SC-200 Free Practice Questions — Page 12

Question 116

Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution. After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen. You have an Azure subscription that uses Microsoft Defender XDR. From the Microsoft Defender portal, you perform an audit search and export the results as a file named File1.csv that contains 10,000 rows. You use Microsoft Excel to perform Get & Transform Data operations to parse the AuditData column from File1.csv. The operations fail to generate columns for specific JSON properties. You need to ensure that Excel generates columns for the specific JSON properties in the audit search results. Solution: From Excel, you apply filters to the existing columns in File1.csv to reduce the number of JSON properties, and then you perform the Get 8t Transform Data operations to parse the AuditData column. Does this meet the requirement?

Question 117

You have a Microsoft Sentinel workspace. You are investigating an incident that involves multiple alerts, events, and entities. You need to create a bookmark for the investigation. The solution must minimize administrative effort. Which settings should you use?

Question 118

You have a Microsoft 365 subscription that uses Microsoft Defender for Endpoint and contains the devices shown in the following table. You initiate a live response session on each device. You need to collect a Defender for Endpoint investigation package from each device. On which devices can you collect the package by running advanced live response commands from the command-line interface (CLI)?

Question 119

HOTSPOT - You have an Azure subscription that contains a Log Analytics workspace named Workspace1. You configure Azure activity logs and Microsoft Entra ID logs to be forwarded to Workspace1. You need to query Workspace1 to identify all the requests that failed due to insufficient authorization. How should you complete the KQL query? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.

Question 120

You have an Azure subscription that contains a Microsoft Sentinel workspace named Workspace1 and a user named User1. You need to ensure that User1 can investigate incidents by using Workspace1. The solution must follow the principle of least privilege. Which role should you assign to User1?

Question 121

You have an Azure subscription that contains a Microsoft Sentinel workspace named Workspace1. From Content Hub, you deploy the Microsoft Entra solution for Microsoft Sentinel and configure a connector. You need to analyze actions performed by users that have administrative privileges to the subscription. Which workbook should you use?

Question 122

DRAG DROP - You have a Microsoft Sentinel workspace that contains the following Advanced Security Information Model (ASIM) parsers: • _Im_ProcessCreate • imProcessCreate You create a new source-specific parser named vimProcessCreate. You need to modify the parsers to meet the following requirements: • Call all the ProcessCreate parsers. • Standardize fields to the Process schema. Which parser should you modify to meet each requirement? To answer, drag the appropriate parsers to the correct requirements. Each parser may be used once, more than once, or not at all. You may need to drag the split bar between panes or scroll to view content. NOTE: Each correct selection is worth one point.

Question 123

You have a Microsoft Sentinel workspace named SW1. In SW1, you investigate an incident that is associated with the following entities: • Host • IP address • User account • Malware name Which entity can be labeled as an indicator of compromise (IoC) directly from the incident's page?

Question 124

You have a Microsoft 365 subscription that uses Microsoft Defender XDR. You are investigating an attacker that is known to use the Microsoft Graph API as an attack vector. The attacker performs the tactics shown the following table. You need to search for malicious activities in your organization. Which tactics can you analyze by using the MicrosoftGraphActivityLogs table?

Question 125

You have a Microsoft 365 subscription that uses Microsoft Defender XDR. You need to identify all the entities affected by an incident. Which tab should you use in the Microsoft Defender portal?