Microsoft Microsoft Certifications SC-200 Questions & Answers

• Question 81:

  You are configuring Azure Sentinel.

  You need to send a Microsoft Teams message to a channel whenever an incident representing a sign-in risk event is activated in Azure Sentinel.

  Which two actions should you perform in Azure Sentinel? Each correct answer presents part of the solution.

  NOTE: Each correct selection is worth one point.

  A. Enable Entity behavior analytics.

  B. Associate a playbook to the analytics rule that triggered the incident.

  C. Enable the Fusion rule.

  D. Add a playbook.

  E. Create a workbook.

  Correct Answer: BD

  Reference: https://docs.microsoft.com/en-us/azure/sentinel/enable-entity-behavior-analytics https://docs.microsoft.com/en-us/azure/sentinel/automate-responses-with-playbooks

• Question 82:

  After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.

  You are configuring Microsoft Defender for Identity integration with Active Directory.

  From the Microsoft Defender for identity portal, you need to configure several accounts for attackers to exploit.

  Solution: You add each account as a Sensitive account.

  Does this meet the goal?

  A. Yes

  B. No

  Correct Answer: B

  Reference: https://docs.microsoft.com/en-us/defender-for-identity/manage-sensitive-honeytoken-accounts

• Question 83:

  Your company has a single office in Istanbul and a Microsoft 365 subscription.

  The company plans to use conditional access policies to enforce multi-factor authentication (MFA).

  You need to enforce MFA for all users who work remotely.

  What should you include in the solution?

  A. a fraud alert

  B. a user risk policy

  C. a named location

  D. a sign-in user policy

  Correct Answer: C

  Reference: https://docs.microsoft.com/en-us/azure/active-directory/conditional-access/location-condition

• Question 84:

  You are configuring Microsoft Cloud App Security.

  You have a custom threat detection policy based on the IP address ranges of your company's United States-based offices.

  You receive many alerts related to impossible travel and sign-ins from risky IP addresses.

  You determine that 99% of the alerts are legitimate sign-ins from your corporate offices.

  You need to prevent alerts for legitimate sign-ins from known locations.

  Which two actions should you perform? Each correct answer presents part of the solution.

  NOTE: Each correct selection is worth one point.

  A. Configure automatic data enrichment.

  B. Add the IP addresses to the corporate address range category.

  C. Increase the sensitivity level of the impossible travel anomaly detection policy.

  D. Add the IP addresses to the other address range category and add a tag.

  E. Create an activity policy that has an exclusion for the IP addresses.

  Correct Answer: BE

  Add the IP addresses to the corporate address range category: By adding the IP addresses of your company's United States-based offices to the corporate address range category, you inform Microsoft Cloud App Security that these IP addresses are trusted and belong to your organization. This helps to avoid unnecessary alerts for legitimate sign-ins from these known locations.

  Create an activity policy that has an exclusion for the IP addresses: By creating an activity policy and excluding the IP addresses of your United States-based offices, you can specify that alerts related to sign-ins from these locations should not be generated. This action ensures that legitimate sign-ins from your corporate offices are not considered as risky or impossible travel, thus reducing the number of unnecessary alerts.

• Question 85:

  You have the following environment:

  1.

  Azure Sentinel

  2.

  A Microsoft 365 subscription

  3.

  Microsoft Defender for Identity

  4.

  An Azure Active Directory (Azure AD) tenant

  You configure Azure Sentinel to collect security logs from all the Active Directory member servers and domain controllers.

  You deploy Microsoft Defender for Identity by using standalone sensors.

  You need to ensure that you can detect when sensitive groups are modified in Active Directory.

  Which two actions should you perform? Each correct answer presents part of the solution.

  NOTE: Each correct selection is worth one point.

  A. Configure the Advanced Audit Policy Configuration settings for the domain controllers.

  B. Modify the permissions of the Domain Controllers organizational unit (OU).

  C. Configure auditing in the Microsoft 365 compliance center.

  D. Configure Windows Event Forwarding on the domain controllers.

  Correct Answer: AD

  To enable auditing for sensitive groups, you need to configure the Advanced Audit Policy Configuration settings for the domain controllers. This can be done by modifying the Default Domain Controllers Policy in the Group Policy Management Console (GPMC) and enabling the "Audit Detailed Directory Service Replication" policy under "Advanced Audit Policy Configuration\DS Access". This will generate audit events when sensitive groups are modified.

  Windows Event Forwarding can be used to forward the audit events generated by the domain controllers to Azure Sentinel for analysis. This involves configuring a subscription on the domain controllers and a collection rule in Azure Sentinel to collect the forwarded events.

  Reference: https://docs.microsoft.com/en-us/defender-for-identity/configure-windows-event-collection https://docs.microsoft.com/en-us/defender-for-identity/configure-event-collection

• Question 86:

  You use Azure Security Center.

  You receive a security alert in Security Center.

  You need to view recommendations to resolve the alert in Security Center.

  What should you do?

  A. From Security alerts, select the alert, select Take Action, and then expand the Prevent future attacks section.

  B. From Security alerts, select Take Action, and then expand the Mitigate the threat section.

  C. From Regulatory compliance, download the report.

  D. From Recommendations, download the CSV report.

  Correct Answer: B

  Reference: https://docs.microsoft.com/en-us/azure/security-center/security-center-managing-and-responding-alerts

• Question 87:

  You have a suppression rule in Azure Security Center for 10 virtual machines that are used for testing. The virtual machines run Windows Server.

  You are troubleshooting an issue on the virtual machines.

  In Security Center, you need to view the alerts generated by the virtual machines during the last five days.

  What should you do?

  A. Change the rule expiration date of the suppression rule.

  B. Change the state of the suppression rule to Disabled.

  C. Modify the filter for the Security alerts page.

  D. View the Windows event logs on the virtual machines.

  Correct Answer: B

  Reference: https://docs.microsoft.com/en-us/azure/security-center/alerts-suppression-rules

• Question 88:

  You are investigating an incident in Azure Sentinel that contains more than 127 alerts.

  You discover eight alerts in the incident that require further investigation.

  You need to escalate the alerts to another Azure Sentinel administrator.

  What should you do to provide the alerts to the administrator?

  A. Create a Microsoft incident creation rule

  B. Share the incident URL

  C. Create a scheduled query rule

  D. Assign the incident

  Correct Answer: D

  Reference: https://docs.microsoft.com/en-us/azure/sentinel/investigate-cases

• Question 89:

  You need to configure Microsoft Cloud App Security to generate alerts and trigger remediation actions in response to external sharing of confidential files.

  Which two actions should you perform in the Cloud App Security portal? Each correct answer presents part of the solution.

  NOTE: Each correct selection is worth one point.

  A. From Settings, select Information Protection, select Azure Information Protection, and then select Only scan files for Azure Information Protection classification labels and content inspection warnings from this tenant.

  B. Select Investigate files, and then filter App to Office 365.

  C. Select Investigate files, and then select New policy from search.

  D. From Settings, select Information Protection, select Azure Information Protection, and then select Automatically scan new files for Azure Information Protection classification labels and content inspection warnings.

  E. From Settings, select Information Protection, select Files, and then enable file monitoring.

  F. Select Investigate files, and then filter File Type to Document.

  Correct Answer: DE

  From Settings, select Information Protection, select Azure Information Protection, and then select Automatically scan new files for Azure Information Protection classification labels and content inspection warnings. This will enable Cloud App Security to automatically scan new files for Azure Information Protection classification labels and content inspection warnings, which can be used to detect and protect confidential files.

  From Settings, select Information Protection, select Files, and then enable file monitoring. This will enable Cloud App Security to monitor files for external sharing and other activities, and to generate alerts and trigger remediation actions in response to potential threats or policy violations.

  Reference: https://docs.microsoft.com/en-us/cloud-app-security/tutorial-dlp https://docs.microsoft.com/en-us/cloud-app-security/azip-integration

• Question 90:

  Your company deploys the following services:

  1.

  Microsoft Defender for Identity

  2.

  Microsoft Defender for Endpoint

  3.

  Microsoft Defender for Office 365

  You need to provide a security analyst with the ability to use the Microsoft 365 security center. The analyst must be able to approve and reject pending actions generated by Microsoft Defender for Endpoint. The solution must use the principle

  of least privilege.

  Which two roles should assign to the analyst? Each correct answer presents part of the solution.

  NOTE: Each correct selection is worth one point.

  A. the Compliance Data Administrator in Azure Active Directory (Azure AD)

  B. the Active remediation actions role in Microsoft Defender for Endpoint

  C. the Security Administrator role in Azure Active Directory (Azure AD)

  D. the Security Reader role in Azure Active Directory (Azure AD)

  Correct Answer: BD

  Reason being that you do not need a Reader Role.

  The Active remediation actions role in Microsoft Defender for Endpoint: This role grants the analyst the ability to take active remediation actions, which includes approving and rejecting pending actions in Microsoft Defender for Endpoint.

  The Security Administrator role in Azure Active Directory (Azure AD): While not specific to Defender for Endpoint, this role provides broad access to security-related tasks and configuration across Microsoft 365 services, aligning with the

  analyst's responsibilities.

  Reference:

  https://docs.microsoft.com/en-us/microsoft-365/security/defender-endpoint/rbac?view=o365-worldwide