sie zuerst die Watchlist und filtern Sie dann die Anmeldetabelle."
    },
    "reference": "https://learn.microsoft.com/en-us/azure/sentinel/watchlists-queries"
  },
  {
    "id": "sc200-262",
    "type": "multiple",
    "domain": {
      "en": "Mitigate Threats Using Microsoft Sentinel",
      "de": "Bedrohungen mit Microsoft Sentinel mindern"
    },
    "difficulty": "medium",
    "scenario": null,
    "question": {
      "en": "Which configuration areas are part of a scheduled analytics rule in Sentinel? Select all that apply.",
      "de": "Welche Konfigurationsbereiche gehören zu einer geplanten Analyseregel in Sentinel? Wählen Sie alle zutreffenden Antworten aus."
    },
    "options": [
      {
        "id": "A",
        "text": {
          "en": "Query and scheduling settings",
          "de": "Abfrage- und Zeitplaneinstellungen"
        }
      },
      {
        "id": "B",
        "text": {
          "en": "Entity mapping",
          "de": "Entity Mapping"
        }
      },
      {
        "id": "C",
        "text": {
          "en": "Incident settings",
          "de": "Vorfallseinstellungen"
        }
      },
      {
        "id": "D",
        "text": {
          "en": "Physical rack layout",
          "de": "Physisches Rack-Layout"
        }
      }
    ],
    "correct": [
      "A",
      "B",
      "C"
    ],
    "explanation": {
      "en": "Scheduled analytics rules include detection logic, execution schedule, entity mapping, and incident configuration. Physical layouts are unrelated.",
      "de": "Geplante Analyseregeln umfassen Erkennungslogik, Ausführungszeitplan, Entity Mapping und Vorfallskonfiguration. Physische Layouts sind nicht relevant."
    },
    "hint": {
      "en": "Pick rule configuration, not datacenter design.",
      "de": "Wählen Sie Regelkonfiguration und nicht Rechenzentrumsdesign."
    },
    "reference": "https://learn.microsoft.com/en-us/azure/sentinel/create-analytics-rules"
  },
  {
    "id": "sc200-263",
    "type": "single",
    "domain": {
      "en": "Mitigate Threats Using Microsoft Sentinel",
      "de": "Bedrohungen mit Microsoft Sentinel mindern"
    },
    "difficulty": "hard",
    "scenario": {
      "en": "The SOC lead wants a chartable hourly view of successful versus failed sign-ins.",
      "de": "Die SOC-Leitung möchte eine diagrammfähige stündliche Ansicht erfolgreicher gegenüber fehlgeschlagenen Anmeldungen."
    },
    "question": {
      "en": "Which KQL query best trends sign-ins by result over time?",
      "de": "Welche KQL-Abfrage zeigt den Trend von Anmeldungen nach Ergebnis im Zeitverlauf am besten?"
    },
    "options": [
      {
        "id": "A",
        "text": {
          "en": "SigninLogs | summarize Count=count() by ResultType, bin(TimeGenerated, 1h) | order by TimeGenerated asc",
          "de": "SigninLogs | summarize Count=count() by ResultType, bin(TimeGenerated, 1h) | order by TimeGenerated asc"
        }
      },
      {
        "id": "B",
        "text": {
          "en": "SigninLogs | project TimeGenerated, ResultType | limit 10",
          "de": "SigninLogs | project TimeGenerated, ResultType | limit 10"
        }
      },
      {
        "id": "C",
        "text": {
          "en": "SecurityEvent | where EventID == 4624",
          "de": "SecurityEvent | where EventID == 4624"
        }
      },
      {
        "id": "D",
        "text": {
          "en": "AzureActivity | summarize count() by OperationNameValue",
          "de": "AzureActivity | summarize count() by OperationNameValue"
        }
      }
    ],
    "correct": [
      "A"
    ],
    "explanation": {
      "en": "Trending over time requires bin(TimeGenerated, 1h) and summarize, which option A provides directly.",
      "de": "Eine Trendanalyse über die Zeit erfordert bin(TimeGenerated, 1h) und summarize, was Option A direkt liefert."
    },
    "hint": {
      "en": "Look for summarize plus time binning.",
      "de": "Achten Sie auf summarize plus Zeit-Binning."
    },
    "reference": "https://learn.microsoft.com/en-us/azure/sentinel/hunting"
  },
  {
    "id": "sc200-264",
    "type": "single",
    "domain": {
      "en": "Mitigate Threats Using Microsoft Sentinel",
      "de": "Bedrohungen mit Microsoft Sentinel mindern"
    },
    "difficulty": "easy",
    "scenario": null,
    "question": {
      "en": "Which Sentinel feature is best for creating dashboards and visual summaries from log queries?",
      "de": "Welche Sentinel-Funktion eignet sich am besten, um Dashboards und visuelle Zusammenfassungen aus Protokollabfragen zu erstellen?"
    },
    "options": [
      {
        "id": "A",
        "text": {
          "en": "Workbook",
          "de": "Workbook"
        }
      },
      {
        "id": "B",
        "text": {
          "en": "Automation rule",
          "de": "Automatisierungsregel"
        }
      },
      {
        "id": "C",
        "text": {
          "en": "Bookmark",
          "de": "Lesezeichen"
        }
      },
      {
        "id": "D",
        "text": {
          "en": "Fusion",
          "de": "Fusion"
        }
      }
    ],
    "correct": [
      "A"
    ],
    "explanation": {
      "en": "Workbooks are the Sentinel visualization layer for dashboards, charts, and interactive operational views.",
      "de": "Workbooks sind die Visualisierungsschicht von Sentinel für Dashboards, Diagramme und interaktive Betriebsansichten."
    },
    "hint": {
      "en": "Choose the visualization feature.",
      "de": "Wählen Sie die Visualisierungsfunktion."
    },
    "reference": "https://learn.microsoft.com/en-us/azure/sentinel/sentinel-solutions-catalog"
  },
  {
    "id": "sc200-265",
    "type": "single",
    "domain": {
      "en": "Mitigate Threats Using Microsoft Sentinel",
      "de": "Bedrohungen mit Microsoft Sentinel mindern"
    },
    "difficulty": "medium",
    "scenario": {
      "en": "A vulnerability scanner triggered multiple brute-force detections during a scheduled approved test.",
      "de": "Ein Schwachstellenscanner löste während eines geplanten genehmigten Tests mehrere Brute-Force-Erkennungen aus."
    },
    "question": {
      "en": "A closed incident was investigated and confirmed harmless. Which closure classification is most appropriate?",
      "de": "Ein geschlossener Vorfall wurde untersucht und als harmlos bestätigt. Welche Abschlussklassifizierung ist am geeignetsten?"
    },
    "options": [
      {
        "id": "A",
        "text": {
          "en": "Benign positive",
          "de": "Gutartige Positivmeldung"
        }
      },
      {
        "id": "B",
        "text": {
          "en": "Duplicate data connector",
          "de": "Doppelter Datenconnector"
        }
      },
      {
        "id": "C",
        "text": {
          "en": "Secure score failure",
          "de": "Secure-Score-Fehler"
        }
      },
      {
        "id": "D",
        "text": {
          "en": "Billing anomaly",
          "de": "Abrechnungsanomalie"
        }
      }
    ],
    "correct": [
      "A"
    ],
    "explanation": {
      "en": "Benign positive is used when an alert was triggered correctly by logic but the underlying activity is determined to be harmless.",
      "de": "Gutartige Positivmeldung wird verwendet, wenn eine Warnung korrekt durch die Logik ausgelöst wurde, die zugrunde liegende Aktivität jedoch als harmlos eingestuft wird."
    },
    "hint": {
      "en": "The detection was understandable, but the activity was harmless.",
      "de": "Die Erkennung war nachvollziehbar, aber die Aktivität war harmlos."
    },
    "reference": "https://learn.microsoft.com/en-us/azure/sentinel/investigate-cases"
  },
  {
    "id": "sc200-266",
    "type": "single",
    "domain": {
      "en": "Mitigate Threats Using Microsoft Sentinel",
      "de": "Bedrohungen mit Microsoft Sentinel mindern"
    },
    "difficulty": "hard",
    "scenario": {
      "en": "The SOC is reviewing possible exfiltration from SharePoint Online and OneDrive.",
      "de": "Das SOC überprüft eine mögliche Exfiltration aus SharePoint Online und OneDrive."
    },
    "question": {
      "en": "Which KQL query best summarizes file download activity by user from Office 365 audit data during the last day?",
      "de": "Welche KQL-Abfrage fasst Dateidownload-Aktivitäten pro Benutzer aus Office-365-Überwachungsdaten in den letzten 24 Stunden am besten zusammen?"
    },
    "options": [
      {
        "id": "A",
        "text": {
          "en": "OfficeActivity | where TimeGenerated > ago(1d) | where Operation in ('FileDownloaded','FileSyncDownloadedFull') | summarize Downloads=count() by UserId | order by Downloads desc",
          "de": "OfficeActivity | where TimeGenerated > ago(1d) | where Operation in ('FileDownloaded','FileSyncDownloadedFull') | summarize Downloads=count() by UserId | order by Downloads desc"
        }
      },
      {
        "id": "B",
        "text": {
          "en": "SigninLogs | summarize Downloads=count() by UserPrincipalName",
          "de": "SigninLogs | summarize Downloads=count() by UserPrincipalName"
        }
      },
      {
        "id": "C",
        "text": {
          "en": "AzureActivity | where OperationNameValue has 'Download' | summarize count() by Caller",
          "de": "AzureActivity | where OperationNameValue has 'Download' | summarize count() by Caller"
        }
      },
      {
        "id": "D",
        "text": {
          "en": "SecurityEvent | where EventID == 4663 | summarize count() by Account",
          "de": "SecurityEvent | where EventID == 4663 | summarize count() by Account"
        }
      }
    ],
    "correct": [
      "A"
    ],
    "explanation": {
      "en": "OfficeActivity contains Microsoft 365 audit events, including common file download operations, so it is the best source here.",
      "de": "OfficeActivity enthält Microsoft-365-Überwachungsereignisse, einschließlich gängiger Dateidownload-Operationen, und ist daher hier die beste Quelle."
    },
    "hint": {
      "en": "Use the Office audit table for Microsoft 365 file activity.",
      "de": "Verwenden Sie die Office-Audit-Tabelle für Microsoft-365-Dateiaktivität."
    },
    "reference": "https://learn.microsoft.com/en-us/azure/sentinel/hunting"
  },
  {
    "id": "sc200-267",
    "type": "single",
    "domain": {
      "en": "Mitigate Threats Using Microsoft Sentinel",
      "de": "Bedrohungen mit Microsoft Sentinel mindern"
    },
    "difficulty": "hard",
    "scenario": null,
    "question": {
      "en": "Which KQL query best counts the number of distinct source IPs per user in SigninLogs?",
      "de": "Welche KQL-Abfrage zählt am besten die Anzahl unterschiedlicher Quell-IP-Adressen pro Benutzer in SigninLogs?"
    },
    "options": [
      {
        "id": "A",
        "text": {
          "en": "SigninLogs | summarize DistinctIPs=dcount(IPAddress) by UserPrincipalName | order by DistinctIPs desc",
          "de": "SigninLogs | summarize DistinctIPs=dcount(IPAddress) by UserPrincipalName | order by DistinctIPs desc"
        }
      },
      {
        "id": "B",
        "text": {
          "en": "SigninLogs | project UserPrincipalName, IPAddress",
          "de": "SigninLogs | project UserPrincipalName, IPAddress"
        }
      },
      {
        "id": "C",
        "text": {
          "en": "SigninLogs | summarize count() by UserPrincipalName, IPAddress",
          "de": "SigninLogs | summarize count() by UserPrincipalName, IPAddress"
        }
      },
      {
        "id": "D",
        "text": {
          "en": "SecurityAlert | summarize dcount(IPAddress) by AlertName",
          "de": "SecurityAlert | summarize dcount(IPAddress) by AlertName"
        }
      }
    ],
    "correct": [
      "A"
    ],
    "explanation": {
      "en": "dcount(IPAddress) returns an approximate distinct count, which is ideal for summarizing unique source IPs per user.",
      "de": "dcount(IPAddress) liefert eine approximierte Anzahl unterschiedlicher Werte und ist ideal, um eindeutige Quell-IP-Adressen pro Benutzer zusammenzufassen."
    },
    "hint": {
      "en": "Look for the distinct-count aggregation function.",
      "de": "Suchen Sie nach der Aggregationsfunktion für unterschiedliche Werte."
    },
    "reference": "https://learn.microsoft.com/en-us/azure/sentinel/hunting"
  },
  {
    "id": "sc200-268",
    "type": "single",
    "domain": {
      "en": "Mitigate Threats Using Microsoft Sentinel",
      "de": "Bedrohungen mit Microsoft Sentinel mindern"
    },
    "difficulty": "medium",
    "scenario": {
      "en": "The environment uses two firewall products in different regions but wants consistent detections.",
      "de": "Die Umgebung verwendet in verschiedenen Regionen zwei Firewall-Produkte, möchte aber konsistente Erkennungen."
    },
    "question": {
      "en": "When a SOC wants the same detection idea to run across multiple firewall vendors, what is the best Sentinel approach?",
      "de": "Wenn ein SOC möchte, dass dieselbe Erkennungsidee über mehrere Firewall-Anbieter hinweg funktioniert, was ist der beste Sentinel-Ansatz?"
    },
    "options": [
      {
        "id": "A",
        "text": {
          "en": "Use ASIM parsers and normalized schemas",
          "de": "ASIM-Parser und normalisierte Schemata verwenden"
        }
      },
      {
        "id": "B",
        "text": {
          "en": "Create one separate workspace per firewall",
          "de": "Einen separaten Workspace pro Firewall erstellen"
        }
      },
      {
        "id": "C",
        "text": {
          "en": "Disable entity mapping",
          "de": "Entity Mapping deaktivieren"
        }
      },
      {
        "id": "D",
        "text": {
          "en": "Move data to a watchlist",
          "de": "Daten in eine Watchlist verschieben"
        }
      }
    ],
    "correct": [
      "A"
    ],
    "explanation": {
      "en": "ASIM reduces schema differences between sources so one analytic can be reused with less vendor-specific query logic.",
      "de": "ASIM reduziert Schemaunterschiede zwischen Quellen, sodass eine Analyse mit weniger anbieterspezifischer Abfragelogik wiederverwendet werden kann."
    },
    "hint": {
      "en": "Normalize first, then reuse analytics.",
      "de": "Zuerst normalisieren, dann Analysen wiederverwenden."
    },
    "reference": "https://learn.microsoft.com/en-us/azure/sentinel/normalization"
  },
  {
    "id": "sc200-269",
    "type": "single",
    "domain": {
      "en": "Mitigate Threats Using Microsoft Sentinel",
      "de": "Bedrohungen mit Microsoft Sentinel mindern"
    },
    "difficulty": "medium",
    "scenario": {
      "en": "The scanner repeatedly triggers detections overnight and wastes analyst time.",
      "de": "Der Scanner löst nachts wiederholt Erkennungen aus und verschwendet Analystenzeit."
    },
    "question": {
      "en": "Which Sentinel feature is best for automatically closing incidents triggered by a known vulnerability scanner IP range?",
      "de": "Welche Sentinel-Funktion eignet sich am besten, um Vorfälle automatisch zu schließen, die von einem bekannten IP-Bereich eines Schwachstellenscanners ausgelöst werden?"
    },
    "options": [
      {
        "id": "A",
        "text": {
          "en": "Automation rule",
          "de": "Automatisierungsregel"
        }
      },
      {
        "id": "B",
        "text": {
          "en": "Workbook",
          "de": "Workbook"
        }
      },
      {
        "id": "C",
        "text": {
          "en": "Entity page",
          "de": "Entitätsseite"
        }
      },
      {
        "id": "D",
        "text": {
          "en": "Threat intelligence taxii feed",
          "de": "Threat-Intelligence-TAXII-Feed"
        }
      }
    ],
    "correct": [
      "A"
    ],
    "explanation": {
      "en": "Automation rules can apply filters and incident actions automatically, including closure for well-understood benign sources.",
      "de": "Automatisierungsregeln können Filter und Vorfallsaktionen automatisch anwenden, einschließlich des Schließens für gut verstandene harmlose Quellen."
    },
    "hint": {
      "en": "Use incident orchestration for known benign automation.",
      "de": "Verwenden Sie Vorfallsorchestrierung für bekannte harmlose Automatisierung."
    },
    "reference": "https://learn.microsoft.com/en-us/azure/sentinel/automate-incident-handling-with-automation-rules"
  },
  {
    "id": "sc200-270",
    "type": "single",
    "domain": {
      "en": "Mitigate Threats Using Microsoft Sentinel",
      "de": "Bedrohungen mit Microsoft Sentinel mindern"
    },
    "difficulty": "hard",
    "scenario": {
      "en": "The CISO wants a dedicated dashboard and detections for executives and privileged finance users.",
      "de": "Der CISO möchte ein eigenes Dashboard und eigene Erkennungen für Führungskräfte und privilegierte Finanzbenutzer."
    },
    "question": {
      "en": "Which KQL query best filters SigninLogs to only users listed in a watchlist named vipusers?",
      "de": "Welche KQL-Abfrage filtert SigninLogs am besten nur auf Benutzer, die in einer Watchlist namens vipusers aufgeführt sind?"
    },
    "options": [
      {
        "id": "A",
        "text": {
          "en": "let vip = _GetWatchlist('vipusers') | project SearchKey; SigninLogs | where UserPrincipalName in (vip)",
          "de": "let vip = _GetWatchlist('vipusers') | project SearchKey; SigninLogs | where UserPrincipalName in (vip)"
        }
      },
      {
        "id": "B",
        "text": {
          "en": "SigninLogs | where UserPrincipalName contains 'vipusers'",
          "de": "SigninLogs | where UserPrincipalName contains 'vipusers'"
        }
      },
      {
        "id": "C",
        "text": {
          "en": "vipusers | where UserPrincipalName == SearchKey",
          "de": "vipusers | where UserPrincipalName == SearchKey"
        }
      },
      {
        "id": "D",
        "text": {
          "en": "SecurityEvent | where Account in (_GetWatchlist('vipusers'))",
          "de": "SecurityEvent | where Account in (_GetWatchlist('vipusers'))"
        }
      }
    ],
    "correct": [
      "A"
    ],
    "explanation": {
      "en": "Projecting SearchKey from the watchlist and using it in an in() filter is a standard pattern for narrowing Sentinel queries to tracked identities.",
      "de": "Das Projizieren von SearchKey aus der Watchlist und die Verwendung in einem in()-Filter ist ein Standardmuster, um Sentinel-Abfragen auf verfolgte Identitäten einzugrenzen."
    },
    "hint": {
      "en": "Load the watchlist keys, then filter the sign-in table.",
      "de": "Laden Sie die Watchlist-Schlüssel und filtern Sie dann die Anmeldetabelle."
    },
    "reference": "https://learn.microsoft.com/en-us/azure/sentinel/watchlists-queries"
  },
  {
    "id": "sc200-271",
    "type": "single",
    "domain": {
      "en": "Mitigate Threats Using Microsoft Sentinel",
      "de": "Bedrohungen mit Microsoft Sentinel mindern"
    },
    "difficulty": "medium",
    "scenario": {
      "en": "An analyst has found suspicious log entries but wants to finish enrichment before opening a formal incident.",
      "de": "Ein Analyst hat verdächtige Protokolleinträge gefunden, möchte aber vor der Eröffnung eines formalen Vorfalls noch weitere Anreicherung vornehmen."
    },
    "question": {
      "en": "Which investigation artifact is best for preserving an interesting query result with context before escalating an incident?",
      "de": "Welches Untersuchungsartefakt eignet sich am besten, um ein interessantes Abfrageergebnis mit Kontext zu bewahren, bevor ein Vorfall eskaliert wird?"
    },
    "options": [
      {
        "id": "A",
        "text": {
          "en": "Bookmark",
          "de": "Lesezeichen"
        }
      },
      {
        "id": "B",
        "text": {
          "en": "Data connector",
          "de": "Datenconnector"
        }
      },
      {
        "id": "C",
        "text": {
          "en": "Secure score control",
          "de": "Secure-Score-Kontrolle"
        }
      },
      {
        "id": "D",
        "text": {
          "en": "Workbook parameter",
          "de": "Workbook-Parameter"
        }
      }
    ],
    "correct": [
      "A"
    ],
    "explanation": {
      "en": "Bookmarks are designed to save hunt findings and preserve useful evidence for later investigation steps.",
      "de": "Lesezeichen sind dafür gedacht, Hunting-Ergebnisse zu speichern und nützliche Beweise für spätere Untersuchungsschritte zu bewahren."
    },
    "hint": {
      "en": "Pick the saved investigation note object.",
      "de": "Wählen Sie das Objekt für gespeicherte Untersuchungshinweise."
    },
    "reference": "https://learn.microsoft.com/en-us/azure/sentinel/hunting"
  },
  {
    "id": "sc200-272",
    "type": "multiple",
    "domain": {
      "en": "Mitigate Threats Using Microsoft Sentinel",
      "de": "Bedrohungen mit Microsoft Sentinel mindern"
    },
    "difficulty": "medium",
    "scenario": null,
    "question": {
      "en": "What are valid uses of bookmarks in Microsoft Sentinel? Select all that apply.",
      "de": "Wofür können Lesezeichen in Microsoft Sentinel sinnvoll verwendet werden? Wählen Sie alle zutreffenden Antworten aus."
    },
    "options": [
      {
        "id": "A",
        "text": {
          "en": "Save hunt findings for later review",
          "de": "Hunting-Ergebnisse zur späteren Prüfung speichern"
        }
      },
      {
        "id": "B",
        "text": {
          "en": "Add investigation context to query results",
          "de": "Untersuchungskontext zu Abfrageergebnissen hinzufügen"
        }
      },
      {
        "id": "C",
        "text": {
          "en": "Reference useful results during an incident",
          "de": "Nützliche Ergebnisse während eines Vorfalls referenzieren"
        }
      },
      {
        "id": "D",
        "text": {
          "en": "Ingest raw logs from a SaaS platform",
          "de": "Rohprotokolle aus einer SaaS-Plattform aufnehmen"
        }
      }
    ],
    "correct": [
      "A",
      "B",
      "C"
    ],
    "explanation": {
      "en": "Bookmarks are investigation aids for preserving, annotating, and reusing query results, not connectors for ingesting data.",
      "de": "Lesezeichen sind Untersuchungshilfen zum Bewahren, Kommentieren und Wiederverwenden von Abfrageergebnissen und keine Connectoren zur Datenaufnahme."
    },
    "hint": {
      "en": "Think saved findings, not ingestion.",
      "de": "Denken Sie an gespeicherte Erkenntnisse und nicht an Datenaufnahme."
    },
    "reference": "https://learn.microsoft.com/en-us/azure/sentinel/hunting"
  },
  {
    "id": "sc200-273",
    "type": "single",
    "domain": {
      "en": "Mitigate Threats Using Microsoft Sentinel",
      "de": "Bedrohungen mit Microsoft Sentinel mindern"
    },
    "difficulty": "easy",
    "scenario": null,
    "question": {
      "en": "What is the purpose of the KQL project operator?",
      "de": "Wozu dient der KQL-Operator project?"
    },
    "options": [
      {
        "id": "A",
        "text": {
          "en": "To return only selected columns",
          "de": "Um nur ausgewählte Spalten zurückzugeben"
        }
      },
      {
        "id": "B",
        "text": {
          "en": "To join two tables",
          "de": "Um zwei Tabellen zu verbinden"
        }
      },
      {
        "id": "C",
        "text": {
          "en": "To bin timestamps",
          "de": "Um Zeitstempel zu gruppieren"
        }
      },
      {
        "id": "D",
        "text": {
          "en": "To ingest a watchlist",
          "de": "Um eine Watchlist aufzunehmen"
        }
      }
    ],
    "correct": [
      "A"
    ],
    "explanation": {
      "en": "project narrows query output to the columns you want to keep.",
      "de": "project reduziert die Abfrageausgabe auf die Spalten, die Sie behalten möchten."
    },
    "hint": {
      "en": "Think column selection.",
      "de": "Denken Sie an Spaltenauswahl."
    },
    "reference": "https://learn.microsoft.com/en-us/azure/sentinel/hunting"
  },
  {
    "id": "sc200-274",
    "type": "single",
    "domain": {
      "en": "Mitigate Threats Using Microsoft Sentinel",
      "de": "Bedrohungen mit Microsoft Sentinel mindern"
    },
    "difficulty": "easy",
    "scenario": null,
    "question": {
      "en": "What is the purpose of the KQL extend operator?",
      "de": "Wozu dient der KQL-Operator extend?"
    },
    "options": [
      {
        "id": "A",
        "text": {
          "en": "To create a calculated column",
          "de": "Um eine berechnete Spalte zu erstellen"
        }
      },
      {
        "id": "B",
        "text": {
          "en": "To remove duplicates",
          "de": "Um Duplikate zu entfernen"
        }
      },
      {
        "id": "C",
        "text": {
          "en": "To close incidents",
          "de": "Um Vorfälle zu schließen"
        }
      },
      {
        "id": "D",
        "text": {
          "en": "To deploy a playbook",
          "de": "Um ein Playbook bereitzustellen"
        }
      }
    ],
    "correct": [
      "A"
    ],
    "explanation": {
      "en": "extend adds a new calculated column or modifies one based on an expression.",
      "de": "extend fügt eine neue berechnete Spalte hinzu oder verändert eine vorhandene auf Basis eines Ausdrucks."
    },
    "hint": {
      "en": "Think calculated field creation.",
      "de": "Denken Sie an die Erstellung berechneter Felder."
    },
    "reference": "https://learn.microsoft.com/en-us/azure/sentinel/hunting"
  },
  {
    "id": "sc200-275",
    "type": "single",
    "domain": {
      "en": "Mitigate Threats Using Microsoft Sentinel",
      "de": "Bedrohungen mit Microsoft Sentinel mindern"
    },
    "difficulty": "easy",
    "scenario": null,
    "question": {
      "en": "What is the purpose of the KQL join operator?",
      "de": "Wozu dient der KQL-Operator join?"
    },
    "options": [
      {
        "id": "A",
        "text": {
          "en": "To combine rows from two datasets on a key",
          "de": "Um Zeilen aus zwei Datensätzen über einen Schlüssel zu kombinieren"
        }
      },
      {
        "id": "B",
        "text": {
          "en": "To create a playbook",
          "de": "Um ein Playbook zu erstellen"
        }
      },
      {
        "id": "C",
        "text": {
          "en": "To change workspace pricing",
          "de": "Um die Workspace-Preisstufe zu ändern"
        }
      },
      {
        "id": "D",
        "text": {
          "en": "To onboard a connector",
          "de": "Um einen Connector einzubinden"
        }
      }
    ],
    "correct": [
      "A"
    ],
    "explanation": {
      "en": "join correlates related rows from separate tables or subqueries using matching keys.",
      "de": "join korreliert zusammengehörige Zeilen aus separaten Tabellen oder Unterabfragen über passende Schlüssel."
    },
    "hint": {
      "en": "Think data correlation across tables.",
      "de": "Denken Sie an Datenkorrelation über Tabellen hinweg."
    },
    "reference": "https://learn.microsoft.com/en-us/azure/sentinel/hunting"
  },
  {
    "id": "sc200-276",
    "type": "multiple",
    "domain": {
      "en": "Mitigate Threats Using Microsoft Sentinel",
      "de": "Bedrohungen mit Microsoft Sentinel mindern"
    },
    "difficulty": "medium",
    "scenario": null,
    "question": {
      "en": "Which tasks are appropriate for a Sentinel playbook? Select all that apply.",
      "de": "Welche Aufgaben sind für ein Sentinel-Playbook geeignet? Wählen Sie alle zutreffenden Antworten aus."
    },
    "options": [
      {
        "id": "A",
        "text": {
          "en": "Post a Teams message",
          "de": "Eine Teams-Nachricht senden"
        }
      },
      {
        "id": "B",
        "text": {
          "en": "Open a ticket in an external system",
          "de": "Ein Ticket in einem externen System eröffnen"
        }
      },
      {
        "id": "C",
        "text": {
          "en": "Enrich an incident with data from another service",
          "de": "Einen Vorfall mit Daten aus einem anderen Dienst anreichern"
        }
      },
      {
        "id": "D",
        "text": {
          "en": "Replace the analytics rule query language",
          "de": "Die Abfragesprache einer Analyseregel ersetzen"
        }
      }
    ],
    "correct": [
      "A",
      "B",
      "C"
    ],
    "explanation": {
      "en": "Playbooks orchestrate workflow actions such as notification, enrichment, and ticketing. They do not replace KQL.",
      "de": "Playbooks orchestrieren Workflow-Aktionen wie Benachrichtigung, Anreicherung und Ticketing. Sie ersetzen kein KQL."
    },
    "hint": {
      "en": "Choose workflow automation tasks.",
      "de": "Wählen Sie Aufgaben der Workflow-Automatisierung."
    },
    "reference": "https://learn.microsoft.com/en-us/azure/sentinel/automation/playbook-triggers-actions"
  },
  {
    "id": "sc200-277",
    "type": "single",
    "domain": {
      "en": "Mitigate Threats Using Microsoft Sentinel",
      "de": "Bedrohungen mit Microsoft Sentinel mindern"
    },
    "difficulty": "easy",
    "scenario": null,
    "question": {
      "en": "Which Sentinel view is best for filtering incidents by status, owner, and severity?",
      "de": "Welche Sentinel-Ansicht eignet sich am besten, um Vorfälle nach Status, Besitzer und Schwere zu filtern?"
    },
    "options": [
      {
        "id": "A",
        "text": {
          "en": "Incidents queue",
          "de": "Vorfallswarteschlange"
        }
      },
      {
        "id": "B",
        "text": {
          "en": "Content hub",
          "de": "Content Hub"
        }
      },
      {
        "id": "C",
        "text": {
          "en": "ASIM parser list",
          "de": "ASIM-Parserliste"
        }
      },
      {
        "id": "D",
        "text": {
          "en": "Connector gallery",
          "de": "Connector-Galerie"
        }
      }
    ],
    "correct": [
      "A"
    ],
    "explanation": {
      "en": "The incidents queue is the operational case-management list for filtering and triage.",
      "de": "Die Vorfallswarteschlange ist die operative Fallmanagementliste für Filterung und Triage."
    },
    "hint": {
      "en": "Use the case queue.",
      "de": "Verwenden Sie die Fallwarteschlange."
    },
    "reference": "https://learn.microsoft.com/en-us/azure/sentinel/investigate-cases"
  },
  {
    "id": "sc200-278",
    "type": "single",
    "domain": {
      "en": "Mitigate Threats Using Microsoft Sentinel",
      "de": "Bedrohungen mit Microsoft Sentinel mindern"
    },
    "difficulty": "medium",
    "scenario": null,
    "question": {
      "en": "Which agent is used with data collection rules for modern log collection into Azure Monitor and Sentinel?",
      "de": "Welcher Agent wird zusammen mit Daten­erfassungsregeln für moderne Protokollerfassung in Azure Monitor und Sentinel verwendet?"
    },
    "options": [
      {
        "id": "A",
        "text": {
          "en": "Azure Monitor Agent",
          "de": "Azure Monitor Agent"
        }
      },
      {
        "id": "B",
        "text": {
          "en": "Operations Management Suite agent",
          "de": "Operations-Management-Suite-Agent"
        }
      },
      {
        "id": "C",
        "text": {
          "en": "Browser helper object",
          "de": "Browser Helper Object"
        }
      },
      {
        "id": "D",
        "text": {
          "en": "Office add-in",
          "de": "Office-Add-In"
        }
      }
    ],
    "correct": [
      "A"
    ],
    "explanation": {
      "en": "The Azure Monitor Agent is the modern collection agent used with data collection rules for supported scenarios.",
      "de": "Der Azure Monitor Agent ist der moderne Erfassungsagent, der in unterstützten Szenarien mit Datenerfassungsregeln verwendet wird."
    },
    "hint": {
      "en": "Pick the current Azure Monitor collection agent.",
      "de": "Wählen Sie den aktuellen Azure-Monitor-Erfassungsagenten."
    },
    "reference": "https://learn.microsoft.com/en-us/azure/sentinel/work-with-data-connectors"
  },
  {
    "id": "sc200-279",
    "type": "multiple",
    "domain": {
      "en": "Mitigate Threats Using Microsoft Sentinel",
      "de": "Bedrohungen mit Microsoft Sentinel mindern"
    },
    "difficulty": "medium",
    "scenario": null,
    "question": {
      "en": "Which items can help an analyst investigate a Sentinel incident? Select all that apply.",
      "de": "Welche Elemente können einem Analysten bei der Untersuchung eines Sentinel-Vorfalls helfen? Wählen Sie alle zutreffenden Antworten aus."
    },
    "options": [
      {
        "id": "A",
        "text": {
          "en": "Alerts",
          "de": "Warnungen"
        }
      },
      {
        "id": "B",
        "text": {
          "en": "Mapped entities",
          "de": "Zugeordnete Entitäten"
        }
      },
      {
        "id": "C",
        "text": {
          "en": "Bookmarks and notes",
          "de": "Lesezeichen und Notizen"
        }
      },
      {
        "id": "D",
        "text": {
          "en": "Datacenter power usage",
          "de": "Stromverbrauch des Rechenzentrums"
        }
      }
    ],
    "correct": [
      "A",
      "B",
      "C"
    ],
    "explanation": {
      "en": "Alerts, entities, and investigation artifacts like bookmarks help analysts understand scope and evidence. Facility metrics do not.",
      "de": "Warnungen, Entitäten und Untersuchungsartefakte wie Lesezeichen helfen Analysten, Umfang und Beweise zu verstehen. Gebäudemetriken tun das nicht."
    },
    "hint": {
      "en": "Select investigation context, not facilities data.",
      "de": "Wählen Sie Untersuchungskontext und keine Gebäudedaten."
    },
    "reference": "https://learn.microsoft.com/en-us/azure/sentinel/investigate-cases"
  },
  {
    "id": "sc200-280",
    "type": "single",
    "domain": {
      "en": "Mitigate Threats Using Microsoft Sentinel",
      "de": "Bedrohungen mit Microsoft Sentinel mindern"
    },
    "difficulty": "hard",
    "scenario": null,
    "question": {
      "en": "Which KQL function is best for returning a distinct list of values within summarize, such as all IPs seen for a user?",
      "de": "Welche KQL-Funktion eignet sich am besten, um innerhalb von summarize eine eindeutige Liste von Werten zurückzugeben, etwa alle für einen Benutzer gesehenen IPs?"
    },
    "options": [
      {
        "id": "A",
        "text": {
          "en": "make_set()",
          "de": "make_set()"
        }
      },
      {
        "id": "B",
        "text": {
          "en": "tolower()",
          "de": "tolower()"
        }
      },
      {
        "id": "C",
        "text": {
          "en": "ago()",
          "de": "ago()"
        }
      },
      {
        "id": "D",
        "text": {
          "en": "project-away()",
          "de": "project-away()"
        }
      }
    ],
    "correct": [
      "A"
    ],
    "explanation": {
      "en": "make_set() aggregates distinct values into an array, which is useful for listing all observed IPs or hosts per entity.",
      "de": "make_set() aggregiert unterschiedliche Werte in ein Array und eignet sich, um alle beobachteten IPs oder Hosts pro Entität aufzulisten."
    },
    "hint": {
      "en": "Think distinct value list inside summarize.",
      "de": "Denken Sie an eine Liste eindeutiger Werte innerhalb von summarize."
    },
    "reference": "https://learn.microsoft.com/en-us/azure/sentinel/hunting"
  },
  {
    "id": "sc200-281",
    "type": "single",
    "domain": {
      "en": "Mitigate Threats Using Microsoft Sentinel",
      "de": "Bedrohungen mit Microsoft Sentinel mindern"
    },
    "difficulty": "hard",
    "scenario": {
      "en": "Administrators use known jump-box IPs, and the SOC wants to ignore those sources when looking for risky cloud sign-ins.",
      "de": "Administratoren verwenden bekannte Jump-Box-IP-Adressen, und das SOC möchte diese Quellen bei der Suche nach riskanten Cloud-Anmeldungen ignorieren."
    },
    "question": {
      "en": "Which KQL query best excludes trusted admin IP ranges from a suspicious sign-in hunt by using a watchlist?",
      "de": "Welche KQL-Abfrage schließt vertrauenswürdige Admin-IP-Bereiche aus einer Jagd nach verdächtigen Anmeldungen mithilfe einer Watchlist am besten aus?"
    },
    "options": [
      {
        "id": "A",
        "text": {
          "en": "let trusted = _GetWatchlist('adminips') | project SearchKey; SigninLogs | where IPAddress !in (trusted) | where ResultType != 0",
          "de": "let trusted = _GetWatchlist('adminips') | project SearchKey; SigninLogs | where IPAddress !in (trusted) | where ResultType != 0"
        }
      },
      {
        "id": "B",
        "text": {
          "en": "SigninLogs | where IPAddress != 'adminips'",
          "de": "SigninLogs | where IPAddress != 'adminips'"
        }
      },
      {
        "id": "C",
        "text": {
          "en": "SecurityAlert | where ProviderName !in (_GetWatchlist('adminips'))",
          "de": "SecurityAlert | where ProviderName !in (_GetWatchlist('adminips'))"
        }
      },
      {
        "id": "D",
        "text": {
          "en": "Heartbeat | where Computer !in (_GetWatchlist('adminips'))",
          "de": "Heartbeat | where Computer !in (_GetWatchlist('adminips'))"
        }
      }
    ],
    "correct": [
      "A"
    ],
    "explanation": {
      "en": "The correct pattern is to load the watchlist values and then filter SigninLogs using the projected SearchKey values.",
      "de": "Das korrekte Muster besteht darin, die Watchlist-Werte zu laden und anschließend SigninLogs anhand der projizierten SearchKey-Werte zu filtern."
    },
    "hint": {
      "en": "Use the watchlist as reference data for the sign-in query.",
      "de": "Verwenden Sie die Watchlist als Referenzdaten für die Anmeldeabfrage."
    },
    "reference": "https://learn.microsoft.com/en-us/azure/sentinel/watchlists-queries"
  },
  {
    "id": "sc200-282",
    "type": "multiple",
    "domain": {
      "en": "Mitigate Threats Using Microsoft Sentinel",
      "de": "Bedrohungen mit Microsoft Sentinel mindern"
    },
    "difficulty": "medium",
    "scenario": null,
    "question": {
      "en": "Which capabilities are associated with Sentinel workbooks? Select all that apply.",
      "de": "Welche Funktionen sind Sentinel-Workbooks zugeordnet? Wählen Sie alle zutreffenden Antworten aus."
    },
    "options": [
      {
        "id": "A",
        "text": {
          "en": "Visualize query results with charts",
          "de": "Abfrageergebnisse mit Diagrammen visualisieren"
        }
      },
      {
        "id": "B",
        "text": {
          "en": "Provide interactive dashboard parameters",
          "de": "Interaktive Dashboard-Parameter bereitstellen"
        }
      },
      {
        "id": "C",
        "text": {
          "en": "Combine multiple queries into one operational view",
          "de": "Mehrere Abfragen zu einer betrieblichen Ansicht kombinieren"
        }
      },
      {
        "id": "D",
        "text": {
          "en": "Automatically isolate endpoints without automation",
          "de": "Endpunkte ohne Automatisierung automatisch isolieren"
        }
      }
    ],
    "correct": [
      "A",
      "B",
      "C"
    ],
    "explanation": {
      "en": "Workbooks provide interactive visualization and dashboarding, not endpoint response execution.",
      "de": "Workbooks bieten interaktive Visualisierung und Dashboarding, aber keine Ausführung von Endpunktreaktionen."
    },
    "hint": {
      "en": "Choose visualization features, not response actions.",
      "de": "Wählen Sie Visualisierungsfunktionen und keine Reaktionsaktionen."
    },
    "reference": "https://learn.microsoft.com/en-us/azure/sentinel/sentinel-solutions-catalog"
  },
  {
    "id": "sc200-283",
    "type": "single",
    "domain": {
      "en": "Mitigate Threats Using Microsoft Sentinel",
      "de": "Bedrohungen mit Microsoft Sentinel mindern"
    },
    "difficulty": "easy",
    "scenario": null,
    "question": {
      "en": "What does bin(TimeGenerated, 1h) do in KQL?",
      "de": "Was bewirkt bin(TimeGenerated, 1h) in KQL?"
    },
    "options": [
      {
        "id": "A",
        "text": {
          "en": "Rounds timestamps into one-hour buckets",
          "de": "Rundet Zeitstempel in Ein-Stunden-Intervalle"
        }
      },
      {
        "id": "B",
        "text": {
          "en": "Deletes rows older than one hour",
          "de": "Löscht Zeilen, die älter als eine Stunde sind"
        }
      },
      {
        "id": "C",
        "text": {
          "en": "Converts UTC to local time",
          "de": "Konvertiert UTC in Lokalzeit"
        }
      },
      {
        "id": "D",
        "text": {
          "en": "Joins one hour of data",
          "de": "Verknüpft eine Stunde Daten"
        }
      }
    ],
    "correct": [
      "A"
    ],
    "explanation": {
      "en": "bin() groups time values into fixed intervals, which is useful for trend and time-series analysis.",
      "de": "bin() gruppiert Zeitwerte in feste Intervalle und ist nützlich für Trend- und Zeitreihenanalysen."
    },
    "hint": {
      "en": "Think time bucketing.",
      "de": "Denken Sie an Zeit-Buckets."
    },
    "reference": "https://learn.microsoft.com/en-us/azure/sentinel/hunting"
  },
  {
    "id": "sc200-284",
    "type": "single",
    "domain": {
      "en": "Mitigate Threats Using Microsoft Sentinel",
      "de": "Bedrohungen mit Microsoft Sentinel mindern"
    },
    "difficulty": "medium",
    "scenario": {
      "en": "An approved patch cycle will trigger expected activity that matches an existing detection pattern.",
      "de": "Ein genehmigter Patch-Zyklus wird erwartete Aktivität auslösen, die einem bestehenden Erkennungsmuster entspricht."
    },
    "question": {
      "en": "Which analytics-rule feature should you use to pause repeated alert generation during a planned maintenance window?",
      "de": "Welche Funktion einer Analyseregel sollten Sie verwenden, um die wiederholte Warnungserzeugung während eines geplanten Wartungsfensters auszusetzen?"
    },
    "options": [
      {
        "id": "A",
        "text": {
          "en": "Suppression",
          "de": "Unterdrückung"
        }
      },
      {
        "id": "B",
        "text": {
          "en": "Entity mapping",
          "de": "Entity Mapping"
        }
      },
      {
        "id": "C",
        "text": {
          "en": "Watchlist upload",
          "de": "Watchlist-Upload"
        }
      },
      {
        "id": "D",
        "text": {
          "en": "Workbook pinning",
          "de": "Workbook-Anheften"
        }
      }
    ],
    "correct": [
      "A"
    ],
    "explanation": {
      "en": "Suppression temporarily stops the rule from creating more alerts after it fires, which is useful during maintenance or known noisy periods.",
      "de": "Die Unterdrückung stoppt vorübergehend, dass die Regel nach einer Auslösung weitere Warnungen erstellt, was während Wartung oder bekannter lauter Zeiträume nützlich ist."
    },
    "hint": {
      "en": "Choose the feature that intentionally pauses repeat firing.",
      "de": "Wählen Sie die Funktion, die wiederholte Auslösungen gezielt pausiert."
    },
    "reference": "https://learn.microsoft.com/en-us/azure/sentinel/create-analytics-rules"
  },
  {
    "id": "sc200-285",
    "type": "single",
    "domain": {
      "en": "Mitigate Threats Using Microsoft Sentinel",
      "de": "Bedrohungen mit Microsoft Sentinel mindern"
    },
    "difficulty": "medium",
    "scenario": null,
    "question": {
      "en": "When is a near real-time analytics rule usually a better choice than a scheduled rule?",
      "de": "Wann ist eine Near-Real-Time-Analyseregel normalerweise die bessere Wahl als eine geplante Regel?"
    },
    "options": [
      {
        "id": "A",
        "text": {
          "en": "When a high-confidence signal must trigger an alert with minimal delay",
          "de": "Wenn ein Signal mit hoher Vertrauenswürdigkeit mit minimaler Verzögerung eine Warnung auslösen muss"
        }
      },
      {
        "id": "B",
        "text": {
          "en": "When you need workbook charts",
          "de": "Wenn Sie Workbook-Diagramme benötigen"
        }
      },
      {
        "id": "C",
        "text": {
          "en": "When you want to import a watchlist",
          "de": "Wenn Sie eine Watchlist importieren möchten"
        }
      },
      {
        "id": "D",
        "text": {
          "en": "When you need to install content hub solutions",
          "de": "Wenn Sie Content-Hub-Lösungen installieren möchten"
        }
      }
    ],
    "correct": [
      "A"
    ],
    "explanation": {
      "en": "NRT rules are chosen for fast detection of important, reliable events where waiting for a scheduled interval is not acceptable.",
      "de": "NRT-Regeln werden für die schnelle Erkennung wichtiger, zuverlässiger Ereignisse gewählt, wenn das Warten auf ein geplantes Intervall nicht akzeptabel ist."
    },
    "hint": {
      "en": "Think minimal alert latency.",
      "de": "Denken Sie an minimale Warnlatenz."
    },
    "reference": "https://learn.microsoft.com/en-us/azure/sentinel/create-analytics-rules"
  },
  {
    "id": "sc200-286",
    "type": "multiple",
    "domain": {
      "en": "Mitigate Threats Using Microsoft Sentinel",
      "de": "Bedrohungen mit Microsoft Sentinel mindern"
    },
    "difficulty": "medium",
    "scenario": null,
    "question": {
      "en": "What are benefits of using ASIM in Sentinel? Select all that apply.",
      "de": "Welche Vorteile bietet die Verwendung von ASIM in Sentinel? Wählen Sie alle zutreffenden Antworten aus."
    },
    "options": [
      {
        "id": "A",
        "text": {
          "en": "Normalized field names across sources",
          "de": "Normalisierte Feldnamen über Quellen hinweg"
        }
      },
      {
        "id": "B",
        "text": {
          "en": "Reusable analytics and hunting queries",
          "de": "Wiederverwendbare Analysen und Hunting-Abfragen"
        }
      },
      {
        "id": "C",
        "text": {
          "en": "Easier cross-source investigations",
          "de": "Einfachere Untersuchungen über mehrere Quellen hinweg"
        }
      },
      {
        "id": "D",
        "text": {
          "en": "Guaranteed lower log retention costs",
          "de": "Garantiert niedrigere Kosten für die Protokollaufbewahrung"
        }
      }
    ],
    "correct": [
      "A",
      "B",
      "C"
    ],
    "explanation": {
      "en": "ASIM improves consistency and portability of analytics, but it does not guarantee lower retention costs.",
      "de": "ASIM verbessert Konsistenz und Portabilität von Analysen, garantiert jedoch keine niedrigeren Aufbewahrungskosten."
    },
    "hint": {
      "en": "Choose normalization and reuse benefits.",
      "de": "Wählen Sie Vorteile bei Normalisierung und Wiederverwendung."
    },
    "reference": "https://learn.microsoft.com/en-us/azure/sentinel/normalization"
  },
  {
    "id": "sc200-287",
    "type": "single",
    "domain": {
      "en": "Mitigate Threats Using Microsoft Defender for Cloud",
      "de": "Bedrohungen mit Microsoft Defender for Cloud mindern"
    },
    "difficulty": "easy",
    "scenario": null,
    "question": {
      "en": "What does Secure score in Defender for Cloud primarily help you understand?",
      "de": "Was hilft Secure Score in Defender for Cloud in erster Linie zu verstehen?"
    },
    "options": [
      {
        "id": "A",
        "text": {
          "en": "Your current security posture and improvement opportunities",
          "de": "Ihre aktuelle Sicherheitslage und Verbesserungspotenziale"
        }
      },
      {
        "id": "B",
        "text": {
          "en": "How many incidents are open in Sentinel",
          "de": "Wie viele Vorfälle in Sentinel offen sind"
        }
      },
      {
        "id": "C",
        "text": {
          "en": "Which emails were quarantined",
          "de": "Welche E-Mails in Quarantäne verschoben wurden"
        }
      },
      {
        "id": "D",
        "text": {
          "en": "How many users clicked a URL",
          "de": "Wie viele Benutzer auf eine URL geklickt haben"
        }
      }
    ],
    "correct": [
      "A"
    ],
    "explanation": {
      "en": "Secure score summarizes posture recommendations and progress so teams can prioritize high-value remediation work.",
      "de": "Secure Score fasst Empfehlungen zur Sicherheitslage und den Fortschritt zusammen, damit Teams Maßnahmen mit hohem Nutzen priorisieren können."
    },
    "hint": {
      "en": "Think posture improvement, not incident count.",
      "de": "Denken Sie an Verbesserung der Sicherheitslage und nicht an Vorfallzahlen."
    },
    "reference": "https://learn.microsoft.com/en-us/azure/defender-for-cloud/secure-score-security-controls"
  },
  {
    "id": "sc200-288",
    "type": "single",
    "domain": {
      "en": "Mitigate Threats Using Microsoft Defender for Cloud",
      "de": "Bedrohungen mit Microsoft Defender for Cloud mindern"
    },
    "difficulty": "medium",
    "scenario": {
      "en": "Auditors ask which specific controls are currently failing for your assigned regulatory standard.",
      "de": "Prüfer fragen, welche spezifischen Kontrollen für Ihren zugewiesenen Regulierungsstandard derzeit fehlschlagen."
    },
    "question": {
      "en": "Which Defender for Cloud dashboard is best for checking whether controls in standards such as NIST or ISO are passing or failing?",
      "de": "Welches Defender-for-Cloud-Dashboard eignet sich am besten, um zu prüfen, ob Kontrollen in Standards wie NIST oder ISO bestanden oder nicht bestanden werden?"
    },
    "options": [
      {
        "id": "A",
        "text": {
          "en": "Regulatory compliance dashboard",
          "de": "Dashboard für regulatorische Compliance"
        }
      },
      {
        "id": "B",
        "text": {
          "en": "Cloud Discovery",
          "de": "Cloud Discovery"
        }
      },
      {
        "id": "C",
        "text": {
          "en": "Threat analytics",
          "de": "Threat Analytics"
        }
      },
      {
        "id": "D",
        "text": {
          "en": "Action center",
          "de": "Action Center"
        }
      }
    ],
    "correct": [
      "A"
    ],
    "explanation": {
      "en": "The regulatory compliance dashboard maps recommendations and assessments to compliance standards and control status.",
      "de": "Das Dashboard für regulatorische Compliance ordnet Empfehlungen und Bewertungen Compliance-Standards sowie Kontrollstatus zu."
    },
    "hint": {
      "en": "Choose the standards-focused posture view.",
      "de": "Wählen Sie die auf Standards fokussierte Posture-Ansicht."
    },
    "reference": "https://learn.microsoft.com/en-us/azure/defender-for-cloud/concept-regulatory-compliance-standards"
  },
  {
    "id": "sc200-289",
    "type": "single",
    "domain": {
      "en": "Mitigate Threats Using Microsoft Defender for Cloud",
      "de": "Bedrohungen mit Microsoft Defender for Cloud mindern"
    },
    "difficulty": "easy",
    "scenario": null,
    "question": {
      "en": "What is the primary purpose of Just-in-time (JIT) VM access in Defender for Cloud?",
      "de": "Was ist der Hauptzweck von Just-in-Time-(JIT)-VM-Zugriff in Defender for Cloud?"
    },
    "options": [
      {
        "id": "A",
        "text": {
          "en": "Reduce exposure of management ports by opening them only when needed",
          "de": "Die Exponierung von Verwaltungsports reduzieren, indem sie nur bei Bedarf geöffnet werden"
        }
      },
      {
        "id": "B",
        "text": {
          "en": "Store audit logs for ten years",
          "de": "Auditprotokolle zehn Jahre lang speichern"
        }
      },
      {
        "id": "C",
        "text": {
          "en": "Create Sentinel bookmarks",
          "de": "Sentinel-Lesezeichen erstellen"
        }
      },
      {
        "id": "D",
        "text": {
          "en": "Correlate phishing incidents",
          "de": "Phishing-Vorfälle korrelieren"
        }
      }
    ],
    "correct": [
      "A"
    ],
    "explanation": {
      "en": "JIT reduces attack surface by keeping management ports closed until approved access is requested for a limited time.",
      "de": "JIT reduziert die Angriffsfläche, indem Verwaltungsports geschlossen bleiben, bis genehmigter Zugriff für einen begrenzten Zeitraum angefordert wird."
    },
    "hint": {
      "en": "Think temporary access to RDP or SSH.",
      "de": "Denken Sie an temporären Zugriff auf RDP oder SSH."
    },
    "reference": "https://learn.microsoft.com/en-us/azure/defender-for-cloud/just-in-time-access-overview"
  },
  {
    "id": "sc200-290",
    "type": "single",
    "domain": {
      "en": "Mitigate Threats Using Microsoft Defender for Cloud",
      "de": "Bedrohungen mit Microsoft Defender for Cloud mindern"
    },
    "difficulty": "medium",
    "scenario": {
      "en": "A production server should run only a small, predictable set of processes.",
      "de": "Ein Produktionsserver soll nur eine kleine, vorhersehbare Menge von Prozessen ausführen."
    },
    "question": {
      "en": "Which Defender for Cloud feature helps create an allowlist of approved applications on servers based on observed behavior?",
      "de": "Welche Defender-for-Cloud-Funktion hilft dabei, eine Allowlist genehmigter Anwendungen auf Servern auf Basis beobachteten Verhaltens zu erstellen?"
    },
    "options": [
      {
        "id": "A",
        "text": {
          "en": "Adaptive application controls",
          "de": "Adaptive Anwendungssteuerungen"
        }
      },
      {
        "id": "B",
        "text": {
          "en": "Regulatory compliance",
          "de": "Regulatorische Compliance"
        }
      },
      {
        "id": "C",
        "text": {
          "en": "Secure score",
          "de": "Secure Score"
        }
      },
      {
        "id": "D",
        "text": {
          "en": "Automation rules",
          "de": "Automatisierungsregeln"
        }
      }
    ],
    "correct": [
      "A"
    ],
    "explanation": {
      "en": "Adaptive application controls recommend and help enforce application allowlists for machines with stable workloads.",
      "de": "Adaptive Anwendungssteuerungen empfehlen und helfen bei der Durchsetzung von Anwendungs-Allowlisten für Maschinen mit stabilen Workloads."
    },
    "hint": {
      "en": "Choose the application allowlisting feature.",
      "de": "Wählen Sie die Funktion zur Anwendungs-Allowlist."
    },
    "reference": "https://learn.microsoft.com/en-us/azure/defender-for-cloud/adaptive-application-controls"
  },
  {
    "id": "sc200-291",
    "type": "single",
    "domain": {
      "en": "Mitigate Threats Using Microsoft Defender for Cloud",
      "de": "Bedrohungen mit Microsoft Defender for Cloud mindern"
    },
    "difficulty": "medium",
    "scenario": null,
    "question": {
      "en": "Which Defender for Cloud feature shows exploitable chains of weaknesses so you can prioritize remediation by attacker path?",
      "de": "Welche Defender-for-Cloud-Funktion zeigt ausnutzbare Schwachstellenketten, damit Sie die Behebung nach Angreiferpfaden priorisieren können?"
    },
    "options": [
      {
        "id": "A",
        "text": {
          "en": "Attack path analysis",
          "de": "Attack-Path-Analyse"
        }
      },
      {
        "id": "B",
        "text": {
          "en": "Threat Explorer",
          "de": "Threat Explorer"
        }
      },
      {
        "id": "C",
        "text": {
          "en": "Mailbox audit",
          "de": "Postfachüberwachung"
        }
      },
      {
        "id": "D",
        "text": {
          "en": "Cloud Discovery",
          "de": "Cloud Discovery"
        }
      }
    ],
    "correct": [
      "A"
    ],
    "explanation": {
      "en": "Attack path analysis prioritizes remediation by highlighting chains of exposures and misconfigurations that increase attacker reach.",
      "de": "Die Attack-Path-Analyse priorisiert Behebungen, indem sie Ketten von Expositionen und Fehlkonfigurationen hervorhebt, die die Reichweite eines Angreifers erhöhen."
    },
    "hint": {
      "en": "Choose the feature focused on exploitable paths, not single findings.",
      "de": "Wählen Sie die Funktion, die sich auf ausnutzbare Pfade und nicht auf einzelne Befunde konzentriert."
    },
    "reference": "https://learn.microsoft.com/en-us/azure/defender-for-cloud/concept-attack-path"
  },
  {
    "id": "sc200-292",
    "type": "single",
    "domain": {
      "en": "Mitigate Threats Using Microsoft Defender for Cloud",
      "de": "Bedrohungen mit Microsoft Defender for Cloud mindern"
    },
    "difficulty": "medium",
    "scenario": null,
    "question": {
      "en": "Which Defender for Cloud capability provides graph-based exploration across resources, relationships, and findings?",
      "de": "Welche Defender-for-Cloud-Funktion bietet eine graphbasierte Untersuchung über Ressourcen, Beziehungen und Befunde hinweg?"
    },
    "options": [
      {
        "id": "A",
        "text": {
          "en": "Cloud Security Explorer",
          "de": "Cloud Security Explorer"
        }
      },
      {
        "id": "B",
        "text": {
          "en": "Secure score",
          "de": "Secure Score"
        }
      },
      {
        "id": "C",
        "text": {
          "en": "Workbook",
          "de": "Workbook"
        }
      },
      {
        "id": "D",
        "text": {
          "en": "Threat analytics",
          "de": "Threat Analytics"
        }
      }
    ],
    "correct": [
      "A"
    ],
    "explanation": {
      "en": "Cloud Security Explorer is built for graph-based investigation of cloud assets, relationships, and security findings.",
      "de": "Cloud Security Explorer ist für die graphbasierte Untersuchung von Cloudressourcen, Beziehungen und Sicherheitsbefunden konzipiert."
    },
    "hint": {
      "en": "Look for the graph exploration feature.",
      "de": "Suchen Sie nach der Funktion zur Graph-Untersuchung."
    },
    "reference": "https://learn.microsoft.com/en-us/azure/defender-for-cloud/concept-cloud-security-explorer"
  },
  {
    "id": "sc200-293",
    "type": "multiple",
    "domain": {
      "en": "Mitigate Threats Using Microsoft Defender for Cloud",
      "de": "Bedrohungen mit Microsoft Defender for Cloud mindern"
    },
    "difficulty": "medium",
    "scenario": null,
    "question": {
      "en": "Which capabilities are associated with Defender for Servers Plan 2? Select all that apply.",
      "de": "Welche Funktionen sind Defender for Servers Plan 2 zugeordnet? Wählen Sie alle zutreffenden Antworten aus."
    },
    "options": [
      {
        "id": "A",
        "text": {
          "en": "Just-in-time VM access",
          "de": "Just-in-Time-VM-Zugriff"
        }
      },
      {
        "id": "B",
        "text": {
          "en": "File integrity monitoring",
          "de": "Dateiintegritätsüberwachung"
        }
      },
      {
        "id": "C",
        "text": {
          "en": "Agentless scanning",
          "de": "Agentlose Überprüfung"
        }
      },
      {
        "id": "D",
        "text": {
          "en": "Attack simulation training",
          "de": "Angriffssimulationstraining"
        }
      }
    ],
    "correct": [
      "A",
      "B",
      "C"
    ],
    "explanation": {
      "en": "Defender for Servers Plan 2 includes advanced server protections such as JIT, file integrity monitoring, and agentless scanning. Attack simulation training belongs to Defender for Office 365.",
      "de": "Defender for Servers Plan 2 umfasst erweiterte Schutzfunktionen wie JIT, Dateiintegritätsüberwachung und agentlose Überprüfung. Angriffssimulationstraining gehört zu Defender for Office 365."
    },
    "hint": {
      "en": "Pick server-protection features, not email training.",
      "de": "Wählen Sie Server-Schutzfunktionen und kein E-Mail-Training."
    },
    "reference": "https://learn.microsoft.com/en-us/azure/defender-for-cloud/defender-for-cloud-introduction"
  },
  {
    "id": "sc200-294",
    "type": "single",
    "domain": {
      "en": "Mitigate Threats Using Microsoft Defender for Cloud",
      "de": "Bedrohungen mit Microsoft Defender for Cloud mindern"
    },
    "difficulty": "medium",
    "scenario": null,
    "question": {
      "en": "What usually happens to Secure score after you remediate a recommendation that contributes points?",
      "de": "Was geschieht in der Regel mit dem Secure Score, nachdem Sie eine Empfehlung beheben, die Punkte beiträgt?"
    },
    "options": [
      {
        "id": "A",
        "text": {
          "en": "It improves as the recommendation is satisfied",
          "de": "Er verbessert sich, sobald die Empfehlung erfüllt ist"
        }
      },
      {
        "id": "B",
        "text": {
          "en": "It always resets to zero",
          "de": "Er wird immer auf null zurückgesetzt"
        }
      },
      {
        "id": "C",
        "text": {
          "en": "It disables regulatory compliance",
          "de": "Er deaktiviert regulatorische Compliance"
        }
      },
      {
        "id": "D",
        "text": {
          "en": "It closes Sentinel incidents",
          "de": "Er schließt Sentinel-Vorfälle"
        }
      }
    ],
    "correct": [
      "A"
    ],
    "explanation": {
      "en": "Recommendations that contribute to secure score can increase the score when remediated or otherwise satisfied.",
      "de": "Empfehlungen, die zum Secure Score beitragen, können den Score erhöhen, wenn sie behoben oder anderweitig erfüllt werden."
    },
    "hint": {
      "en": "Think posture improvement points.",
      "de": "Denken Sie an Punkte zur Verbesserung der Sicherheitslage."
    },
    "reference": "https://learn.microsoft.com/en-us/azure/defender-for-cloud/secure-score-security-controls"
  },
  {
    "id": "sc200-295",
    "type": "single",
    "domain": {
      "en": "Mitigate Threats Using Microsoft Defender for Cloud",
      "de": "Bedrohungen mit Microsoft Defender for Cloud mindern"
    },
    "difficulty": "medium",
    "scenario": {
      "en": "The cloud security team wants tickets opened automatically when critical recommendations appear on production subscriptions.",
      "de": "Das Cloud-Security-Team möchte, dass automatisch Tickets eröffnet werden, wenn kritische Empfehlungen in Produktionsabonnements erscheinen."
    },
    "question": {
      "en": "Which Defender for Cloud feature can trigger a Logic App when a recommendation or alert matches specific conditions?",
      "de": "Welche Defender-for-Cloud-Funktion kann eine Logic App auslösen, wenn eine Empfehlung oder Warnung bestimmte Bedingungen erfüllt?"
    },
    "options": [
      {
        "id": "A",
        "text": {
          "en": "Workflow automation",
          "de": "Workflow-Automatisierung"
        }
      },
      {
        "id": "B",
        "text": {
          "en": "Secure score",
          "de": "Secure Score"
        }
      },
      {
        "id": "C",
        "text": {
          "en": "Adaptive application controls",
          "de": "Adaptive Anwendungssteuerungen"
        }
      },
      {
        "id": "D",
        "text": {
          "en": "Cloud Security Explorer",
          "de": "Cloud Security Explorer"
        }
      }
    ],
    "correct": [
      "A"
    ],
    "explanation": {
      "en": "Workflow automation uses Logic Apps to respond automatically to selected Defender for Cloud recommendations and alerts.",
      "de": "Die Workflow-Automatisierung verwendet Logic Apps, um automatisch auf ausgewählte Empfehlungen und Warnungen von Defender for Cloud zu reagieren."
    },
    "hint": {
      "en": "Choose the Logic App integration feature.",
      "de": "Wählen Sie die Funktion mit der Logic-App-Integration."
    },
    "reference": "https://learn.microsoft.com/en-us/azure/defender-for-cloud/workflow-automation"
  },
  {
    "id": "sc200-296",
    "type": "multiple",
    "domain": {
      "en": "Mitigate Threats Using Microsoft Defender for Cloud",
      "de": "Bedrohungen mit Microsoft Defender for Cloud mindern"
    },
    "difficulty": "medium",
    "scenario": null,
    "question": {
      "en": "Which features are primarily part of cloud security posture management in Defender for Cloud? Select all that apply.",
      "de": "Welche Funktionen gehören in Defender for Cloud primär zum Cloud-Security-Posture-Management? Wählen Sie alle zutreffenden Antworten aus."
    },
    "options": [
      {
        "id": "A",
        "text": {
          "en": "Secure score",
          "de": "Secure Score"
        }
      },
      {
        "id": "B",
        "text": {
          "en": "Recommendations",
          "de": "Empfehlungen"
        }
      },
      {
        "id": "C",
        "text": {
          "en": "Regulatory compliance",
          "de": "Regulatorische Compliance"
        }
      },
      {
        "id": "D",
        "text": {
          "en": "Attack simulation training",
          "de": "Angriffssimulationstraining"
        }
      }
    ],
    "correct": [
      "A",
      "B",
      "C"
    ],
    "explanation": {
      "en": "Secure score, recommendations, and regulatory compliance are posture management capabilities. Attack simulation training is not part of Defender for Cloud posture management.",
      "de": "Secure Score, Empfehlungen und regulatorische Compliance sind Funktionen des Posture Management. Angriffssimulationstraining gehört nicht dazu."
    },
    "hint": {
      "en": "Select posture views and controls, not email awareness training.",
      "de": "Wählen Sie Posture-Ansichten und -Steuerungen und kein E-Mail-Awareness-Training."
    },
    "reference": "https://learn.microsoft.com/en-us/azure/defender-for-cloud/defender-for-cloud-introduction"
  },
  {
    "id": "sc200-297",
    "type": "single",
    "domain": {
      "en": "Mitigate Threats Using Microsoft Defender for Cloud",
      "de": "Bedrohungen mit Microsoft Defender for Cloud mindern"
    },
    "difficulty": "medium",
    "scenario": {
      "en": "A security team wants additional assessment coverage across large VM fleets with minimal operational friction.",
      "de": "Ein Sicherheitsteam möchte zusätzliche Bewertungsabdeckung über große VM-Flotten hinweg mit minimalem Betriebsaufwand."
    },
    "question": {
      "en": "What is a key benefit of agentless scanning in Defender for Cloud?",
      "de": "Was ist ein wesentlicher Vorteil der agentlosen Überprüfung in Defender for Cloud?"
    },
    "options": [
      {
        "id": "A",
        "text": {
          "en": "It can assess resources without requiring a guest agent on each machine",
          "de": "Sie kann Ressourcen bewerten, ohne auf jeder Maschine einen Gastagenten zu benötigen"
        }
      },
      {
        "id": "B",
        "text": {
          "en": "It replaces Microsoft Sentinel analytics",
          "de": "Sie ersetzt Microsoft-Sentinel-Analysen"
        }
      },
      {
        "id": "C",
        "text": {
          "en": "It guarantees zero false positives",
          "de": "Sie garantiert null Fehlalarme"
        }
      },
      {
        "id": "D",
        "text": {
          "en": "It disables JIT access",
          "de": "Sie deaktiviert JIT-Zugriff"
        }
      }
    ],
    "correct": [
      "A"
    ],
    "explanation": {
      "en": "Agentless scanning extends visibility without relying on in-guest agents for certain assessment scenarios.",
      "de": "Agentlose Überprüfung erweitert die Sichtbarkeit, ohne sich in bestimmten Bewertungsszenarien auf In-Guest-Agenten zu verlassen."
    },
    "hint": {
      "en": "Think coverage without installing software inside every guest.",
      "de": "Denken Sie an Abdeckung, ohne Software in jedem Gast zu installieren."
    },
    "reference": "https://learn.microsoft.com/en-us/azure/defender-for-cloud/defender-for-cloud-introduction"
  },
  {
    "id": "sc200-298",
    "type": "single",
    "domain": {
      "en": "Mitigate Threats Using Microsoft Defender for Cloud",
      "de": "Bedrohungen mit Microsoft Defender for Cloud mindern"
    },
    "difficulty": "hard",
    "scenario": {
      "en": "Leadership wants the single most meaningful remediation first, not a long list of lower-impact tasks.",
      "de": "Die Leitung möchte zuerst die eine sinnvollste Behebung und nicht eine lange Liste weniger wirkungsvoller Aufgaben."
    },
    "question": {
      "en": "Attack path analysis shows an internet-exposed VM that can reach a high-value data store through an overprivileged identity. Which remediation is most aligned with breaking the path quickly?",
      "de": "Die Attack-Path-Analyse zeigt eine internetexponierte VM, die über eine überprivilegierte Identität einen hochwertigen Datenspeicher erreichen kann. Welche Behebungsmaßnahme ist am ehesten geeignet, den Pfad schnell zu unterbrechen?"
    },
    "options": [
      {
        "id": "A",
        "text": {
          "en": "Remove the exposed access or excessive privilege that forms the path",
          "de": "Den exponierten Zugriff oder das übermäßige Privileg entfernen, das den Pfad bildet"
        }
      },
      {
        "id": "B",
        "text": {
          "en": "Increase workbook refresh frequency",
          "de": "Die Aktualisierungsfrequenz des Workbooks erhöhen"
        }
      },
      {
        "id": "C",
        "text": {
          "en": "Create a watchlist of the VM name",
          "de": "Eine Watchlist mit dem VM-Namen erstellen"
        }
      },
      {
        "id": "D",
        "text": {
          "en": "Close unrelated incidents",
          "de": "Nicht zusammenhängende Vorfälle schließen"
        }
      }
    ],
    "correct": [
      "A"
    ],
    "explanation": {
      "en": "Attack path analysis is used to prioritize remediation that actually breaks exploitable chains, such as removing exposure or overprivileged access.",
      "de": "Die Attack-Path-Analyse wird verwendet, um Behebungsmaßnahmen zu priorisieren, die tatsächlich ausnutzbare Ketten unterbrechen, etwa das Entfernen von Exposition oder übermäßigen Berechtigungen."
    },
    "hint": {
      "en": "Break the attacker path, not the reporting view.",
      "de": "Unterbrechen Sie den Angreiferpfad und nicht nur die Berichtsansicht."
    },
    "reference": "https://learn.microsoft.com/en-us/azure/defender-for-cloud/concept-attack-path"
  },
  {
    "id": "sc200-299",
    "type": "single",
    "domain": {
      "en": "Mitigate Threats Using Microsoft Defender for Cloud",
      "de": "Bedrohungen mit Microsoft Defender for Cloud mindern"
    },
    "difficulty": "easy",
    "scenario": null,
    "question": {
      "en": "Why is JIT VM access considered a hardening control?",
      "de": "Warum gilt JIT-VM-Zugriff als Härtungsmaßnahme?"
    },
    "options": [
      {
        "id": "A",
        "text": {
          "en": "It reduces persistent exposure of management ports",
          "de": "Er reduziert die dauerhafte Exponierung von Verwaltungsports"
        }
      },
      {
        "id": "B",
        "text": {
          "en": "It increases phishing simulation coverage",
          "de": "Er erhöht die Abdeckung von Phishing-Simulationen"
        }
      },
      {
        "id": "C",
        "text": {
          "en": "It writes KQL queries for Sentinel",
          "de": "Er schreibt KQL-Abfragen für Sentinel"
        }
      },
      {
        "id": "D",
        "text": {
          "en": "It replaces incident triage",
          "de": "Er ersetzt die Vorfallstriage"
        }
      }
    ],
    "correct": [
      "A"
    ],
    "explanation": {
      "en": "JIT hardens machines by limiting when and how long remote management ports are exposed.",
      "de": "JIT härtet Maschinen, indem es begrenzt, wann und wie lange Remote-Verwaltungsports exponiert sind."
    },
    "hint": {
      "en": "Think shrinking the open-port attack surface.",
      "de": "Denken Sie daran, die Angriffsfläche offener Ports zu verkleinern."
    },
    "reference": "https://learn.microsoft.com/en-us/azure/defender-for-cloud/just-in-time-access-overview"
  },
  {
    "id": "sc200-300",
    "type": "single",
    "domain": {
      "en": "Mitigate Threats Using Microsoft Defender for Cloud",
      "de": "Bedrohungen mit Microsoft Defender for Cloud mindern"
    },
    "difficulty": "medium",
    "scenario": {
      "en": "A production IIS server should not be launching random tools outside its normal operating profile.",
      "de": "Ein produktiver IIS-Server sollte keine zufälligen Tools außerhalb seines normalen Betriebsprofils starten."
    },
    "question": {
      "en": "For which type of workload are adaptive application controls most useful?",
      "de": "Für welche Art von Workload sind adaptive Anwendungssteuerungen am nützlichsten?"
    },
    "options": [
      {
        "id": "A",
        "text": {
          "en": "Servers with stable and predictable application patterns",
          "de": "Server mit stabilen und vorhersehbaren Anwendungsmustern"
        }
      },
      {
        "id": "B",
        "text": {
          "en": "Short-lived build agents that constantly change toolsets",
          "de": "Kurzlebige Build-Agenten mit ständig wechselnden Toolsets"
        }
      },
      {
        "id": "C",
        "text": {
          "en": "Mailboxes in Exchange Online",
          "de": "Postfächer in Exchange Online"
        }
      },
      {
        "id": "D",
        "text": {
          "en": "Watchlists in Sentinel",
          "de": "Watchlists in Sentinel"
        }
      }
    ],
    "correct": [
      "A"
    ],
    "explanation": {
      "en": "Adaptive application controls work best where normal application behavior is consistent enough to recommend meaningful allowlists.",
      "de": "Adaptive Anwendungssteuerungen funktionieren am besten dort, wo normales Anwendungsverhalten konsistent genug ist, um sinnvolle Allowlisten zu empfehlen."
    },
    "hint": {
      "en": "Choose a stable server workload.",
      "de": "Wählen Sie einen stabilen Server-Workload."
    },
    "reference": "https://learn.microsoft.com/en-us/azure/defender-for-cloud/adaptive-application-controls"
  },
  {
    "id": "sc200-301",
    "type": "single",
    "domain": {
      "en": "Mitigate Threats Using Microsoft Defender for Cloud",
      "de": "Bedrohungen mit Microsoft Defender for Cloud mindern"
    },
    "difficulty": "medium",
    "scenario": null,
    "question": {
      "en": "At what scope can Defender for Cloud regulatory compliance information commonly be reviewed?",
      "de": "Auf welcher Ebene können regulatorische Compliance-Informationen in Defender for Cloud üblicherweise eingesehen werden?"
    },
    "options": [
      {
        "id": "A",
        "text": {
          "en": "Management group or subscription scope",
          "de": "Managementgruppen- oder Abonnementebene"
        }
      },
      {
        "id": "B",
        "text": {
          "en": "Only on a single mailbox",
          "de": "Nur auf Ebene eines einzelnen Postfachs"
        }
      },
      {
        "id": "C",
        "text": {
          "en": "Only inside a workbook",
          "de": "Nur innerhalb eines Workbooks"
        }
      },
      {
        "id": "D",
        "text": {
          "en": "Only in Teams",
          "de": "Nur in Teams"
        }
      }
    ],
    "correct": [
      "A"
    ],
    "explanation": {
      "en": "Regulatory compliance can be viewed across Azure scopes such as management groups and subscriptions to support governance reporting.",
      "de": "Regulatorische Compliance kann über Azure-Bereiche wie Managementgruppen und Abonnements hinweg angezeigt werden, um Governance-Reporting zu unterstützen."
    },
    "hint": {
      "en": "Think Azure governance scopes.",
      "de": "Denken Sie an Azure-Governance-Bereiche."
    },
    "reference": "https://learn.microsoft.com/en-us/azure/defender-for-cloud/concept-regulatory-compliance-standards"
  },
  {
    "id": "sc200-302",
    "type": "multiple",
    "domain": {
      "en": "Mitigate Threats Using Microsoft Defender for Cloud",
      "de": "Bedrohungen mit Microsoft Defender for Cloud mindern"
    },
    "difficulty": "medium",
    "scenario": null,
    "question": {
      "en": "Which statements about Secure score in Defender for Cloud are true? Select all that apply.",
      "de": "Welche Aussagen über Secure Score in Defender for Cloud sind richtig? Wählen Sie alle zutreffenden Antworten aus."
    },
    "options": [
      {
        "id": "A",
        "text": {
          "en": "It reflects posture improvement opportunities",
          "de": "Er spiegelt Möglichkeiten zur Verbesserung der Sicherheitslage wider"
        }
      },
      {
        "id": "B",
        "text": {
          "en": "It is influenced by completing applicable recommendations",
          "de": "Er wird durch die Umsetzung anwendbarer Empfehlungen beeinflusst"
        }
      },
      {
        "id": "C",
        "text": {
          "en": "It can be reviewed across scoped cloud resources",
          "de": "Er kann über abgegrenzte Cloudressourcen hinweg geprüft werden"
        }
      },
      {
        "id": "D",
        "text": {
          "en": "It is the same thing as incident severity",
          "de": "Er ist dasselbe wie die Schwere eines Vorfalls"
        }
      }
    ],
    "correct": [
      "A",
      "B",
      "C"
    ],
    "explanation": {
      "en": "Secure score is a posture metric tied to recommendations and scope. It is not an incident severity rating.",
      "de": "Secure Score ist eine Kennzahl zur Sicherheitslage, die an Empfehlungen und den Geltungsbereich gebunden ist. Er ist keine Vorfallsschwerebewertung."
    },
    "hint": {
      "en": "Think posture metric, not alert severity.",
      "de": "Denken Sie an eine Kennzahl zur Sicherheitslage und nicht an Warnschwere."
    },
    "reference": "https://learn.microsoft.com/en-us/azure/defender-for-cloud/secure-score-security-controls"
  },
  {
    "id": "sc200-303",
    "type": "single",
    "domain": {
      "en": "Mitigate Threats Using Microsoft Defender for Cloud",
      "de": "Bedrohungen mit Microsoft Defender for Cloud mindern"
    },
    "difficulty": "medium",
    "scenario": {
      "en": "The SOC wants to move from a posture finding into adjacent cloud resources without manually clicking through many pages.",
      "de": "Das SOC möchte von einem Posture-Befund aus zu benachbarten Cloudressourcen wechseln, ohne sich manuell durch viele Seiten zu klicken."
    },
    "question": {
      "en": "Which Defender for Cloud capability is best for interactively finding an internet-exposed resource connected to a sensitive data resource?",
      "de": "Welche Defender-for-Cloud-Funktion eignet sich am besten, um interaktiv eine internetexponierte Ressource zu finden, die mit einer sensiblen Datenressource verbunden ist?"
    },
    "options": [
      {
        "id": "A",
        "text": {
          "en": "Cloud Security Explorer",
          "de": "Cloud Security Explorer"
        }
      },
      {
        "id": "B",
        "text": {
          "en": "Regulatory compliance dashboard",
          "de": "Dashboard für regulatorische Compliance"
        }
      },
      {
        "id": "C",
        "text": {
          "en": "Threat Explorer",
          "de": "Threat Explorer"
        }
      },
      {
        "id": "D",
        "text": {
          "en": "Action center",
          "de": "Action Center"
        }
      }
    ],
    "correct": [
      "A"
    ],
    "explanation": {
      "en": "Cloud Security Explorer supports graph exploration of exposure and relationships, which is ideal for tracing connected cloud resources.",
      "de": "Cloud Security Explorer unterstützt die graphbasierte Untersuchung von Exposition und Beziehungen und ist ideal, um verbundene Cloudressourcen nachzuverfolgen."
    },
    "hint": {
      "en": "Use the graph exploration view.",
      "de": "Verwenden Sie die graphbasierte Untersuchungsansicht."
    },
    "reference": "https://learn.microsoft.com/en-us/azure/defender-for-cloud/concept-cloud-security-explorer"
  },
  {
    "id": "sc200-304",
    "type": "multiple",
    "domain": {
      "en": "Mitigate Threats Using Microsoft Defender for Cloud",
      "de": "Bedrohungen mit Microsoft Defender for Cloud mindern"
    },
    "difficulty": "medium",
    "scenario": null,
    "question": {
      "en": "Which events can commonly be used to trigger Defender for Cloud workflow automation? Select all that apply.",
      "de": "Welche Ereignisse können üblicherweise verwendet werden, um die Workflow-Automatisierung von Defender for Cloud auszulösen? Wählen Sie alle zutreffenden Antworten aus."
    },
    "options": [
      {
        "id": "A",
        "text": {
          "en": "Security alerts",
          "de": "Sicherheitswarnungen"
        }
      },
      {
        "id": "B",
        "text": {
          "en": "Recommendations",
          "de": "Empfehlungen"
        }
      },
      {
        "id": "C",
        "text": {
          "en": "Regulatory compliance changes tied to recommendations",
          "de": "Änderungen der regulatorischen Compliance, die mit Empfehlungen verknüpft sind"
        }
      },
      {
        "id": "D",
        "text": {
          "en": "Every workbook refresh",
          "de": "Jede Workbook-Aktualisierung"
        }
      }
    ],
    "correct": [
      "A",
      "B",
      "C"
    ],
    "explanation": {
      "en": "Workflow automation is designed around security findings and recommendations, not around workbook rendering events.",
      "de": "Die Workflow-Automatisierung ist auf Sicherheitsbefunde und Empfehlungen ausgelegt und nicht auf Ereignisse beim Rendern von Workbooks."
    },
    "hint": {
      "en": "Choose security findings and posture events, not dashboard refreshes.",
      "de": "Wählen Sie Sicherheitsbefunde und Posture-Ereignisse und keine Dashboard-Aktualisierungen."
    },
    "reference": "https://learn.microsoft.com/en-us/azure/defender-for-cloud/workflow-automation"
  },
  {
    "id": "sc200-305",
    "type": "single",
    "domain": {
      "en": "Mitigate Threats Using Microsoft Defender for Cloud",
      "de": "Bedrohungen mit Microsoft Defender for Cloud mindern"
    },
    "difficulty": "medium",
    "scenario": null,
    "question": {
      "en": "What is the key advantage of attack path analysis over reviewing isolated recommendations one by one?",
      "de": "Was ist der entscheidende Vorteil der Attack-Path-Analyse gegenüber der isolierten Prüfung einzelner Empfehlungen?"
    },
    "options": [
      {
        "id": "A",
        "text": {
          "en": "It shows how findings combine into exploitable attack chains",
          "de": "Sie zeigt, wie Befunde sich zu ausnutzbaren Angriffsketten verbinden"
        }
      },
      {
        "id": "B",
        "text": {
          "en": "It replaces all compliance standards",
          "de": "Sie ersetzt alle Compliance-Standards"
        }
      },
      {
        "id": "C",
        "text": {
          "en": "It disables secure score calculations",
          "de": "Sie deaktiviert Secure-Score-Berechnungen"
        }
      },
      {
        "id": "D",
        "text": {
          "en": "It stores raw network packets",
          "de": "Sie speichert rohe Netzwerkpakete"
        }
      }
    ],
    "correct": [
      "A"
    ],
    "explanation": {
      "en": "Attack path analysis adds attacker context by showing relationships between exposures so remediation can be prioritized by actual risk paths.",
      "de": "Die Attack-Path-Analyse fügt Angreiferkontext hinzu, indem sie Beziehungen zwischen Expositionen zeigt, sodass Behebungen nach tatsächlichen Risikopfaden priorisiert werden können."
    },
    "hint": {
      "en": "Pick the option that adds relationship context and prioritization.",
      "de": "Wählen Sie die Option, die Beziehungskontext und Priorisierung hinzufügt."
    },
    "reference": "https://learn.microsoft.com/en-us/azure/defender-for-cloud/concept-attack-path"
  },
  {
    "id": "sc200-306",
    "type": "single",
    "domain": {
      "en": "Mitigate Threats Using Microsoft Defender for Cloud",
      "de": "Bedrohungen mit Microsoft Defender for Cloud mindern"
    },
    "difficulty": "medium",
    "scenario": {
      "en": "Executives want a posture trend, while auditors want evidence mapped to formal controls.",
      "de": "Führungskräfte möchten einen Trend der Sicherheitslage, während Prüfer Nachweise verlangen, die formalen Kontrollen zugeordnet sind."
    },
    "question": {
      "en": "What is the best way to describe the difference between Secure score and the regulatory compliance dashboard?",
      "de": "Wie lässt sich der Unterschied zwischen Secure Score und dem Dashboard für regulatorische Compliance am besten beschreiben?"
    },
    "options": [
      {
        "id": "A",
        "text": {
          "en": "Secure score measures posture improvement, while regulatory compliance maps status to standards and controls",
          "de": "Secure Score misst die Verbesserung der Sicherheitslage, während regulatorische Compliance den Status Standards und Kontrollen zuordnet"
        }
      },
      {
        "id": "B",
        "text": {
          "en": "Secure score shows incidents, while compliance shows bookmarks",
          "de": "Secure Score zeigt Vorfälle, während Compliance Lesezeichen zeigt"
        }
      },
      {
        "id": "C",
        "text": {
          "en": "Secure score is for email, while compliance is for endpoints only",
          "de": "Secure Score ist für E-Mail, während Compliance nur für Endpunkte ist"
        }
      },
      {
        "id": "D",
        "text": {
          "en": "They are identical views with different names",
          "de": "Es sind identische Ansichten mit unterschiedlichen Namen"
        }
      }
    ],
    "correct": [
      "A"
    ],
    "explanation": {
      "en": "Secure score is a posture metric focused on improvement actions, whereas regulatory compliance organizes posture findings against formal standards and control sets.",
      "de": "Secure Score ist eine Kennzahl für die Sicherheitslage mit Fokus auf Verbesserungsmaßnahmen, während regulatorische Compliance Posture-Befunde gegenüber formalen Standards und Kontrollsätzen organisiert."
    },
    "hint": {
      "en": "One is posture scoring; the other is standards mapping.",
      "de": "Das eine ist Posture-Bewertung, das andere die Zuordnung zu Standards."
    },
    "reference": "https://learn.microsoft.com/en-us/azure/defender-for-cloud/concept-regulatory-compliance-standards"
  }
];
  if (window.ExamData && window.ExamData['sc-200']) {
    window.ExamData['sc-200'].questions = window.ExamData['sc-200'].questions.concat(extra);
  }
})();
