You have a Microsoft 365 tenant that uses Microsoft Exchange Online and Microsoft Defender for Office 365.What should you use to identify whether zero-hour auto purge (ZAP) moved an email message from the mailbox of a user?

the Threat Protection Status report in Microsoft Defender for Office 365

the mailbox audit log in Exchange

the Safe Attachments file types report in Microsoft Defender for Office 365

the mail flow report in Exchange

You have a Microsoft 365 subscription that contains 1,000 Windows 10 devices. The devices have Microsoft Office 365 installed.You need to mitigate the following device threats:Microsoft Excel macros that download scripts from untrusted websitesUsers that open executable attachments in Microsoft Outlook Outlook rules and forms exploits What should you use?

attack surface reduction rules in Microsoft Defender for Endpoint

adaptive application control in Azure Defender

Which rule setting should you configure to meet the Microsoft Sentinel requirements?

From Set rule logic, turn off suppression

From Analytic rule details, configure the tactics.

From Set rule logic, map the entities

From Analytic rule details, configure the severity.

You need to modify the anomaly detection policy settings to meet the Microsoft Defender for Cloud Apps requirements and resolve the reported problem.Which policy should you modify?

Activity from suspicious IP addresses

Activity from anonymous IP addresses

You need to configure event monitoring for Server1. The solution must meet the Microsoft Sentinel requirements. What should you create first?

a Microsoft Sentinel automation rule

a Microsoft Sentinel scheduled query rule

You need to implement the Defender for Cloud requirements.What should you configure for Server2?

the Azure Automanage machine configuration extension for Windows

the Microsoft Antimalware extension

the Azure Automanage machine configuration extension for Windows

You need to ensure that the configuration of HuntingQuery1 meets the Microsoft Sentinel requirements.What should you do?

Add HuntingQuery1 to favorites.

Add HuntingQuery1 to a livestream.

Create an Azure Automation rule.

Add HuntingQuery1 to favorites.

You need to ensure that the processing of incidents generated by rulequery1 meets the Microsoft Sentinel requirements.What should you create first?

a playbook with an incident trigger

a playbook with an entity trigger

a playbook with an alert trigger

You need to implement the Defender for Cloud requirements.Which subscription-level role should you assign to Group1?

Security Assessment Contributor

You need to ensure that the Group1 members can meet the Microsoft Sentinel requirements.Which role should you assign to Group1?

Microsoft Sentinel Playbook Operator

Microsoft Sentinel Automation Contributor

Microsoft Sentinel Playbook Operator

You need to complete the query for failed sign-ins to meet the technical requirements.Where can you find the column name to complete the where clause?

the query windows of the Log Analytics workspace

Security alerts in Azure Security Center

the query windows of the Log Analytics workspace

You need to create the test rule to meet the Azure Sentinel requirements.What should you do when you create the rule?

From Set rule logic, map the entities.

From Set rule logic, turn off suppression.

From Analytics rule details, configure the tactics.

From Set rule logic, map the entities.

From Analytics rule details, configure the severity.

You need to restrict cloud apps running on CLIENT1 to meet the Microsoft Defender for Endpoint requirements.Which two configurations should you modify? Each correct answer present part of the solution.NOTE: Each correct selection is worth one point.

Advanced features from Settings in Microsoft Defender Security Center

the Cloud Discovery settings in Cloud App Security

the Onboarding settings from Device management in Microsoft Defender Security Center

Cloud App Security anomaly detection policies

Advanced features from Settings in Microsoft Defender Security Center

the Cloud Discovery settings in Cloud App Security

You need to restrict cloud apps running on CUENT1 to meet the Microsoft Defender for Endpoint requirements. Which two configurations should you modify? Each correct answer presents part of the solution. NOTE: Each correct selection is worth one point.

the Cloud Discovery settings in Microsoft Defender for Cloud Apps

Advanced features from the Endpoints Settings in the Microsoft 365 Defender portal

the Cloud Discovery settings in Microsoft Defender for Cloud Apps

the Onboarding settings from Device management in Settings in Microsoft 365 Defender portal

Microsoft Defender for Cloud Apps anomaly detection policies

Advanced features from the Endpoints Settings in the Microsoft 365 Defender portal

You need to implement the Azure Information Protection requirements.What should you configure first?

Advanced features from Settings in Microsoft Defender Security Center

Device health and compliance reports settings in Microsoft Defender Security Center

scanner clusters in Azure Information Protection from the Azure portal

content scan jobs in Azure Information Protection from the Azure portal

Advanced features from Settings in Microsoft Defender Security Center

You need to modify the anomaly detection policy settings to meet the Cloud App Security requirements.Which policy should you modify?

Activity from suspicious IP addresses

Activity from anonymous IP addresses

You have a Microsoft 365 B5 subscription that uses Microsoft Defender XDR. You are investigating an incidentYou need to review the incident tasks that were performed. What can you use on the Incident page?

Tasks, Activity log, and Alert timeline

Microsoft SC-200 Practice Test 3 - Free Online Exam Questions 81-120

You are configuring Microsoft Cloud App Security.

You have a custom threat detection policy based on the IP address ranges of your companyâ€™s United States-based offices.

You receive many alerts related to impossible travel and sign-ins from risky IP addresses.

You determine that 99% of the alerts are legitimate sign-ins from your corporate offices.

You need to prevent alerts for legitimate sign-ins from known locations.

Which two actions should you perform? Each correct answer presents part of the solution.

NOTE: Each correct selection is worth one point.

Become a Premium Member for full access

Unlock Premium Member

Microsoft SC-200 Practice Test 3

Question

Microsoft SC-200 Practice Tests

Practice Tests