SC-200 Free Practice Questions — Page 9

Question 86

You have a Microsoft 365 E5 subscription that contains two users named User1 and User2 and uses Microsoft Copilot for Security. From the Copilot for Security portal, User1 starts a session and creates the following prompts: • Prompt1: Provides access to the Entra plugin • Prompt2: Provides access to the Intune plugin • Prompt3: Provides access to the Entra plugin User1 shares the session with User2. User2 does NOT have access to Microsoft Intune. For which prompts can User2 view results during the shared session?

Question 87

HOTSPOT - You have a Microsoft 365 E5 subscription that uses Microsoft Defender XDR. You have a Microsoft Sentinel workspace. Microsoft Sentinel connectors are configured as shown in the following table. You use Microsoft Sentinel to investigate suspicious Microsoft Graph API activity related to Conditional Access policies. You need to search for the following activities: • Downloads of the Conditional Access policies by using PowerShell • Updates to the Conditional Access policies by using the Microsoft Entra admin center Which tables should you query for each activity? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.

Question 88

You have a Microsoft 365 E5 subscription and a Microsoft Sentinel workspace. You need to create a KQL query that will combine data from the following sources: • Microsoft Graph • Risky users detected by using Microsoft Entra ID Protection The solution must minimize the volume of data returned. How should the query start?

Question 89

You have a Microsoft 365 E5 subscription. You have a PowerShell script that queries the unified audit log. You discover that the query returns only the first page of results due to server-side paging. You need to ensure that you get all the results. Which property should you query in the results?

Question 90

HOTSPOT - You have a Microsoft 365 E5 subscription that uses Microsoft Defender for Office 365. You need to build a hunting query that will list events involving potentially malicious emails that were detected but NOT removed successfully from mailboxes after delivery. The solution must ensure that the events are correlated with the sign-in events of the email recipients. How should you complete the query? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.

Question 91

You have a Microsoft 365 E5 subscription that contains two groups named Group1 and Group2 and uses Microsoft Copilot for Security. You need to configure Copilot for Security role assignments to meet the following requirements: • Ensure that members of Group1 can run prompts and respond to Microsoft Defender XDR security incidents. • Ensure that members of Group2 can run prompts. • Follow the principle of least privilege. You remove Everyone from the Copilot Contributor role. Which two actions should you perform next? Each correct answer presents part of the solution. NOTE: Each correct selection is worth one point.

Question 92

You have a Microsoft 365 E5 subscription that uses Microsoft Copilot for Security. Copilot for Security has the default settings configured. You need to ensure that a user named User can use Copilot for Security to perform the following tasks: • Upload files. • View the usage dashboard. • Share promptbooks with all users. The solution must follow the principle of least privilege Which role should you assign to User?

Question 93

HOTSPOT - You have a Microsoft 365 E5 subscription that uses Microsoft Exchange Online. You identify the suspicious emails shown in the following table. In Microsoft Purview, you create the content searches shown in the following table. For each of the following statements, select Yes if the statement is true. Otherwise, select No. NOTE: Each correct selection is worth one point.

Question 94

HOTSPOT - You have a Microsoft 365 subscription that contains a Windows device named Device1. Device1 is onboarded to Microsoft Defender for Endpoint. You initiate a live response session on Device1. You need to execute a long running script. The solution must ensure that you can run additional commands during the session while the script is running. How should you complete the live response command? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.

Question 95

You have a Microsoft 365 E5 subscription that uses Microsoft Defender XDR. You are investigating an incident. You need to review the incident tasks that were performed. What can you use on the Incident page?