SC-200 Free Practice Questions — Page 11

Question 106

You have a Microsoft 365 subscription that uses Microsoft Defender XDR. You are investigating an incident. You need to review the incident tasks that were performed. The solution must include a query that will display the incidents in a workbook, and then display the tasks of each incident in another grid. Which table should you target in the query?

Question 107

You have a Microsoft 365 subscription that uses Microsoft Defender XDR. You need to implement deception rules. The solution must ensure that you can limit the scope of the rules. What should you create first?

Question 108

You have a Microsoft 365 subscription that uses Microsoft Purview. Your company has a project named Project1. You need to identify all the email messages that have the word Project1 in the subject line. The solution must search only the mailboxes of users that worked on Project1. What should you do?

Question 109

HOTSPOT - You need to build a KQL query in a Microsoft Sentinel workspace. The query must return the SecurityEvent record for accounts that have the last record with an EventID value of 4624. How should you complete the query? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.

Question 110

HOTSPOT - You have an on-premises datacenter that contains a custom web app named App1. App1 uses Active Directory Domain Services (AD DS) authentication and is accessible by using Microsoft Entra application proxy. You have a Microsoft 365 E5 subscription that uses Microsoft Defender XDR. You receive an alert that a user downloaded highly confidential documents. You need to remediate the risk associated with the alert by requiring multi-factor authentication (MFA) when users use App1 to initiate the download of documents that have a Highly Confidential sensitivity label applied. What should you do? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.

Question 111

HOTSPOT - You have a Microsoft Sentinel workspace. You need to configure the Fusion analytics rule to temporarily suppress incidents generated by a Microsoft Defender connector. The solution must meet the following requirements: • Minimize impact on the ability to detect multistage attacks. • Minimize administrative effort. How should you configure the rule? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.

Question 112

HOTSPOT - You have a Microsoft 365 E5 subscription that uses Microsoft Defender XDR and contains a Windows device named Device1. You detect malicious activity on Device1. You initiate a live response session on Device1. You need to perform the following actions: • Download a file from the live response library. • Stop a process that is running on Device1. Which live response command should you run for each action? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.

Question 113

HOTSPOT - You have a Microsoft 365 subscription that uses Microsoft Defender XDR and Microsoft Defender for Endpoint. The subscription contains the devices shown in the following table. You discover the following forensic data: • During the startup of Device1, a connection is established to Device2 via port 5555. • Device2 connects to Device3 by using port 5555. • Device4 connects to Device1 by using port 5555. You perform the following actions: • Initiate a live response session on Device1 and run the processes • From Devices in the Microsoft Defender portal, isolate Device1 and Device2. For each of the following statements, select Yes if True. Otherwise select No. NOTE: Each correct selection is worth one point.

Question 114

HOTSPOT - You have a Microsoft 365 E5 subscription that contains the hosts shown in the following table. You have indicators in Microsoft Defender for Endpoint as shown in the following table. ID1 and ID2 reference the same file as ID3. For each of the following statements, select Yes if the statement is true. Otherwise, select No. NOTE: Each correct selection is worth one point.

Question 115

You have a Microsoft 365 subscription that uses Microsoft Defender XDR. You have a query that contains the following statements. You need to configure a custom detection rule that will use the query. The solution must minimize how long it takes to be notified about events that match the query. Which frequency should you select for the rule?