Home / Microsoft / SC-200 / List of questions

Ask Question

Microsoft SC-200 Practice Test - Questions Answers, Page 12

List of questions

Question 111

HOTSPOT

You need to create the analytics rule to meet the Azure Sentinel requirements.

What should you do? To answer, select the appropriate options in the answer area.

NOTE: Each correct selection is worth one point.

Microsoft SC-200 image Question 111 107849 10052024010847000

Show Answer Show Case Study Comment (0)

Correct answer: Microsoft SC-200 image answer Question 111 107849 10052024010847000

Explanation:

Reference:

https://docs.microsoft.com/en-us/azure/sentinel/tutorial-detect-threats-custom#set-automated-responses-and-create-the-rule

https://docs.microsoft.com/en-us/azure/sentinel/tutorial-respond-threats-playbook

asked 05/10/2024

Tom Nice

30 questions

Question 112

You need to restrict cloud apps running on CLIENT1 to meet the Microsoft Defender for Endpoint requirements.

Which two configurations should you modify? Each correct answer present part of the solution.

NOTE: Each correct selection is worth one point.

the Onboarding settings from Device management in Microsoft Defender Security Center

Cloud App Security anomaly detection policies

Advanced features from Settings in Microsoft Defender Security Center

the Cloud Discovery settings in Cloud App Security

Show Answer Show Case Study Comment (0)

Question 113

You need to restrict cloud apps running on CUENT1 to meet the Microsoft Defender for Endpoint requirements. Which two configurations should you modify? Each correct answer presents part of the solution. NOTE: Each correct selection is worth one point.

the Cloud Discovery settings in Microsoft Defender for Cloud Apps

the Onboarding settings from Device management in Settings in Microsoft 365 Defender portal

Microsoft Defender for Cloud Apps anomaly detection policies

Advanced features from the Endpoints Settings in the Microsoft 365 Defender portal

Show Answer Show Case Study Comment (0)

Question 114

HOTSPOT

You need to configure the Microsoft Sentinel integration to meet the Microsoft Sentinel requirements. What should you do? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.

Microsoft SC-200 image Question 114 107852 10052024010847000

Show Answer Show Case Study Comment (0)

Correct answer: Microsoft SC-200 image answer Question 114 107852 10052024010847000

asked 05/10/2024

Zahidul Haque

47 questions

Question 115

HOTSPOT

You need to implement Microsoft Defender for Cloud to meet the Microsoft Defender for Cloud requirements and the business requirements. What should you include in the solution? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.

Microsoft SC-200 image Question 115 107853 10052024010847000

Show Answer Show Case Study Comment (0)

Correct answer: Microsoft SC-200 image answer Question 115 107853 10052024010847000

Explanation:

asked 05/10/2024

Razan Althubaiti

42 questions

Question 116

You need to implement the Azure Information Protection requirements.

What should you configure first?

Device health and compliance reports settings in Microsoft Defender Security Center

scanner clusters in Azure Information Protection from the Azure portal

content scan jobs in Azure Information Protection from the Azure portal

Advanced features from Settings in Microsoft Defender Security Center

Show Answer Show Case Study Comment (0)

Question 117

You need to modify the anomaly detection policy settings to meet the Cloud App Security requirements.

Which policy should you modify?

Activity from suspicious IP addresses

Activity from anonymous IP addresses

Impossible travel

Risky sign-in

Show Answer Show Case Study Comment (0)

Question 118

DRAG DROP

You need to configure DC1 to meet the business requirements.

Which four actions should you perform in sequence? To answer, move the appropriate actions from the list of actions to the answer area and arrange them in the correct order.

Microsoft SC-200 image Question 118 107774 10052024010847000

Show Answer Show Case Study Comment (0)

Correct answer: Microsoft SC-200 image answer Question 118 107774 10052024010847000

Explanation:

Step 1: log in to https://portal.atp.azure.com as a global admin

Step 2: Create the instance

Step 3. Connect the instance to Active Directory

Step 4. Download and install the sensor.

Reference:

https://docs.microsoft.com/en-us/defender-for-identity/install-step1

https://docs.microsoft.com/en-us/defender-for-identity/install-step4

asked 05/10/2024

Ali Alaqoul

34 questions

Question 119

You have a third-party security information and event management (SIEM) solution.

You need to ensure that the SIEM solution can generate alerts for Azure Active Directory (Azure AD) sign-events in near real time.

What should you do to route events to the SIEM solution?

Create an Azure Sentinel workspace that has a Security Events connector.

Configure the Diagnostics settings in Azure AD to stream to an event hub.

Create an Azure Sentinel workspace that has an Azure Active Directory connector.

Configure the Diagnostics settings in Azure AD to archive to a storage account.

Show Answer Comment (0)

Question 120

You have an Azure subscription that contains a virtual machine named VM1 and uses Azure Defender. Azure Defender has automatic provisioning enabled.

You need to create a custom alert suppression rule that will supress false positive alerts for suspicious use of PowerShell on VM1.

What should you do first?

From Azure Security Center, add a workflow automation.

On VM1, run the Get-MPThreatCatalog cmdlet.

On VM1 trigger a PowerShell alert.

From Azure Security Center, export the alerts to a Log Analytics workspace.

Show Answer Comment (0)

Question

Case Study

Question 111 (0)

HOTSPOT You need to create the analytics rule to meet the Azure Sentinel requirements. What should you do? To answer, select the appropriate options in the answer area. NOTE: Each correct selecti

Question 112 (0)

You need to restrict cloud apps running on CLIENT1 to meet the Microsoft Defender for Endpoint requirements. Which two configurations should you modify? Each correct answer present part of the solu

Question 113 (0)

You need to restrict cloud apps running on CUENT1 to meet the Microsoft Defender for Endpoint requirements. Which two configurations should you modify? Each correct answer presents part of the solut

Question 114 (0)

HOTSPOT You need to configure the Microsoft Sentinel integration to meet the Microsoft Sentinel requirements. What should you do? To answer, select the appropriate options in the answer area. NOTE:

Question 115 (0)

HOTSPOT You need to implement Microsoft Defender for Cloud to meet the Microsoft Defender for Cloud requirements and the business requirements. What should you include in the solution? To answer, s

Question 116 (0)

You need to implement the Azure Information Protection requirements. What should you configure first?

Question 117 (0)

You need to modify the anomaly detection policy settings to meet the Cloud App Security requirements. Which policy should you modify?

Question 118 (0)

DRAG DROP You need to configure DC1 to meet the business requirements. Which four actions should you perform in sequence? To answer, move the appropriate actions from the list of actions to the an

Question 119 (0)

You have a third-party security information and event management (SIEM) solution. You need to ensure that the SIEM solution can generate alerts for Azure Active Directory (Azure AD) sign-events in

Question 120 (0)

You have an Azure subscription that contains a virtual machine named VM1 and uses Azure Defender. Azure Defender has automatic provisioning enabled. You need to create a custom alert suppression ru

Related questions

You have a Microsoft 365 subscription that contains 1,000 Windows 10 devices. The devices have Microsoft Office 365 installed. You need to mitigate the following device threats: Microsoft Excel macros that download scripts from untrusted websites Users that open executable attachments in Microsoft Outlook Outlook rules and forms exploits What should you use?

HOTSPOT You have an Azure subscription named Sub1 that uses Microsoft Defender for Cloud. You have an Azure DevOps organization named AzDO1. You need to integrate Sub! and AzDO1. The solution must meet the following requirements: * Detect secrets exposed in pipelines by using Defender for Cloud. * Minimize administrative effort.

DRAG DROP You have an Azure subscription. The subscription contains 10 virtual machines that are onboarded to Microsoft Defender for Cloud. You need to ensure that when Defender for Cloud detects digital currency mining behavior on a virtual machine, you receive an email notification. The solution must generate a test email. Which three actions should you perform in sequence? To answer, move the appropriate actions from the list of actions to the answer area and arrange them in the correct order.

HOTSPOT You have an Azure DevOps organization that uses Microsoft Defender for DevOps. The organization contains an Azure DevOps repository named Repo1 and an Azure Pipelines pipeline named Pipeline1. Pipeline1 is used to build and deploy code stored in Repo1. You need to ensure that when Pipeline1 runs, Microsoft Defender for Cloud can perform secret scanning of the code in Repo1. What should you install in the organization, and what should you add to the YAML file of Pipeline'!? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.

You create an Azure subscription. You enable Microsoft Defender for Cloud for the subscription. You need to use Defender for Cloud to protect on-premises computers. What should you do on the on-premises computers?

You have a Microsoft 365 E5 subscription that uses Microsoft Defender XDR and contains a user named User1. You need to ensure that User1 can manage Microsoft Defender XDR custom detection rules and Endpoint security policies. The solution must follow the principle of least privilege. Which role should you assign to User1?

HOTSPOT You have a Microsoft 365 subscription that uses Microsoft Defender XDR. You need to create a custom detection rule that will identify devices that had more than five antivirus detections within the last 24 hours. how should you complete the query? To answer, select the appropriate options in the answer area. NOTE Each correct selection is worth one point.

DRAG DROP You have a Microsoft Sentinel workspace that contains the following Advanced Security Information Model (ASIM) parsers: * _Im_ProcessCreate * InProceessCreate You create a new source-specific parser named vimProcessCreate. You need to modify the parsers to meet the following requirements: * Call all the ProcessCreate parsers. * Standardize fields to the Process schema. Which parser should you modify to meet each requirement? To answer, drag the appropriate parsers to the correct requirements. tach parser may be used once, more than once, or not at all You may need to drag the split bar between panes or scroll to view content. NOTE Each correct selection is worth one point.

You have a Microsoft 365 E5 subscription that contains 100 Linux devices. The devices are onboarded to Microsoft Defender 365. You need to initiate the collection of investigation packages from the devices by using the Microsoft 365 Defender portal. Which response action should you use?

HOTSPOT You have a Microsoft Sentinel workspace. You need to create a KQL query that will identify successful sign-ins from multiple countries during the last three hours. How should you complete the query? To answer, select the appropriate options in the answer area. NOTE Each correct selection is worth one point

Export

with questions and answers will be exported as:

VPLUS file

PDF file (Demo 30 questions)

Highest scored 'comment-votes'

Your question list is being generated. We”ll email you once it’s ready.

If you didn't receive an email within 5 minutes, you should submit a support request to [email protected].