AI Bot
SC-500: Cloud & AI Threat Detection and Incident Response Flashcards
Microsoft Cloud and AI Security Engineer Associate SC-500 Flashcards
Study our SC-500: Cloud & AI Threat Detection and Incident Response flashcards for the Microsoft Cloud and AI Security Engineer Associate SC-500 exam with 41+ flashcards. View as flashcards, a searchable table, or as a fun matching game.
| Front | Back |
| Define alert triage | The process of validating enriching and prioritizing alerts to determine if they are true positive and require investigation |
| Define Fusion in Sentinel | A capability that correlates multiple low fidelity alerts into higher fidelity incidents using ML based correlation |
| Describe the first step of incident investigation | Define scope by identifying affected entities assets timelines and initial indicators of compromise |
| Describe watchlist use case for AI workloads | Maintain list of approved models and datasets to detect unauthorized model registrations or training jobs |
| Give a common KQL pattern for pivoting from alerts to raw logs | Use AlertEvidence or Entities to extract IP or host then join with relevant tables using where and timestamp filters |
| How do you reduce alert fatigue | Tune rule thresholds suppress noisy alerts use correlation and implement alert grouping and rate limiting |
| How does Defender integrate with Sentinel | Defender sends security alerts and recommendations to Sentinel via native data connectors for correlation and investigation |
| How to detect data poisoning | Monitor for anomalous training data uploads unexpected data schema changes or sudden shifts in model performance metrics |
| How to detect suspicious API keys usage | Alert on high rate of requests from single key unusual geolocations or API calls outside normal hours |
| How to handle remediation in multi tenant cloud | Coordinate with tenant owners use least privilege orchestration and document consent and gating steps |
| How to monitor model drift | Compare inbound inference distributions against baseline feature distributions and track model accuracy and error rates |
| How to validate a false positive | Recreate the event context check asset owner activity and corroborate with multiple independent logs |
| List five log sources critical for cloud and AI detection | Cloud audit logs network flow logs authentication logs application telemetry and model inference logs |
| List four triage enrichment actions | Query logs reverse DNS reputational lookup asset owner lookup and external threat intelligence |
| List three AI specific attack types | Data poisoning model inversion and prompt injection |
| Name a detection signal for prompt injection in AI services | Unusual sequences of user inputs repeated escape tokens or outputs that contain hidden or unexpected instructions |
| Name a practice to test detections | Run red team or purple team exercises and build regression tests to validate rule coverage |
| Name four types of analytics rules | Scheduled anomaly machine learning and fusion |
| Name key remediation steps after credential compromise | Reset passwords rotate keys revoke refresh tokens and review recent privileged activity |
| Name three common cloud attack techniques used against workloads | Credential theft lateral movement and privilege escalation |
| Name three safe actions for automated playbooks | Quarantine a VM disable a user account or block an IP address |
| What are hunting queries | Hypothesis driven KQL searches across logs to find stealthy or novel malicious activity not covered by analytics rules |
| What does UEBA stand for and why use it | User and Entity Behavior Analytics to detect anomalous behaviors that indicate insider threat or compromised accounts |
| What is a containment action for a compromised VM | Isolate network access stop suspicious processes and revoke temporary credentials |
| What is a KQL function to expand arrays | mv-expand to normalize array elements into rows for analysis |
| What is a Sentinel playbook | An automated response workflow built with Logic Apps to perform actions like notify isolate or remediate when triggered by alerts or incidents |
| What is a watchlist in Sentinel | Static reference data uploaded to Sentinel used to enrich detections and hunting queries |
| What is an analytics rule in Sentinel | A scheduled or near real time rule that converts events into alerts and incidents using KQL and detection logic |
| What is an incident playbook checklist | Containment steps evidence collection communication plan remediation steps and post incident review |
| What is evidence preservation best practice | Collect and snapshot logs preserve VM disk images and record chain of custody and timestamps |
| What is KQL | Kusto Query Language used to query and analyze log data in Sentinel and other Azure services |
| What is Microsoft Defender for Cloud | A cloud workload protection platform that provides security posture management and threat protection for cloud resources |
| What is Microsoft Sentinel | A cloud native SIEM for collecting analyzing and responding to security signals across cloud and hybrid environments |
| What is model exfiltration | A technique where an attacker extracts a machine learning model or training data via probing or repeated queries |
| What is sentinel notebook use | Advanced investigation data science and visualization using Jupyter notebooks with access to Sentinel data |
| What is severity scoring criteria in Sentinel | Impact on critical assets exploitability scope of affected resources and business impact determine severity |
| What is the primary goal of cloud threat detection | Identify malicious or unauthorized activity in cloud workloads early to reduce impact and enable rapid response |
| What is threat hunting hypothesis structure | Start with suspicion then define scope data sources query and success criteria for detecting the behavior |
| When should you escalate an incident to SOC tier 2 or higher | When the incident affects critical assets shows evidence of lateral movement or requires privileged remediation |
| Why design idempotent playbooks | To ensure repeated executions do not cause unintended side effects or duplicate actions |
| Why use service connectors like ServiceNow | To automate ticket creation assignment and maintain workflow between SOC tools and ITSM |
About the Flashcards
Flashcards for the Microsoft Cloud and AI Security Engineer Associate exam help students review core terminology and detection concepts for cloud and AI workloads, including Microsoft Sentinel, Microsoft Defender for Cloud, analytics rules, watchlists, and common log sources. Cards cover how alerts are generated, enriched, and correlated, plus Kusto Query Language (KQL) patterns for pivoting from alerts to raw logs and building hunting queries.
The deck also reinforces incident response and operations skills tested on the exam: alert triage, evidence preservation, containment and remediation steps, playbook design and safe automated actions, and model-specific threats such as prompt injection, data poisoning, model exfiltration, and monitoring model drift.
Topics covered in this flashcard deck:
- Cloud threat detection
- AI attack types
- Sentinel analytics and rules
- KQL queries and hunting
- Incident response playbooks