Microsoft Role-based SC-200 Questions & Answers

• Question 61:

  HOTSPOT

  You have an Azure Storage account that will be accessed by multiple Azure Function apps during the development of an application.

  You need to hide Azure Defender alerts for the storage account.

  Which entity type and field should you use in a suppression rule? To answer, select the appropriate options in the answer area.

  NOTE: Each correct selection is worth one point.

  Hot Area:

  

  Correct Answer:

  

  Reference: https://techcommunity.microsoft.com/t5/azure-security-center/suppression-rules-for-azure-security-center-alerts-are-now/ba-p/1404920

• Question 62:

  HOTSPOT

  You have an Azure subscription that uses Azure Defender.

  You plan to use Azure Security Center workflow automation to respond to Azure Defender threat alerts.

  You need to create an Azure policy that will perform threat remediation automatically.

  What should you include in the solution? To answer, select the appropriate options in the answer area.

  NOTE: Each correct selection is worth one point.

  Hot Area:

  

  Correct Answer:

  

  Reference: https://docs.microsoft.com/en-us/azure/governance/policy/concepts/effects https://docs.microsoft.com/en-us/azure/security-center/workflow-automation

• Question 63:

  HOTSPOT

  You deploy Azure Sentinel.

  You need to implement connectors in Azure Sentinel to monitor Microsoft Teams and Linux virtual machines in Azure. The solution must minimize administrative effort.

  Which data connector type should you use for each workload? To answer, select the appropriate options in the answer area.

  NOTE: Each correct selection is worth one point.

  Hot Area:

  

  Correct Answer:

  

  Reference: https://docs.microsoft.com/en-us/azure/sentinel/connect-office-365 https://docs.microsoft.com/en-us/azure/sentinel/connect-syslog

• Question 64:

  HOTSPOT

  You need to implement Azure Sentinel queries for Contoso and Fabrikam to meet the technical requirements.

  What should you include in the solution? To answer, select the appropriate options in the answer area.

  NOTE: Each correct selection is worth one point.

  Hot Area:

  

  Correct Answer:

  

  Reference: https://docs.microsoft.com/en-us/azure/sentinel/extend-sentinel-across-workspaces-tenants

• Question 65:

  HOTSPOT

  You purchase a Microsoft 365 subscription.

  You plan to configure Microsoft Cloud App Security.

  You need to create a custom template-based policy that detects connections to Microsoft 365 apps that originate from a botnet network.

  What should you use? To answer, select the appropriate options in the answer area.

  NOTE: Each correct selection is worth one point.

  Hot Area:

  

  Correct Answer:

  

  Reference: https://docs.microsoft.com/en-us/cloud-app-security/anomaly-detection-policy

• Question 66:

  HOTSPOT

  You need to use an Azure Resource Manager template to create a workflow automation that will trigger an automatic remediation when specific security alerts are received by Azure Security Center.

  How should you complete the portion of the template that will provision the required Azure resources? To answer, select the appropriate options in the answer area.

  NOTE: Each correct selection is worth one point.

  Hot Area:

  

  Correct Answer:

  

  Reference: https://docs.microsoft.com/en-us/azure/security-center/quickstart-automation-alert

• Question 67:

  HOTSPOT

  You are informed of an increase in malicious email being received by users.

  You need to create an advanced hunting query in Microsoft 365 Defender to identify whether the accounts of the email recipients were compromised. The query must return the most recent 20 sign-ins performed by the recipients within an

  hour of receiving the known malicious email.

  How should you complete the query? To answer, select the appropriate options in the answer area.

  NOTE: Each correct selection is worth one point.

  Hot Area:

  

  Correct Answer:

  

  Reference: https://docs.microsoft.com/en-us/microsoft-365/security/defender/advanced-hunting-query-emails-devices?view=o365-worldwide

• Question 68:

  HOTSPOT

  You have a Microsoft 365 E5 subscription that uses Microsoft Defender and an Azure subscription that uses Azure Sentinel.

  You need to identify all the devices that contain files in emails sent by a known malicious email sender. The query will be based on the match of the SHA256 hash.

  How should you complete the query? To answer, select the appropriate options in the answer area.

  NOTE: Each correct selection is worth one point.

  Hot Area:

  

  Correct Answer:

  

  Reference: https://docs.microsoft.com/en-us/microsoft-365/security/defender/advanced-hunting-query-emails-devices?view=o365-worldwide

• Question 69:

  HOTSPOT

  You manage the security posture of an Azure subscription that contains two virtual machines name vm1 and vm2.

  The secure score in Azure Security Center is shown in the Security Center exhibit. (Click the Security Center tab.)

  

  Azure Policy assignments are configured as shown in the Policies exhibit. (Click the Policies tab.)

  

  For each of the following statements, select Yes if the statement is true. Otherwise, select No.

  NOTE: Each correct selection is worth one point.

  Hot Area:

  

  Correct Answer:

  

  Reference: https://techcommunity.microsoft.com/t5/azure-security-center/security-control-restrict-unauthorized-network-access/ba-p/1593833 https://techcommunity.microsoft.com/t5/azure-security-center/security-control-secure-management-ports/ba-p/1505770

• Question 70:

  HOTSPOT

  You have a Microsoft 365 E5 subscription.

  You plan to perform cross-domain investigations by using Microsoft 365 Defender.

  You need to create an advanced hunting query to identify devices affected by a malicious email attachment.

  How should you complete the query? To answer, select the appropriate options in the answer area.

  NOTE: Each correct selection is worth one point.

  Hot Area:

  

  Correct Answer:

  

  Reference: https://docs.microsoft.com/en-us/microsoft-365/security/mtp/advanced-hunting-query-emails-devices?view=o365-worldwide