SC-200 Free Practice Questions

Question 1

You have three Azure subscriptions. Each subscription contains multiple virtual machines that run Windows Server. You have a Microsoft Sentinel workspace. You need to ensure that failed sign-in attempts from all the virtual machines can be analyzed by using Microsoft Sentinel. The solution must minimize administrative effort. What should you do first?

Question 1

HOTSPOT - You have a Microsoft 365 subscription that uses Microsoft Defender XDR. You plan to investigate suspicious activity in the subscription by using Microsoft Graph activity logs. You need to search for requests to delete resources from the subscription and identify the users that initiated the requests. How should you complete the KQL query? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.

Question 2

HOTSPOT - You have the resources shown in the following table. You have an Azure subscription that uses Microsoft Defender for Cloud. You need to use Defender for Cloud to protect VM1 and Server1. The solution must meet the following requirements: • Support Advanced Threat Protection and vulnerability assessment. • Register each SQL Server 2022 instance as a SQL virtual machine. • Minimize implementation and administrative effort. What should you deploy to each server? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.

Question 2

You have a Microsoft 365 subscription. You have the devices shown in the following table. All the devices are onboarded to Microsoft Defender for Endpoint. You are investigating a potential malware exploit on the devices. You need to review the system log of each device. The solution must minimize disruptions to the devices. What should you do for each device first in the Microsoft Defender portal?

Question 3

HOTSPOT - You have a Microsoft 365 subscription named contoso.com that contains a Windows 11 device named Device1. Device1 is onboarded to Microsoft Defender for Endpoint. You perform the following actions: • From Defender for Endpoint, create the device groups shown in the following table. • Onboard an Android device named Device2 to Defender for Endpoint. To which device groups will each device be added? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.

Question 3

You have a Microsoft Sentinel workspace that contains the following tables. You need to investigate the log data by using a search. Which tables can you search?

Question 4

You have 1,000 on-premises Windows 11 Pro devices that are onboarded to Microsoft Defender for Endpoint. You have a Microsoft 365 subscription that uses Microsoft Defender XDR. You identify that an attacker performed the following actions on a device: • Modified the file system path of a registry-based antivirus exclusion • Downloaded a malicious file to the file system path You initiate a live response session on the device. You need to remove the malicious file. Which command should you run?

Question 4

HOTSPOT - You have a Microsoft Sentinel workspace named Workspace1. The AzureActivity table in Workspace1 has the following retention periods: • Interactive: 180 days • Total: 180 days You need to modify the retention periods to meet the following requirements: • Minimize the costs associated with storing data in the table. • Maximize the period during which the table data remains available. How should you configure each retention period? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.

Question 5

You have two Microsoft Entra tenants named Tenant1 and Tenant2. Each tenant is linked to an Azure subscription. Tenant1 contains a group named Group1. Tenant2 contains a group named Group2. You need to implement Microsoft Sentinel for each tenant. The solution must meet the following requirements: • Ensure that Group1 can manage security incidents for Tenant1 and Tenant2 in a single workspace. • Ensure that Group2 can manage security incidents only for Tenant2. • Minimize the use of guest accounts. • Minimize administrative effort. • Minimize costs. What should you include in the solution?

Question 6

You have a Microsoft 365 E5 subscription that contains 500 Windows 11 devices. You have a Microsoft Defender for Endpoint deployment that has the following settings: • Discovery mode: Basic • Live Response: Disabled • Enable EDR in block mode: Off • Tamper Protection: Off You need to implement automatic attack disruption in Microsoft Defender XDR. What should you do?