SC-200 Free Practice Questions — Page 3

Question 21

HOTSPOT - You have a Microsoft 365 subscription named contoso.com that contains a Windows 11 device named Device1. Device1 is onboarded to Microsoft Defender for Endpoint. You perform the following actions: • From Defender for Endpoint, create the device groups shown in the following table. • Onboard an Android device named Device2 to Defender for Endpoint. To which device groups will each device be added? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.

Question 22

You have 1,000 on-premises Windows 11 Pro devices that are onboarded to Microsoft Defender for Endpoint. You have a Microsoft 365 subscription that uses Microsoft Defender XDR. You identify that an attacker performed the following actions on a device: • Modified the file system path of a registry-based antivirus exclusion • Downloaded a malicious file to the file system path You initiate a live response session on the device. You need to remove the malicious file. Which command should you run?

Question 23

You have two Microsoft Entra tenants named Tenant1 and Tenant2. Each tenant is linked to an Azure subscription. Tenant1 contains a group named Group1. Tenant2 contains a group named Group2. You need to implement Microsoft Sentinel for each tenant. The solution must meet the following requirements: • Ensure that Group1 can manage security incidents for Tenant1 and Tenant2 in a single workspace. • Ensure that Group2 can manage security incidents only for Tenant2. • Minimize the use of guest accounts. • Minimize administrative effort. • Minimize costs. What should you include in the solution?

Question 24

HOTSPOT - You have a Microsoft Sentinel workspace named Workspace1. The AzureActivity table in Workspace1 has the following retention periods: • Interactive: 180 days • Total: 180 days You need to modify the retention periods to meet the following requirements: • Minimize the costs associated with storing data in the table. • Maximize the period during which the table data remains available. How should you configure each retention period? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.

Question 25

You have an Azure subscription that uses Microsoft Security Copilot. You need to temporarily increase the number of security compute units. What is the smallest interval of time you can be billed for?

Question 26

You have a Microsoft 365 E5 subscription that contains 500 Windows 11 devices. You have a Microsoft Defender for Endpoint deployment that has the following settings: • Discovery mode: Basic • Live Response: Disabled • Enable EDR in block mode: Off • Tamper Protection: Off You need to implement automatic attack disruption in Microsoft Defender XDR. What should you do?

Question 27

You have a Microsoft 365 subscription that uses Microsoft Security Copilot. You plan to configure a custom GPT plugin for Copilot. Which GPT model should you use?

Question 28

HOTSPOT - You have a Microsoft Sentinel workspace. You have a KQL query. The query returns Microsoft Sentinel incidents that are stored in the SecurityIncident table and occurred during the last 90 days. You need to create a Microsoft Sentinel workbook that will include a visualization of the query. To what should you set Data source and Resource type for the workbook? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.

Question 30

You have a Microsoft 365 subscription. The subscription contains 500 Windows 11 devices that are onboarded to Microsoft Defender for Endpoint. You have 500 devices that run Linux. Users sign in to the Windows and Linux devices by using their Microsoft Entra credentials. You need to recommend a response process for Microsoft Defender XDR security incidents associated with a compromised Linux endpoint. The solution must ensure that the compromised device is prevented from communicating with all devices onboarded to Defender for Endpoint. Which response action should you include in the recommendation?

Question 31

DRAG DROP - You have a Microsoft 365 E5 subscription that contains a Windows 11 device named Device1. Device1 is onboarded to Microsoft Defender XDR. You perform the following actions: • Create a PowerShell script named Script1.ps1. • From the Microsoft Defender XDR portal, establish a live response session to Device1. You need to ensure that you can run Script1.ps1 on Device1. Which three actions should you perform in sequence? To answer, move the appropriate actions from the list of actions to the answer area and arrange them in the correct order.