Microsoft Microsoft Certifications SC-200 Questions & Answers

• Question 141:

  You need to implement the Defender for Cloud requirements. Which subscription-level role should you assign to Group1?

  A. Security Admin

  B. Owner

  C. Security Assessment Contributor

  D. Contributor

  Correct Answer: B

• Question 142:

  You need to deploy the native cloud connector to Account 1 to meet the Microsoft Defender for Cloud requirements. What should you do in Account1 first?

  A. Create an AWS user for Defender for Cloud.

  B. Configure AWS Security Hub.

  C. Deploy the AWS Systems Manager (SSM) agent.

  D. Create an Access control (IAM) role for Defender for Cloud.

  Correct Answer: A

  Dynamic scaled onboarding of AWS EC2 instances to Azure Arc using Ansible

  Create an AWS identity

  In order for Terraform to create resources in AWS, we will need to create a new AWS IAM role with appropriate permissions and configure Terraform to use it.

  Scenario: Automate the deployment of the Azure Connected Machine agent for Azure Arc-enabled servers to the existing and future resources of Account1.

  Fabrikam has an Amazon Web Services (AWS) account named Account1. Account1 contains 100 Amazon Elastic Compute Cloud (EC2) instances that run a custom Windows Server 2022. The image includes Microsoft SQL Server 2019 and

  does NOT have any agents installed.

  Reference:

  https://github.com/microsoft/azure_arc/blob/main/docs/azure_arc_jumpstart/azure_arc_servers/scaled_deployment/aws_scaled_ansible/_index.md

• Question 143:

  You need to identify which mean time metrics to use to meet the Microsoft Sentinel requirements. Which workbook should you use?

  A. Event Analyzer

  B. Investigation Insights

  C. Security Operations Efficiency

  D. Analytics Efficiency

  Correct Answer: C

  Identify the mean time to close incidents generated during the last 30 days.

  As a Security Operations Center (SOC) manager, you need to have overall efficiency metrics and measures at your fingertips to gauge the performance of your team. You'll want to see incident operations over time by many different criteria,

  like severity, MITRE tactics, mean time to triage, mean time to resolve, and more. Microsoft Sentinel now makes this data available to you with the new SecurityIncident table and schema in Log Analytics and the accompanying Security

  operations efficiency workbook. You'll be able to visualize your team's performance over time and use this insight to improve efficiency. You can also write and use your own KQL queries against the incident table to create customized

  workbooks that fit your specific auditing needs and KPIs.

  Note: Security operations efficiency workbook

  To complement the SecurityIncidents table, we’ve provided you an out-of-the-box security operations efficiency workbook template that you can use to monitor your SOC operations. The workbook contains the following metrics:

  Incident created over time

  Incidents created by closing classification, severity, owner, and status

  Mean time to triage

  *-> Mean time to closure

  Incidents created by severity, owner, status, product, and tactics over time

  Time to triage percentiles

  Time to closure percentiles

  Mean time to triage per owner

  Recent activities

  Recent closing classifications

  Reference:

  https://learn.microsoft.com/en-us/azure/sentinel/manage-soc-with-incident-metrics

• Question 144:

  You need to minimize the effort required to investigate the Microsoft Defender for Identity false positive alerts. What should you review?

  A. the status update time

  B. the resolution method of the source computer

  C. the alert status

  D. the certainty of the source computer

  Correct Answer: D

  Scenario: Microsoft Defender for Identity Requirements: Minimize the administrative effort required to investigate the false positive alerts.

  Defender for Identity raises a high volume of Suspected DCSync attack alerts that are false positives.

  Note: Suspected DCSync attack (replication of directory services) (external ID 2006)

  Previous name: Malicious replication of directory services.

  Description

  Active Directory replication is the process by which changes that are made on one domain controller are synchronized with all other domain controllers. Given necessary permissions, attackers can initiate a replication request, allowing them

  to retrieve the data stored in Active Directory, including password hashes.

  In this detection, an alert is triggered when a replication request is initiated from a computer that isn't a domain controller.

  If the source computer is a domain controller, failed or low certainty resolution can prevent Defender for Identity from being able to confirm identification.

  Check if the source computer is a domain controller? If the answer is yes, Close the alert as a B-TP activity.

  Reference:

  https://learn.microsoft.com/en-us/defender-for-identity/domain-dominance-alerts

• Question 145:

  You have an Azure subscription that uses Microsoft Defender for Cloud.

  You have a GitHub account named Account1 that contains 10 repositories.

  You need to ensure that Defender for Cloud can access the repositories in Account1.

  What should you do first in the Microsoft Defender for Cloud portal?

  A. Enable integrations.

  B. Enable a plan.

  C. Add an environment.

  D. Enable security policies.

  Correct Answer: C

  Connect your GitHub repositories to Microsoft Defender for Cloud

  Connect your GitHub account

  To connect your GitHub account to Microsoft Defender for Cloud:

  1.

  Sign in to the Azure portal.

  2.

  Go to Microsoft Defender for Cloud > Environment settings.

  3.

  Select Add environment.

  4.

  Select GitHub.

  5.

  Enter a name (limit of 20 characters), and then select your subscription, resource group, and region.

  6.

  Etc.

  Reference: https://learn.microsoft.com/en-us/azure/defender-for-cloud/quickstart-onboard-github

• Question 146:

  You have the resources shown in the following table.

  

  You have an Azure subscription that uses Microsoft Defender for Cloud. You need to enable Microsoft Defender for Servers on each resource. Which resources will require the installation of the Azure Arc agent?

  A. Server3 only

  B. Server1 and Server4 only

  C. Server1, Server2, and Server4 only

  D. Server1, Server2, Server3, and Server4

  Correct Answer: C

  * Server1 and Server4:

  Connect your non-Azure machines to Microsoft Defender for Cloud

  Microsoft Defender for Cloud can monitor the security posture of your non-Azure machines, but first you need to connect them to Azure.

  Connect on-premises machines by using Azure Arc

  A machine that has Azure Arc-enabled servers becomes an Azure resource. When you install the Log Analytics agent on it, it appears in Defender for Cloud with recommendations, like your other Azure resources.

  Azure Arc-enabled servers provide enhanced capabilities, such as enabling guest configuration policies on the machine and simplifying deployment with other Azure services.

  * Server2 Connect your AWS account to Microsoft Defender for Cloud Workloads commonly span multiple cloud platforms. Cloud security services must do the same. Microsoft Defender for Cloud helps protect workloads in Amazon Web Services (AWS), but you need to set up the connection between them and Defender for Cloud.

  Defender for Servers

  If you choose the Microsoft Defender for Servers plan, you need:

  Microsoft Defender for Servers enabled on your subscription. Learn how to enable plans in Enable enhanced security features.

  An active AWS account, with EC2 instances.

  *-> Azure Arc for servers installed on your EC2 instances.

  Reference: https://learn.microsoft.com/en-us/azure/defender-for-cloud/quickstart-onboard-machines https://learn.microsoft.com/en-us/azure/defender-for-cloud/quickstart-onboard-aws

• Question 147:

  You need to ensure that you can run hunting queries to meet the Microsoft Sentinel requirements. Which type of workspace should you create?

  A. Azure Synapse Analytics

  B. Azure Machine Learning

  C. Log Analytics

  D. Azure Databricks

  Correct Answer: B

  Fabrikam identifies the following Microsoft Sentinel requirements:

  Run hunting queries on Pool1 by using Jupyter notebooks.

  Get started with Jupyter notebooks and MSTICPy in Microsoft Sentinel

  Run and initialize the Getting Started Guide notebook

  This procedure describes how to launch your notebook and initialize MSTICpy.

  1.

  In Microsoft Sentinel, select Notebooks from the left.

  2.

  From the Templates tab, select A Getting Started Guide For Microsoft Sentinel ML Notebooks > Save notebook to save it to your Azure ML workspace.

  3.

  Etc.

  Reference: https://learn.microsoft.com/en-us/azure/sentinel/notebook-get-started

• Question 148:

  You need to meet the Microsoft Sentinel requirements for App1. What should you configure for App1?

  A. a trigger

  B. a connector

  C. authorization

  D. an API connection

  Correct Answer: A

  Ensure that App1 is available for use in Microsoft Sentinel automation rules. Automation rules are made up of several components:

  1.

  Triggers that define what kind of incident event will cause the rule to run, subject to...

  2.

  Conditions that will determine the exact circumstances under which the rule will run and perform...

  3.

  Actions to change the incident in some way or call a playbook.

  Reference: https://learn.microsoft.com/en-us/azure/sentinel/automate-incident-handling-with-automation-rules

• Question 149:

  You need to modify the anomaly detection policy settings to meet the Cloud App Security requirements. Which policy should you modify?

  A. Activity from suspicious IP addresses

  B. Activity from anonymous IP addresses

  C. Impossible travel

  D. Risky sign-in

  Correct Answer: C

  Reference: https://docs.microsoft.com/en-us/cloud-app-security/anomaly-detection-policy

• Question 150:

  You need to implement the Azure Information Protection requirements. What should you configure first?

  A. Device health and compliance reports settings in Microsoft Defender Security Center

  B. scanner clusters in Azure Information Protection from the Azure portal

  C. content scan jobs in Azure Information Protection from the Azure portal

  D. Advanced features from Settings in Microsoft Defender Security Center

  Correct Answer: D

  Reference: https://docs.microsoft.com/en-us/windows/security/threat-protection/microsoft-defender-atp/information-protection-in-windows-overview