SC-200 Free Practice Questions — Page 7

Question 60

You have a Microsoft 365 subscription that uses Microsoft Copilot for Security. You create a promptbook named Book1. For Book1, you need to create a prompt that contains an input named IncidentID. How should you format IncidentID?

Question 61

You have a Microsoft 365 E5 subscription that contains a Microsoft SharePoint Online site named Site1. You need to enable Microsoft Defender for Cloud Apps session control for Site1. Which type of policy should you create first?

Question 62

You have a Microsoft 365 E5 subscription. You need to search the Microsoft Purview audit log by using PowerShell on a Windows device. What should you do first?

Question 63

You have a Microsoft 365 E5 subscription that contains a database server named DB1. DB1 is onboarded to Microsoft Defender XDR. You need to ensure that DB1 appears on the attack surface map. What should you configure?

Question 64

Note: This section contains one or more sets of questions with the same scenario and problem. Each question presents a unique solution to the problem. You must determine whether the solution meets the stated goals. More than one solution in the set might solve the problem. It is also possible that none of the solutions in the set solve the problem. After you answer a question in this section, you will NOT be able to return. As a result, these questions do not appear on the Review Screen. You have a Microsoft 365 subscription. You have 1,000 Windows devices that have a third-party antivirus product installed and Microsoft Defender Antivirus in passive mode. All Windows devices are onboarded to Microsoft Defender for Endpoint. You need to ensure that the devices are protected from malicious artifacts that were undetected by the third-party antivirus product. Solution: You enable Live Response. Does this meet the goal?

Question 65

You have a Microsoft 365 E5 subscription that contains a user named User1. The subscription uses Microsoft 365 Copilot for Security. Copilot for Security uses the Sentinel plugin. User1 is assigned the Copilot Contributor role. During an investigation, User1 submits a prompt and receives a notification that Copilot for Security cannot respond to requests because the security compute unit (SCU) usage is nearing the provisioned capacity limit. You need to ensure that User1 can use Copilot for Security to generate a successful response. What should User1 do?

Question 66

You have a Microsoft 365 E5 subscription that contains two users named User1 and User2 and uses Microsoft Copilot for Security. From the Copilot for Security portal, User1 starts a session and creates the following prompts: • Prompt1: Provides access to the Entra plugin • Prompt2: Provides access to the Intune plugin • Prompt3: Provides access to the Entra plugin User1 shares the session with User2. User2 does NOT have access to Microsoft Intune. For which prompts can User2 view results during the shared session?

Question 67

HOTSPOT - You have a Microsoft 365 E5 subscription that uses Microsoft Defender XDR. You have a Microsoft Sentinel workspace. Microsoft Sentinel connectors are configured as shown in the following table. You use Microsoft Sentinel to investigate suspicious Microsoft Graph API activity related to Conditional Access policies. You need to search for the following activities: • Downloads of the Conditional Access policies by using PowerShell • Updates to the Conditional Access policies by using the Microsoft Entra admin center Which tables should you query for each activity? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.

Question 68

You have a Microsoft 365 E5 subscription and a Microsoft Sentinel workspace. You need to create a KQL query that will combine data from the following sources: • Microsoft Graph • Risky users detected by using Microsoft Entra ID Protection The solution must minimize the volume of data returned. How should the query start?

Question 69

You have a Microsoft 365 E5 subscription. You have a PowerShell script that queries the unified audit log. You discover that the query returns only the first page of results due to server-side paging. You need to ensure that you get all the results. Which property should you query in the results?