SC-200 Free Practice Questions — Page 8

Question 70

HOTSPOT - You have a Microsoft 365 E5 subscription that uses Microsoft Defender for Office 365. You need to build a hunting query that will list events involving potentially malicious emails that were detected but NOT removed successfully from mailboxes after delivery. The solution must ensure that the events are correlated with the sign-in events of the email recipients. How should you complete the query? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.

Question 71

You have a Microsoft 365 E5 subscription that contains two groups named Group1 and Group2 and uses Microsoft Copilot for Security. You need to configure Copilot for Security role assignments to meet the following requirements: • Ensure that members of Group1 can run prompts and respond to Microsoft Defender XDR security incidents. • Ensure that members of Group2 can run prompts. • Follow the principle of least privilege. You remove Everyone from the Copilot Contributor role. Which two actions should you perform next? Each correct answer presents part of the solution. NOTE: Each correct selection is worth one point.

Question 72

You have a Microsoft 365 E5 subscription that uses Microsoft Copilot for Security. Copilot for Security has the default settings configured. You need to ensure that a user named User can use Copilot for Security to perform the following tasks: • Upload files. • View the usage dashboard. • Share promptbooks with all users. The solution must follow the principle of least privilege Which role should you assign to User?

Question 73

HOTSPOT - You have a Microsoft 365 E5 subscription that uses Microsoft Exchange Online. You identify the suspicious emails shown in the following table. In Microsoft Purview, you create the content searches shown in the following table. For each of the following statements, select Yes if the statement is true. Otherwise, select No. NOTE: Each correct selection is worth one point.

Question 74

HOTSPOT - You have a Microsoft 365 subscription that contains a Windows device named Device1. Device1 is onboarded to Microsoft Defender for Endpoint. You initiate a live response session on Device1. You need to execute a long running script. The solution must ensure that you can run additional commands during the session while the script is running. How should you complete the live response command? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.

Question 75

You have a Microsoft 365 E5 subscription that uses Microsoft Defender XDR. You are investigating an incident. You need to review the incident tasks that were performed. What can you use on the Incident page?

Question 76

You have 1,000 on-premises Windows 11 Pro devices that are onboarded to Microsoft Defender for Endpoint. You have a Microsoft 365 subscription that uses Microsoft Defender XDR. You identify that an attacker performed the following actions on a device: • Modified the filesystem path of a registry-based antivirus exclusion • Downloaded a malicious file to the file system path You initiate a live response session on the device. You need to undo the registry change. Which command should you run?

Question 77

You have an Azure subscription that contains a Microsoft Sentinel workspace named WS1. WS1 has the Azure Activity connector and the Microsoft Entra ID connector configured. You need to investigate which accounts have the most alerts and any corresponding incident information for each alert. The solution must minimize administrative effort. What should you do first in WS1?

Question 78

You have a Microsoft 365 subscription that contains a user named User1 and two Windows devices named Device1 and Device2. Device1 and Device2 are onboarded to Microsoft Defender for Endpoint. The following events occur. • User1 signs in to Device1. • Automatic attack disruption in Microsoft Defender XDR responds to an attack on Device1 and contains User1. • User1 attempts to connect to Device2. Which protocols will Device2 block when User1 attempts to connect to Device2?

Question 79

You have a Microsoft 365 subscription. You have the following KQL query. You need to ensure that you can create a Microsoft Defender XDR custom detection rule by using the query. What should you add to the query?