Home / Microsoft / SC-200 / List of questions

Ask Question

Microsoft SC-200 Practice Test - Questions Answers, Page 9

List of questions

Question 81

You are configuring Microsoft Cloud App Security.

You have a custom threat detection policy based on the IP address ranges of your companyâ€™s United States-based offices.

You receive many alerts related to impossible travel and sign-ins from risky IP addresses.

You determine that 99% of the alerts are legitimate sign-ins from your corporate offices.

You need to prevent alerts for legitimate sign-ins from known locations.

Which two actions should you perform? Each correct answer presents part of the solution.

NOTE: Each correct selection is worth one point.

Override automatic data enrichment.

Add the IP addresses to the corporate address range category.

Increase the sensitivity level of the impossible travel anomaly detection policy.

Add the IP addresses to the other address range category and add a tag.

Create an activity policy that has an exclusion for the IP addresses.

Show Answer Comment (0)

Question 82

Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.

After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.

You are configuring Microsoft Defender for Identity integration with Active Directory.

From the Microsoft Defender for identity portal, you need to configure several accounts for attackers to exploit.

Solution: You add each account as a Sensitive account.

Does this meet the goal?

Yes

Show Answer Comment (0)

Question 83

You have a Microsoft 365 tenant that uses Microsoft Exchange Online and Microsoft Defender for Office 365.

What should you use to identify whether zero-hour auto purge (ZAP) moved an email message from the mailbox of a user?

the Threat Protection Status report in Microsoft Defender for Office 365

the mailbox audit log in Exchange

the Safe Attachments file types report in Microsoft Defender for Office 365

the mail flow report in Exchange

Show Answer Comment (0)

Question 84

You have a Microsoft 365 subscription that contains 1,000 Windows 10 devices. The devices have Microsoft Office 365 installed.

You need to mitigate the following device threats:

Microsoft Excel macros that download scripts from untrusted websites

Users that open executable attachments in Microsoft Outlook Outlook rules and forms exploits What should you use?

Microsoft Defender Antivirus

attack surface reduction rules in Microsoft Defender for Endpoint

Windows Defender Firewall

adaptive application control in Azure Defender

Show Answer Comment (0)

Question 85

Which rule setting should you configure to meet the Microsoft Sentinel requirements?

From Set rule logic, turn off suppression

From Analytic rule details, configure the tactics.

From Set rule logic, map the entities

From Analytic rule details, configure the severity.

Show Answer Comment (0)

Question 86

You need to modify the anomaly detection policy settings to meet the Microsoft Defender for Cloud Apps requirements and resolve the reported problem.

Which policy should you modify?

Activity from suspicious IP addresses

Risky sign-in

Activity from anonymous IP addresses

Impossible travel

Show Answer Comment (0)

Question 87

You need to configure event monitoring for Server1. The solution must meet the Microsoft Sentinel requirements. What should you create first?

a Microsoft Sentinel automation rule

a Microsoft Sentinel scheduled query rule

a Data Collection Rule (DCR)

an Azure Event Grid topic

Show Answer Comment (0)

Question 88

You need to implement the Defender for Cloud requirements.

What should you configure for Server2?

the Microsoft Antimalware extension

an Azure resource lock

an Azure resource tag

the Azure Automanage machine configuration extension for Windows

Show Answer Comment (0)

Question 89

HOTSPOT

You need to implement the ASIM query for DNS requests. The solution must meet the Microsoft Sentinel requirements. How should you configure the query? To answer, select the appropriate options in the answer are a. NOTE: Each correct selection is worth one point.

Microsoft SC-200 image Question 89 107803 10052024010847000

Show Answer Comment (0)

Correct answer: Microsoft SC-200 image answer Question 89 107803 10052024010847000

asked 05/10/2024

Slawomir Kucharski

30 questions

Question 90

HOTSPOT

You need to implement the query for Workbook1 and Webapp1. The solution must meet the Microsoft Sentinel requirements. How should you configure the query? To answer, select the appropriate options in the answer are a. NOTE: Each correct selection is worth one point.

Microsoft SC-200 image Question 90 107804 10052024010847000

Show Answer Comment (0)

Correct answer: Microsoft SC-200 image answer Question 90 107804 10052024010847000

asked 05/10/2024

Anna Panagiotidou

34 questions

Total 307 questions

7 8 9 10 11

Go to page: of 31

Question

Case Study

Question 81 (0)

You are configuring Microsoft Cloud App Security. You have a custom threat detection policy based on the IP address ranges of your companyâ€™s United States-based offices. You receive many alerts

Question 82 (0)

Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might

Question 83 (0)

You have a Microsoft 365 tenant that uses Microsoft Exchange Online and Microsoft Defender for Office 365. What should you use to identify whether zero-hour auto purge (ZAP) moved an email message

Question 84 (0)

You have a Microsoft 365 subscription that contains 1,000 Windows 10 devices. The devices have Microsoft Office 365 installed. You need to mitigate the following device threats: Microsoft Excel ma

Question 85 (0)

Which rule setting should you configure to meet the Microsoft Sentinel requirements?

Question 86 (0)

You need to modify the anomaly detection policy settings to meet the Microsoft Defender for Cloud Apps requirements and resolve the reported problem. Which policy should you modify?

Question 87 (0)

You need to configure event monitoring for Server1. The solution must meet the Microsoft Sentinel requirements. What should you create first?

Question 88 (0)

You need to implement the Defender for Cloud requirements. What should you configure for Server2?

Question 89 (0)

HOTSPOT You need to implement the ASIM query for DNS requests. The solution must meet the Microsoft Sentinel requirements. How should you configure the query? To answer, select the appropriate opti

Question 90 (0)

HOTSPOT You need to implement the query for Workbook1 and Webapp1. The solution must meet the Microsoft Sentinel requirements. How should you configure the query? To answer, select the appropriate

Related questions

You have a Microsoft 365 subscription that contains 1,000 Windows 10 devices. The devices have Microsoft Office 365 installed. You need to mitigate the following device threats: Microsoft Excel macros that download scripts from untrusted websites Users that open executable attachments in Microsoft Outlook Outlook rules and forms exploits What should you use?

HOTSPOT You have an Azure subscription named Sub1 that uses Microsoft Defender for Cloud. You have an Azure DevOps organization named AzDO1. You need to integrate Sub! and AzDO1. The solution must meet the following requirements: * Detect secrets exposed in pipelines by using Defender for Cloud. * Minimize administrative effort.

DRAG DROP You have an Azure subscription. The subscription contains 10 virtual machines that are onboarded to Microsoft Defender for Cloud. You need to ensure that when Defender for Cloud detects digital currency mining behavior on a virtual machine, you receive an email notification. The solution must generate a test email. Which three actions should you perform in sequence? To answer, move the appropriate actions from the list of actions to the answer area and arrange them in the correct order.

HOTSPOT You have an Azure DevOps organization that uses Microsoft Defender for DevOps. The organization contains an Azure DevOps repository named Repo1 and an Azure Pipelines pipeline named Pipeline1. Pipeline1 is used to build and deploy code stored in Repo1. You need to ensure that when Pipeline1 runs, Microsoft Defender for Cloud can perform secret scanning of the code in Repo1. What should you install in the organization, and what should you add to the YAML file of Pipeline'!? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.

You create an Azure subscription. You enable Microsoft Defender for Cloud for the subscription. You need to use Defender for Cloud to protect on-premises computers. What should you do on the on-premises computers?

You have a Microsoft 365 E5 subscription that uses Microsoft Defender XDR and contains a user named User1. You need to ensure that User1 can manage Microsoft Defender XDR custom detection rules and Endpoint security policies. The solution must follow the principle of least privilege. Which role should you assign to User1?

HOTSPOT You have a Microsoft 365 subscription that uses Microsoft Defender XDR. You need to create a custom detection rule that will identify devices that had more than five antivirus detections within the last 24 hours. how should you complete the query? To answer, select the appropriate options in the answer area. NOTE Each correct selection is worth one point.

DRAG DROP You have a Microsoft Sentinel workspace that contains the following Advanced Security Information Model (ASIM) parsers: * _Im_ProcessCreate * InProceessCreate You create a new source-specific parser named vimProcessCreate. You need to modify the parsers to meet the following requirements: * Call all the ProcessCreate parsers. * Standardize fields to the Process schema. Which parser should you modify to meet each requirement? To answer, drag the appropriate parsers to the correct requirements. tach parser may be used once, more than once, or not at all You may need to drag the split bar between panes or scroll to view content. NOTE Each correct selection is worth one point.

You have a Microsoft 365 E5 subscription that contains 100 Linux devices. The devices are onboarded to Microsoft Defender 365. You need to initiate the collection of investigation packages from the devices by using the Microsoft 365 Defender portal. Which response action should you use?

HOTSPOT You have a Microsoft Sentinel workspace. You need to create a KQL query that will identify successful sign-ins from multiple countries during the last three hours. How should you complete the query? To answer, select the appropriate options in the answer area. NOTE Each correct selection is worth one point

Export

with questions and answers will be exported as:

VPLUS file

PDF file (Demo 30 questions)

Highest scored 'comment-votes'

Your question list is being generated. We”ll email you once it’s ready.

If you didn't receive an email within 5 minutes, you should submit a support request to [email protected].