You receive an alert from Azure Defender for Key Vault.You discover that the alert is generated from multiple suspicious IP addresses.You need to reduce the potential of Key Vault secrets being leaked while you investigate the issue. The solution must be implemented as soon as possible and must minimize the impact on legitimate users.What should you do first?

Modify the access control settings for the key vault.

Create an application security group.

Modify the access policy for the key vault.

You have a Microsoft 365 subscription that uses Azure Defender.You have 100 virtual machines in a resource group named RG1.You assign the Security Admin roles to a new user named Sec Adm in 1.You need to ensure that SecAdminl can apply quick fixes to the virtual machines by using Azure Defender. The solution must use the principle of least privilege.Which role should you assign to SecAdminl?

the Security Reader role for the subscription

the Contributor for the subscription

You provision a Linux virtual machine in a new Azure subscription.You enable Azure Defender and onboard the virtual machine to Azure Defender.You need to verify that an attack on the virtual machine triggers an alert in Azure Defender.Which two Bash commands should you run on the virtual machine? Each correct answer presents part of the solution.NOTE: Each correct selection is worth one point.

cp /bin/echo ./asc_alerttest_662jfi039n

./asc_alerttest_662jfi039n testing eicar pipe

cp /bin/echo ./asc_alerttest_662jfi039n

./asc_alerttest_662jfi039n testing eicar pipe

You create an Azure subscription named sub1.In sub1, you create a Log Analytics workspace named workspace*!.You enable Azure Security Center and configure Security Center to use workspace*!.You need to colect security event logs from the Azure virtual machines that report to workspace 1.What should you do?

From Security Center, enable data colection

From Security Center, create a Workflow automation.

In workspace*!, create a workbook.

You are responsible for responding to Azure Defender for Key Vault alerts.During an investigation of an alert, you discover unauthorized attempts to access a key vault from a Tor exit node.What should you configure to mitigate the threat?

Key Vault firewals and virtual networks

Azure Active Directory (Azure AD) permissions

role-based access control (RBAC) for the key vault

the access policy settings of the key vault

You use Azure Defender.You have an Azure Storage account that contains sensitive information.You need to run a PowerShell script if someone accesses the storage account from a suspicious IP address.Which two actions should you perform? Each correct answer presents part of the solution.NOTE: Each correct selection is worth one point.

From Azure Security Center, enable workflow automation.

Create an Azure logic app that has an Azure Security Center alert trigger.

From Azure Security Center, enable workflow automation.

Create an Azure logic app that has a manual trigger.

Create an Azure logic app that has an Azure Security Center alert trigger.

Create an Azure logic app that has an HTTP trigger.

From Azure Active Directory (Azure AD), add an app registration.

You have a suppression rule in Azure Security Center for 10 virtual machines that are used for testing. The virtual machines run Windows Server.You are troubleshooting an issue on the virtual machines.In Security Center, you need to view the alerts generated by the virtual machines during the last five days.What should you do?

Change the state of the suppression rule to Disabled.

Change the rule expiration date of the suppression rule.

Change the state of the suppression rule to Disabled.

Modify the filter for the Security alerts page.

View the Windows event logs on the virtual machines.

You create an Azure subscription.You enable Azure Defender for the subscription.You need to use Azure Defender to protect on-premises computers.What should you do on the on-premises computers?

Install the Log Analytics agent.

Configure the Hybrid Runbook Worker role.

Install the Connected Machine agent.

A security administrator receives email alerts from Azure Defender for activities such as potential malware uploaded to a storage account and potential successful brute force attacks.The security administrator does NOT receive email alerts for activities such as antimalware action failed and suspicious network activity. The alerts appear in Azure Security Center.You need to ensure that the security administrator receives email alerts for all the activities.What should you configure in the Security Center settings?

the severity level of email notifications

the integration settings for Threat detection

You are configuring Azure Sentinel.You need to send a Microsoft Teams message to a channel whenever a sign-in from a suspicious IP address is detected.Which two actions should you perform in Azure Sentinel? Each correct answer presents part of the solution.NOTE: Each correct selection is worth one point.

Associate a playbook to an incident.

Enable Entity behavior analytics.

You need to visualize Azure Sentinel data and enrich the data by using third-party data sources to identify indicators of compromise (loC).What should you use?

hunting queries in Azure Sentinel

You have an existing Azure logic app that is used to block Azure Active Directory (Azure AD) users. The logic app is triggered manually.You deploy Azure Sentinel.You need to use the existing logic app as a playbook in Azure Sentinel.What should you do first?

Add a data connector to Azure Sentinel.

And a new scheduled query rule.

Add a data connector to Azure Sentinel.

Configure a custom Threat Intelligence connector in Azure Sentinel.

Modify the trigger in the logic app.

You have a playbook in Azure Sentinel.When you trigger the playbook, it sends an email to a distribution group.You need to modify the playbook to send the email to the owner of the resource instead of the distribution group.What should you do?

Add an alert and modify the action.

Add a parameter and modify the trigger.

Add a custom data connector and modify the trigger.

Add a condition and modify the action.

Add an alert and modify the action.

Your company stores the data for every project in a different Azure subscription. All the subscriptions use the same Azure Active Directory (Azure AD) tenant.Every project consists of multiple Azure virtual machines that run Windows Server. The Windows events of the virtual machines are stored in a Log Analytics workspace in each machine's respective subscription.You deploy Azure Sentinel to a new Azure subscription.You need to perform hunting queries in Azure Sentinel to search across all the Log Analytics workspaces of all the subscriptions.Which two actions should you perform? Each correct answer presents part of the solution.NOTE: Each correct selection is worth one point.

Create a query that uses the workspace expression and the union operator.

Add the Azure Sentinel solution to each workspace.

Add the Security Events connector to the Azure Sentinel workspace.

Create a query that uses the workspace expression and the union operator.

Create a query that uses the resource expression and the alias operator.

Add the Azure Sentinel solution to each workspace.

You have a custom analytics rule to detect threats in Azure Sentinel.You discover that the analytics rule stopped running. The rule was disabled, and the rule name has a prefix of AUTO DISABLED.What is a possible cause of the issue?

Permissions to one of the data sources of the rule query were modified.

There are connectivity issues between the data sources and Log Analytics.

The number of alerts exceeded 10,000 within two minutes.

The rule query takes too long to run and times out.

Permissions to one of the data sources of the rule query were modified.

You recently deployed Azure Sentinel.You discover that the default Fusion rule does not generate any alerts. You verify that the rule is enabled.You need to ensure that the Fusion rule can generate alerts.What should you do?

Disable, and then enable the rule.

Create a new machine learning analytics rule.

Microsoft SC-200 Practice Test 1 - Free Online Exam Prep & Questions

Question 1 / 40

Note: This question-is part of a series of questions that present the same scenario. Each question-in the series contains a unique solution that might meet the stated goals. Some question-sets might have more than one correct solution, while others might not have a correct solution.

After you answer a question-in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.

You use Azure Security Center.

You receive a security alert in Security Center.

You need to view recommendations to resolve the alert in Security Center.

Solution: From Security alerts, you select the alert, select Take Action, and then expand the Prevent future attacks section.

Does this meet the goal?

Yes

Comment (0)

Microsoft SC-200 Practice Test 1

Question

Microsoft SC-200 Practice Tests

Practice Tests