Microsoft Microsoft Certifications SC-200 Questions & Answers

• Question 271:

  HOTSPOT

  You need to implement Azure Sentinel queries for Contoso and Fabrikam to meet the technical requirements.

  What should you include in the solution? To answer, select the appropriate options in the answer area.

  NOTE: Each correct selection is worth one point.

  Hot Area:

  

  Correct Answer:

  

  Reference: https://docs.microsoft.com/en-us/azure/sentinel/extend-sentinel-across-workspaces-tenants

• Question 272:

  HOTSPOT

  You need to configure the Azure Sentinel integration to meet the Azure Sentinel requirements.

  What should you do? To answer, select the appropriate options in the answer area.

  NOTE: Each correct selection is worth one point.

  Hot Area:

  

  Correct Answer:

  

  Reference: https://docs.microsoft.com/en-us/cloud-app-security/siem-sentinel

• Question 273:

  HOTSPOT

  You need to create the analytics rule to meet the Azure Sentinel requirements.

  What should you do? To answer, select the appropriate options in the answer area.

  NOTE: Each correct selection is worth one point.

  Hot Area:

  

  Correct Answer:

  

  Reference: https://docs.microsoft.com/en-us/azure/sentinel/tutorial-detect-threats-custom#set-automated-responses-and-create-the-rule https://docs.microsoft.com/en-us/azure/sentinel/tutorial-respond-threats-playbook

• Question 274:

  HOTSPOT

  You need to implement Azure Defender to meet the Azure Defender requirements and the business requirements.

  What should you include in the solution? To answer, select the appropriate options in the answer area.

  NOTE: Each correct selection is worth one point.

  Hot Area:

  

  Correct Answer:

  

• Question 275:

  HOTSPOT

  You need to configure the Azure Sentinel integration to meet the Azure Sentinel requirements.

  What should you do? To answer, select the appropriate options in the answer area.

  NOTE: Each correct selection is worth one point.

  Hot Area:

  

  Correct Answer:

  

• Question 276:

  HOTSPOT

  You need to implement Microsoft Defender for Cloud to meet the Microsoft Defender for Cloud requirements and the business requirements.

  What should you include in the solution?

  To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.

  Hot Area:

  

  Correct Answer:

  

• Question 277:

  HOTSPOT

  You need to create a query to investigate DNS-related activity. The solution must meet the Microsoft Sentinel requirements.

  How should you complete the query? To answer, select the appropriate options in the answer area.

  NOTE: Each correct selection is worth one point.

  Hot Area:

  

  Correct Answer:

  

  Box 1: _Im_Dns

  Fabrikam identifies the following Microsoft Sentinel requirements:

  Query for NXDOMAIN DNS requests from the last seven days by using built-in Advanced Security Information Model (ASIM) unifying parsers.

  Unifying parsers

  When using ASIM in your queries, use unifying parsers to combine all sources, normalized to the same schema, and query them using normalized fields. The unifying parser name is _Im_ for built-in parsers and im for

  workspace deployed parsers, where stands for the specific schema it serves.

  For example, the following query uses the built-in unifying DNS parser to query DNS events using the ResponseCodeName, SrcIpAddr, and TimeGenerated normalized fields:

  _Im_Dns(starttime=ago(1d), responsecodename='NXDOMAIN') | summarize count() by SrcIpAddr, bin(TimeGenerated,15m)

  The example uses filtering parameters, which improve ASIM performance. The same example without filtering parameters would look like this:

  _Im_Dns | where TimeGenerated > ago(1d) | where ResponseCodeName =~ "NXDOMAIN" | summarize count() by SrcIpAddr, bin(TimeGenerated,15m)

  Box 2: (where TimeGenerated > ago(7d) |

  Reference: https://learn.microsoft.com/en-us/azure/sentinel/normalization-about-parsers

• Question 278:

  HOTSPOT

  You need to meet the Microsoft Sentinel requirements for collecting Windows Security event logs.

  What should you do? To answer, select the appropriate options in the answer area.

  NOTE: Each correct selection is worth one point.

  Hot Area:

  

  Correct Answer:

  

  Box 1: Log Analytics agent Fabrikam identifies the following Microsoft Sentinel requirements: From AWS EC2 instances, collect Windows Security event log entries that include local group membership changes

  Use the Log Analytics agent if you need to:

  Collect logs and performance data from Azure virtual machines or hybrid machines hosted outside of Azure.

  Send data to a Log Analytics workspace to take advantage of features supported by Azure Monitor Logs, such as log queries

  Etc.

  Box 2: KQL Log queries in Azure Monitor Azure Monitor Logs is based on Azure Data Explorer, and log queries are written by using the same Kusto Query Language (KQL). This rich language is designed to be easy to read and author, so you should be able to start writing queries with some basic guidance.

  Reference: https://learn.microsoft.com/en-us/azure/azure-monitor/agents/log-analytics-agent

• Question 279:

  HOTSPOT

  You need to meet the Microsoft Defender for Cloud Apps requirements.

  What should you do? To answer, select the appropriate options in the answer area.

  NOTE: Each correct selection is worth one point.

  Hot Area:

  

  Correct Answer:

  

• Question 280:

  HOTSPOT

  You need to assign role-based access control (RBAC) roles to Group1 and Group2 to meet the Microsoft Defender for Cloud requirements and the business requirements.

  Which role should you assign to each group? To answer, select the appropriate options in the answer area.

  NOTE: Each correct selection is worth one point.

  Hot Area:

  

  Correct Answer: