SC-200 Free Practice Questions — Page 14

Question 136

You have a Microsoft 365 subscription that uses Microsoft Defender for Endpoint Plan 2 and contains 500 Windows devices. As part of an incident investigation, you identify the following suspected malware files: • sys • pdf • docx • xlsx You need to create indicator hashes to block users from downloading the files to the devices. Which files can you block by using the indicator hashes?

Question 137

You have a Microsoft 365 E5 subscription that uses Microsoft Defender XDR. The security team at your company detects command and control (C2) agent traffic on the network. Agents communicate once every 50 hours. You need to create a Microsoft Defender XDR custom detection rule that will identify compromised devices and establish a pattern of communication. The solution must meet the following requirements: • Identify all the devices that have communicated during the past 14 days. • Minimize how long it takes to identify the devices. To what should you set the detection frequency for the rule?

Question 138

You have 500 on-premises Windows 11 devices that use Microsoft Defender for Endpoint. You enable Network device discovery. You need to create a hunting query that will identify discovered network devices and return the identity of the onboarded device that discovered each network device. Which built-in function should you use?

Question 139

HOTSPOT - You have a Microsoft 365 E5 subscription that uses Microsoft Defender XDR and contains a Windows device named Device1. You investigate Device1 for malicious activity and discover a suspicious file named File1.exe. You collect an investigation package from Device1. You need to review the following forensic data points: • Is an attacker currently accessing Device1 remotely? • When was File1.exe first executed? Which folder in the investigation package should you review for each data point? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.

Question 140

You have a Microsoft Sentinel workspace named SW1. You need to identify which anomaly rules are enabled in SW1. What should you review in Microsoft Sentinel?

Question 141

You have an Azure subscription named Sub1 that uses Microsoft Defender for Cloud. You need to assign the PCI DSS 4.0 initiative to Sub1 and have the initiative displayed in the Defender for Cloud Regulatory compliance dashboard. From Security policies in the Environment settings, you discover that the option to add more industry and regulatory standards is unavailable. What should you do first?

Question 142

You have a Microsoft 365 subscription that uses Microsoft Defender for Endpoint and contains a user named User1 and a Microsoft 365 group named Group1. All users are assigned a Defender for Endpoint Plan 1 license. You enable Microsoft Defender XDR Unified role-based access control (RBAC) for Endpoints & Vulnerability Management. You need to ensure that User1 can configure alerts that will send email notifications to Group1. The solution must follow the principle of least privilege. Which permissions should you assign to User1?

Question 143

HOTSPOT - You have a Microsoft 365 E5 subscription that uses Microsoft Defender XDR and contains two users named User1 and User2. You need to ensure that the users can perform searches by using the Microsoft Purview portal. The solution must meet the following requirements: • Ensure that User1 can search the Microsoft Purview Audit service logs and review the Microsoft Purview Audit service configuration. • Ensure that User2 can search Microsoft Exchange Online mailboxes. • Follow the principle of least privilege. To which Microsoft Purview role group should you add each user? To answer, select the appropriate options in the answer area NOTE: Each correct selection is worth one point.

Question 144

HOTSPOT - You have the resources shown in the following table. You have an Azure subscription that uses Microsoft Defender for Cloud. You need to use Defender for Cloud to protect VM1 and Server1. The solution must meet the following requirements: • Support Advanced Threat Protection and vulnerability assessment. • Register each SQL Server 2022 instance as a SQL virtual machine. • Minimize implementation and administrative effort. What should you deploy to each server? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.

Question 145

HOTSPOT - You have a Microsoft 365 subscription that uses Microsoft Defender for Endpoint Plan 2 and contains a Windows device named Device1. You initiate a live response session on Device1 and launch an executable file named File1.exe in the background. You need to perform the following actions: • Identify the command ID of File1.exe. • Interact with File1.exe. Which live response command should you run for each action? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.