Microsoft Microsoft Certifications SC-200 Questions & Answers

• Question 281:

  HOTSPOT

  You need to implement the query for Workbook1 and Webapp1.

  The solution must meet the Microsoft Sentinel requirements.

  How should you configure the query? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.

  Hot Area:

  

  Correct Answer:

  

• Question 282:

  HOTSPOT

  You need to implement the Microsoft Sentinel NRT rule for monitoring the designated break glass account. The solution must meet the Microsoft Sentinel requirements.

  How should you complete the query? To answer, select the appropriate options in the answer area.

  NOTE: Each correct selection is worth one point.

  Hot Area:

  

  Correct Answer:

  

• Question 283:

  HOTSPOT

  You need to implement the ASIM query for DNS requests. The solution must meet the Microsoft Sentinel requirements. How should you configure the query? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.

  Hot Area:

  

  Correct Answer:

  

• Question 284:

  HOTSPOT

  You need to monitor the password resets. The solution must meet the Microsoft Sentinel requirements.

  What should you do? To answer, select the appropriate options in the answer area.

  NOTE: Each correct selection is worth one point.

  Hot Area:

  

  Correct Answer:

  

• Question 285:

  DRAG DROP

  You are investigating an incident by using Microsoft 365 Defender.

  You need to create an advanced hunting query to detect failed sign-in authentications on three devices named CFOLaptop, CEOLaptop, and COOLaptop.

  How should you complete the query? To answer, select the appropriate options in the answer area.

  NOTE: Each correct selection is worth one point.

  Select and Place:

  

  Correct Answer:

  

• Question 286:

  DRAG DROP

  You open the Cloud App Security portal as shown in the following exhibit.

  

  You need to remediate the risk for the Launchpad app.

  Which four actions should you perform in sequence? To answer, move the appropriate actions from the list of actions to the answer area and arrange them in the correct order.

  Select and Place:

  

  Correct Answer:

  

  Reference: https://docs.microsoft.com/en-us/cloud-app-security/governance-discovery

• Question 287:

  DRAG DROP

  You are informed of a new common vulnerabilities and exposures (CVE) vulnerability that affects your environment.

  You need to use Microsoft Defender Security Center to request remediation from the team responsible for the affected systems if there is a documented active exploit available.

  Which three actions should you perform in sequence? To answer, move the appropriate actions from the list of actions to the answer area and arrange them in the correct order.

  Select and Place:

  

  Correct Answer:

  

  Reference: https://docs.microsoft.com/en-us/azure/sentinel/detect-threats-custom https://techcommunity.microsoft.com/t5/core-infrastructure-and-security/microsoft-defender-atp-remediate-apps-using-mem/ba-p/1599271

• Question 288:

  DRAG DROP

  You create a new Azure subscription and start collecting logs for Azure Monitor.

  You need to configure Azure Security Center to detect possible threats related to sign-ins from suspicious IP addresses to Azure virtual machines. The solution must validate the configuration.

  Which three actions should you perform in a sequence? To answer, move the appropriate actions from the list of action to the answer area and arrange them in the correct order.

  Select and Place:

  

  Correct Answer:

  

  Reference: https://docs.microsoft.com/en-us/azure/security-center/security-center-alert-validation

• Question 289:

  DRAG DROP

  You have resources in Azure and Google cloud.

  You need to ingest Google Cloud Platform (GCP) data into Azure Defender.

  In which order should you perform the actions? To answer, move all actions from the list of actions to the answer area and arrange them in the correct order.

  Select and Place:

  

  Correct Answer:

  

  Reference: https://docs.microsoft.com/en-us/azure/security-center/quickstart-onboard-gcp

• Question 290:

  DRAG DROP

  You plan to connect an external solution that will send Common Event Format (CEF) messages to Azure Sentinel.

  You need to deploy the log forwarder.

  Which three actions should you perform in sequence? To answer, move the appropriate actions form the list of actions to the answer area and arrange them in the correct order.

  Select and Place:

  

  Correct Answer:

  

  Reference: https://docs.microsoft.com/en-us/azure/sentinel/connect-cef-agent?tabs=rsyslog