Home / Microsoft / SC-200 / List of questions

Ask Question

Microsoft SC-200 Practice Test - Questions Answers, Page 16

List of questions

Question 151

You have an Azure subscription that has Microsoft Defender for Cloud enabled.

You have a virtual machine that runs Windows 10 and has the Log Analytics agent installed.

You need to simulate an attack on the virtual machine that will generate an alert.

What should you do first?

Run the Log Analytics Troubleshooting Tool.

Copy a executable and rename the file as ASC_AlerTest_662jf10N,exe

Modify the settings of the Microsoft Monitoring Agent.

Run the MMASetup executable and specify the -foo argument

Show Answer Comment (0)

Question 152

HOTSPOT

You have the following KQL query.

Microsoft SC-200 image Question 34 107921 10052024010847000000

Microsoft SC-200 image Question 152 107921 10052024010847000

Show Answer Comment (0)

Correct answer: Microsoft SC-200 image answer Question 152 107921 10052024010847000

asked 05/10/2024

James Valdivia

30 questions

Question 153

You have a Microsoft 365 subscription that uses Microsoft Defender for Endpoint.

You need to add threat indicators for all the IP addresses in a range of 171.23.3432-171.2334.63. The solution must minimize administrative effort.

What should you do in the Microsoft 365 Defender portal?

Create an import file that contains the IP address of 171.23.34.32/27. Select Import and import the file.

Select Add indicator and set the IP address to 171.2334.32-171.23.34.63.

Select Add indicator and set the IP address to 171.23.34.32/27

Create an import file that contains the individual IP addresses in the range. Select Import and import the file.

Show Answer Comment (0)

Question 154

Your company has an on-premises network that uses Microsoft Defender for Identity.

The Microsoft Secure Score for the company includes a security assessment associated with unsecure Kerberos delegation.

You need remediate the security risk.

What should you do?

Install the Local Administrator Password Solution (LAPS) extension on the computers listed as exposed entities.

Modify the properties of the computer objects listed as exposed entities.

Disable legacy protocols on the computers listed as exposed entities.

Enforce LDAP signing on the computers listed as exposed entities.

Show Answer Comment (0)

Question 155

HOTSPOT

You have a Microsoft Sentinel workspace named Workspaces

You configure Workspace1 to collect DNS events and deploy the Advanced Security information Model (ASIM) unifying parser for the DNS schema.

You need to query the ASIM DNS schema to list all the DNS events from the last 24 hours that have a response code of 'NXDOMAIN' and were aggregated by the source IP address in 15-minute intervals.

The solution must maximize query performance.

How should you complete the query? To answer, select the appropriate options in the answer area

NOTE: Each correct selection is worth one point.

Microsoft SC-200 image Question 155 107924 10052024010847000

Show Answer Comment (0)

Correct answer: Microsoft SC-200 image answer Question 155 107924 10052024010847000

asked 05/10/2024

Subramaniam Pratheep

39 questions

Question 156

HOTSPOT

You have an Azure subscription that contains an Microsoft Sentinel workspace.

You need to create a hunting query using Kusto Query Language (KQL) that meets the following requirements:

• Identifies an anomalous number of changes to the rules of a network security group (NSG) made by the same security principal

• Automatically associates the security principal with an Microsoft Sentinel entity

How should you complete the query? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.

Microsoft SC-200 image Question 156 107925 10052024010847000

Show Answer Comment (0)

Correct answer: Microsoft SC-200 image answer Question 156 107925 10052024010847000

asked 05/10/2024

Olanrewaju Abolanle

31 questions

Question 157

You have an Azure subscription that uses Microsoft Sentinel.

You detect a new threat by using a hunting query.

You need to ensure that Microsoft Sentinel automatically detects the threat. The solution must minimize administrative effort.

What should you do?

Create a playbook.

Create a watchlist.

Create an analytics rule.

Add the query to a workbook.

Show Answer Comment (0)

Question 158

You have an Azure subscription that uses Microsoft Defender for Cloud and contains a storage account named storage1. You receive an alert that there was an unusually high volume of delete operations on the blobs in storage1. You need to identify which blobs were deleted. What should you review?

the activity logs of storage1

the Azure Storage Analytics logs

the alert details

the related entities of the alert

Show Answer Comment (0)

Question 159

You have a Microsoft Sentinel workspace.

You have a query named Query1 as shown in the following exhibit.

Microsoft SC-200 image Question 41 107928 10052024010847000000

You plan to create a custom parser named Parser 1. You need to use Query1 in Parser1. What should you do first?

Remove line 2.

In line 4. remove the TimeGenerated predicate.

Remove line 5.

In line 3, replace the 'contains operator with the !has operator.

Show Answer Comment (0)

Question 160

You have an Azure subscription that contains a Microsoft Sentinel workspace. The workspace contains a Microsoft Defender for Cloud data connector. You need to customize which details will be included when an alert is created for a specific event. What should you do?

Modify the properties of the connector.

Create a Data Collection Rule (DCR).

Create a scheduled query rule.

Enable User and Entity Behavior Analytics (UEBA)

Show Answer Comment (0)

Question

Case Study

Question 151 (0)

You have an Azure subscription that has Microsoft Defender for Cloud enabled. You have a virtual machine that runs Windows 10 and has the Log Analytics agent installed. You need to simulate an att

Question 152 (0)

HOTSPOT You have the following KQL query.

Question 153 (0)

You have a Microsoft 365 subscription that uses Microsoft Defender for Endpoint. You need to add threat indicators for all the IP addresses in a range of 171.23.3432-171.2334.63. The solution must

Question 154 (0)

Your company has an on-premises network that uses Microsoft Defender for Identity. The Microsoft Secure Score for the company includes a security assessment associated with unsecure Kerberos delega

Question 155 (0)

HOTSPOT You have a Microsoft Sentinel workspace named Workspaces You configure Workspace1 to collect DNS events and deploy the Advanced Security information Model (ASIM) unifying parser for the DN

Question 156 (0)

HOTSPOT You have an Azure subscription that contains an Microsoft Sentinel workspace. You need to create a hunting query using Kusto Query Language (KQL) that meets the following requirements: •

Question 157 (0)

You have an Azure subscription that uses Microsoft Sentinel. You detect a new threat by using a hunting query. You need to ensure that Microsoft Sentinel automatically detects the threat. The solu

Question 158 (0)

You have an Azure subscription that uses Microsoft Defender for Cloud and contains a storage account named storage1. You receive an alert that there was an unusually high volume of delete operations

Question 159 (0)

You have a Microsoft Sentinel workspace. You have a query named Query1 as shown in the following exhibit. You plan to create a custom parser named Parser 1. You need to use Query1 in Parser1. Wh

Question 160 (0)

You have an Azure subscription that contains a Microsoft Sentinel workspace. The workspace contains a Microsoft Defender for Cloud data connector. You need to customize which details will be include

Related questions

You have a Microsoft 365 subscription that contains 1,000 Windows 10 devices. The devices have Microsoft Office 365 installed. You need to mitigate the following device threats: Microsoft Excel macros that download scripts from untrusted websites Users that open executable attachments in Microsoft Outlook Outlook rules and forms exploits What should you use?

HOTSPOT You have an Azure subscription named Sub1 that uses Microsoft Defender for Cloud. You have an Azure DevOps organization named AzDO1. You need to integrate Sub! and AzDO1. The solution must meet the following requirements: * Detect secrets exposed in pipelines by using Defender for Cloud. * Minimize administrative effort.

DRAG DROP You have an Azure subscription. The subscription contains 10 virtual machines that are onboarded to Microsoft Defender for Cloud. You need to ensure that when Defender for Cloud detects digital currency mining behavior on a virtual machine, you receive an email notification. The solution must generate a test email. Which three actions should you perform in sequence? To answer, move the appropriate actions from the list of actions to the answer area and arrange them in the correct order.

HOTSPOT You have an Azure DevOps organization that uses Microsoft Defender for DevOps. The organization contains an Azure DevOps repository named Repo1 and an Azure Pipelines pipeline named Pipeline1. Pipeline1 is used to build and deploy code stored in Repo1. You need to ensure that when Pipeline1 runs, Microsoft Defender for Cloud can perform secret scanning of the code in Repo1. What should you install in the organization, and what should you add to the YAML file of Pipeline'!? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.

You create an Azure subscription. You enable Microsoft Defender for Cloud for the subscription. You need to use Defender for Cloud to protect on-premises computers. What should you do on the on-premises computers?

You have a Microsoft 365 E5 subscription that uses Microsoft Defender XDR and contains a user named User1. You need to ensure that User1 can manage Microsoft Defender XDR custom detection rules and Endpoint security policies. The solution must follow the principle of least privilege. Which role should you assign to User1?

HOTSPOT You have a Microsoft 365 subscription that uses Microsoft Defender XDR. You need to create a custom detection rule that will identify devices that had more than five antivirus detections within the last 24 hours. how should you complete the query? To answer, select the appropriate options in the answer area. NOTE Each correct selection is worth one point.

DRAG DROP You have a Microsoft Sentinel workspace that contains the following Advanced Security Information Model (ASIM) parsers: * _Im_ProcessCreate * InProceessCreate You create a new source-specific parser named vimProcessCreate. You need to modify the parsers to meet the following requirements: * Call all the ProcessCreate parsers. * Standardize fields to the Process schema. Which parser should you modify to meet each requirement? To answer, drag the appropriate parsers to the correct requirements. tach parser may be used once, more than once, or not at all You may need to drag the split bar between panes or scroll to view content. NOTE Each correct selection is worth one point.

You have a Microsoft 365 E5 subscription that contains 100 Linux devices. The devices are onboarded to Microsoft Defender 365. You need to initiate the collection of investigation packages from the devices by using the Microsoft 365 Defender portal. Which response action should you use?

HOTSPOT You have a Microsoft Sentinel workspace. You need to create a KQL query that will identify successful sign-ins from multiple countries during the last three hours. How should you complete the query? To answer, select the appropriate options in the answer area. NOTE Each correct selection is worth one point

Export

with questions and answers will be exported as:

VPLUS file

PDF file (Demo 30 questions)

Highest scored 'comment-votes'

Your question list is being generated. We”ll email you once it’s ready.

If you didn't receive an email within 5 minutes, you should submit a support request to [email protected].