Microsoft Microsoft Certifications SC-200 Questions & Answers

• Question 21:

  You have an Azure subscription that has Microsoft Defender for Cloud enabled.

  You have a virtual machine that runs Windows 10 and has the Log Analytics agent installed.

  You need to simulate an attack on the virtual machine that will generate an alert.

  What should you do first?

  A. Run the Log Analytics Troubleshooting Tool.

  B. Copy and executable and rename the file as ASC_AlertTest_662jfi039N.exe.

  C. Modify the settings of the Microsoft Monitoring Agent.

  D. Run the MMASetup executable and specify the -foo argument.

  Correct Answer: B

  Simulate alerts on your Azure VMs (Windows)

  After the Log Analytics agent is installed on your machine, follow these steps from the computer where you want to be the attacked resource of the alert:

  1.

  Copy an executable (for example calc.exe) to the computer's desktop, or other directory of your convenience, and rename it as ASC_AlertTest_662jfi039N.exe.

  2.

  Open the command prompt and execute this file with an argument (just a fake argument name), such as: ASC_AlertTest_662jfi039N.exe -foo

  3.

  Wait 5 to 10 minutes and open Defender for Cloud Alerts. An alert should appear.

  Reference: https://learn.microsoft.com/en-us/azure/defender-for-cloud/alert-validation

• Question 22:

  You have an Azure subscription that uses Microsoft Defender for Cloud and contains a resource group named RG1. RG1. You need to configure just in time (JIT) VM access for the virtual machines in RG1. The solution must meet the following

  1.

  Limit the maximum request time to two hours.

  2.

  Limit protocol access to Remote Desktop Protocol (RDP) only.

  3.

  Minimize administrative effort. What should you use?

  A. Azure AD Privileged Identity Management (PIM)

  B. Azure Policy

  C. Azure Front Door

  D. Azure Bastion

  Correct Answer: A

• Question 23:

  You have a Microsoft Sentinel workspace that contains the following incident.

  Brute force attack against Azure Portal analytics rule has been triggered.

  You need to identify the geolocation information that corresponds to the incident. What should you do?

  A. From Overview, review the Potential malicious events map.

  B. From Incidents, review the details of the iPCustomEntity entity associated with the incident.

  C. From Incidents, review the details of the AccouncCuscomEntity entity associated with the incident.

  D. From Investigation, review insights on the incident entity.

  Correct Answer: B

  According to this article, Microsoft Defender for Cloud detects brute force attacks and triggers alerts that contain the attacking IP address in the ‘entities

• Question 24:

  You have an Azure Sentinel workspace.

  You need to test a playbook manually in the Azure portal. From where can you run the test in Azure Sentinel?

  A. Playbooks

  B. Analytics

  C. Threat intelligence

  D. Incidents

  Correct Answer: D

  Reference: https://docs.microsoft.com/en-us/azure/sentinel/tutorial-respond-threats-playbook#run-a-playbook-on-demand

• Question 25:

  You have a Microsoft 365 E5 subscription that uses Microsoft SharePoint Online.

  You delete users from the subscription.

  You need to be notified if the deleted users downloaded numerous documents from SharePoint Online sites during the month before their accounts were deleted.

  What should you use?

  A. a file policy in Microsoft Defender for Cloud Apps

  B. an access review policy

  C. an alert policy in Microsoft Defender for Office 365

  D. an insider risk policy

  Correct Answer: C

  Alert policies let you categorize the alerts that are triggered by a policy, apply the policy to all users in your organization, set a threshold level for when an alert is triggered, and decide whether to receive email notifications when alerts are

  triggered.

  Default alert policies include:

  Unusual external user file activity - Generates an alert when an unusually large number of activities are performed on files in SharePoint or OneDrive by users outside of your organization. This includes activities such as accessing files,

  downloading files, and deleting files. This policy has a High severity setting.

  Reference: https://docs.microsoft.com/en-us/microsoft-365/compliance/alert-policies

• Question 26:

  You have a custom Microsoft Sentinel workbook named Workbooks.

  You need to add a grid to Workbook1. The solution must ensure that the grid contains a maximum of 100 rows.

  What should you do?

  A. In the query editor interface, configure Settings.

  B. In the query editor interface, select Advanced Editor

  C. In the grid query, include the project operator.

  D. In the grid query, include the take operator.

  Correct Answer: D

  The take operator allows you to limit the number of rows returned by a query. By including the take operator in the grid query and specifying a maximum of 100 rows, you can ensure that the grid in Workbook1 contains a maximum of 100 rows.

• Question 27:

  You have an Azure subscription that uses Microsoft Sentinel.

  You need to minimize the administrative effort required to respond to the incidents and remediate the security threats detected by Microsoft Sentinel.

  Which two features should you use? Each correct answer presents part of the solution.

  NOTE: Each correct selection is worth one point.

  A. Microsoft Sentinel bookmarks

  B. Azure Automation runbooks

  C. Microsoft Sentinel automation rules

  D. Microsoft Sentinel playbooks

  E. Azure Functions apps

  Correct Answer: CD

  Reference: https://docs.microsoft.com/en-us/azure/sentinel/tutorial-respond-threats-playbook?tabs=LAC

• Question 28:

  You have a Microsoft 365 subscription that uses Microsoft 365 Defender.

  You need to identify all the entities affected by an incident.

  Which tab should you use in the Microsoft 365 Defender portal?

  A. Investigations

  B. Devices

  C. Evidence and Response

  D. Alerts

  Correct Answer: C

  The Evidence and Response tab shows all the supported events and suspicious entities in the alerts in the incident. Reference: https://docs.microsoft.com/en-us/microsoft-365/security/defender/investigate-incidents

• Question 29:

  You have a Microsoft Sentinel workspace.

  You receive multiple alerts for failed sign in attempts to an account.

  You identify that the alerts are false positives.

  You need to prevent additional failed sign-in alerts from being generated for the account. The solution must meet the following requirements:

  1.

  Ensure that failed sign-in alerts are generated for other accounts.

  2.

  Minimize administrative effort What should do?

  A. Create an automation rule.

  B. Create a watchlist.

  C. Modify the analytics rule.

  D. Add an activity template to the entity behavior.

  Correct Answer: A

  There are two methods for avoiding false positives:

  Automation rules create exceptions without modifying analytics rules.

  Scheduled analytics rules modifications permit more detailed and permanent exceptions.

  Automation rules

  Can apply to several analytics rules.

  Keep an audit trail. Exceptions prevent incident creation, but alerts are still recorded for audit purposes.

  Are often generated by analysts.

  Allow applying exceptions for a limited time. For example, maintenance work might trigger false positives that outside the maintenance timeframe would be true incidents.

  Incorrect:

  Not A: Analytics rules modifications

  Allow advanced boolean expressions and subnet-based exceptions.

  Let you use watchlists to centralize exception management.

  Typically require implementation by Security Operations Center (SOC) engineers.

  Are the most flexible and complete false positive solution, but are more complex

  Reference:

  https://docs.microsoft.com/en-us/azure/sentinel/false-positives

• Question 30:

  A company uses Azure Security Center and Azure Defender. However, the security operator of the company doesn't receive any email notifications for security alerts. What should be configured in Security Center to enable the email notifications?

  A. Pricing and settings

  B. Security solutions

  C. Security policy

  D. Azure Defender

  Correct Answer: A