SC-200 Free Practice Questions — Page 11

Question 70

You have a Microsoft 365 E5 subscription that contains a device named Device1. From the Microsoft Defender portal, you discover that an alert was triggered for Device1. From the Device inventory page, you isolate Device1. You need to collect a list of installed programs on Device1. What should you do?

Question 71

HOTSPOT - You have a Microsoft 365 E5 subscription that uses Microsoft Defender XDR. You are implementing a deception rule. You need to provide a custom lure file. For the custom lure, you set Planting path to HOME. Which types of files can you use for the custom lure, and in which home directory should the file be located on a device? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.

Question 72

HOTSPOT - You have an Azure subscription that uses Microsoft Defender for Cloud. You need to use an Azure Resource Manager (ARM) template to create a workflow automation that will trigger a logic app when specific alerts are received by Microsoft Defender for Cloud. How should you complete the template? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.

Question 73

HOTSPOT - You have an Azure subscription named Sub1 that is linked to a Microsoft Entra tenant named contoso.com. Contoso.com contains a user named User1. Sub1 contains a Microsoft Sentinel workspace. You provision a Microsoft Copilot for Security capacity. You need to ensure that User1 can use Copilot for Security to perform the following tasks: • Update the data sharing and feedback options. • Investigate Microsoft Sentinel incidents. The solution must follow the principle of least privilege. Which role should you assign to User1 for each task? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.

Question 74

HOTSPOT - You have an Azure subscription named Sub1 that contains a resource group named RG1. RG1 contains two Azure key vaults named KV1 and KV2 that use Azure role-based access control (Azure RBAC). The subscription contains the users shown in the following table. KV1 contains a secret named Secret1. KV2 contains a secret named Secret2. Which users can read the values of each secret? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.

Question 76

HOTSPOT - You have an Azure subscription named Sub1 that contains an Azure key vault named Vault1 and an Azure Automation account named Automation1. You need to ensure that Automation1 can access Vault1. The solution1 must meet the following requirements: • Ensure that if Automation1 is deleted, the permissions granted for Vault1 will be removed automatically. • Ensure that runbooks created in Automation1 can read secret values stored in Vault1. • Follow the principle of least privilege. What should you configure for Automation1, and which built-in role should Automation1 use to access Vault1? To answer, select the appropriate options in the answer area. NOTE: Each correct answer is worth one point.

Question 78

HOTSPOT - Your on-premises network contains a Hyper-V cluster. The cluster contains the virtual machines shown in the following table. You have a Microsoft Sentinel workspace named SW1. You have a data collection rule (DCR) that has the following configurations: • Name: DCR1 • Destination: SW1 • Platform type: All • Data collection endpoint: None • Data source: Windows event logs, Linux syslog For each of the following statements, select Yes if the statement is true. Otherwise, select No. NOTE: Each correct selection is worth one point.

Question 79

HOTSPOT - You have an on-premises Linux server that runs a background process named App1 and has the Azure Connected Machine agent installed. You have a Microsoft Sentinel workspace named WS1. You need to configure a data collection rule (DCR) named DCR1 that will use the Syslog via AMA connector to collect messages related to App1. The solution must meet the following requirements: • Only collect messages that have a priority level of critical. • Minimize the volume of data collected. Which facility and log level should you configure for DCR1? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.

Question 80

You have a Microsoft 365 subscription that uses Microsoft Copilot for Security. You create a promptbook named Book1. For Book1, you need to create a prompt that contains an input named IncidentID. How should you format IncidentID?

Question 81

You have a Microsoft 365 E5 subscription that contains a Microsoft SharePoint Online site named Site1. You need to enable Microsoft Defender for Cloud Apps session control for Site1. Which type of policy should you create first?