How to pass Microsoft SC-200 exam with the help of dumps?

Question # 1

You have 50 Microsoft Sentinel workspaces.You need to view all the incidents from all the workspaces on a single page in the Azureportal. The solution must minimize administrative effort. Which page should you use in the Azure portal?

A. Microsoft Sentinel - Incidents
B. Microsoft Sentinel - Workbooks
C. Microsoft Sentinel
D. Log Analytics workspaces

Show Answer

Question # 2

You need to correlate data from the SecurityEvent Log Anarytks table to meet the MicrosoftSentinel requirements for using UEBA. Which Log Analytics table should you use?

A. SentwlAuoNt
B. AADRiskyUsers
C. IdentityOirectoryEvents
D. Identityinfo

Show Answer

Question # 3

You haw the resources shown in the following Table. You have an Azure subscription that uses Microsoft Defender for Cloud.You need to enable Microsoft Defender lot Servers on each resource.Which resources will require the installation of the Azure Arc agent?

A. Server 3 only
B. Server1 and 5erver4 only
C. Server 1. Server2. arid Server4 only
D. Server 1, Servec2, Server3. and Seiver4

Show Answer

Question # 4

You need to minimize the effort required to investigate the Microsoft Defender for Identityfalse positive alerts. What should you review?

A. the status update time
B. the alert status
C. the certainty of the source computer
D. the resolution method of the source computer

Show Answer

Question # 5

You have an Azure subscription that uses Microsoft Defender fof Ctoud.You have an Amazon Web Services (AWS) account that contains an Amazon ElasticCompute Cloud (EC2) instance named EC2-1.You need to onboard EC2-1 to Defender for Cloud.What should you install on EC2-1?

A. the Log Analytics agent
B. the Azure Connected Machine agent
C. the unified Microsoft Defender for Endpoint solution package
D. Microsoft Monitoring Agent

Show Answer

Question # 6

You need to ensure that you can run hunting queries to meet the Microsoft Sentinel requirements. Which type of workspace should you create?

A. Azure Synapse AnarytKS
B. AzureDalabricks
C. Azure Machine Learning
D. LogAnalytics

Show Answer

Question # 7

You have an Azure subscription that uses Microsoft Defender for Cloud and contains 100virtual machines that run Windows Server.You need to configure Defender for Cloud to collect event data from the virtual machines.The solution must minimize administrative effort and costs.Which two actions should you perform? Each correct answer presents part of the solution.NOTE: Each correct selection is worth one point.

A. From the workspace created by Defender for Cloud, set the data collection level to Common
B. From the Microsoft Endpoint Manager admin center, enable automatic enrollment.
C. From the Azure portal, create an Azure Event Grid subscription.
D. From the workspace created by Defender for Cloud, set the data collection level to All Events
E. From Defender for Cloud in the Azure portal, enable automatic provisioning for thevirtual machines.

Show Answer

Question # 8

You have a Microsoft Sentinel workspace.You enable User and Entity Behavior Analytics (UFBA) by using Audit logs and Signin logs.The following entities are detected in the Azure AD tenant:• App name: App1 • IP address: 192.168.1.2• Computer name: Device1• Used client app: Microsoft Edge• Email address: user1@company.com• Sign-in URL: https://www.company.comWhich entities can be investigated by using UEBA?

A. app name, computer name, IP address, email address, and used client app only
B. IP address and email address only
C. used client app and app name only
D. IP address only

Show Answer

Question # 9

You have an Azure subscription that use Microsoft Defender for Cloud and contains a usernamed User1.You need to ensure that User1 can modify Microsoft Defender for Cloud security policies.The solution must use the principle of least privilege.Which role should you assign to User1?

A. Security operator
B. Security Admin
C. Owner
D. Contributor

Show Answer

Question # 10

You use Microsoft Sentinel.You need to receive an alert in near real-time whenever Azure Storage account keys areenumerated. Which two actions should you perform? Each correct answer presents part ofthe solution. NOTE: Each correct selection is worth one point

A. Create a bookmark.
B. Create an analytics rule.
C. Create a livestream.
D. Create a hunting query.
E. Add a data connector.

Show Answer

Question # 11

You have a Microsoft Sentinel workspace that has user and Entity Behavior Analytics(UEBA) enabled for Signin Logs.You need to ensure that failed interactive sign-ins are detected.The solution must minimize administrative effort.What should you use?

A. a scheduled alert query
B. a UEBA activity template
C. the Activity Log data connector
D. a hunting query

Show Answer

Question # 12

You have an Azure subscription that uses resource type for Cloud. You need to filter thesecurity alerts view to show the following alerts:• Unusual user accessed a key vault• Log on from an unusual location• Impossible travel activityWhich severity should you use?

A. Informational
B. Low
C. Medium
D. High

Show Answer

Question # 13

You have an Azure subscription that contains an Azure logic app named app1 and aMicrosoft Sentinel workspace that has an Azure AD connector. You need to ensure thatapp1 launches when Microsoft Sentinel detects an Azure AD-generated alert. What shouldyou create first?

A. a repository connection
B. awatchlist
C. an analytics rule
D. an automation rule

Show Answer

Question # 14

You have an Azure subscription that has Microsoft Defender for Cloud enabled.You have a virtual machine named Server! that runs Windows Server 2022 and is hosted inAmazon Web Services (AWS).You need to collect logs and resolve vulnerabilities for Server1 by using Defender forCloud.What should you install first on Server1?

A. the Microsoft Monitoring Agent
B. the Azure Arc agent
C. the Azure Monitor agent
D. the Azure Pipelines agent

Show Answer

Question # 15

You have a Microsoft Sentinel workspace named Workspace1 and 200 custom AdvancedSecurity Information Model (ASIM) parsers based on the DNS schema. You need to makethe 200 parsers available in Workspace1. The solution must minimize administrative effort.What should you do first?

A. Copy the parsers to the Azure Monitor Logs page.
B. Create a JSON file based on the DNS template.
C. Create an XML file based on the DNS template.
D. Create a YAML file based on the DNS template.

Show Answer

Question # 16

You have an Azure subscription that uses Microsoft Sentinel and contains 100 Linux virtualmachines.You need to monitor the virtual machines by using Microsoft Sentinel. The solution mustmeet the fallowing requirements:• Minimize administrative effort• Minimize the parsing required to read log dataWhat should you configure?

A. REST API integration
B. a SysJog connector
C. a Log Analytics Data Collector API
D. a Common Event Format (CEF) connector

Show Answer

Question # 17

You have a Microsoft 365 subscription. The subscription uses Microsoft 365 Defender andhas data loss prevention (DLP) policies that have aggregated alerts configured.You need to identify the impacted entities in an aggregated alert.What should you review in the DIP alert management dashboard of the Microsoft Purviewcompliance portal?

A. the Details tab of the alert
B. Management log
C. the Sensitive Info Types tab of the alert
D. the Events tab of the alert

Show Answer

Question # 18

You have an Azure subscription that uses Microsoft Defender for Servers Plan 1 andcontains a server named Server1.You enable agentless scanning.You need to prevent Server1 from being scanned. The solution must minimizeadministrative effort.What should you do?

A. Create an exclusion tag.
B. Upgrade the subscription to Defender for Servers Plan 2.
C. Create a governance rule.
D. Create an exclusion group.

Show Answer

Question # 19

You have a Microsoft 365 E5 subscription that uses Microsoft Defender for EndpointYou need to identify any devices that triggered a malware alert and collect evidence relatedto the alert. The solution must ensure that you can use the results to initiate device isolationfor the affected devices.What should you use in the Microsoft 365 Defender portal?

A. Incidents
B. Investigations
C. Advanced hunting
D. Remediation

Show Answer

Question # 20

You have a Microsoft Sentinel workspace that uses the Microsoft 365 Defender dataconnector.From Microsoft Sentinel, you investigate a Microsoft 365 incident.You need to update the incident to include an alert generated by Microsoft Defender forCloud Apps.What should you use?

A. the entity side panel of the Timeline card in Microsoft Sentinel
B. the investigation graph on the Incidents page of Microsoft Sentinel
C. the Timeline tab on the Incidents page of Microsoft Sentinel
D. the Alerts page in the Microsoft 365 Defender portal

Show Answer

Question # 21

You have an Azure subscription that contains a user named User1.User1 is assigned an Azure Active Directory Premium Plan 2 licenseYou need to identify whether the identity of User1 was compromised during the last 90days.What should you use?

A. the risk detections report
B. the risky users report
C. Identity Secure Score recommendations
D. the risky sign-ins report

Show Answer

Question # 22

You need to deploy the native cloud connector to Account! to meet the Microsoft Defenderfor Cloud requirements. What should you do in Account! first?

A. Create an AWS user for Defender for Cloud.
B. Create an Access control (1AM) role for Defender for Cloud.
C. Configure AWS Security Hub.
D. Deploy the AWS Systems Manager (SSM) agent

Show Answer

Question # 23

You have a Microsoft Sentinel playbook that is triggered by using the Azure Activityconnector.You need to create a new near-real-time (NRT) analytics rule that will use the playbook.What should you configure for the rule?

A. the Incident automation settings
B. entity mapping
C. the query rule
D. the Alert automation settings

Show Answer

Question # 24

You have a Microsoft 365 subscription that uses Microsoft Purview.Your company has a project named Project1.You need to identify all the email messages that have the word Project1 in the subject line.The solution must search only the mailboxes of users that worked on Project1.What should you do?

A. Create a records management disposition.
B. Perform a user data search.
C. Perform an audit search.
D. Perform a content search.

Show Answer

Question # 25

You need to meet the Microsoft Sentinel requirements for App1. What should you configurefor App1?

A. an API connection
B. a trigger
C. an connector
D. authorization

Show Answer

Question # 26

You have an Azure subscription that uses Microsoft Defender for Cloud.You have an Amazon Web Services (AWS) subscription. The subscription containsmultiple virtual machines that run Windows Server.You need to enable Microsoft Defender for Servers on the virtual machines.Which two actions should you perform? Each correct answer presents part of the solution.NOTE: Each correct answer is worth one point.

A. From Defender for Cloud, enable agentless scanning.
B. Install the Azure Virtual Machine Agent (VM Agent) on each virtual machine.
C. Onboard the virtual machines to Microsoft Defender for Endpoint.
D. From Defender for Cloud, configure auto-provisioning.
E. From Defender for Cloud, configure the AWS connector.

Show Answer

Question # 27

You have a Microsoft 365 subscription that uses Microsoft 365 Defender.You plan to create a hunting query from Microsoft Defender.You need to create a custom tracked query that will be used to assess the threat status ofthe subscription.From the Microsoft 365 Defender portal, which page should you use to create the query?

A. Policies & rules
B. Explorer
C. Threat analytics
D. Advanced Hunting

Show Answer

Question # 28

You have a Microsoft 365 E5 subscription that uses Microsoft Defender for EndpointYou need to create a query that will link the Alertlnfo, AlertEvidence, andDeviceLogonEvents tables. The solution must return all the rows in the tables. Which operator should you use?

A. join kind = inner
B. evaluate hint. Remote =
C. search *
D. union kind = inner

Show Answer

Question # 29

You have an Azure subscription that contains an Microsoft Sentinel workspace.You need to create a playbook that will run automatically in response to an MicrosoftSentinel alert.What should you create first?

A. a trigger in Azure Functions
B. an Azure logic app
C. a hunting query in Microsoft Sentinel
D. an automation rule in Microsoft Sentinel

Show Answer

Question # 30

You need to identify which mean time metrics to use to meet the Microsoft Sentinelrequirements. Which workbook should you use?

A. Analytics Efficiency
B. Security Operations Efficiency
C. Event Analyzer
D. Investigation insights

Show Answer

Question # 31

You have a Microsoft 365 E5 subscription that contains 100 Linux devices. The devices areonboarded to Microsoft Defender 365. You need to initiate the collection of investigationpackages from the devices by using the Microsoft 365 Defender portal. Which responseaction should you use?

A. Run antivirus scan
B. Initiate Automated Investigation
C. Collect investigation package
D. Initiate Live Response Session

Show Answer

Question # 32

Which rule setting should you configure to meet the Microsoft Sentinel requirements?

A. From Set rule logic, turn off suppression.
B. From Analytic rule details, configure the tactics.
C. From Set rule logic, map the entities.
D. From Analytic rule details, configure the severity.

Show Answer

Question # 33

You need to restrict cloud apps running on CUENT1 to meet the Microsoft Defender forEndpoint requirements. Which two configurations should you modify? Each correct answerpresents part of the solution. NOTE: Each correct selection is worth one point.

A. the Cloud Discovery settings in Microsoft Defender for Cloud Apps
B. the Onboarding settings from Device management in Settings in Microsoft 365 Defenderportal
C. Microsoft Defender for Cloud Apps anomaly detection policies
D. Advanced features from the Endpoints Settings in the Microsoft 365 Defender portal

Show Answer

Question # 34

You need to modify the anomaly detection policy settings to meet the Microsoft Defenderfor Cloud Apps requirements and resolve the reported problem.Which policy should you modify?

A. Activity from suspicious IP addresses
B. Risky sign-in
C. Activity from anonymous IP addresses
D. Impossible travel

Show Answer

Question # 35

You have two Azure subscriptions that use Microsoft Defender for Cloud. You need to ensure that specific Defender for Cloud security alerts are suppressed at the root management group level. The solution must minimize administrative effort. What should you do in the Azure portal?

A. Create an Azure Policy assignment. 
B. Modify the Workload protections settings in Defender for Cloud. 
C. Create an alert rule in Azure Monitor. 
D. Modify the alert settings in Defender for Cloud. 

Show Answer

Question # 36

Your company uses Azure Security Center and Azure Defender. The security operations team at the company informs you that it does NOT receive email notifications for security alerts. What should you configure in Security Center to enable the email notifications? 

A. Security solutions 
B. Security policy 
C. Pricing & settings 
D. Security alerts 
E. Azure Defender 

Show Answer

Question # 37

You use Azure Defender. You have an Azure Storage account that contains sensitive information. You need to run a PowerShell script if someone accesses the storage account from a suspicious IP address. Which two actions should you perform? Each correct answer presents part of the solution. NOTE: Each correct selection is worth one point.  

A. From Azure Security Center, enable workflow automation. 
B. Create an Azure logic appthat has a manual trigger 
C. Create an Azure logic app that has an Azure Security Center alert trigger. 
D. Create an Azure logic appthat has an HTTP trigger. 
E. From Azure Active Directory (Azure AD), add an app registration. 

Show Answer

Question # 38

You have an Azure subscription that uses Microsoft Sentinel. You detect a new threat by using a hunting query. You need to ensure that Microsoft Sentinel automatically detects the threat. The solution must minimize administrative effort. What should you do? 

A. Create a playbook. 
B. Create a watchlist. 
C. Create an analytics rule. 
D. Add the query to a workbook.

Show Answer

Question # 39

Your company uses Microsoft Defender for Endpoint. The company has Microsoft Word documents that contain macros. The documents are used frequently on the devices of the company’s accounting team. You need to hide false positive in the Alerts queue, while maintaining the existing security posture. Which three actions should you perform? Each correct answer presents part of the solution. NOTE: Each correct selection is worth one point. 

A. Resolve the alert automatically. 
B. Hide the alert. 
C. Create a suppression rule scoped to any device. 
D. Create a suppression rule scoped to a device group. 
E. Generate the alert. 

Show Answer

Question # 40

You have a Microsoft Sentinel workspace named Workspace1. You need to exclude a built-in, source-specific Advanced Security information Model (ASIM) parse from a built-in unified ASIM parser. What should you create in Workspace1? 

A. a watch list
B. an analytic rule 
C. a hunting query 
D. a workbook 

Show Answer

Question # 41

You have a Microsoft 365 subscription that has Microsoft 365 Defender enabled. You need to identify all the changes made to sensitivity labels during the past seven days. What should you use? 

A. the Incidents blade of the Microsoft 365 Defender portal 
B. the Alerts settings on the Data Loss Prevention blade of the Microsoft 365 compliance center 
C. Activity explorer in the Microsoft 365 compliance center 
D. the Explorer settings on the Email & collaboration blade of the Microsoft 365 Defender portal

Show Answer

Question # 42

You have a Microsoft Sentinel workspace that contains the following incident. Brute force attack against Azure Portal analytics rule has been triggered. You need to identify the geolocation information that corresponds to the incident. What should you do? 

A. From Overview, review the Potential malicious events map. 
B. From Incidents, review the details of the iPCustomEntity entity associated with the incident. 
C. From Incidents, review the details of the AccouncCuscomEntity entity associated with the incident. 
D. From Investigation, review insights on the incident entity. 

Show Answer

Question # 43

You create a custom analytics rule to detect threats in Azure Sentinel. You discover that the rule fails intermittently. What are two possible causes of the failures? Each correct answer presents part of the solution. NOTE: Each correct selection is worth one point.

A. The rule query takes too long to run and times out. 
B. The target workspace was deleted. 
C. Permissions to the data sources of the rule query were modified. 
D. There are connectivity issues between the data sources and Log Analytics 

Show Answer

Question # 44

You have a Microsoft Sentinel workspace. You have a query named Query1 as shown in the following exhibit.

A. Remove line 2. 
B. In line 4. remove the TimeGenerated predicate.
 C. Remove line 5. 
D. In line 3, replace the 'contains operator with the !has operator. 

Show Answer

Question # 45

You have a Microsoft 365 subscription that uses Azure Defender. You have 100 virtual machines in a resource group named RG1. You assign the Security Admin roles to a new user named SecAdmin1. You need to ensure that SecAdmin1 can apply quick fixes to the virtual machines by using Azure Defender. The solution must use the principle of least privilege. Which role should you assign to SecAdmin1? 

A. the Security Reader role for the subscription
B. the Contributor for the subscription 
C. the Contributor role for RG1 
D. the Owner role for RG1 

Show Answer

Question # 46

Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution. After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen. You are configuring Azure Sentinel. You need to create an incident in Azure Sentinel when a sign-in to an Azure virtual machine from a malicious IP address is detected. Solution: You create a Microsoft incident creation rule for a data connector. Does this meet the goal?

A. Yes 
B. No 

Show Answer

Question # 47

You are responsible for responding to Azure Defender for Key Vault alerts. During an investigation of an alert, you discover unauthorized attempts to access a key vault from a Tor exit node. What should you configure to mitigate the threat? 

A. Key Vault firewalls and virtual networks 
B. Azure Active Directory (Azure AD) permissions
C. role-based access control (RBAC) for the key vault 
D. the access policy settings of the key vault 

Show Answer

Question # 48

You provision a Linux virtual machine in a new Azure subscription. You enable Azure Defender and onboard the virtual machine to Azure Defender. You need to verify that an attack on the virtual machine triggers an alert in Azure Defender. Which two Bash commands should you run on the virtual machine? Each correct answer presents part of the solution. NOTE: Each correct selection is worth one point.

A. cp /bin/echo ./asc_alerttest_662jfi039n 
B. ./alerttest testing eicar pipe 
C. cp /bin/echo ./alerttest 
D. ./asc_alerttest_662jfi039n testing eicar pipe 

Show Answer

Question # 49

You have a third-party security information and event management (SIEM) solution. You need to ensure that the SIEM solution can generate alerts for Azure Active Directory (Azure AD) sign-events in near real time. What should you do to route events to the SIEM solution? 

A. Create an Azure Sentinel workspace that has a Security Events connector. 
B. Configure the Diagnostics settings in Azure AD to stream to an event hub. 
C. Create an Azure Sentinel workspace that has an Azure Active Directory connector. 
D. Configure the Diagnostics settings in Azure AD to archive to a storage account. 

Show Answer

Question # 50

You plan to create a custom Azure Sentinel query that will track anomalous Azure Active Directory (Azure AD) sign-in activity and present the activity as a time chart aggregated by day. You need to create a query that will be used to display the time chart. What should you include in the query? 

A. extend 
B. bin 
C. makeset 
D. workspace 

Show Answer

Question # 51

You have an Azure subscription that has Microsoft Defender for Cloud enabled. You have a virtual machine that runs Windows 10 and has the Log Analytics agent installed. You need to simulate an attack on the virtual machine that will generate an alert. What should you do first? 

A. Run the Log Analytics Troubleshooting Tool. 
B. Copy a executable and rename the file as ASC_AlerTest_662jf10N,exe
 C. Modify the settings of the Microsoft Monitoring Agent. 
D. Run the MMASetup executable and specify the -foo argument 

Show Answer

Question # 52

Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution. After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen. You are configuring Microsoft Defender for Identity integration with Active Directory. From the Microsoft Defender for identity portal, you need to configure several accounts for attackers to exploit. Solution: From Azure Identity Protection, you configure the sign-in risk policy. Does this meet the goal? 

A. Yes 
B. No 

Show Answer

Question # 53

You are configuring Microsoft Cloud App Security. You have a custom threat detection policy based on the IP address ranges of your company’s United States-based offices. You receive many alerts related to impossible travel and sign-ins from risky IP addresses. You determine that 99% of the alerts are legitimate sign-ins from your corporate offices. You need to prevent alerts for legitimate sign-ins from known locations. Which two actions should you perform? Each correct answer presents part of the solution. NOTE: Each correct selection is worth one point.

A. Override automatic data enrichment. 
B. Add the IP addresses to the corporate address range category. 
C. Increase the sensitivity level of the impossible travel anomaly detection policy. 
D. Add the IP addresses to the other address range category and add a tag. 
E. Create an activity policy that has an exclusion for the IP addresses.

Show Answer

Question # 54

Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution. After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen. You use Azure Security Center. You receive a security alert in Security Center. You need to view recommendations to resolve the alert in Security Center. Solution: From Security alerts, you select the alert, select Take Action, and then expand the Prevent future attacks section. Does this meet the goal?  

A. Yes 
B. No 

Show Answer

Question # 55

Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution. After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen. You are configuring Microsoft Defender for Identity integration with Active Directory. From the Microsoft Defender for identity portal, you need to configure several accounts for attackers to exploit. Solution: You add the accounts to an Active Directory group and add the group as a Sensitive group. Does this meet the goal?

A. Yes 
B. No 

Show Answer

Question # 56

You need to configure Microsoft Cloud App Security to generate alerts and trigger remediation actions in response to external sharing of confidential files. Which two actions should you perform in the Cloud App Security portal? Each correct answer presents part of the solution. NOTE: Each correct selection is worth one point. 

A. From Settings, select Information Protection, select Azure Information Protection, and then select Only scan files for Azure Information Protection classification labels and content inspection warnings from this tenant 
B. Select Investigate files, and then filter App to Office 365. 
C. Select Investigate files, and then select New policy from search 
D. From Settings, select Information Protection, select Azure Information Protection, and then select Automatically scan new files for Azure Information Protection classification labels and content inspection warnings 
E. From Settings, select Information Protection, select Files, and then enable file monitoring. 
F. Select Investigate files, and then filter File Type to Document. 

Show Answer

Question # 57

A company uses Azure Sentinel. You need to create an automated threat response. What should you use? 

A. a data connector 
B. a playbook 
C. a workbook 
D. a Microsoft incident creation rule 

Show Answer

Question # 58

You have a Microsoft 365 subscription that contains 1,000 Windows 10 devices. The devices have Microsoft Office 365 installed. You need to mitigate the following device threats: Microsoft Excel macros that download scripts from untrusted websites Users that open executable attachments in Microsoft Outlook Outlook rules and forms exploits What should you use?

A. Microsoft Defender Antivirus 
B. attack surface reduction rules in Microsoft Defender for Endpoint 
C. Windows Defender Firewall 
D. adaptive application control in Azure Defender 

Show Answer

Question # 59

You plan to create a custom Azure Sentinel query that will provide a visual representation of the security alerts generated by Azure Security Center. You need to create a query that will be used to display a bar graph. What should you include in the query? 

A. extend 
B. bin 
C. count 
D. workspace 

Show Answer