SC-200 Free Practice Questions — Page 10

Question 90

HOTSPOT - You have an on-premises datacenter that contains a custom web app named App1. App1 uses Active Directory Domain Services (AD DS) authentication and is accessible by using Microsoft Entra application proxy. You have a Microsoft 365 E5 subscription that uses Microsoft Defender XDR. You receive an alert that a user downloaded highly confidential documents. You need to remediate the risk associated with the alert by requiring multi-factor authentication (MFA) when users use App1 to initiate the download of documents that have a Highly Confidential sensitivity label applied. What should you do? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.

Question 91

HOTSPOT - You have a Microsoft Sentinel workspace. You need to configure the Fusion analytics rule to temporarily suppress incidents generated by a Microsoft Defender connector. The solution must meet the following requirements: • Minimize impact on the ability to detect multistage attacks. • Minimize administrative effort. How should you configure the rule? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.

Question 92

HOTSPOT - You have a Microsoft 365 E5 subscription that uses Microsoft Defender XDR and contains a Windows device named Device1. You detect malicious activity on Device1. You initiate a live response session on Device1. You need to perform the following actions: • Download a file from the live response library. • Stop a process that is running on Device1. Which live response command should you run for each action? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.

Question 93

HOTSPOT - You have a Microsoft 365 subscription that uses Microsoft Defender XDR and Microsoft Defender for Endpoint. The subscription contains the devices shown in the following table. You discover the following forensic data: • During the startup of Device1, a connection is established to Device2 via port 5555. • Device2 connects to Device3 by using port 5555. • Device4 connects to Device1 by using port 5555. You perform the following actions: • Initiate a live response session on Device1 and run the processes • From Devices in the Microsoft Defender portal, isolate Device1 and Device2. For each of the following statements, select Yes if True. Otherwise select No. NOTE: Each correct selection is worth one point.

Question 94

HOTSPOT - You have a Microsoft 365 E5 subscription that contains the hosts shown in the following table. You have indicators in Microsoft Defender for Endpoint as shown in the following table. ID1 and ID2 reference the same file as ID3. For each of the following statements, select Yes if the statement is true. Otherwise, select No. NOTE: Each correct selection is worth one point.

Question 95

You have a Microsoft 365 subscription that uses Microsoft Defender XDR. You have a query that contains the following statements. You need to configure a custom detection rule that will use the query. The solution must minimize how long it takes to be notified about events that match the query. Which frequency should you select for the rule?

Question 96

Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution. After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen. You have an Azure subscription that uses Microsoft Defender XDR. From the Microsoft Defender portal, you perform an audit search and export the results as a file named File1.csv that contains 10,000 rows. You use Microsoft Excel to perform Get & Transform Data operations to parse the AuditData column from File1.csv. The operations fail to generate columns for specific JSON properties. You need to ensure that Excel generates columns for the specific JSON properties in the audit search results. Solution: From Excel, you apply filters to the existing columns in File1.csv to reduce the number of JSON properties, and then you perform the Get 8t Transform Data operations to parse the AuditData column. Does this meet the requirement?

Question 97

You have a Microsoft Sentinel workspace. You are investigating an incident that involves multiple alerts, events, and entities. You need to create a bookmark for the investigation. The solution must minimize administrative effort. Which settings should you use?

Question 98

You have a Microsoft 365 subscription that uses Microsoft Defender for Endpoint and contains the devices shown in the following table. You initiate a live response session on each device. You need to collect a Defender for Endpoint investigation package from each device. On which devices can you collect the package by running advanced live response commands from the command-line interface (CLI)?

Question 99

HOTSPOT - You have an Azure subscription that contains a Log Analytics workspace named Workspace1. You configure Azure activity logs and Microsoft Entra ID logs to be forwarded to Workspace1. You need to query Workspace1 to identify all the requests that failed due to insufficient authorization. How should you complete the KQL query? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.