Microsoft Microsoft Certifications SC-200 Questions & Answers

• Question 31:

  You have a Microsoft Sentinel workspace named workspace1 that contains custom Kusto queries.

  You need to create a Python-based Jupyter notebook that will create visuals. The visuals will display the results of the queries and be pinned to a dashboard. The solution must minimize development effort.

  What should you use to create the visuals?

  A. plotly

  B. TensorFlow

  C. msticpy

  D. matplotlib

  Correct Answer: C

  msticpy is a library for InfoSec investigation and hunting in Jupyter Notebooks. It includes functionality to: query log data from multiple sources. enrich the data with Threat Intelligence, geolocations and Azure resource data. extract Indicators of Activity (IoA) from logs and unpack encoded data.

  MSTICPy reduces the amount of code that customers need to write for Microsoft Sentinel, and provides:

  Data query capabilities, against Microsoft Sentinel tables, Microsoft Defender for Endpoint, Splunk, and other data sources. Threat intelligence lookups with TI providers, such as VirusTotal and AlienVault OTX. Enrichment functions like geolocation of IP addresses, Indicator of Compromise (IoC) extraction, and WhoIs lookups. Visualization tools using event timelines, process trees, and geo mapping. Advanced analyses, such as time series decomposition, anomaly detection, and clustering.

  Reference: https://docs.microsoft.com/en-us/azure/sentinel/notebook-get-started https://msticpy.readthedocs.io/en/latest/

• Question 32:

  You have a Microsoft 365 subscription that has Microsoft 365 Defender enabled.

  You need to identify all the changes made to sensitivity labels during the past seven days.

  What should you use?

  A. the Incidents blade of the Microsoft 365 Defender portal

  B. the Alerts settings on the Data Loss Prevention blade of the Microsoft 365 compliance center

  C. Activity explorer in the Microsoft 365 compliance center

  D. the Explorer settings on the Email and collaboration blade of the Microsoft 365 Defender portal

  Correct Answer: C

  Labeling activities are available in Activity explorer.

  For example:

  Sensitivity label applied

  This event is generated each time an unlabeled document is labeled or an email is sent with a sensitivity label.

  It is captured at the time of save in Office native applications and web applications. It is captured at the time of occurrence in Azure Information protection add-ins. Upgrade and downgrade labels actions can also be monitored via the Label

  event type field and filter.

  Reference:

  https://docs.microsoft.com/en-us/microsoft-365/compliance/data-classification-activity-explorer-available-events?view=o365-worldwide

• Question 33:

  You have a Microsoft 365 tenant that uses Microsoft Exchange Online and Microsoft Defender for Office 365.

  You are required to identify whether zero-hour auto purge (ZAP) moved an email message from the mailbox of a user.

  Which option should you use?

  A. the Threat Protection Status report in Microsoft Defender for Office 365

  B. the mail flow report in Exchange

  C. the mailbox audit log in Exchange

  D. the Safe Attachments file types report in Microsoft Defender for Office 365

  Correct Answer: A

  To determine if ZAP moved your message, you can use either the Threat Protection Status report or Threat Explorer (and real-time detections). Reference:https://docs.microsoft.com/en-us/microsoft-365/security/office-365-security/zero-hour-auto-purge?view=o365-worldwide

• Question 34:

  The custom analytics rule which can detect threats in Azure Sentinel stopped running. The rule was disabled, and the rule name has a prefix of AUTO DISABLED. What is the problem?

  A. The number of alerts exceeded 10,000 within two minutes.

  B. There are connectivity issues between the data sources and Log Analytics.

  C. The rule query takes too long to run and times out.

  D. Permissions to one of the data sources of the rule query were modified.

  Correct Answer: D

  Reference: https://docs.microsoft.com/en-us/azure/sentinel/tutorial-detect-threats-custom

• Question 35:

  You have five on-premises Linux servers.

  You have an Azure subscription that uses Microsoft Defender for Cloud.

  You need to use Defender for Cloud to protect the Linux servers.

  What should you install on the servers first?

  A. the Dependency agent

  B. the Log Analytics agent

  C. the Azure Connected Machine agent

  D. the Guest Configuration extension

  Correct Answer: C

  The Azure Connected Machine agent is required to connect the on-premises Linux servers to the Azure subscription and integrate them with Microsoft Defender for Cloud. The agent enables communication between the servers and the Defender for Cloud service, allowing security events and data to be collected and analyzed.

  Once the Azure Connected Machine agent is installed, you can then install the Log Analytics agent to collect security data from the servers and send it to the Log Analytics workspace in Azure. This will allow you to use Defender for Cloud to monitor the security of your Linux servers, identify threats, and respond to security incidents.

• Question 36:

  You have a Microsoft Sentinel workspace named Workspace1.

  You need to exclude a built-in, source-specific Advanced Security information Model (ASIM) parse from a built-in unified ASIM parser.

  What should you create in Workspace1?

  A. a watch list

  B. an analytic rule

  C. a hunting query

  D. a workbook

  Correct Answer: A

  To support excluding built-in source-specific parsers, ASIM uses a watchlist. Deploy the watchlist to your Microsoft Sentinel workspace from the Microsoft Sentinel GitHub repository. Reference: https://learn.microsoft.com/en-us/azure/sentinel/normalization-manage-parsers

• Question 37:

  You have two Azure subscriptions that use Microsoft Defender for Cloud.

  You need to ensure that specific Defender for Cloud security alerts are suppressed at the root management group level. The solution must minimize administrative effort.

  What should you do in the Azure portal?

  A. Create an Azure Policy assignment.

  B. Modify the Workload protections settings in Defender for Cloud.

  C. Create an alert rule in Azure Monitor.

  D. Modify the alert settings in Defender for Cloud.

  Correct Answer: A

  You can use alerts suppression rules to suppress false positives or other unwanted security alerts from Defender for Cloud. Note: To create a rule directly in the Azure portal:

  1.

  From Defender for Cloud's security alerts page:

  Select the specific alert you don't want to see anymore, and from the details pane, select Take action.

  Or, select the suppression rules link at the top of the page, and from the suppression rules page select Create new suppression rule:

  2.

  In the new suppression rule pane, enter the details of your new rule. Your rule can dismiss the alert on all resources so you don't get any alerts like this one in the future. Your rule can dismiss the alert on specific criteria - when it relates to

  a specific IP address, process name, user account, Azure resource, or location.

  3.

  Enter details of the rule.

  4.

  Save the rule.

  Reference: https://docs.microsoft.com/en-us/azure/defender-for-cloud/alerts-suppression-rules

• Question 38:

  You have an Azure subscription that uses Microsoft Defender for Endpoint.

  You need to ensure that you can allow or block a user-specified range of IP addresses and URLs.

  What should you enable first in the advanced features from the Endpoints Settings in the Microsoft 365 Defender portal?

  A. endpoint detection and response (EDR) in block mode

  B. custom network indicators

  C. web content filtering

  D. Live response for servers

  Correct Answer: B

  Custom network indicators Configures devices to allow or block connections to IP addresses, domains, or URLs in your custom indicator lists. To use this feature, devices must be running Windows 10 version 1709 or later. They should also have network protection in block mode and version 4.18.1906.3 or later of the antimalware platform (see KB 4052623). Note that network protection leverages reputation services that process requests in locations that might be outside of the location you have selected for your Microsoft Defender for Endpoint data.

• Question 39:

  You have an Azure subscription that uses Microsoft Defender for Cloud and contains a storage account named storage1. You receive an alert that there was an unusually high volume of delete operations on the blobs in storage1.

  You need to identify which blobs were deleted.

  What should you review?

  A. the Azure Storage Analytics logs

  B. the activity logs of storage1

  C. the alert details

  D. the related entities of the alert

  Correct Answer: A

  Configure Microsoft Defender for Storage Security alerts are triggered when anomalies in activity occur. These security alerts are integrated with Microsoft Defender for Cloud, and are also sent via email to subscription administrators, with details of suspicious activity and recommendations on how to investigate and remediate threats.

  The service ingests resource logs of read, write, and delete requests to Blob storage and to Azure Files for threat detection. To investigate alerts from Microsoft Defender for Cloud, you can view related storage activity using Storage Analytics Logging.

  Reference: https://learn.microsoft.com/en-us/azure/storage/common/azure-defender-storage-configure

• Question 40:

  You have a third-party security information and event management (SIEM) solution.

  You need to ensure that the SIEM solution can generate alerts for Azure Active Directory (Azure AD) sign-events in near real time.

  What should you do to route events to the SIEM solution?

  A. Create an Azure Sentinel workspace that has a Security Events connector.

  B. Configure the Diagnostics settings in Azure AD to stream to an event hub.

  C. Create an Azure Sentinel workspace that has an Azure Active Directory connector.

  D. Configure the Diagnostics settings in Azure AD to archive to a storage account.

  Correct Answer: B

  Reference: https://docs.microsoft.com/en-us/azure/active-directory/reports-monitoring/overview-monitoring