SC-200 Free Practice Questions — Page 2

Question 7

You have a Microsoft 365 subscription that uses Microsoft Security Copilot. You plan to configure a custom GPT plugin for Copilot. Which GPT model should you use?

Question 8

HOTSPOT - You have a Microsoft Sentinel workspace. You have a KQL query. The query returns Microsoft Sentinel incidents that are stored in the SecurityIncident table and occurred during the last 90 days. You need to create a Microsoft Sentinel workbook that will include a visualization of the query. To what should you set Data source and Resource type for the workbook? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.

Question 9

HOTSPOT - You have a Microsoft 365 subscription that uses Microsoft Defender for Endpoint and contains the following devices: • Device1: Runs Windows 11 Pro • Device2: Runs Windows Server • Device3: Runs Ubuntu Linux You identify three suspicious files named File1.exe, File2.zip, and File3.ps1. You need to investigate the files by using deep analysis. Which devices support deep analysis, and which files can be submitted for deep analysis? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.

Question 11

DRAG DROP - You have a Microsoft 365 E5 subscription that contains a Windows 11 device named Device1. Device1 is onboarded to Microsoft Defender XDR. You perform the following actions: • Create a PowerShell script named Script1.ps1. • From the Microsoft Defender XDR portal, establish a live response session to Device1. You need to ensure that you can run Script1.ps1 on Device1. Which three actions should you perform in sequence? To answer, move the appropriate actions from the list of actions to the answer area and arrange them in the correct order.

Question 12

DRAG DROP - You have a Microsoft 365 subscription that uses Microsoft Defender XDR. You have an Azure subscription that uses Microsoft Security Copilot. You need to create a custom promptbook in Security Copilot that will gather the following information about an incident ID: • An incident summary • Threat intelligence on the identified threat actors • A detailed analysis of the users affected by the incident • A detailed analysis of the devices affected by the incident Which four actions should you perform in sequence? To answer, move the appropriate actions from the list of actions to the answer area and arrange them in the correct order.

Question 13

HOTSPOT - You have a Microsoft 365 E5 subscription that is linked to a Microsoft Entra tenant named contoso.com. You need to query Microsoft Graph activity logs to identify changes to the roles in contoso.com. How should you complete the KQL query? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point

Question 14

You have a Microsoft 365 subscription that uses Microsoft Defender for Endpoint Plan 2. The subscription contains 1,000 Windows 11 devices that run a third-party antivirus software and have Smart App Control enabled. You need to ensure that if Defender for Endpoint detects a malicious artifact that was missed by the third-party software, it will remediate the artifact automatically. What should you configure?

Question 15

You have a Microsoft 365 subscription. The subscription contains 500 devices that are onboarded to Microsoft Defender for Endpoint. You have an Azure subscription that contains a Microsoft Sentinel workspace. You need to run a pilot on 50 devices that will remediate threats automatically. The solution must meet the following requirements: • Minimize the impact on devices that are excluded from the pilot. • Minimize administrative effort. What should you configure first?

Question 16

HOTSPOT - You have a Microsoft 365 E5 subscription that uses Microsoft Defender XDR. You need to create a hunting query in KQL that meets the following requirements: • Identifies any devices that received an email containing an attachment named File1.pdf during the last 12 hours and opened the attachment. • Minimizes the resources required to run the query How should you complete the query? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.

Question 17

You have a Microsoft 365 subscription that uses Microsoft Defender XDR. All endpoint devices are onboarded to Microsoft Defender for Endpoint. You have an Azure subscription that contains a Microsoft Sentinel workspace named Workspace1. All Microsoft Defender XDR events are ingested into Workspace1. You have a Microsoft Entra tenant. You create a KQL query named query1 that searches device logs for a known vulnerability. You need to ensure that query1 runs every hour. The solution must minimize administrative effort. What should you configure?