SC-200 Free Practice Questions

Question 1

You have a Microsoft 365 subscription that uses Microsoft Security Copilot. You have the files shown in the following table. Each file contains a copy of your company's compliance policy. You need to ensure that Security Copilot responses are informed by the compliance policy. Which files can be uploaded to Security Copilot?

Question 1

You have a Windows 11 device named Device1 that is onboarded to Microsoft Defender for Endpoint and has tamper protection enabled. You are investigating a potential threat on Device1. You enable troubleshooting mode for Device1. You need to temporarily disable tamper protection on Device1. Which PowerShell command should you run on Device1?

Question 2

You have a Microsoft 365 subscription. You have the devices shown in the following table. All the devices are onboarded to Microsoft Defender for Endpoint. You are investigating a potential malware exploit on the devices. You need to review the system log of each device. The solution must minimize disruptions to the devices. What should you do for each device first in the Microsoft Defender portal?

Question 2

You have an Azure subscription that contains a Microsoft Sentinel workspace and a virtual machine named VM1. VM1 runs Linux and hosts a log forwarder that receives Syslog and Common Event Format (CEF) messages from network appliances on TCP/UDP port 514. VM1 has the Azure Monitor Agent installed and is associated with a single data collection rule (DCR) that collects Syslog facilities. You discover that when the appliances send CEF messages by using the local0 facility, the events are ingested into both the CommonSecurityLog table and the Syslog table. You need to prevent the CEF messages from being ingested into the Syslog table. The solution must ensure that the CEF messages are still ingested into CommonSecurityLog. What should you use?

Question 2

You have Microsoft 365 subscription that contains a Windows device named Device1 and two users named User1 and User2. Device1 is onboarded to Microsoft Defender for Endpoint. Automatic attack disruption is triggered on Device1, and User1 is contained during the disruption. You need to ensure that User2 can undo the containment of User1. The solution must follow the principle of least privilege. Which role should you assign to User2?

Question 3

You have a Microsoft Sentinel workspace that contains the following tables. You need to investigate the log data by using a search. Which tables can you search?

Question 3

You have a Microsoft Sentinel workspace named Workspace1. In Workspace1, you create a Microsoft Sentinel workbook named WB1. You need to add a query to WB1 that will return a list of all the watchlists in Workspace1. To what should you set Data source for the query?

Question 3

You have a Microsoft Sentinel workspace that is connected to the Microsoft Sentinel data lake. In Microsoft Visual Studio Code, you plan to run Jupyter notebooks by using a GitHub Copilot agent that hunts for threats. The agent will search for relevant tables and query long-term data in the data lake by using natural language queries. You need to connect the GitHub Copilot agent to the Microsoft Sentinel Model Context Protocol (MCP) collection endpoint. Which URL should you use?

Question 4

You have a Microsoft 365 E5 subscription. You have the following KQL query. You need to use the query to create a Microsoft Defender XDR custom detection rule that can isolate an onboarded device. How should you modify the query?

Question 4

You have a Microsoft Sentinel workspace named Workspace1 and a firewall named FW1. FW1 logs are ingested into Workspace1. Typically, firewall events are ingested approximately two minutes after the event occurs, and occasionally up to five minutes after. A scheduled analytics rule runs every five minutes and queries the TimeGenerated value for the last five minutes. You need to minimize missed detections caused by ingestion delays and prevent duplicate alerts across rule runs. How should you change the analytics rule query?