You have a Microsoft 365 B5 subscription that contains two groups named Group! and Group2 and uses Microsoft Copilot for Security. You need to configure Copilot for Security role assignments to meet the following requirements:* Ensure that members of Group1 can run prompts and respond to Microsoft Defender XDR security incidents.* Ensure that members of Group2 can run prompts.* Follow the principle of least privilege.You remove Everyone from the Copilot Contributor role.Which two actions should you perform next? Each correct answer presents part of the solution. NOTE: Each correct selection is worth one point.

Assign the Copilot Contributor role to Group2.

Assign the Security Operator role to Group1.

Assign the Copilot Contributor role to Group2.

Assign the Security Operator role to Group1.

Assign the Copilot Owner role to Group1.

Assign the Security Operator role to Group2.

Assign the Copilot Owner role to Group2.

You have an Azure subscription that contains a Microsoft Sentinel workspace named Workspace1 and a user named User1.You need to ensure that User1 can investigate incidents by using Workspace1. The solution must follow the principle of least privilege.Which role should you assign to User1?

Microsoft Sentinel Automation Contributor

You have a Microsoft 365 B5 subscription that contains a user named User1. The subscription uses Microsoft 365 Copilot for Security. Copilot for Security uses the Sentinel plugin. User1 is assigned the Copilot Contributor role.During an investigation, User1 submits a prompt and receives a notification that Copilot for Security cannot respond to requests because the security compute unit (SCU) usage is nearing the provisioned capacity limit.You need to ensure that User1 can use Copilot for Security to generate a successful response.What should User1 do?

Open a second Copilot for Security session and submit the prompt.

Wait one hour and resubmit the prompt.

Run the Microsoft Sentinel Optimization Workbook.

You have a Microsoft 365 subscription. You have the following KQL query.DeviceEvents| where ActionType == 'AntivirusDetection*You need to ensure that you can create a Microsoft Defender XDR custom detection rule by using the query.What should you add to the query?

sumarize (Timestamp, ReportId)>arg_max(Timestanp, Reportld), count{) by Deviceld

summarize (Timestamp, DeviceHanw)=arg_min(Timestampf DeviceName), count() by Deviceld

sumarize (Timestamp, ReportId)>arg_max(Timestanp, Reportld), count{) by Deviceld

summarize (Timestamp)=range(Timestatip), count() by Deviceld

sumarize (ReportId)=make_set(ReportId), count() by Deviceld

You have a third-party security information and event management (SIEM) solution.You need to ensure that the SIEM solution can generate alerts for Azure Active Directory (Azure AD) sign-events in near real time.What should you do to route events to the SIEM solution?

Configure the Diagnostics settings in Azure AD to stream to an event hub.

Create an Azure Sentinel workspace that has a Security Events connector.

Configure the Diagnostics settings in Azure AD to stream to an event hub.

Create an Azure Sentinel workspace that has an Azure Active Directory connector.

Configure the Diagnostics settings in Azure AD to archive to a storage account.

You have an Azure subscription that contains a virtual machine named VM1 and uses Azure Defender. Azure Defender has automatic provisioning enabled.You need to create a custom alert suppression rule that will supress false positive alerts for suspicious use of PowerShell on VM1.What should you do first?

On VM1 trigger a PowerShell alert.

From Azure Security Center, add a workflow automation.

On VM1, run the Get-MPThreatCatalog cmdlet.

On VM1 trigger a PowerShell alert.

From Azure Security Center, export the alerts to a Log Analytics workspace.

You have a Microsoft 365 E5 subscription that uses Microsoft SharePoint Online.You delete users from the subscription.You need to be notified if the deleted users downloaded numerous documents from SharePoint Online sites during the month before their accounts were deleted.What should you use?

an alert policy in Microsoft Defender for Office 365

a file policy in Microsoft Defender for Cloud Apps

an alert policy in Microsoft Defender for Office 365

You have a Microsoft 365 subscription that has Microsoft 365 Defender enabled.You need to identify all the changes made to sensitivity labels during the past seven days.What should you use?

Activity explorer in the Microsoft 365 compliance center

the Incidents blade of the Microsoft 365 Defender portal

the Alerts settings on the Data Loss Prevention blade of the Microsoft 365 compliance center

Activity explorer in the Microsoft 365 compliance center

the Explorer settings on the Email & collaboration blade of the Microsoft 365 Defender portal

You have five on-premises Linux servers.You have an Azure subscription that uses Microsoft Defender for Cloud.You need to use Defender for Cloud to protect the Linux servers.What should you install on the servers first?

the Azure Connected Machine agent

the Guest Configuration extension

You have an Azure subscription that uses Microsoft Sentinel.You need to minimize the administrative effort required to respond to the incidents and remediate the security threats detected by Microsoft Sentinel.Which two features should you use? Each correct answer presents part of the solution.NOTE: Each correct selection is worth one point.

Microsoft Sentinel automation rules

You have a Microsoft Sentinel workspace that contains the following incident.Brute force attack against Azure Portal analytics rule has been triggered.You need to identify the geolocation information that corresponds to the incident.What should you do?

From Overview, review the Potential malicious events map.

From Incidents, review the details of the iPCustomEntity entity associated with the incident.

From Incidents, review the details of the AccouncCuscomEntity entity associated with the incident.

From Investigation, review insights on the incident entity.

You have two Azure subscriptions that use Microsoft Defender for Cloud.You need to ensure that specific Defender for Cloud security alerts are suppressed at the root management group level. The solution must minimize administrative effort.What should you do in the Azure portal?

Modify the alert settings in Defender for Cloud.

Create an Azure Policy assignment.

Modify the Workload protections settings in Defender for Cloud.

Create an alert rule in Azure Monitor.

Modify the alert settings in Defender for Cloud.

You have a Microsoft 365 E5 subscription that is linked to a hybrid Azure AD tenant.You need to identify all the changes made to Domain Admins group during the past 30 days.What should you use?

the Modifications of sensitive groups report in Microsoft Defender for Identity

the Azure Active Directory Provisioning Analysis workbook

the Overview settings of Insider risk management

the Modifications of sensitive groups report in Microsoft Defender for Identity

the identity security posture assessment in Microsoft Defender for Cloud Apps

You have a Microsoft Sentinel workspace.You need to prevent a built-in Advance Security information Model (ASIM) parse from being updated automatically.What are two ways to achieve this goal? Each correct answer presents a complete solution.NOTE: Each correct selection is worth one point.

Redeploy the built-in parse and specify a CallerContext parameter of any and a SourceSpecificParse parameter of any.

Build a custom unify parse and include the build- parse version

Redeploy the built-in parse and specify a CallerContext parameter of any and a SourceSpecificParse parameter of any.

Create a hunting query that references the built-in parse.

Redeploy the built-in parse and specify a CallerContext parameter of built-in.

Build a custom unify parse and include the build- parse version

Create an analytics rule that includes the built-in parse

You have a Microsoft Sentinel workspace.You receive multiple alerts for failed sign in attempts to an account.You identify that the alerts are false positives.You need to prevent additional failed sign-in alerts from being generated for the account. The solution must meet the following requirements.• Ensure that failed sign-in alerts are generated for other accounts.• Minimize administrative effortWhat should do?

Add an activity template to the entity behavior.

Microsoft SC-200 Practice Test 4 - Free Online Exam Questions 121-160

You have a Microsoft 365 E5 subscription that uses Microsoft Copilot for Security. You plan to run the following code to create a custom Copilot for Security plugin.

Microsoft SC-200 image Question 3 63875591094112013860295

You need to specify a format and complete the code segment. Which format should you use for the <target> variable?

Become a Premium Member for full access

Unlock Premium Member

Microsoft SC-200 Practice Test 4

Question

Microsoft SC-200 Practice Tests

Practice Tests