You have a custom Microsoft Sentinel workbook named Workbooks.You need to add a grid to Workbook1. The solution must ensure that the grid contains a maximum of 100 rows.What should you do?

In the query editor interface, select Advanced Editor

In the query editor interface, configure Settings.

In the query editor interface, select Advanced Editor

In the grid query, include the project operator.

In the grid query, include the take operator.

You have an Azure subscription that uses Microsoft Defender for Cloud and contains a resource group named RG1. RG1. You need to configure just in time (JIT) VM access for the virtual machines in RG1.The solution must meet the following• Limit the maximum request time to two hours.• Limit protocol access to Remote Desktop Protocol (RDP) only.• Minimize administrative effort.What should you use?

Azure AD Privileged Identity Management (PIM)

You have an Azure subscription that uses Microsoft Defender for Endpoint.You need to ensure that you can allow or block a user-specified range of IP addresses and URLs.What should you enable first in the advanced features from the Endpoints Settings in the Microsoft 365 Defender portal?

endpoint detection and response (EDR) in block mode

You have an Azure subscription that uses Microsoft Defender for Cloud and contains a storage account named storage1. You receive an alert that there was an unusually high volume of delete operations on the blobs in storage1.You need to identify which blobs were deleted.What should you review?

the Azure Storage Analytics logs

the related entities of the alert

You have an Azure subscription that has Microsoft Defender for Cloud enabled.You have a virtual machine that runs Windows 10 and has the Log Analytics agent installed.You need to simulate an attack on the virtual machine that will generate an alert.What should you do first?

Copy a executable and rename the file as ASC_AlerTest_662jf10N,exe

Run the Log Analytics Troubleshooting Tool.

Copy a executable and rename the file as ASC_AlerTest_662jf10N,exe

Modify the settings of the Microsoft Monitoring Agent.

Run the MMASetup executable and specify the -foo argument

You have a Microsoft 365 subscription that uses Microsoft Defender for Endpoint.You need to add threat indicators for all the IP addresses in a range of 171.23.3432-171.2334.63. The solution must minimize administrative effort.What should you do in the Microsoft 365 Defender portal?

Create an import file that contains the individual IP addresses in the range. Select Import and import the file.

Create an import file that contains the IP address of 171.23.34.32/27. Select Import and import the file.

Select Add indicator and set the IP address to 171.2334.32-171.23.34.63.

Select Add indicator and set the IP address to 171.23.34.32/27

Create an import file that contains the individual IP addresses in the range. Select Import and import the file.

Your company has an on-premises network that uses Microsoft Defender for Identity.The Microsoft Secure Score for the company includes a security assessment associated with unsecure Kerberos delegation.You need remediate the security risk.What should you do?

Modify the properties of the computer objects listed as exposed entities.

Install the Local Administrator Password Solution (LAPS) extension on the computers listed as exposed entities.

Modify the properties of the computer objects listed as exposed entities.

Disable legacy protocols on the computers listed as exposed entities.

Enforce LDAP signing on the computers listed as exposed entities.

You have an Azure subscription that uses Microsoft Defender for Cloud and contains a storage account named storage1. You receive an alert that there was an unusually high volume of delete operations on the blobs in storage1. You need to identify which blobs were deleted. What should you review?

the Azure Storage Analytics logs

the related entities of the alert

You have a Microsoft Sentinel workspace.You have a query named Query1 as shown in the following exhibit. You plan to create a custom parser named Parser 1. You need to use Query1 in Parser1. What should you do first?

In line 4. remove the TimeGenerated predicate.

In line 3, replace the 'contains operator with the !has operator.

You have an Azure subscription that contains a Microsoft Sentinel workspace. The workspace contains a Microsoft Defender for Cloud data connector. You need to customize which details will be included when an alert is created for a specific event. What should you do?

Enable User and Entity Behavior Analytics (UEBA)

Modify the properties of the connector.

Create a Data Collection Rule (DCR).

Enable User and Entity Behavior Analytics (UEBA)

You have a Microsoft 365 subscription that uses Microsoft 365 Defender A remediation action for an automated investigation quarantines a file across multiple devices. You need to mark the file as safe and remove the file from quarantine on the devices. What should you use m the Microsoft 365 Defender portal?

From the History tab in the Action center, revert the actions.

From Threat tracker, review the queries.

From the History tab in the Action center, revert the actions.

From the investigation page, review the AIR processes.

From Quarantine from the Review page, modify the rules.

You create an Azure subscription.You enable Microsoft Defender for Cloud for the subscription.You need to use Defender for Cloud to protect on-premises computers.What should you do on the on-premises computers?

Install the Log Analytics agent

Configure the Hybrid Runbook Worker role.

Install the Connected Machine agent.

Install the Log Analytics agent

You have an Azure subscription that uses Microsoft Defender for Cloud and contains 100 virtual machines that run Windows Server.You need to configure Defender for Cloud to collect event data from the virtual machines. The solution must minimize administrative effort and costs.Which two actions should you perform? Each correct answer presents part of the solution.NOTE: Each correct selection is worth one point.

From the workspace created by Defender for Cloud, set the data collection level to All Events

From Defender for Cloud in the Azure portal, enable automatic provisioning for the virtual machines.

From the workspace created by Defender for Cloud, set the data collection level to Common

From the Microsoft Endpoint Manager admin center, enable automatic enrollment.

From the Azure portal, create an Azure Event Grid subscription.

From the workspace created by Defender for Cloud, set the data collection level to All Events

From Defender for Cloud in the Azure portal, enable automatic provisioning for the virtual machines.

You have an Azure subscription that contains a user named User1.User1 is assigned an Azure Active Directory Premium Plan 2 licenseYou need to identify whether the identity of User1 was compromised during the last 90 days.What should you use?

Identity Secure Score recommendations

You have an Azure subscription that uses Microsoft Defender fof Ctoud.You have an Amazon Web Services (AWS) account that contains an Amazon Elastic Compute Cloud (EC2) instance named EC2-1.You need to onboard EC2-1 to Defender for Cloud.What should you install on EC2-1?

the Azure Connected Machine agent

the unified Microsoft Defender for Endpoint solution package

You have a Microsoft Sentinel workspace named Workspace1 and 200 custom Advanced Security Information Model (ASIM) parsers based on the DNS schema. You need to make the 200 parsers available in Workspace1. The solution must minimize administrative effort. What should you do first?

Copy the parsers to the Azure Monitor Logs page.

Create a JSON file based on the DNS template.

Create an XML file based on the DNS template.

Create a YAML file based on the DNS template.

Microsoft SC-200 Practice Test 5 - Free Online Exam Prep & Questions

DRAG DROP

A company wants to analyze by using Microsoft 365 Apps.

You need to describe the connected experiences the company can use.

Which connected experiences should you describe? To answer, drag the appropriate connected experiences to the correct description. Each connected experience may be used once, more than once, or not at all. You may need to drag the split between panes or scroll to view content.

NOTE: Each correct selection is worth one point.

Become a Premium Member for full access

Unlock Premium Member

Microsoft SC-200 Practice Test 5

Question

Microsoft SC-200 Practice Tests

Practice Tests