Microsoft Microsoft Certifications SC-200 Questions & Answers

• Question 311:

  DRAG DROP

  You have an Azure subscription.

  You need to delegate permissions to meet the following requirements:

  Enable and disable advanced features of Microsoft Defender for Cloud.

  Apply security recommendations to a resource.

  The solution must use the principle of least privilege.

  Which Microsoft Defender for Cloud role should you use for each requirement? To answer, drag the appropriate roles to the correct requirements. Each role may be used once, mote than once, or not at all. You may need to drag the split bar

  between panes or scroll to view content.

  NOTE: Each correct selection is worth one point.

  Select and Place:

  

  Correct Answer:

  

• Question 312:

  DRAG DROP

  You have a Microsoft Sentinel workspace that contains the following Advanced Security Information Model (ASIM) parsers:

  1.

  _Im_ProcessCreate

  2.

  imProcessCreate

  You create a new source-specific parser named vimProcessCreate.

  You need to modify the parsers to meet the following requirements:

  1.

  Call all the ProcessCreate parsers.

  2.

  Standardize fields to the Process schema.

  Which parser should you modify to meet each requirement? To answer, drag the appropriate parsers to the correct requirements.

  Each parser may be used once, more than once, or not at all. You may need to drag the split bar between panes or scroll to view content.

  NOTE: Each correct selection is worth one point.

  Select and Place:

  

  Correct Answer:

  

• Question 313:

  DRAG DROP

  You have a Microsoft Sentinel workspace named SW1.

  In SW1, you enable User and Entity Behavior Analytics (UEBA).

  You need to use KQL to perform the following tasks:

  1.

  View the entity data that has fields for each type of entity.

  2.

  Assess the quality of rules by analyzing how well a rule performs.

  Which table should you use in KQL for each task? To answer, drag the appropriate tables to the correct tasks. Each table may be used once, more than once, or not at all. You may need to drag the split bar between panes or scroll to view

  content.

  NOTE: Each correct selection is worth one point.

  Select and Place:

  

  Correct Answer:

  

• Question 314:

  DRAG DROP

  You need to add notes to the events to meet the Azure Sentinel requirements.

  Which three actions should you perform in sequence? To answer, move the appropriate actions from the list of action to the answer area and arrange them in the correct order.

  Select and Place:

  

  Correct Answer:

  

  Reference: https://docs.microsoft.com/en-us/azure/sentinel/bookmarks

• Question 315:

  DRAG DROP

  You need to configure DC1 to meet the business requirements.

  Which four actions should you perform in sequence? To answer, move the appropriate actions from the list of actions to the answer area and arrange them in the correct order.

  Select and Place:

  

  Correct Answer:

  

  Step 1: log in to https://portal.atp.azure.com as a global admin Step 2: Create the instance Step 3. Connect the instance to Active Directory Step 4. Download and install the sensor.

  Reference: https://docs.microsoft.com/en-us/defender-for-identity/install-step1 https://docs.microsoft.com/en-us/defender-for-identity/install-step4

• Question 316:

  DRAG DROP

  You need to assign role-based access control (RBAC) roles to Group1 and Group2 to meet the Microsoft Sentinel requirements and the business requirements.

  Which role should you assign to each group? To answer, drag the appropriate roles to the correct groups. Each role may be used once, more than once, or not at all. You may need to drag the split bar between panes or scroll to view content.

  NOTE: Each correct selection is worth one point.

  Select and Place:

  

  Correct Answer:

  

  Box 1: Microsoft Sentinel Playbook Operator

  Microsoft Sentinel Playbook Operator can list, view, and manually run playbooks.

  Note: The fabrikam.com forest contains two global groups named Group1 and Group2.

  Fabrikam identifies the following Microsoft Sentinel requirements:

  Ensure that the members of Group1 can create and run playbooks.

  Box 2: Microsoft Sentinel Contributor

  Ensure that the members of Group1 can manage analytics rules.

  Microsoft Sentinel Contributor can, in addition to the below (Microsoft Sentinel Reader +Microsoft Sentinel Responder), create and edit workbooks, analytics rules, and other Microsoft Sentinel resources.

  Box 3: Microsoft Sentinel Responder

  Ensure that the members of Group2 can manage incidents.

  Microsoft Sentinel Reader can view data, incidents, workbooks, and other Microsoft Sentinel resources. Microsoft Sentinel Responder can, in addition to the above, manage incidents (assign, dismiss, etc.). Reference:

  https://learn.microsoft.com/en-us/azure/sentinel/roles