SC-200 Free Practice Questions — Page 4

Question 29

HOTSPOT - You have an Azure subscription named Sub1. Sub1 contains a Microsoft Sentinel workspace named SW1 and a virtual machine named VM1 that runs Windows Server. SW1 collects security logs from VM1 by using the Windows Security Events via AMA connector. You need to limit the scope of events collected from VM1. The solution must ensure that only audit failure events are collected. How should you complete the filter expression for the connector? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.

Question 30

You have a Microsoft 365 E5 subscription. You have the following KQL query. You need to use the query to create a Microsoft Defender XDR custom detection rule that can isolate an onboarded device. How should you modify the query?

Question 31

HOTSPOT - You have an Azure subscription named Sub1 that contains a Microsoft Sentinel workspace named WS1. You need to create a hunting query in WS1 that meets the following requirements: • Returns the number of changes performed daily by each Microsoft Entra security principal during a seven-day period • Identifies all the successful changes to the resources in Sub1 • Substitutes any missing data points with 0 How should you complete the KQL query? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.

Question 32

DRAG DROP - You have an Azure subscription that contains a Microsoft Sentinel workspace. You need to create and customize a workbook for the Microsoft Entra ID Audit Logs. Which three actions should you perform in sequence? To answer, move the appropriate actions from the list of actions to the answer area and arrange them in the correct order.

Question 33

HOTSPOT - You have a Microsoft Sentinel workbook that contains the following KQL query. You need to create a visual that will change the color of the errCount column based on the value returned. How should you configure the visual? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.

Question 34

HOTSPOT - You have an Azure subscription name Sub1 that is linked to a Microsoft Entra tenant named contoso.com. Sub1 contains a Log Analytics workspace named Workspace1. All the logs from contoso.com are streamed to Workspace1. You have a Microsoft 365 E5 subscription. You need to query Workspace1 for the following: • HTTP requests to the Microsoft Graph service of contoso.com • Third-party app sign-in activities that use certificates or secrets How should you complete the KQL query? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.

Question 35

HOTSPOT - You have the Azure subscriptions shown in the following table. You have a Microsoft Entra tenant that contains the users shown in the following table. The users have the Azure roles shown in the following table. You configure Microsoft Copilot for Security capacities as shown in the following table. For each of the following statements, select Yes if the statement is true. Otherwise, select No. NOTE: Each correct selection is worth one point.

Question 36

HOTSPOT - You have an Azure subscription named Sub1 that contains the resources shown in the following table. You plan to configure Rule1 to trigger Lapp1 when an incident is generated. You need to recommend the role-based access control (RBAC) role that you should assign to WS1, and the scope at which should you assign the role. The solution must follow the principle of least privilege. What should you recommend? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.

Question 37

HOTSPOT - You have a Microsoft 365 subscription that contains three users named User1, User2 and User3 and the resources shown in the following table. You have a Microsoft Defender XDR detection rule named Rule1 that has the following configurations: • Scope:DevGroup1 • File hash: File1.exe • Actions o Devices: Collect investigation package o User: Mark as compromised o Files: Block Each user attempts to run File1.exe on their device. For each of the following statements, select Yes if the statement is true. Otherwise, select No. NOTE: Each correct selection is worth one point.

Question 38

HOTSPOT - You have an Azure subscription that contains the users shown in the following table. The subscription contains instances of Azure Firewall as shown in the following table. You have a Microsoft 365 E5 subscription that uses Microsoft Copilot for Security. You have the Copilot for Security role assignments shown in the following table. Each user runs a Copilot for Security session. For each of the following statements, select Yes if the statement is true. Otherwise, select No. NOTE: Each correct selection is worth one point.