SC-200 Free Practice Questions — Page 20

Question 198

HOTSPOT - You have a Microsoft Sentinel workspace that contains a custom workbook. You need to query the number of daily security alerts. The solution must meet the following requirements: • Identify alerts that occurred during the last 30 days. • Display the results in a timechart. How should you complete the query? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.

Question 200

You need to configure Microsoft Defender for Cloud Apps to generate alerts and trigger remediation actions in response to external sharing of confidential files. Which two actions should you perform in the Microsoft 365 Defender portal? Each correct answer presents part of the solution. NOTE: Each correct selection is worth one point.

Question 201

You have 50 Microsoft Sentinel workspaces. You need to view all the incidents from all the workspaces on a single page in the Azure portal. The solution must minimize administrative effort. Which page should you use in the Azure portal?

Question 202

HOTSPOT - You have a Microsoft 365 E5 subscription that uses Microsoft Teams. You need to perform a content search of Teams chats for a user by using the Microsoft Purview compliance portal. The solution must minimize the scope of the search. How should you configure the content search? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.

Question 204

DRAG DROP - You have an Azure subscription that uses Microsoft Defender for Cloud. You need to create a workflow that will send a Microsoft Teams message to the IT department of your company when a new Microsoft Secure Score action is generated. Which three actions should you perform in sequence? To answer, move the appropriate actions from the list of actions to the answer area and arrange them in the correct order.

Question 205

You have a Microsoft 365 E5 subscription that uses Microsoft Defender for Endpoint. You need to create a query that will link the AlertInfo, AlertEvidence, and DeviceLogonEvents tables. The solution must return all the rows in the tables. Which operator should you use?

Question 206

You have a Microsoft 365 subscription that uses Microsoft Purview and Microsoft Teams. You have a team named Team1 that has a project named Project1. You need to identify any Project1 files that were stored on the team site of Team1 between February 1, 2023, and February 10, 2023. Which KQL query should you run?

Question 209

HOTSPOT - You have a Microsoft 365 E5 subscription that uses Microsoft Defender for Endpoint. You need to create a detection rule that meets the following requirements: • Is triggered when a device that has critical software vulnerabilities was active during the last hour • Limits the number of duplicate results How should you complete the KQL query? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.

Question 210

You have a Microsoft 365 E5 subscription that contains 100 Windows 10 devices. You onboard the devices to Microsoft Defender 365. You need to ensure that you can initiate remote shell connections to the onboarded devices from the Microsoft 365 Defender portal. What should you do first?

Question 211

You have a Microsoft Sentinel workspace that uses the Microsoft 365 Defender data connector. From Microsoft Sentinel, you investigate a Microsoft 365 incident. You need to update the incident to include an alert generated by Microsoft Defender for Cloud Apps. What should you use?