CertBlaze

Microsoft

SC-200 Free Practice Questions — Page 18

Question 177

You have a Microsoft Sentinel workspace that has User and Entity Behavior Analytics (UEBA) enabled for Signin Logs. You need to ensure that failed interactive sign-ins are detected. The solution must minimize administrative effort. What should you use?

A. a scheduled alert query
B. the Activity Log data connector
C. a UEBA activity template
D. a hunting query
Show Answer
Correct Answer: C
Explanation:
UEBA in Microsoft Sentinel includes built-in activity templates for common identity behaviors, including failed interactive sign-ins from SigninLogs. Using a UEBA activity template leverages preconfigured detection logic and behavioral baselining with minimal configuration or maintenance, which best satisfies the requirement to detect failed interactive sign-ins while minimizing administrative effort.

Question 178

HOTSPOT - You have four Azure subscriptions. One of the subscriptions contains a Microsoft Sentinel workspace. You need to deploy Microsoft Sentinel data connectors to collect data from the subscriptions by using Azure Policy. The solution must ensure that the policy will apply to new and existing resources in the subscriptions. Which type of connectors should you provision, and what should you use to ensure that all the resources are monitored? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.

Illustration for SC-200 question 178
Show Answer
Correct Answer: Connector type: Diagnostic settings Use: A remediation task
Explanation:
Azure Policy supports deploying diagnostic settings–based Microsoft Sentinel connectors at scale. Diagnostic settings can be enforced by policy across subscriptions, and a remediation task applies the policy to existing resources while ensuring new resources are automatically configured.

Question 179

You have an Azure subscription that uses Microsoft Defender for Cloud and contains 100 virtual machines that run Windows Server. You need to configure Defender for Cloud to collect event data from the virtual machines. The solution must minimize administrative effort and costs. Which two actions should you perform? Each correct answer presents part of the solution. NOTE: Each correct selection is worth one point.

A. Configure auto-provisioning by setting the security event storage to Common.
B. From the Microsoft Endpoint Manager admin center, enable automatic enrollment.
C. From the Azure portal, create an Azure Event Grid subscription.
D. Configure auto-provisioning by setting the security event storage to All Events.
E. From Defender for Cloud in the Azure portal, enable Microsoft Defender for Servers.
Show Answer
Correct Answer: A, E
Explanation:
To collect Windows security event data with minimal effort and cost, you must first enable Microsoft Defender for Servers in Defender for Cloud, which activates the capability to collect and analyze VM security data. Then configure auto-provisioning with security event storage set to Common, which gathers essential security events while avoiding the higher cost and overhead of collecting all events.

Question 181

HOTSPOT - You have a Microsoft Sentinel workspace that contains a custom workbook. You need to query the number of daily security alerts. The solution must meet the following requirements: • Identify alerts that occurred during the last 30 days. • Display the results in a timechart. How should you complete the query? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.

Illustration for SC-200 question 181
Show Answer
Correct Answer: summarize bin
Explanation:
Use summarize to aggregate alert counts and bin(TimeGenerated, 1d) to group results into daily intervals over the last 30 days, enabling rendering as a timechart.

Question 183

You need to configure Microsoft Defender for Cloud Apps to generate alerts and trigger remediation actions in response to external sharing of confidential files. Which two actions should you perform in the Microsoft 365 Defender portal? Each correct answer presents part of the solution. NOTE: Each correct selection is worth one point.

A. From Settings, select Cloud App, select Microsoft Information Protection, and then select Only scan files for Microsoft Information Protection sensitivity labels and content inspection warnings from this tenant.
B. From Cloud apps, select Files, and then filter File Type to Document.
C. From Settings, select Cloud App, select Microsoft Information Protection, select Files, and then enable file monitoring.
D. From Cloud apps, select Files, and then filter App to Office 365.
E. From Cloud apps, select Files, and then select New policy from search.
F. From Settings, select Cloud App, select Microsoft Information Protection, and then select Automatically scan new files for Microsoft Information Protection sensitivity labels and content inspection warnings.
Show Answer
Correct Answer: C, F
Explanation:
To generate alerts and remediation actions for external sharing of confidential files, Defender for Cloud Apps must be able to inspect files and detect sensitivity labels. Action C enables file monitoring, which is required so Defender for Cloud Apps can continuously evaluate files in connected cloud apps. Action F enables automatic scanning of new files for Microsoft Information Protection sensitivity labels and content inspection warnings, which is necessary to identify confidential content and trigger alerts or remediation. The other options relate to filtering views or optional scope limitations and do not configure inspection or alerting behavior.

Question 184

You have 50 Microsoft Sentinel workspaces. You need to view all the incidents from all the workspaces on a single page in the Azure portal. The solution must minimize administrative effort. Which page should you use in the Azure portal?

A. Microsoft Sentinel - Incidents
B. Microsoft Sentinel - Workbooks
C. Microsoft Sentinel
D. Log Analytics workspaces
Show Answer
Correct Answer: A
Explanation:
To view incidents from multiple Microsoft Sentinel workspaces on a single page with minimal administrative effort, you use the **Microsoft Sentinel – Incidents** page. From the Sentinel landing page you can select multiple workspaces and then choose **View incidents**, which opens the Incidents page aggregating incidents across all selected workspaces. Workbooks or Log Analytics require additional configuration, and the general Sentinel landing page itself does not display incidents until you navigate to Incidents.

Question 185

HOTSPOT - You have a Microsoft 365 E5 subscription that uses Microsoft Teams. You need to perform a content search of Teams chats for a user by using the Microsoft Purview compliance portal. The solution must minimize the scope of the search. How should you configure the content search? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.

Illustration for SC-200 question 185
Show Answer
Correct Answer: Locations: Exchange mailboxes Keywords: Kind
Explanation:
Teams 1:1 and group chat messages are stored in users’ Exchange mailboxes. Using the Kind keyword (for example, Teams/IM message types) narrows the search to Teams chat items, minimizing the search scope.

Question 187

DRAG DROP - You have an Azure subscription that uses Microsoft Defender for Cloud. You need to create a workflow that will send a Microsoft Teams message to the IT department of your company when a new Microsoft Secure Score action is generated. Which three actions should you perform in sequence? To answer, move the appropriate actions from the list of actions to the answer area and arrange them in the correct order.

Illustration for SC-200 question 187
Show Answer
Correct Answer: Create an Azure logic app that includes the Defender for Cloud recommendation trigger. Configure workflow automation. Configure a trigger condition.
Explanation:
Microsoft Secure Score improvement actions are surfaced in Defender for Cloud as recommendations. To notify Teams automatically, you first need a Logic App with the Defender for Cloud recommendation trigger. Then you configure workflow automation in Defender for Cloud to connect to that Logic App, and finally define the trigger conditions that specify when the workflow should run.

Question 188

You have a Microsoft 365 E5 subscription that uses Microsoft Defender for Endpoint. You need to create a query that will link the AlertInfo, AlertEvidence, and DeviceLogonEvents tables. The solution must return all the rows in the tables. Which operator should you use?

A. search *
B. union kind = inner
C. join kind = inner
D. evaluate hint.remote =
Show Answer
Correct Answer: B
Explanation:
To return all rows from multiple tables in Kusto Query Language, you must use the union operator. Union combines two or more tables and outputs every row from each table, regardless of matching columns. An inner join would only return matching rows, which does not meet the requirement.

Question 189

You have a Microsoft 365 subscription that uses Microsoft Purview and Microsoft Teams. You have a team named Team1 that has a project named Project1. You need to identify any Project1 files that were stored on the team site of Team1 between February 1, 2023, and February 10, 2023. Which KQL query should you run?

A. (c:c)(Project1)(date=(2023-02-01)..date=(2023-02-10))
B. AuditLogs - | where Timestamp between (datetime(2023-02-01)..datetime(2023-02-10)) | where FileName contains “Project1”
C. Project1(c:c)(date=2023-02-01..2023-02-10)
D. AuditLogs - | where Timestamp > ago(10d) | where FileName contains “Project1”
Show Answer
Correct Answer: C
Explanation:
The scenario refers to Microsoft Purview content search/eDiscovery, which uses Keyword Query Language (KQL) for content searches, not Advanced Hunting queries. To find files related to Project1 stored in a Teams/SharePoint site within a specific date range, the correct syntax is a keyword search combined with a date filter. Option C uses valid Purview content search KQL: it searches for the keyword Project1 and constrains results to items dated between February 1 and February 10, 2023. Options B and D are Advanced Hunting (AuditLogs) queries, which require Microsoft 365 Defender and are not appropriate here, while A has incorrect syntax.

$19

Get all 370 questions with detailed answers and explanations

  • Instant download HTML + PDF delivered the moment payment clears.
  • Secure Stripe checkout we never see or store your card details.
  • 7-day refund if files are defective see our refund policy.

Full SC-200 study guide →