SC-200 Free Practice Questions — Page 5

Question 39

HOTSPOT - You have a Microsoft 365 E5 subscription that contains a Microsoft SharePoint Online site named Site1. In Site1, you identify the suspicious files shown in the following table. In Microsoft Purview, you create the content searches shown in the following table. For each of the following statements, select Yes if the statement is true. Otherwise, select No. NOTE: Each correct selection is worth one point.

Question 40

HOTSPOT - You have a Microsoft Sentinel workspace. You need to create playbooks that meet the following requirements: • Use an automation rule to trigger actions on an entity. • Call the Entities - Get Hosts action. Which types of playbooks should you use, and which parameters should you specify? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.

Question 41

HOTSPOT - You have a Microsoft 365 E5 subscription that contains Windows 11 and Linux CentOS devices. In Microsoft Defender XDR, Deception is set to On. You plan to create a deception rule that will use a custom lure. You need to specify the type of file, and the planting path for the custom lure. What should you specify? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.

Question 42

HOTSPOT - You have an Azure subscription. You have a Microsoft Sentinel workbook that contains the following text parameters: • text1 • grouptime1 You need to display the count of security alerts. The count must be filtered based on the text1 parameter and grouped by the grouptime1 parameter. How should you complete the KOL query? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.

Question 43

HOTSPOT - You have a Microsoft 365 E5 subscription that uses Microsoft Defender XDR. You discover a malicious process that was initiated by a file named File1.exe on a device named Device1. You need to create a KQL query that will identify when File1.exe was created. The solution must meet the following requirements: • Return the FileName, InitiatingProcessFileName, and InitiatingProcessCommandLine columns. • Minimize the volume of data returned. How should you complete the query? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.

Question 44

Your on-premises network contains two Active Directory Domain Services (AD DS) domains named contoso.com and fabrikam.com. Contoso.com contains a group named Group1. Fabrikam.com contains a group named Group2. You have a Microsoft Sentinel workspace named WS1 that contains a scheduled query rule named Rule1. Rule1 generates alerts in response to anomalous AD DS security events. Each alert creates an incident. You need to implement an incident triage solution that meets the following requirements: • Security incidents from contoso.com must be assigned to Group1. • Security incidents from fabrikam.com must be assigned to Group2. • Administrative effort must be minimized. What should you include in the solution?

Question 45

You have a Microsoft 365 E5 subscription that uses Microsoft Copilot for Security. You have a Copilot for Security workspace that uses the following plugins: • Microsoft Entra • Microsoft Defender XDR From the Microsoft Defender portal, you use Copilot for Security to investigate a reported incident. You need to run a promptbook that will include information from Microsoft Entra ID Protection in the investigation. What should you do first?

Question 46

You have a Microsoft Sentinel workspace. You are investigating an incident that involves the following entities: • A host named Host1 • A user account named User1 • An IP address of 175.45.176.99 You need to update the threat intelligence list to include the entities. Which entities can you add on the Incident page?

Question 47

DRAG DROP - You have an on-premises Windows 11 Pro device named Device1 that is onboarded to Microsoft Defender for Endpoint. You have a Microsoft 365 subscription. You need to identify the processes running on Device1 and which network connections the processes have open. The solution must minimize administrative effort. Which four actions should you perform in the Microsoft Defender portal in sequence? To answer, move the appropriate actions from the list of actions to the answer area and arrange them in the correct order.

Question 48

You have a Microsoft 365 E5 subscription. You need to ensure that an alert is generated in Microsoft Defender XDR when attackers attempt to connect to a specific device. The solution must minimize administrative effort. What should you do in the Microsoft Defender portal?