SC-200 Free Practice Questions — Page 13

Question 120

You have a Microsoft Sentinel workspace named SW1. You need to identify which anomaly rules are enabled in SW1. What should you review in Microsoft Sentinel?

Question 121

You have an Azure subscription named Sub1 that uses Microsoft Defender for Cloud. You need to assign the PCI DSS 4.0 initiative to Sub1 and have the initiative displayed in the Defender for Cloud Regulatory compliance dashboard. From Security policies in the Environment settings, you discover that the option to add more industry and regulatory standards is unavailable. What should you do first?

Question 122

You have a Microsoft 365 subscription that uses Microsoft Defender for Endpoint and contains a user named User1 and a Microsoft 365 group named Group1. All users are assigned a Defender for Endpoint Plan 1 license. You enable Microsoft Defender XDR Unified role-based access control (RBAC) for Endpoints & Vulnerability Management. You need to ensure that User1 can configure alerts that will send email notifications to Group1. The solution must follow the principle of least privilege. Which permissions should you assign to User1?

Question 123

HOTSPOT - You have a Microsoft 365 E5 subscription that uses Microsoft Defender XDR and contains two users named User1 and User2. You need to ensure that the users can perform searches by using the Microsoft Purview portal. The solution must meet the following requirements: • Ensure that User1 can search the Microsoft Purview Audit service logs and review the Microsoft Purview Audit service configuration. • Ensure that User2 can search Microsoft Exchange Online mailboxes. • Follow the principle of least privilege. To which Microsoft Purview role group should you add each user? To answer, select the appropriate options in the answer area NOTE: Each correct selection is worth one point.

Question 124

HOTSPOT - You have the resources shown in the following table. You have an Azure subscription that uses Microsoft Defender for Cloud. You need to use Defender for Cloud to protect VM1 and Server1. The solution must meet the following requirements: • Support Advanced Threat Protection and vulnerability assessment. • Register each SQL Server 2022 instance as a SQL virtual machine. • Minimize implementation and administrative effort. What should you deploy to each server? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.

Question 125

HOTSPOT - You have a Microsoft 365 subscription that uses Microsoft Defender for Endpoint Plan 2 and contains a Windows device named Device1. You initiate a live response session on Device1 and launch an executable file named File1.exe in the background. You need to perform the following actions: • Identify the command ID of File1.exe. • Interact with File1.exe. Which live response command should you run for each action? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.

Question 126

You have a Microsoft 365 subscription that uses Microsoft Defender XDR and contains a Windows device named Device1. The timeline of Device1 includes three files named File1.ps1, File2.exe, and File3.dll. You need to submit files for deep analysis in Microsoft Defender XDR. Which files can you submit?

Question 127

HOTSPOT - You have on-premises servers that run Windows Server. You have a Microsoft Sentinel workspace named SW1. SW1 is configured to collect Windows Security log entries from the servers by using the Azure Monitor Agent data connector. You plan to limit the scope of collected events to events 4624 and 4625 only. You need to use a PowerShell script to validate the syntax of the filter applied to the connector. How should you complete the script? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.

Question 128

HOTSPOT - You have an Azure subscription that contains a Log Analytics workspace named Workspace1. You configure Azure activity logs and Microsoft Entra ID logs to be forwarded to Workspace1. You need to identify which Azure resources have been queried or modified by risky users. How should you complete the KQL query? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.

Question 129

Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution. After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen. You have an Azure subscription that uses Microsoft Defender XDR. From the Microsoft Defender portal, you perform an audit search and export the results as a file named File1.csv that contains 10,000 rows. You use Microsoft Excel to perform Get & Transform Data operations to parse the AuditData column from File1.csv. The operations fail to generate columns for specific JSON properties. You need to ensure that Excel generates columns for the specific JSON properties in the audit search results. Solution: From Excel, you apply filters to the existing columns in File1.csv to reduce the number of rows, and then you perform the Get & Transform Data operations to parse the AuditData column. Does this meet the requirement?