SC-200 Free Practice Questions — Page 7

Question 65

You have a Microsoft 365 E5 subscription that uses Microsoft Copilot for Security. You have a Copilot for Security workspace that uses the following plugins: • Microsoft Entra • Microsoft Defender XDR From the Microsoft Defender portal, you use Copilot for Security to investigate a reported incident. You need to run a promptbook that will include information from Microsoft Entra ID Protection in the investigation. What should you do first?

Question 66

You have a Microsoft Sentinel workspace. You are investigating an incident that involves the following entities: • A host named Host1 • A user account named User1 • An IP address of 175.45.176.99 You need to update the threat intelligence list to include the entities. Which entities can you add on the Incident page?

Question 67

DRAG DROP - You have an on-premises Windows 11 Pro device named Device1 that is onboarded to Microsoft Defender for Endpoint. You have a Microsoft 365 subscription. You need to identify the processes running on Device1 and which network connections the processes have open. The solution must minimize administrative effort. Which four actions should you perform in the Microsoft Defender portal in sequence? To answer, move the appropriate actions from the list of actions to the answer area and arrange them in the correct order.

Question 68

You have a Microsoft 365 E5 subscription. You need to ensure that an alert is generated in Microsoft Defender XDR when attackers attempt to connect to a specific device. The solution must minimize administrative effort. What should you do in the Microsoft Defender portal?

Question 69

HOTSPOT - You have a Microsoft 365 E5 subscription that has a Conditional Access policy named Policy1. You need to perform the following actions: • Create a Conditional Access App Control custom policy named Custom1. • Configure Policy1 to use Custom1. What should you use co create Custom1, and in which settings of Policy1 should you enable Conditional Access App Control? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.

Question 70

You have a Microsoft 365 E5 subscription that contains a device named Device1. From the Microsoft Defender portal, you discover that an alert was triggered for Device1. From the Device inventory page, you isolate Device1. You need to collect a list of installed programs on Device1. What should you do?

Question 71

HOTSPOT - You have a Microsoft 365 E5 subscription that uses Microsoft Defender XDR. You are implementing a deception rule. You need to provide a custom lure file. For the custom lure, you set Planting path to HOME. Which types of files can you use for the custom lure, and in which home directory should the file be located on a device? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.

Question 72

HOTSPOT - You have an Azure subscription that uses Microsoft Defender for Cloud. You need to use an Azure Resource Manager (ARM) template to create a workflow automation that will trigger a logic app when specific alerts are received by Microsoft Defender for Cloud. How should you complete the template? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.

Question 73

HOTSPOT - You have an Azure subscription named Sub1 that is linked to a Microsoft Entra tenant named contoso.com. Contoso.com contains a user named User1. Sub1 contains a Microsoft Sentinel workspace. You provision a Microsoft Copilot for Security capacity. You need to ensure that User1 can use Copilot for Security to perform the following tasks: • Update the data sharing and feedback options. • Investigate Microsoft Sentinel incidents. The solution must follow the principle of least privilege. Which role should you assign to User1 for each task? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.

Question 74

HOTSPOT - You have an Azure subscription named Sub1 that contains a resource group named RG1. RG1 contains two Azure key vaults named KV1 and KV2 that use Azure role-based access control (Azure RBAC). The subscription contains the users shown in the following table. KV1 contains a secret named Secret1. KV2 contains a secret named Secret2. Which users can read the values of each secret? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.