SC-200 Free Practice Questions — Page 6

Question 54

HOTSPOT - You have an Azure subscription name Sub1 that is linked to a Microsoft Entra tenant named contoso.com. Sub1 contains a Log Analytics workspace named Workspace1. All the logs from contoso.com are streamed to Workspace1. You have a Microsoft 365 E5 subscription. You need to query Workspace1 for the following: • HTTP requests to the Microsoft Graph service of contoso.com • Third-party app sign-in activities that use certificates or secrets How should you complete the KQL query? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.

Question 55

HOTSPOT - You have the Azure subscriptions shown in the following table. You have a Microsoft Entra tenant that contains the users shown in the following table. The users have the Azure roles shown in the following table. You configure Microsoft Copilot for Security capacities as shown in the following table. For each of the following statements, select Yes if the statement is true. Otherwise, select No. NOTE: Each correct selection is worth one point.

Question 57

HOTSPOT - You have a Microsoft 365 subscription that contains three users named User1, User2 and User3 and the resources shown in the following table. You have a Microsoft Defender XDR detection rule named Rule1 that has the following configurations: • Scope:DevGroup1 • File hash: File1.exe • Actions o Devices: Collect investigation package o User: Mark as compromised o Files: Block Each user attempts to run File1.exe on their device. For each of the following statements, select Yes if the statement is true. Otherwise, select No. NOTE: Each correct selection is worth one point.

Question 58

HOTSPOT - You have an Azure subscription that contains the users shown in the following table. The subscription contains instances of Azure Firewall as shown in the following table. You have a Microsoft 365 E5 subscription that uses Microsoft Copilot for Security. You have the Copilot for Security role assignments shown in the following table. Each user runs a Copilot for Security session. For each of the following statements, select Yes if the statement is true. Otherwise, select No. NOTE: Each correct selection is worth one point.

Question 59

HOTSPOT - You have a Microsoft 365 E5 subscription that contains a Microsoft SharePoint Online site named Site1. In Site1, you identify the suspicious files shown in the following table. In Microsoft Purview, you create the content searches shown in the following table. For each of the following statements, select Yes if the statement is true. Otherwise, select No. NOTE: Each correct selection is worth one point.

Question 60

HOTSPOT - You have a Microsoft Sentinel workspace. You need to create playbooks that meet the following requirements: • Use an automation rule to trigger actions on an entity. • Call the Entities - Get Hosts action. Which types of playbooks should you use, and which parameters should you specify? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.

Question 61

HOTSPOT - You have a Microsoft 365 E5 subscription that contains Windows 11 and Linux CentOS devices. In Microsoft Defender XDR, Deception is set to On. You plan to create a deception rule that will use a custom lure. You need to specify the type of file, and the planting path for the custom lure. What should you specify? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.

Question 62

HOTSPOT - You have an Azure subscription. You have a Microsoft Sentinel workbook that contains the following text parameters: • text1 • grouptime1 You need to display the count of security alerts. The count must be filtered based on the text1 parameter and grouped by the grouptime1 parameter. How should you complete the KOL query? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.

Question 63

HOTSPOT - You have a Microsoft 365 E5 subscription that uses Microsoft Defender XDR. You discover a malicious process that was initiated by a file named File1.exe on a device named Device1. You need to create a KQL query that will identify when File1.exe was created. The solution must meet the following requirements: • Return the FileName, InitiatingProcessFileName, and InitiatingProcessCommandLine columns. • Minimize the volume of data returned. How should you complete the query? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.

Question 64

Your on-premises network contains two Active Directory Domain Services (AD DS) domains named contoso.com and fabrikam.com. Contoso.com contains a group named Group1. Fabrikam.com contains a group named Group2. You have a Microsoft Sentinel workspace named WS1 that contains a scheduled query rule named Rule1. Rule1 generates alerts in response to anomalous AD DS security events. Each alert creates an incident. You need to implement an incident triage solution that meets the following requirements: • Security incidents from contoso.com must be assigned to Group1. • Security incidents from fabrikam.com must be assigned to Group2. • Administrative effort must be minimized. What should you include in the solution?