SC-200 Free Practice Questions — Page 12

Question 110

HOTSPOT - You have an Azure subscription that uses Microsoft Defender for Cloud. You need to use an Azure Resource Manager (ARM) template to create a workflow automation that will trigger a logic app when specific alerts are received by Microsoft Defender for Cloud. How should you complete the template? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.

Question 111

Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution. After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen. You have an Azure subscription that uses Microsoft Defender XDR. From the Microsoft Defender portal, you perform an audit search and export the results as a file named File1.csv that contains 10,000 rows. You use Microsoft Excel to perform Get & Transform Data operations to parse the AuditData column from File1.csv. The operations fail to generate columns for specific JSON properties. You need to ensure that Excel generates columns for the specific JSON properties in the audit search results. Solution: From Defender, you modify the search criteria of the audit search to increase the number of returned records, and then you export the results. From Excel, you perform the Get & Transform Data operations by using the new export. Does this meet the requirement?

Question 112

You have an Azure subscription that contains a resource group named RG1. RG1 contains a Microsoft Sentinel workspace. The subscription is linked to a Microsoft Entra tenant that contains a user named User1. You need to ensure that User1 can deploy and customize Microsoft Sentinel workbook templates. The solution must follow the principle of least privilege. Which role should you assign to User1 for RG1?

Question 113

HOTSPOT - You have a Microsoft 365 subscription that uses Microsoft Defender XDR. You need to create a custom detection rule that will identify devices that had more than five antivirus detections within the last 24 hours. How should you complete the query? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.

Question 114

HOTSPOT - You have a Microsoft 365 subscription that uses Microsoft Purview and contains a Microsoft SharePoint Online site named Site1. Site1 contains the files shown in the following table. From Microsoft Purview, you create the content search queries shown in the following table. For each of the following statements, select Yes if the statement is true. Otherwise, select No. NOTE: Each correct selection is worth one point.

Question 115

HOTSPOT - You have a Microsoft 365 subscription that uses Microsoft Defender for Endpoint Plan 2 and contains a Windows device named Device1. Twenty files on Device1 are quarantined by custom indicators as part of an investigation. You need to release the 20 files from quarantine. How should you complete the command? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.

Question 116

You have a Microsoft 365 subscription that uses Microsoft Defender for Endpoint Plan 2 and contains 500 Windows devices. As part of an incident investigation, you identify the following suspected malware files: • sys • pdf • docx • xlsx You need to create indicator hashes to block users from downloading the files to the devices. Which files can you block by using the indicator hashes?

Question 117

You have a Microsoft 365 E5 subscription that uses Microsoft Defender XDR. The security team at your company detects command and control (C2) agent traffic on the network. Agents communicate once every 50 hours. You need to create a Microsoft Defender XDR custom detection rule that will identify compromised devices and establish a pattern of communication. The solution must meet the following requirements: • Identify all the devices that have communicated during the past 14 days. • Minimize how long it takes to identify the devices. To what should you set the detection frequency for the rule?

Question 118

You have 500 on-premises Windows 11 devices that use Microsoft Defender for Endpoint. You enable Network device discovery. You need to create a hunting query that will identify discovered network devices and return the identity of the onboarded device that discovered each network device. Which built-in function should you use?

Question 119

HOTSPOT - You have a Microsoft 365 E5 subscription that uses Microsoft Defender XDR and contains a Windows device named Device1. You investigate Device1 for malicious activity and discover a suspicious file named File1.exe. You collect an investigation package from Device1. You need to review the following forensic data points: • Is an attacker currently accessing Device1 remotely? • When was File1.exe first executed? Which folder in the investigation package should you review for each data point? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.