Microsoft Security Operations Analyst practice questions

1. Question 1 of 25

   Select 2

   Your company deploys the following services: ✑ Microsoft Defender for Identity ✑ Microsoft Defender for Endpoint ✑ Microsoft Defender for Office 365 You need to provide a security analyst with the ability to use the Microsoft 365 security center. The analyst must be able to approve and reject pending actions generated by Microsoft Defender for Endpoint. The solution must use the principle of least privilege. Which two roles should assign to the analyst? Each correct answer presents part of the solution. NOTE: Each correct selection is worth one point.

   • Athe Compliance Data Administrator in Azure Active Directory (Azure AD)
   • Bthe Active remediation actions role in Microsoft Defender for Endpoint
   • Cthe Security Administrator role in Azure Active Directory (Azure AD)
   • Dthe Security Reader role in Azure Active Directory (Azure AD)

   Show answer

   Correct answer: B, D

   How others answered

   • BD81%
   • BC19%

   Explanation

   Provided answer B and D is correct. Security Reader - can access M365 Security Center. Active Remediation Actions role in Defender for Endpoint meets need to 'approve and reject' pending actions with respect to Defender For Endpoint. Requirement does not need more.

   Adapted from community discussion by PhilAus · 2024-09-19 · 27 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

   Supporting references

   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn

   View community discussion4

   Candidate context

   Question 1 discussion

   These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by SC-200 or CertExamHQ.

   1. P

      PhilAus

      2024-09-19

      27 upvotes

      Provided answer B and D is correct. Security Reader - can access M365 Security Center. Active Remediation Actions role in Defender for Endpoint meets need to 'approve and reject' pending actions with respect to Defender For Endpoint. Requirement does not need more.

   2. M

      Metasploit

      2024-09-23

      Selected B, D9 upvotes

      This question is tricky. If you follow the question directly, they are not asking either/or. They want you to assign 2 roles to the Analyst each being half of the entire solution. Using least privileges the answer should be BD. Not A = Too many other permissions not needed. B = the Active remediation actions role in Microsoft Defender for Endpoint is enough for the task to be done of approving/rejecting pending actions. Not C = Would be able to fulfill both B and D and (more), not least privilege. D = Quite redundant, but gives reader roles read access to the portal up until RBAC is turned on the defender permissions. Least Privilege. ¯\_(ツ)_/¯

   3. T

      TOMtheBOMB

      2024-09-23

      5 upvotes

      Slight confused by this one, this link suggests the answer is B & C: https://docs.microsoft.com/en-us/microsoft-365/security/defender/m365d-action-center?view=o365-worldwide Remediation action: Microsoft Defender for Endpoint remediation (devices) Required roles and permissions: Security Administrator role assigned in either Azure Active Directory (Azure AD) (https://portal.azure.com) or the Microsoft 365 admin center (https://admin.microsoft.com) --- or --- Active remediation actions role assigned in Microsoft Defender for Endpoint

   4. J

      jasonfmj

      2021-08-22

      4 upvotes

      Answer is B and C Security Reader: A user that belongs to this role has viewing rights to Security Center. The user can view recommendations, alerts, a security policy, and security states, but cannot make changes. Security Admin: A user that belongs to this role has the same rights as the Security Reader and can also update the security policy and dismiss alerts and recommendations. https://docs.microsoft.com/en-us/azure/security-center/security-center-permissions

2. Question 2 of 25

   Select 2

   You need to configure Microsoft Cloud App Security to generate alerts and trigger remediation actions in response to external sharing of confidential files. Which two actions should you perform in the Cloud App Security portal? Each correct answer presents part of the solution. NOTE: Each correct selection is worth one point.

   • AFrom Settings, select Information Protection, select Azure Information Protection, and then select Only scan files for Azure Information Protection classification labels and content inspection warnings from this tenant.
   • BSelect Investigate files, and then filter App to Office 365.
   • CSelect Investigate files, and then select New policy from search.
   • DFrom Settings, select Information Protection, select Azure Information Protection, and then select Automatically scan new files for Azure Information Protection classification labels and content inspection warnings.
   • EFrom Settings, select Information Protection, select Files, and then enable file monitoring.
   • FSelect Investigate files, and then filter File Type to Document.

   Show answer

   Correct answer: D, E

   How others answered

   • DE78%
   • CE17%

   Explanation

   D. From Settings, select Information Protection, select Azure Information Protection, and then select Automatically scan new files for Azure Information Protection classification labels and content inspection warnings. This will enable Cloud App Security to automatically scan new files for Azure Information Protection classification labels and content inspection warnings, which can be used to detect and protect confidential files. E. From Settings, select Information Protection, select Files, and then enable file monitoring. This will enable Cloud App Security to monitor files for external sharing and other activities, and to generate alerts and trigger remediation actions in response to potential threats or policy violations.

   Adapted from community discussion by jrjrjrchlv · 2023-01-08 · 3 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

   Supporting references

   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn

   View community discussion4

   Candidate context

   Question 2 discussion

   These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by SC-200 or CertExamHQ.

   1. L

      liberty123

      2024-09-19

      Selected D, E25 upvotes

      DE is correct , I have seen these configurations in Microsoft Learning video: https://www.microsoft.com/en-us/videoplayer/embed/RE4CMYG?postJsllMsg=true

   2. J

      jrjrjrchlv

      2023-01-08

      Selected D, E3 upvotes

      D. From Settings, select Information Protection, select Azure Information Protection, and then select Automatically scan new files for Azure Information Protection classification labels and content inspection warnings. This will enable Cloud App Security to automatically scan new files for Azure Information Protection classification labels and content inspection warnings, which can be used to detect and protect confidential files. E. From Settings, select Information Protection, select Files, and then enable file monitoring. This will enable Cloud App Security to monitor files for external sharing and other activities, and to generate alerts and trigger remediation actions in response to potential threats or policy violations.

   3. P

      palito1980

      2023-01-19

      Selected D, E4 upvotes

      D: Settings>Information Protection>Microsoft Information Protection>Automatically scan new files for Microsoft Information Protection classification labels and content inspection warnings. E: Settings>Information Protection>Files>Enable file monitoring.

   4. J

      ja_girl_eng

      2022-01-15

      4 upvotes

      Definitely DE though it seems to be called MIP and not AIP In Defender for Cloud Apps, under the settings cog, select the Settings page under the System heading. Under Microsoft Information Protection, select Automatically scan new files for Microsoft Information Protection sensitivity labels. https://docs.microsoft.com/en-us/defender-cloud-apps/tutorial-dlp

3. Question 3 of 25

   Select 2

   You are configuring Microsoft Cloud App Security. You have a custom threat detection policy based on the IP address ranges of your company's United States-based offices. You receive many alerts related to impossible travel and sign-ins from risky IP addresses. You determine that 99% of the alerts are legitimate sign-ins from your corporate offices. You need to prevent alerts for legitimate sign-ins from known locations. Which two actions should you perform? Each correct answer presents part of the solution. NOTE: Each correct selection is worth one point.

   • AConfigure automatic data enrichment.
   • BAdd the IP addresses to the corporate address range category.
   • CIncrease the sensitivity level of the impossible travel anomaly detection policy.
   • DAdd the IP addresses to the other address range category and add a tag.
   • ECreate an activity policy that has an exclusion for the IP addresses.

   Show answer

   Correct answer: A, B

   How others answered

   • AB82%

   Explanation

   Apologies, the answer provided is correct. I just know checked the site myself and the options exist, you add the IP address range and a tag and then you check to override the data enrichment by providing a location that goes along with that IP range. So, A & D stand correct.

   Adapted from community discussion by JohnAvlakiotis · 2021-10-08 · 52 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

   Supporting references

   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn

   View community discussion4

   Candidate context

   Question 3 discussion

   These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by SC-200 or CertExamHQ.

   1. J

      JohnAvlakiotis

      2021-10-08

      52 upvotes

      Apologies, the answer provided is correct. I just know checked the site myself and the options exist, you add the IP address range and a tag and then you check to override the data enrichment by providing a location that goes along with that IP range. So, A & D stand correct.

   2. J

      JohnAvlakiotis

      2021-10-01

      43 upvotes

      This answer looks wrong and since there is no reference link to support it I challenge it. To me the correct answer is B,E.

   3. S

      stromnessian

      2022-02-19

      Selected A, B40 upvotes

      A - this seems correct, as if you override the automatic detection of location for company IP address ranges, you can prevent the impossible travel alerts. B - This makes sense as you need to define your corporate address ranges so that they are not seen as risky. C - Increasing the sensitivity of the impossible travel detection would create more alerts. D - Why would you set the IP addresses to the "Other" category when there is a "Corporate" category that fits the description? E - Creating a new policy when there is already an existing one that you need to reduce the alerts from, would not reduce the number of alerts.

   4. N

      Neela

      2022-03-23

      8 upvotes

      https://docs.microsoft.com/en-us/defender-cloud-apps/api-data-enrichment

4. Question 4 of 25

   You have a Microsoft 365 E5 subscription that uses Microsoft SharePoint Online. You delete users from the subscription. You need to be notified if the deleted users downloaded numerous documents from SharePoint Online sites during the month before their accounts were deleted. What should you use?

   • Aa file policy in Microsoft Defender for Cloud Apps
   • Ban access review policy
   • Can alert policy in Microsoft Defender for Office 365
   • Dan insider risk policy

   Show answer

   Correct answer: D

   How others answered

   • D81%

   Explanation

   D: Insider risk policy. Data theft by departing users: https://learn.microsoft.com/en-us/microsoft-365/compliance/insider-risk-management-policies?view=o365-worldwide#data-theft-by-departing-users When users leave your organization, there are specific risk indicators typically associated with data theft by departing users. This policy template uses exfiltration indicators for risk scoring and focuses on detection and alerts in this risk area.

   Adapted from community discussion by Metasploit · 2022-10-21 · 29 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

   Supporting references

   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn

   View community discussion4

   Candidate context

   Question 4 discussion

   These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by SC-200 or CertExamHQ.

   1. M

      Metasploit

      2022-10-21

      Selected D29 upvotes

      D: Insider risk policy. Data theft by departing users: https://learn.microsoft.com/en-us/microsoft-365/compliance/insider-risk-management-policies?view=o365-worldwide#data-theft-by-departing-users When users leave your organization, there are specific risk indicators typically associated with data theft by departing users. This policy template uses exfiltration indicators for risk scoring and focuses on detection and alerts in this risk area.

   2. V

      vannear

      2022-11-07

      Selected D5 upvotes

      My first day on my first job was to review the trainning session from Micrsoft, they highlighted this "Insider Risk"feature several times, the correct answer defenitely is D.

   3. [

      [Removed]

      2023-02-17

      Selected D3 upvotes

      To be notified if the deleted users downloaded numerous documents from SharePoint Online sites during the month before their accounts were deleted, you should use an insider risk policy. Insider risk policies in Microsoft 365 can monitor user activity across different services, including SharePoint Online, to detect potential insider risks such as data leaks or theft. You can configure an insider risk policy to trigger an alert when certain user activity matches a defined risk level or condition, such as downloading a large number of documents.

   4. L

      Lokmane14

      2022-12-01

      Selected D4 upvotes

      D seems to be correct, insider risk policy suits to this question.

5. Question 5 of 25

   You have a Microsoft 365 subscription that uses Microsoft Defender for Office 365. You have Microsoft SharePoint Online sites that contain sensitive documents. The documents contain customer account numbers that each consists of 32 alphanumeric characters. You need to create a data loss prevention (DLP) policy to protect the sensitive documents. What should you use to detect which documents are sensitive?

   • ASharePoint search
   • Ba hunting query in Microsoft 365 Defender
   • CAzure Information Protection
   • DRegEx pattern matching

   Show answer

   Correct answer: D

   How others answered

   • D60%
   • C40%

   Only 60% agreed on this answer — treat it as contested rather than settled.

   Explanation

   Azure API is the correct answer. The question is asking what you need. It is not asking you how to do it. You must use Azure AIP as a tool for DLP. And then Regex is a way to build your pattern in case there is not any built-in sensitive pattern type that supports your case (account number with 32 char). So bonus the regex ^[a-zA-Z0-9]{32}$

   Adapted from community discussion by teehex · 2024-09-19 · 63 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

   Supporting references

   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn

   View community discussion4

   Candidate context

   Question 5 discussion

   These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by SC-200 or CertExamHQ.

   1. T

      teehex

      2024-09-19

      63 upvotes

      Azure API is the correct answer. The question is asking what you need. It is not asking you how to do it. You must use Azure AIP as a tool for DLP. And then Regex is a way to build your pattern in case there is not any built-in sensitive pattern type that supports your case (account number with 32 char). So bonus the regex ^[a-zA-Z0-9]{32}$

   2. L

      Lone__Wolf

      2024-09-23

      Selected D5 upvotes

      D. RegEx pattern matching To detect sensitive documents in SharePoint Online, you can use a RegEx (regular expression) pattern matching rule in the data loss prevention (DLP) policy. A RegEx pattern is a sequence of characters that defines a search pattern, which can be used to match specific sequences of characters in the documents. In this scenario, you can use a RegEx pattern to match the customer account numbers, which consist of 32 alphanumeric characters. By using a RegEx pattern, you can accurately identify the sensitive documents that contain the customer account numbers and take appropriate action, such as blocking access to the documents or sending notifications to the appropriate users. Once you have defined the RegEx pattern, you can create a DLP policy in Microsoft Defender for Office 365 that uses the pattern to detect sensitive documents. The DLP policy can then be configured to take appropriate action, such as blocking access to the sensitive documents or sending notifications to the appropriate users.

   3. M

      Max_DeJaV

      2024-01-14

      Selected D5 upvotes

      I tried to apply the different solution, but only D seems to be correct, below the steps I followed in my environment: Open the Microsoft Pureview portal: 1) Create a new classifier: - Data Classification -> Classifiers -> Sensitive Info Type -> Create a new classifier with the regex (32 alphanumeric characters) https://learn.microsoft.com/en-us/purview/create-a-custom-sensitive-information-type?view=o365-worldwide 2) Create the DLP rule (using the previously created classifier) - Data Loss Prevention -> Policies -> Create a policy and using the previously created classifier. AIP uses labels, and I couldn't find the option to create them with Regex, moreover this functionality should be part of another plan

   4. T

      TechMinerUK

      2023-01-03

      Selected D5 upvotes

      I would say it is D as the question already states you need to make a DLP policy meaning you have chosen the technology which you are going to use. As such the policy would involve a RegEx component in order to protect the data mentioned Whilst you are "protecting" the data it doesn't necesarily need to be AIP, it could be DLP with the RegEx policy to prevent it being sent externally

6. Question 6 of 25

   You have a Microsoft 365 subscription. The subscription uses Microsoft 365 Defender and has data loss prevention (DLP) policies that have aggregated alerts configured. You need to identify the impacted entities in an aggregated alert. What should you review in the DLP alert management dashboard of the Microsoft 365 compliance center?

   • Athe Events tab of the alert
   • Bthe Sensitive Info Types tab of the alert
   • CManagement log
   • Dthe Details tab of the alert

   Show answer

   Correct answer: A

   How others answered

   • A73%
   • D26%

   Only 73% agreed on this answer — treat it as contested rather than settled.

   Explanation

   In order to identify the impacted entities in an aggregated alert, you should review the "Events" tab of the DLP alert management dashboard in the Microsoft 365 compliance center. This tab will display a list of all the events that triggered the alert, including the specific entities (e.g. files, emails, etc.) that were affected. You can further investigate each event to identify the specific user, device and action that caused the alert to be triggered.

   Adapted from community discussion by eddz25 · 2023-01-21 · 26 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

   Supporting references

   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn

   View community discussion4

   Candidate context

   Question 6 discussion

   These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by SC-200 or CertExamHQ.

   1. E

      eddz25

      2023-01-21

      Selected A26 upvotes

      In order to identify the impacted entities in an aggregated alert, you should review the "Events" tab of the DLP alert management dashboard in the Microsoft 365 compliance center. This tab will display a list of all the events that triggered the alert, including the specific entities (e.g. files, emails, etc.) that were affected. You can further investigate each event to identify the specific user, device and action that caused the alert to be triggered.

   2. W

      Wutan

      2023-01-19

      Selected A11 upvotes

      The correct answer is A. More on: https://learn.microsoft.com/en-us/microsoft-365/compliance/dlp-configure-view-alerts-policies?view=o365-worldwide

   3. L

      Lone__Wolf

      2023-02-12

      Selected A3 upvotes

      The Events tab of the DLP alert management dashboard in the Microsoft 365 compliance center provides a comprehensive view of the entities that have been impacted by the aggregated alert. This tab provides information about the number of entities affected, the type of entities affected, the users or devices that caused the DLP violation, and other relevant details about the alert. By reviewing the Events tab, you can quickly determine the extent of the impact of the alert and take appropriate actions to mitigate the impact.

   4. R

      Ramye

      2024-02-26

      Selected A2 upvotes

      This question is tricky as there are Details tab from the Alerts itself which does not show any impacted entities. However, if you open the Alert you will see a 'View details' tab at the bottom and here you' will see the Events tab next to the Details tab. Click on 'View details' at the bottom which will take you to the details page, Here you'll see the Overview and Events tab. Click on the Events tab and at the right-hand side you will see another Details tab and under that you will see Impacted entities. So the answer is clearly A the Events tab as this leads to you the impacted entities info,

7. Question 7 of 25

   Your company uses line-of-business apps that contain Microsoft Office VBA macros. You need to prevent users from downloading and running additional payloads from the Office VBA macros as additional child processes. Which two commands can you run to achieve the goal? Each correct answer presents a complete solution. NOTE: Each correct selection is worth one point. A.

   

   B.

   

   C.

   

   D.

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer

   Explanation

   Reference: https://docs.microsoft.com/en-us/windows/security/threat-protection/microsoft-defender-atp/attack-surface-reduction

   Adapted from community discussion by Metasploit · 2024-09-19 · 23 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

   Supporting references

   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn

   View community discussion4

   Candidate context

   Question 7 discussion

   These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by SC-200 or CertExamHQ.

   1. M

      Metasploit

      2024-09-19

      23 upvotes

      A,D. These are 2 complete solutions on their own. Not a step by step by step. 1) Add the rule and enable it. 2) Add the rule, set the rule to overwrite existing rules, and enable it. "Set-MpPreference will always overwrite the existing set of rules. If you want to add to the existing set, use Add-MpPreference instead." https://learn.microsoft.com/en-us/microsoft-365/security/defender-endpoint/enable-attack-surface-reduction?view=o365-worldwide#powershell The command does not need to mention anything about block because the GUID references a Rule with already set actions. Configuration Manager name: Block Office application from creating child processes GUID: d4f940ab-401b-4efc-aadc-ad5f3c50688a https://learn.microsoft.com/en-us/microsoft-365/security/defender-endpoint/attack-surface-reduction-rules-reference?source=recommendations&view=o365-worldwide#block-all-office-applications-from-creating-child-processes

   2. A

      AlaReAla

      2021-10-01

      17 upvotes

      I echo, as the requirement is not for audit, but to prevent. So the answer should be A & D.

   3. H

      Haz56

      2021-12-17

      13 upvotes

      I would say A&D as the question states "Each correct answer presents a complete solution.", so choosing one of the audit options would not be a complete solution on its own to prevent the action

   4. R

      Remilia

      2021-11-20

      5 upvotes

      From Microsoft: you can configure attack surface reduction capabilities to run in audit mode to see how they'll work. In audit mode, you can enable: Attack surface reduction rules Exploit protection Network protection And controlled folder access in audit mode Audit mode lets you see a record of what would have happened if you had enabled the feature. You can enable audit mode when testing how the features will work. This will help make sure your line-of-business apps aren't affected. You can also get an idea of how many suspicious file modification attempts occur over a certain period of time. The features won't block or prevent apps, scripts, or files from being modified. However, the Windows Event Log will record events as if the features were fully enabled. With audit mode, you can review the event log to see what affect the feature would have had if it was enabled.

8. Question 8 of 25

   You have a Microsoft 365 E5 subscription that uses Microsoft Defender for Endpoint. You need to identify any devices that triggered a malware alert and collect evidence related to the alert. The solution must ensure that you can use the results to initiate device isolation for the affected devices. What should you use in the Microsoft 365 Defender portal?

   • Aincidents
   • BRemediation
   • CInvestigations
   • DAdvanced hunting

   Show answer

   Correct answer: D

   How others answered

   • D65%
   • A27%

   Only 65% agreed on this answer — treat it as contested rather than settled.

   Explanation

   "You can quickly contain threats or address compromised assets that you find in advanced hunting using powerful and comprehensive action options" "You can take the following actions on devices identified by the DeviceId column in your query results: Isolate affected devices to contain an infection or prevent attacks from moving laterally Collect investigation package to obtain more forensic information Run an antivirus scan to find and remove threats using the latest security intelligence updates Initiate an automated investigation to check and remediate threats on the device and possibly other affected devices Restrict app execution to only Microsoft-signed executable files, preventing subsequent threat activity through malware or other untrusted executables"

   Adapted from community discussion by DanielMDC · 2023-10-02 · 4 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

   Supporting references

   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn

   View community discussion4

   Candidate context

   Question 8 discussion

   These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by SC-200 or CertExamHQ.

   1. V

      Vika_1_111

      2023-09-24

      Selected D8 upvotes

      I think it's D. https://learn.microsoft.com/en-us/microsoft-365/security/defender/advanced-hunting-take-action?view=o365-worldwide

   2. D

      DanielMDC

      2023-10-02

      Selected D4 upvotes

      "You can quickly contain threats or address compromised assets that you find in advanced hunting using powerful and comprehensive action options" "You can take the following actions on devices identified by the DeviceId column in your query results: Isolate affected devices to contain an infection or prevent attacks from moving laterally Collect investigation package to obtain more forensic information Run an antivirus scan to find and remove threats using the latest security intelligence updates Initiate an automated investigation to check and remediate threats on the device and possibly other affected devices Restrict app execution to only Microsoft-signed executable files, preventing subsequent threat activity through malware or other untrusted executables"

   3. P

      Porter5000

      2024-06-05

      3 upvotes

      Lets break this down one by one A. Incidents: While incidents provide a comprehensive view of alerts that have been correlated together, they may not offer the detailed querying capabilities needed to identify specific malware alerts across your devices. B. Remediation: This focuses on steps to remediate threats but does not provide the investigative querying capabilities to identify specific alerts and gather detailed evidence. C. Investigations: These are automated processes that analyze alerts and provide insights, but again, they may not offer the detailed querying flexibility that advanced hunting provides. D. Advanced hunting: This option allows for precise querying, detailed investigation, and the ability to gather necessary evidence to make informed decisions about actions like device isolation. Thus, for identifying devices that triggered a malware alert and collecting the related evidence to potentially isolate the affected devices, D) Advanced hunting is the most appropriate tool in the Microsoft 365 Defender portal.

   4. R

      Roblearns

      2023-11-07

      4 upvotes

      i checked with ChatGPT, here is what it says after verification. In your scenario of identifying devices that triggered a malware alert and initiating device isolation for affected devices, you should use option A: Incidents in the Microsoft 365 Defender portal. The "Incidents" feature is specifically designed for tracking and managing security incidents, including those related to malware alerts. You can use this feature to take action on specific incidents, including initiating device isolation if necessary. While the "Investigations" feature (option C) is useful for in-depth analysis and evidence collection, it doesn't directly provide the capability to initiate device isolation. Therefore, option A (Incidents) is the more appropriate choice for your specific use case.

9. Question 9 of 25

   Select 2

   You have the following advanced hunting query in Microsoft 365 Defender.

   

   You need to receive an alert when any process disables System Restore on a device managed by Microsoft Defender during the last 24 hours. Which two actions should you perform? Each correct answer presents part of the solution. NOTE: Each correct selection is worth one point.

   • ACreate a detection rule.
   • BCreate a suppression rule.
   • CAdd | order by Timestamp to the query.
   • DReplace DeviceProcessEvents with DeviceNetworkEvents.
   • EAdd DeviceId and ReportId to the output of the query.

   Show answer

   Correct answer: A, E

   How others answered

   • AE88%

   Explanation

   Correct query is DeviceProcessEvents | where Timestamp > ago (24h) //Pivoting for rundll32 | where InitiatingProcessFileName =~ 'rundll32.exe' //Looking for empty command line and InitiatingProcessCommandLine !contains " " and InitiatingProcessCommandLine != "" //Looking for schtasks.exe as the created process and FileName in~ ('schtasks.exe') //Disabling system restore and ProcessCommandLine has 'Change' and ProcessCommandLine has 'SystemRestore' and ProcessCommandLine has 'disable' | project Timestamp, AccountName, ProcessCommandLine, DeviceId, ReportId Given answer is correct. - Create detection rule - Add ReportId and DeviceId to the output. Both fields are supported in DeviceProcessEvents table.(https://docs.microsoft.com/en-us/microsoft-365/security/defender/advanced-hunting-deviceprocessevents-table?view=o365-worldwide) The sample query can be found here https://docs.microsoft.com/en-us/microsoft-365/security/defender/advanced-hunting-find-ransomware?view=o365-worldwide#turning-off-system-restore

   Adapted from community discussion by teehex · 2024-09-23 · 46 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

   Supporting references

   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn

   View community discussion4

   Candidate context

   Question 9 discussion

   These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by SC-200 or CertExamHQ.

   1. T

      teehex

      2024-09-23

      46 upvotes

      Correct query is DeviceProcessEvents | where Timestamp > ago (24h) //Pivoting for rundll32 | where InitiatingProcessFileName =~ 'rundll32.exe' //Looking for empty command line and InitiatingProcessCommandLine !contains " " and InitiatingProcessCommandLine != "" //Looking for schtasks.exe as the created process and FileName in~ ('schtasks.exe') //Disabling system restore and ProcessCommandLine has 'Change' and ProcessCommandLine has 'SystemRestore' and ProcessCommandLine has 'disable' | project Timestamp, AccountName, ProcessCommandLine, DeviceId, ReportId Given answer is correct. - Create detection rule - Add ReportId and DeviceId to the output. Both fields are supported in DeviceProcessEvents table.(https://docs.microsoft.com/en-us/microsoft-365/security/defender/advanced-hunting-deviceprocessevents-table?view=o365-worldwide) The sample query can be found here https://docs.microsoft.com/en-us/microsoft-365/security/defender/advanced-hunting-find-ransomware?view=o365-worldwide#turning-off-system-restore

   2. A

      ArciOfficial

      2021-07-08

      8 upvotes

      Given answer is CORRECT: According to the link below, DeviceID and ReportID are REQUIRED columns for any custom query. https://docs.microsoft.com/en-us/microsoft-365/security/defender-endpoint/manage-alerts?view=o365-worldwide#suppress-an-alert-and-create-a-new-suppression-rule

   3. M

      Metasploit

      2024-09-23

      Selected A, E6 upvotes

      A = Requirement is to create an alert. Not B = This will hide the the alert. Not C = Avoid filtering custom detections using the Timestamp column. The data used for custom detections is pre-filtered based on the detection frequency. Not D = Random filler answer E = To create a custom detection rule, the query must return the following columns: ->Timestamp—used to set the timestamp for generated alerts ->ReportId—enables lookups for the original records One of the following columns that identify specific devices, users, or mailboxes: -> DeviceId

   4. O

      Oryx360

      2024-09-23

      1 upvote

      It is C&E C. Adding | order by Timestamp to the query ensures that the results are ordered by the Timestamp in ascending or descending order, depending on your requirement. This helps you easily identify the most recent events related to the disabling of System Restore. E. Adding DeviceId and ReportId to the output of the query provides additional context about the affected device and the specific report associated with the event. This information is valuable for investigation and tracking purposes. The other options (B and D) are not relevant to the task of creating an alert for detecting the disabling of System Restore by a process. Suppression rules are used to manage and control alert noise, and replacing DeviceProcessEvents with DeviceNetworkEvents changes the source of data, which isn't related to the objective of the question.

10. Question 10 of 25

    Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution. After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen. You use Azure Security Center. You receive a security alert in Security Center. You need to view recommendations to resolve the alert in Security Center. Solution: From Security alerts, you select the alert, select Take Action, and then expand the Prevent future attacks section. Does this meet the goal?

    • AYes
    • BNo

    Show answer

    Correct answer: B

    How others answered

    • B76%
    • A24%

    Explanation

    Answer is (B) No, because the question is asking for recommendations on the current alert that you are viewing(Mitigate the threat) and not on security recommendations in general(Prevent Future attacks) for the device associated with the alert.. https://learn.microsoft.com/en-us/azure/defender-for-cloud/managing-and-responding-alerts#respond-to-security-alerts (Mitigate the threat) - provides manual remediation steps for this security alert (Provides recommendations on what to do to resolve the alert) (Prevent future attacks) - provides security recommendations to help reduce the attack surface, increase security posture, and thus prevent future attacks.(Provides recommendations for security in general such as Remediate Vulnerabilities and win defender should be activated on all devices)

    Adapted from community discussion by Metasploit · 2022-10-21 · 17 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    Supporting references

    • Microsoft Learn
    • Microsoft Learn
    • Microsoft Learn
    • Microsoft Learn
    • Microsoft Learn

    View community discussion4

    Candidate context

    Question 10 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by SC-200 or CertExamHQ.

    1. M

       Metasploit

       2022-10-21

       Selected B17 upvotes

       Answer is (B) No, because the question is asking for recommendations on the current alert that you are viewing(Mitigate the threat) and not on security recommendations in general(Prevent Future attacks) for the device associated with the alert.. https://learn.microsoft.com/en-us/azure/defender-for-cloud/managing-and-responding-alerts#respond-to-security-alerts (Mitigate the threat) - provides manual remediation steps for this security alert (Provides recommendations on what to do to resolve the alert) (Prevent future attacks) - provides security recommendations to help reduce the attack surface, increase security posture, and thus prevent future attacks.(Provides recommendations for security in general such as Remediate Vulnerabilities and win defender should be activated on all devices)

    2. E

       examkid

       2021-07-15

       11 upvotes

       Answer is correct: https://docs.microsoft.com/en-us/azure/security-center/security-center-managing-and-responding-alerts

    3. M

       ModsGods

       2021-09-27

       5 upvotes

       Reference isn't working anymore. See the comment from @examkid for further learning pages.

    4. V

       vnez

       2022-08-17

       3 upvotes

       Answer should be A - On the Security Alert > Take Action > Prevent future attacks -- this will give you a list of active security recommendations on the affected resource * Mitigate the threat - provides manual remediation steps for this security alert * Prevent future attacks - provides security recommendations to help reduce the attack surface, increase security posture, and thus prevent future attacks

11. Question 11 of 25

    You have an Azure subscription that contains a Log Analytics workspace. You need to enable just-in-time (JIT) VM access and network detections for Azure resources. Where should you enable Azure Defender?

    • Aat the subscription level
    • Bat the workspace level
    • Cat the resource level

    Show answer

    Correct answer: A

    How others answered

    • A100%

    Explanation

    "Enabling it at the workspace level doesn't enable just-in-time VM access, adaptive application controls, and network detections for Azure resources. In addition, the only Microsoft Defender plans available at the workspace level are Microsoft Defender for servers and Microsoft Defender for SQL servers on machines." Reference: https://docs.microsoft.com/en-us/azure/defender-for-cloud/enable-enhanced-security

    Adapted from community discussion by Daniel9527 · 2022-01-15 · 14 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    Supporting references

    • Microsoft Learn
    • Microsoft Learn
    • Microsoft Learn
    • Microsoft Learn
    • Microsoft Learn

    View community discussion4

    Candidate context

    Question 11 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by SC-200 or CertExamHQ.

    1. D

       Daniel9527

       2022-01-15

       14 upvotes

       "Enabling it at the workspace level doesn't enable just-in-time VM access, adaptive application controls, and network detections for Azure resources. In addition, the only Microsoft Defender plans available at the workspace level are Microsoft Defender for servers and Microsoft Defender for SQL servers on machines." Reference: https://docs.microsoft.com/en-us/azure/defender-for-cloud/enable-enhanced-security

    2. M

       Malik2165

       2021-12-10

       6 upvotes

       you can do it two ways - at Subscription Level - at Resource Level

    3. A

       Adom3730

       2023-05-18

       Selected A3 upvotes

       Just-in-time virtual machine access locks down machine ports to reduce the attack surface. To use this feature, Defender for Cloud must be enabled on the subscription. https://learn.microsoft.com/en-us/azure/defender-for-cloud/plan-defender-for-servers-select-plan#plan-features:~:text=Just%2Din%2Dtime%20virtual%20machine%20access%20locks%20down%20machine%20ports%20to%20reduce%20the%20attack%20surface.%20To%20use%20this%20feature%2C%20Defender%20for%20Cloud%20must%20be%20enabled%20on%20the%20subscription.

    4. M

       MS_KoolaidMan

       2023-12-23

       Selected A3 upvotes

       It must be enabled at the Subscription level before it can be enabled at the resource level. Tested in the "Secure Azure services and workloads with Microsoft Defender for Cloud regulatory compliance controls" Applied Skills Assessment https://learn.microsoft.com/en-us/credentials/applied-skills/secure-azure-services-and-workloads-with-microsoft-defender-for-cloud-regulatory-compliance-controls/

12. Question 12 of 25

    You have a suppression rule in Azure Security Center for 10 virtual machines that are used for testing. The virtual machines run Windows Server. You are troubleshooting an issue on the virtual machines. In Security Center, you need to view the alerts generated by the virtual machines during the last five days. What should you do?

    • AChange the rule expiration date of the suppression rule.
    • BChange the state of the suppression rule to Disabled.
    • CModify the filter for the Security alerts page.
    • DView the Windows event logs on the virtual machines.

    Show answer

    Correct answer: C

    How others answered

    • C80%
    • B20%

    Explanation

    I think this is incorrect and the answer should be C - Modify the filter for the Security alerts page. Answer B would prevent future alerts from being supressed but the question is asking to view alerts created in the last 5 days - these would have been dismissed by the supression rule and to view them you need to alter the filter to display dismissed alerts. Ref: https://docs.microsoft.com/en-us/azure/security-center/alerts-suppression-rules#what-are-suppression-rules

    Adapted from community discussion by PJR · 2021-10-11 · 58 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    Supporting references

    • Microsoft Learn
    • Microsoft Learn
    • Microsoft Learn
    • Microsoft Learn

    View community discussion4

    Candidate context

    Question 12 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by SC-200 or CertExamHQ.

    1. P

       PJR

       2021-10-11

       58 upvotes

       I think this is incorrect and the answer should be C - Modify the filter for the Security alerts page. Answer B would prevent future alerts from being supressed but the question is asking to view alerts created in the last 5 days - these would have been dismissed by the supression rule and to view them you need to alter the filter to display dismissed alerts. Ref: https://docs.microsoft.com/en-us/azure/security-center/alerts-suppression-rules#what-are-suppression-rules

    2. M

       mali1969

       2023-09-05

       3 upvotes

       the correct answer is C. Modify the filter for the Security alerts page. The other options are not correct because: A. Change the rule expiration date of the suppression rule: This option will not help you view the alerts generated by the suppressed resources, but only change the duration of the suppression rule B. Change the state of the suppression rule to Disabled: This option will not help you view the alerts generated by the suppressed resources, but only disable the suppression rule and allow new alerts to be generated D. View the Windows event logs on the virtual machines: This option will not help you view the alerts generated by Security Center, but only show you the Windows event logs on the virtual machines, which may not contain all the relevant information

    3. M

       Metasploit

       2022-10-24

       Selected C4 upvotes

       C: Modify the filter. You goto the Azure Security Alerts: https://portal.azure.com/#view/Microsoft_Azure_Security_AzureDefenderForData/AlertsGridBlade There is a default filter: Status == Active, In Progress Click on it to modify the Values. You can now select Dismissed and Resolved.

    4. J

       jaikah

       2022-01-20

       4 upvotes

       According to your link, the answer should be C: "Suppressed alerts will be hidden in Azure Security Center, Azure Sentinel and third-party SIEM solutions, but will still be reachable if needed later on with dismissed state." So you have to modify the filter to display dismissed alerts and not the "Active" one.

13. Question 13 of 25

    You create an Azure subscription. You enable Azure Defender for the subscription. You need to use Azure Defender to protect on-premises computers. What should you do on the on-premises computers?

    • AInstall the Log Analytics agent.
    • BInstall the Dependency agent.
    • CConfigure the Hybrid Runbook Worker role.
    • DInstall the Connected Machine agent.

    Show answer

    Correct answer: A

    How others answered

    • A67%
    • D33%

    Only 67% agreed on this answer — treat it as contested rather than settled.

    Explanation

    I would say install connected machine agent (use Azure Arc) to mimic on prem server as azure resource and enable for it Microsoft defender for Cloud. It will use log analitics agent to parse logs but log analitics agent itself will not connect on prem server to Defender. https://docs.microsoft.com/en-us/azure/defender-for-cloud/quickstart-onboard-machines?pivots=azure-arc

    Adapted from community discussion by rabusiak · 2021-12-22 · 9 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    Supporting references

    • Microsoft Learn
    • Microsoft Learn
    • Microsoft Learn
    • Microsoft Learn
    • Microsoft Learn

    View community discussion4

    Candidate context

    Question 13 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by SC-200 or CertExamHQ.

    1. C

       CertKid

       2022-01-27

       10 upvotes

       A machine with Azure Arc-enabled servers becomes an Azure resource and - when you've installed the Log Analytics agent on it - appears in Defender for Cloud with recommendations like your other Azure resources. From your source. It's Log Analytics Agent.

    2. R

       rabusiak

       2021-12-22

       9 upvotes

       I would say install connected machine agent (use Azure Arc) to mimic on prem server as azure resource and enable for it Microsoft defender for Cloud. It will use log analitics agent to parse logs but log analitics agent itself will not connect on prem server to Defender. https://docs.microsoft.com/en-us/azure/defender-for-cloud/quickstart-onboard-machines?pivots=azure-arc

    3. L

       Lone__Wolf

       2023-02-14

       6 upvotes

       If am not wrong the Connected Machine agent is used to protect servers, not workstations. So, in the case of on-premises workstations, you would install the Log Analytics agent, not the Connected Machine agent.

    4. S

       slurppp

       2023-10-08

       5 upvotes

       Think many of these questions are now out of date. Log Analytics Agent is now legacy and is replaced as "Azure Monitor Agent (AMA)" - Examptopics needs to update this whole course I think. Too many things have changed names now so I would expect the exam questions to be different or updated.

14. Question 14 of 25

    Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution. After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen. You have Linux virtual machines on Amazon Web Services (AWS). You deploy Azure Defender and enable auto-provisioning. You need to monitor the virtual machines by using Azure Defender. Solution: You enable Azure Arc and onboard the virtual machines to Azure Arc. Does this meet the goal?

    • AYes
    • BNo

    Show answer

    Correct answer: A

    How others answered

    • A57%
    • B43%

    Only 57% agreed on this answer — treat it as contested rather than settled.

    Explanation

    You need both Azure Arc to see the VM and the LAW agent. Now, the agent can be automatically deployed after Azure Arc is deployed. Answer should be A) Yes.

    Adapted from community discussion by Tanasi · 2023-03-19 · 8 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    Supporting references

    • Microsoft Learn
    • Microsoft Learn
    • Microsoft Learn
    • Microsoft Learn
    • Microsoft Learn

    View community discussion4

    Candidate context

    Question 14 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by SC-200 or CertExamHQ.

    1. O

       Osamat98

       2022-10-24

       22 upvotes

       Should Be Yes A https://docs.microsoft.com/en-us/azure/defender-for-cloud/quickstart-onboard-machines?pivots=azure-arc

    2. T

       Tanasi

       2023-03-19

       Selected A8 upvotes

       You need both Azure Arc to see the VM and the LAW agent. Now, the agent can be automatically deployed after Azure Arc is deployed. Answer should be A) Yes.

    3. R

       Ramye

       2024-08-07

       7 upvotes

       No - because this Linux machine is a non-Azure machine as it is on AWS. you do need Azure Arc to get it onboarded to MS Defender for Cloud

    4. Z

       Zzziambored

       2023-12-17

       5 upvotes

       No it does not: No, enabling Azure Arc and onboarding the Linux virtual machines to Azure Arc does not meet the goal of monitoring the virtual machines using Azure Defender. Azure Arc is a service that extends Azure management capabilities to resources outside of Azure, including on-premises and multi-cloud environments. It allows you to manage and govern these resources using Azure tools and services. However, Azure Arc itself does not provide the security monitoring and threat detection capabilities offered by Azure Defender.

15. Question 15 of 25

    Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution. After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen. You have Linux virtual machines on Amazon Web Services (AWS). You deploy Azure Defender and enable auto-provisioning. You need to monitor the virtual machines by using Azure Defender. Solution: You manually install the Log Analytics agent on the virtual machines. Does this meet the goal?

    • AYes
    • BNo

    Show answer

    Correct answer: B

    How others answered

    • B89%

    Explanation

    It's B because it doesn't mention Azure Arc, it just says Log analytics agent (which by the way is going to be deprecated and replaced by Azure monitor agent) https://docs.microsoft.com/en-us/azure/azure-monitor/agents/azure-monitor-agent-overview?tabs=PowerShellWindows

    Adapted from community discussion by Drui · 2022-05-26 · 12 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    Supporting references

    • Microsoft Learn
    • Microsoft Learn
    • Microsoft Learn
    • Microsoft Learn
    • Microsoft Learn

    View community discussion4

    Candidate context

    Question 15 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by SC-200 or CertExamHQ.

    1. D

       Drui

       2022-05-26

       12 upvotes

       It's B because it doesn't mention Azure Arc, it just says Log analytics agent (which by the way is going to be deprecated and replaced by Azure monitor agent) https://docs.microsoft.com/en-us/azure/azure-monitor/agents/azure-monitor-agent-overview?tabs=PowerShellWindows

    2. E

       ejml

       2022-05-09

       11 upvotes

       Wrong answer. it should be A. A machine with Azure Arc-enabled servers becomes an Azure resource and - when you've installed the Log Analytics agent on it - appears in Defender for Cloud with recommendations like your other Azure resources.

    3. N

       Nailik_Ms

       2023-02-02

       Selected B9 upvotes

       The question has few traps. 1. You have Linux machines on AWS. (don't specify if already onboarded) 2. You deploy a solution (Azure defender and enable auto provisioning) This doesn't mean any interaction with the previous Linux Machines. HERE: YOU NEED TO MONITOR THOSE VM WITH AZURE DEFENDER. meaning first we need to do the first step to monitor them, and that first step is not install the Log analytics agent. First we should enable Azure Arc on them. So I think answer is no B

    4. M

       Marchiano

       2023-07-25

       3 upvotes

       Guys, I am now on MS Defender for Cloud (Getting started) and there is one option here called "Add non-Azure servers" with the following description: "Use the Log Analytics agent to extend Microsoft Defender for Cloud capabilities to servers running outside of Azure, including resources running on-premises and in other clouds." What are some of the MS Defender for Cloud extended capabilities? 1. Secure cloud application 2. Improve your security posture 3. Protect cloud workloads Please check also what the Log Analytics agent/extension is capable of, search on the web. "Azure Monitor Logs provides monitoring, alerting, and alert remediation capabilities across cloud and on-premises assets. [..] The extension installs the Log Analytics agent on Azure virtual machines, and enrolls virtual machines into an existing Log Analytics workspace." So even if it will be deprecated at some point in 2024, it is still a valid solution in the present.

16. Question 16 of 25

    You have five on-premises Linux servers. You have an Azure subscription that uses Microsoft Defender for Cloud. You need to use Defender for Cloud to protect the Linux servers. What should you install on the servers first?

    • Athe Dependency agent
    • Bthe Log Analytics agent
    • Cthe Azure Connected Machine agent
    • Dthe Guest Configuration extension

    Show answer

    Correct answer: C

    How others answered

    • C70%
    • B30%

    Only 70% agreed on this answer — treat it as contested rather than settled.

    Explanation

    The Azure Connected Machine agent is required to connect the on-premises Linux servers to the Azure subscription and integrate them with Microsoft Defender for Cloud. The agent enables communication between the servers and the Defender for Cloud service, allowing security events and data to be collected and analyzed. Once the Azure Connected Machine agent is installed, you can then install the Log Analytics agent to collect security data from the servers and send it to the Log Analytics workspace in Azure. This will allow you to use Defender for Cloud to monitor the security of your Linux servers, identify threats, and respond to security incidents.

    Adapted from community discussion by Lone__Wolf · 2023-02-14 · 23 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    Supporting references

    • Microsoft Learn
    • Microsoft Learn
    • Microsoft Learn
    • Microsoft Learn
    • Microsoft Learn

    View community discussion4

    Candidate context

    Question 16 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by SC-200 or CertExamHQ.

    1. L

       Lone__Wolf

       2023-02-14

       Selected C23 upvotes

       The Azure Connected Machine agent is required to connect the on-premises Linux servers to the Azure subscription and integrate them with Microsoft Defender for Cloud. The agent enables communication between the servers and the Defender for Cloud service, allowing security events and data to be collected and analyzed. Once the Azure Connected Machine agent is installed, you can then install the Log Analytics agent to collect security data from the servers and send it to the Log Analytics workspace in Azure. This will allow you to use Defender for Cloud to monitor the security of your Linux servers, identify threats, and respond to security incidents.

    2. M

       mfalkjunk

       2023-05-02

       Selected C11 upvotes

       I will go with C first, then LA-Agent: https://learn.microsoft.com/en-us/azure/defender-for-cloud/plan-defender-for-servers-agents

    3. H

       herta

       2023-01-16

       Selected C4 upvotes

       should be C A machine with Azure Arc-enabled servers becomes an Azure resource and - when you've installed the Log Analytics agent on it - appears in Defender for Cloud with recommendations like your other Azure resources https://learn.microsoft.com/en-us/azure/defender-for-cloud/quickstart-onboard-machines?pivots=azure-arc

    4. K

       KRAKE3N

       2024-04-17

       Selected C2 upvotes

       https://learn.microsoft.com/en-us/azure/azure-arc/servers/agent-overview The Azure Connected Machine agent enables you to manage your Windows and Linux machines hosted outside of Azure on your corporate network or other cloud providers. *Note The Azure Monitor agent (AMA) is a separate agent that collects monitoring data, and it does not replace the Connected Machine agent; the AMA only replaces the Log Analytics agent, Diagnostics extension, and Telegraf agent for both Windows and Linux machines.

17. Question 17 of 25

    You have an Azure subscription that uses Microsoft Defender for Cloud and contains a storage account named storage1. You receive an alert that there was an unusually high volume of delete operations on the blobs in storage1. You need to identify which blobs were deleted. What should you review?

    • Athe activity logs of storage1
    • Bthe Azure Storage Analytics logs
    • Cthe alert details
    • Dthe related entities of the alert

    Show answer

    Correct answer: B

    How others answered

    • B48%
    • D30%
    • A15%

    Only 48% agreed on this answer — treat it as contested rather than settled.

    Explanation

    Seems like the answer is actually correct. "Azure Storage Analytics performs logging and provides metrics data for a storage account. You can use this data to trace requests, analyze usage trends, and diagnose issues with your storage account."

    Adapted from community discussion by RodrigoLima · 2023-01-25 · 13 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    Supporting references

    • Microsoft Learn
    • Microsoft Learn
    • Microsoft Learn
    • Microsoft Learn

    View community discussion4

    Candidate context

    Question 17 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by SC-200 or CertExamHQ.

    1. R

       RodrigoLima

       2023-01-25

       Selected B13 upvotes

       Seems like the answer is actually correct. "Azure Storage Analytics performs logging and provides metrics data for a storage account. You can use this data to trace requests, analyze usage trends, and diagnose issues with your storage account."

    2. A

       ACSC

       2023-01-22

       8 upvotes

       Activity logs contains events regarding to the storage account, not to the blobs.

    3. H

       Holii

       2023-04-17

       5 upvotes

       Security alert -> View Full Details -> Alert details does NOT contain a list of affected blob resources. In order to see affected blob containers affected by a deletion event, the answer would be D Expand the Related Entities -> Blob container -> Provides a list of all blob entities affected by the alert. Since this is specifically talking about an alert, and the entities affected by the deletion of the alert, I think it would honestly be best to do it from inside the 'Related Entities -> blob containers' page rather than generating a view of deleted blob incidents. You don't know whether a blob container was deleted that was not part of that alert if you're searching the analytics logs or storage account logs. For the fact that it is specifically targeting blobs touching this alert, im choosing D.

    4. A

       ACSC

       2023-01-22

       Selected B5 upvotes

       Answer is correct. https://learn.microsoft.com/en-us/rest/api/storageservices/storage-analytics-logged-operations-and-status-messages#logged-operations

18. Question 18 of 25

    You have an Azure subscription that contains a user named User1. User1 is assigned an Azure Active Directory Premium Plan 2 license. You need to identify whether the identity of User1 was compromised during the last 90 days. What should you use?

    • Athe risk detections report
    • Bthe risky users report
    • CIdentity Secure Score recommendations
    • Dthe risky sign-ins report

    Show answer

    Correct answer: B

    How others answered

    • B57%
    • A37%

    Only 57% agreed on this answer — treat it as contested rather than settled.

    Explanation

    On the Risky Users page you will have to select an account and then select the Risk History tab. This will show you if the entity was compromised or not for the past 90 days. https://learn.microsoft.com/en-us/azure/active-directory/identity-protection/howto-identity-protection-investigate-risk#risky-users This question very confusing...Risky Users and Risk Detections are the only ones that provide data for the past 90 days, but both provide info about the Risk State....like Confirmed Compromised...

    Adapted from community discussion by Marchiano · 2023-07-12 · 20 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    Supporting references

    • Microsoft Learn
    • Microsoft Learn
    • Microsoft Learn
    • Microsoft Learn

    View community discussion4

    Candidate context

    Question 18 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by SC-200 or CertExamHQ.

    1. M

       Marchiano

       2023-07-12

       Selected B20 upvotes

       On the Risky Users page you will have to select an account and then select the Risk History tab. This will show you if the entity was compromised or not for the past 90 days. https://learn.microsoft.com/en-us/azure/active-directory/identity-protection/howto-identity-protection-investigate-risk#risky-users This question very confusing...Risky Users and Risk Detections are the only ones that provide data for the past 90 days, but both provide info about the Risk State....like Confirmed Compromised...

    2. D

       donathon

       2023-08-28

       Selected B4 upvotes

       My thoughts are it should be risky users. The question did not state that the user attempted any sign-ins. If the user did not sign-in at all then it would not appear under risk detections and risky sign-ins. Risky users instead will flag any users who's password are compromised regardless whether there are any sign-ins or not.

    3. J

       jwkin

       2023-02-23

       Selected B4 upvotes

       The risky user report also gives you all the risky sign-ins for that user. Also Risky Sign-ins report only does 30 days and they are wanting 90 days. https://learn.microsoft.com/en-us/azure/active-directory/identity-protection/howto-identity-protection-investigate-risk#risky-users

    4. S

       Studytime2023

       2024-08-11

       Selected B4 upvotes

       Just tested this with the tenant of the MSP I work for. It shows risky user accounts right back to a couple of years ago. I went to portal.azure.com Then "Entra ID" Then "Security" Then "Identity protection" Then I see "Report" and under that I see "Risky users".

19. Question 19 of 25

    You have an Azure subscription that uses Microsoft Defender for Cloud. You have an Amazon Web Services (AWS) account that contains an Amazon Elastic Compute Cloud (EC2) instance named EC2-1. You need to onboard EC2-1 to Defender for Cloud. What should you install on EC2-1?

    • Athe Log Analytics agent
    • Bthe Azure Connected Machine agent
    • Cthe unified Microsoft Defender for Endpoint solution package
    • DMicrosoft Monitoring Agent

    Show answer

    Correct answer: B

    How others answered

    • B81%
    • A19%

    Explanation

    To onboard an Amazon Elastic Compute Cloud (EC2) instance to Microsoft Defender for Cloud, you should install the Azure Connected Machine agent on the instance. Therefore, the correct answer is B.

    Adapted from community discussion by [Removed] · 2023-02-21 · 11 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    Supporting references

    • Microsoft Learn
    • Microsoft Learn
    • Microsoft Learn
    • Microsoft Learn
    • Microsoft Learn

    View community discussion4

    Candidate context

    Question 19 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by SC-200 or CertExamHQ.

    1. [

       [Removed]

       2023-02-21

       Selected B11 upvotes

       To onboard an Amazon Elastic Compute Cloud (EC2) instance to Microsoft Defender for Cloud, you should install the Azure Connected Machine agent on the instance. Therefore, the correct answer is B.

    2. T

       teouba

       2023-04-13

       Selected B4 upvotes

       Answer is B Please check the video below at 04:15 As you can see, server is already onboarded using Azure Arc agent and there is a recommendation to also install Log Analytics agent. So FIRST you need to install Arc agent https://www.youtube.com/watch?v=uogTZe6p7nc

    3. E

       EM1234

       2023-07-19

       Selected B3 upvotes

       You're going to need defender for servers which needs ARC. So choice B makes the most sense. Also A and D are the same thing, and yes they are "legacy". The log analytics agent has been called OMS (the code came from it) and also the Microsoft Monitoring agent. This is different than the Azure monitor agent, which has a whole new code base and features. Link for choosing B: https://learn.microsoft.com/en-us/azure/defender-for-cloud/quickstart-onboard-aws#defender-for-servers Hope this helps.

    4. M

       Marchiano

       2023-07-27

       Selected B3 upvotes

       A & D are the same thing, C is out of context, while Azure Connected Machine agent = Azure Arc "We recommend that you use the auto-provisioning process to install Azure Arc on all of your existing and future EC2 instances. To enable the Azure Arc auto-provisioning, you need Owner permission on the relevant Azure subscription." Source: https://learn.microsoft.com/en-us/azure/defender-for-cloud/quickstart-onboard-aws

20. Question 20 of 25

    Select 2

    You have an Azure subscription named Sub1 and a Microsoft 365 subscription. Sub1 is linked to an Azure Active Directory (Azure AD) tenant named contoso.com. You create an Azure Sentinel workspace named workspace1. In workspace1, you activate an Azure AD connector for contoso.com and an Office 365 connector for the Microsoft 365 subscription. You need to use the Fusion rule to detect multi-staged attacks that include suspicious sign-ins to contoso.com followed by anomalous Microsoft Office 365 activity. Which two actions should you perform? Each correct answer present part of the solution. NOTE: Each correct selection is worth one point.

    • ACreate custom rule based on the Office 365 connector templates.
    • BCreate a Microsoft incident creation rule based on Azure Security Center.
    • CCreate a Microsoft Cloud App Security connector.
    • DCreate an Azure AD Identity Protection connector.

    Show answer

    Correct answer: C, D

    How others answered

    • CD54%
    • AD42%

    Only 54% agreed on this answer — treat it as contested rather than settled.

    Explanation

    A. Create custom rule based on the Office 365 connector templates. no need to create a custom rule - Fusion rule - Advanced Multistage Attack Detection is not a part of office 365 connector templates, but uses it. B. Create a Microsoft incident creation rule based on Azure Security Center. not relevant C. Create a Microsoft Cloud App Security connector. currently we already have, AD, office 365 connectors, definitely might contribute (correlated searches) to monitor suspicious sign-in events form other clouds which use controso.com D. Create an Azure AD Identity Protection connector. this module has it's own user sign-in risk detection models, you definitely want to correlate with it's detections. https://learn.microsoft.com/en-us/azure/sentinel/configure-fusion-rules

    Adapted from community discussion by 7c0a · 2023-06-26 · 4 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    Supporting references

    • Microsoft Learn
    • Microsoft Learn
    • Microsoft Learn
    • Microsoft Learn
    • Microsoft Learn

    View community discussion4

    Candidate context

    Question 20 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by SC-200 or CertExamHQ.

    1. A

       arunkum

       2021-10-13

       27 upvotes

       Answer should be A & D Azure security center is not in the equation at all Any comments ?

    2. D

       Discuss4certi

       2021-10-15

       11 upvotes

       I follow A and D. ASC indeed shouldnt be in the equation when you are already using sentinel. D for the logon events and A for the o365 activity

    3. 7

       7c0a

       2023-06-26

       Selected C, D4 upvotes

       A. Create custom rule based on the Office 365 connector templates. no need to create a custom rule - Fusion rule - Advanced Multistage Attack Detection is not a part of office 365 connector templates, but uses it. B. Create a Microsoft incident creation rule based on Azure Security Center. not relevant C. Create a Microsoft Cloud App Security connector. currently we already have, AD, office 365 connectors, definitely might contribute (correlated searches) to monitor suspicious sign-in events form other clouds which use controso.com D. Create an Azure AD Identity Protection connector. this module has it's own user sign-in risk detection models, you definitely want to correlate with it's detections. https://learn.microsoft.com/en-us/azure/sentinel/configure-fusion-rules

    4. R

       RandomNickname

       2022-01-10

       Selected C, D5 upvotes

       Believe I00t, to be correct. It should be C&D. Use fusion rule to query data source. As per URL; https://techcommunity.microsoft.com/t5/microsoft-sentinel-blog/what-s-new-fusion-advanced-multistage-attack-detection-scenarios/ba-p/2337497 & https://docs.microsoft.com/en-us/azure/sentinel/fusion

21. Question 21 of 25

    You have an existing Azure logic app that is used to block Azure Active Directory (Azure AD) users. The logic app is triggered manually. You deploy Azure Sentinel. You need to use the existing logic app as a playbook in Azure Sentinel. What should you do first?

    • AAnd a new scheduled query rule.
    • BAdd a data connector to Azure Sentinel.
    • CConfigure a custom Threat Intelligence connector in Azure Sentinel.
    • DModify the trigger in the logic app.

    Show answer

    Correct answer: D

    How others answered

    • D60%
    • B40%

    Only 60% agreed on this answer — treat it as contested rather than settled.

    Explanation

    Some people are saying this is correct as a logic app connector, actually this is referring to that as you have literally just deployed Sentinel, you need to add the AAD Connector to get that in first before you do anything. Need the data there first.

    Adapted from community discussion by JhnCanthern12 · 2021-06-14 · 24 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    Supporting references

    • Microsoft Learn
    • Microsoft Learn
    • Microsoft Learn
    • Microsoft Learn
    • Microsoft Learn

    View community discussion4

    Candidate context

    Question 21 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by SC-200 or CertExamHQ.

    1. J

       JhnCanthern12

       2021-06-14

       24 upvotes

       Some people are saying this is correct as a logic app connector, actually this is referring to that as you have literally just deployed Sentinel, you need to add the AAD Connector to get that in first before you do anything. Need the data there first.

    2. T

       teehex

       2021-07-07

       12 upvotes

       No. There is nothing to do with AAD Connector. This is not about threat hunting against AAD. It is about how to integrate Azure Logic App to work with Azure Sentinel. You must modify existing Logic App and choose Azure Sentinel actions either the following ones: - When a response to an Azure Sentinel Alert is triggered - When Azure Sentinel incident creation rule was triggered

    3. M

       madhatter

       2021-06-25

       11 upvotes

       agreed, you are working with an already deployed logic app and you just created a NEW sentinel deployment. You need the AAD Connector to send the data first. Provided answer "B" is correct.

    4. C

       Check123Dumps

       2021-04-17

       11 upvotes

       The answer is A. Azure Sentinel -> Analytics -> Create -> Scheduled query rule -> Automated response

22. Question 22 of 25

    You have two Azure subscriptions that use Microsoft Defender for Cloud. You need to ensure that specific Defender for Cloud security alerts are suppressed at the root management group level. The solution must minimize administrative effort. What should you do in the Azure portal?

    • ACreate an Azure Policy assignment.
    • BModify the Workload protections settings in Defender for Cloud.
    • CCreate an alert rule in Azure Monitor.
    • DModify the alert settings in Defender for Cloud.

    Show answer

    Correct answer: A

    How others answered

    • A92%

    Explanation

    To minimize effort I would go with A, set it once, forget it and keep it enforced. A - Can set it at Management Group level B - Nothing to do alert suppression C - Generate an alert, will not suppress another D - You can suppress an alert, but not at Management Group or Subscription level Looking at the Policy Definitions: Suppress Azure Security Center alerts to reduce alerts fatigue by deploying suppression rules on your management group or subscription. https://learn.microsoft.com/en-us/azure/defender-for-cloud/policy-reference

    Adapted from community discussion by D_PaW · 2023-11-28 · 4 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    Supporting references

    • Microsoft Learn
    • Microsoft Learn
    • Microsoft Learn
    • Microsoft Learn
    • Microsoft Learn

    View community discussion4

    Candidate context

    Question 22 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by SC-200 or CertExamHQ.

    1. S

       siddique12345

       2023-03-13

       Selected A20 upvotes

       To suppress alerts at the management group level, use Azure Policy

    2. R

       RomanV

       2023-04-30

       Selected A9 upvotes

       "To suppress alerts at the management group level, use Azure Policy" https://learn.microsoft.com/en-us/azure/defender-for-cloud/alerts-suppression-rules#create-a-suppression-rule

    3. D

       D_PaW

       2023-11-28

       Selected A4 upvotes

       To minimize effort I would go with A, set it once, forget it and keep it enforced. A - Can set it at Management Group level B - Nothing to do alert suppression C - Generate an alert, will not suppress another D - You can suppress an alert, but not at Management Group or Subscription level Looking at the Policy Definitions: Suppress Azure Security Center alerts to reduce alerts fatigue by deploying suppression rules on your management group or subscription. https://learn.microsoft.com/en-us/azure/defender-for-cloud/policy-reference

    4. E

       eddz25

       2023-07-21

       Selected A3 upvotes

       A. Create an Azure Policy assignment. To suppress specific Defender for Cloud security alerts at the root management group level, you can create an Azure Policy assignment. This will allow you to apply a policy that will suppress the alerts across all subscriptions and management groups in the tenant. Azure Policy allows you to define and assign policies that govern your resources and enforce compliance. By creating an Azure Policy assignment, you can set up the suppression of alerts in one place, minimizing administrative effort.

23. Question 23 of 25

    You have an Azure subscription that has the enhanced security features in Microsoft Defender for Cloud enabled and contains a user named User1. You need to ensure that User1 can export alert data from Defender for Cloud. The solution must use the principle of least privilege. Which role should you assign to User1?

    • AUser Access Administrator
    • BOwner
    • CContributor
    • DReader

    Show answer

    Correct answer: D

    How others answered

    • D45%
    • B28%
    • C27%

    Only 45% agreed on this answer — treat it as contested rather than settled.

    Explanation

    The correct answer is D. Reader. The Reader role in Defender for Cloud allows users to view recommendations, alerts, a security policy, and security states, but cannot make changes. This is the least privileged role that allows User1 to export alert data from Defender for Cloud. The other options are incorrect. Option A: The User Access Administrator role allows users to manage user access to Defender for Cloud. It does not allow users to export alert data. Option B: The Owner role allows users to do everything that the Reader role allows, plus they can make changes to the security policy and recommendations. This is more privileged than necessary. Option C: The Contributor role allows users to do everything that the Reader role allows, plus they can apply recommendations and dismiss alerts. This is more privileged than necessary.

    Adapted from community discussion by BMG6 · 2023-09-04 · 14 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    Supporting references

    • Microsoft Learn
    • Microsoft Learn
    • Microsoft Learn
    • Microsoft Learn
    • Microsoft Learn

    View community discussion4

    Candidate context

    Question 23 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by SC-200 or CertExamHQ.

    1. B

       BMG6

       2023-09-04

       14 upvotes

       The correct answer is D. Reader. The Reader role in Defender for Cloud allows users to view recommendations, alerts, a security policy, and security states, but cannot make changes. This is the least privileged role that allows User1 to export alert data from Defender for Cloud. The other options are incorrect. Option A: The User Access Administrator role allows users to manage user access to Defender for Cloud. It does not allow users to export alert data. Option B: The Owner role allows users to do everything that the Reader role allows, plus they can make changes to the security policy and recommendations. This is more privileged than necessary. Option C: The Contributor role allows users to do everything that the Reader role allows, plus they can apply recommendations and dismiss alerts. This is more privileged than necessary.

    2. D

       danb67

       2023-10-23

       Selected D7 upvotes

       Why does everyone keep going on about Continous Export? It's not part of thE question. Continuous is about exportting security alerts and reccomendations to a Azure Log Analytics, Event Hubs, or to another SIEM, SOAR. All this question is asing is how does one download alert data from DFC. To do so open up DFC click security alerts and download CSV report. Can do this with reader access as many have pointed out.

    3. S

       smosmo

       2024-07-17

       Selected D5 upvotes

       Detailed Role Information for Reader The Reader role in Azure provides the following permissions: View all resources. Access and export alert data from Microsoft Defender for Cloud. Read-only access to monitoring data and other resource properties.

    4. I

       Ikazimirs

       2023-06-21

       5 upvotes

       well its ambiguous this time as a security reader can export alert data, only for continuous export you need owner\contributor role, but nowhere in the question continuous export is mentioned.

24. Question 24 of 25

    HOTSPOT - You have 100 Azure subscriptions that have enhanced security features in Microsoft Defender for Cloud enabled. All the subscriptions are inked to a single Azure Active Directory (Azure AD) tenant. You need to stream the Defender for Cloud logs to a syslog server. The solution must minimize administrative effort. What should you do? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point. Hot Area:

    

    This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

    Show the answer figure

    Answer

    Explanation

    1st Azure Event hub 2nd Azure Policy Both answers are in this link: https://learn.microsoft.com/en-us/azure/defender-for-cloud/export-to-siem#stream-alerts-with-continuous-export To stream alerts into //Syslog servers// ,and other monitoring solutions, connect Defender for Cloud using continuous export and Azure Event Hubs. Note: To stream alerts at the tenant level, use this //Azure policy// and set the scope at the root management group.

    Adapted from community discussion by Metasploit · 2022-10-28 · 11 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    Supporting references

    • Microsoft Learn
    • Microsoft Learn
    • Microsoft Learn
    • Microsoft Learn
    • Microsoft Learn

    Answer figure

    

    View community discussion4

    Candidate context

    Question 24 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by SC-200 or CertExamHQ.

    1. F

       fred99

       2022-09-06

       40 upvotes

       1 - Event Hub: https://docs.microsoft.com/en-us/azure/defender-for-cloud/export-to-siem#stream-alerts-with-continuous-export 2 - Azure Policy - https://docs.microsoft.com/en-us/azure/defender-for-cloud/continuous-export?tabs=azure-policy#configure-continuous-export-at-scale-using-the-supplied-policies

    2. M

       Metasploit

       2022-10-28

       11 upvotes

       1st Azure Event hub 2nd Azure Policy Both answers are in this link: https://learn.microsoft.com/en-us/azure/defender-for-cloud/export-to-siem#stream-alerts-with-continuous-export To stream alerts into //Syslog servers// ,and other monitoring solutions, connect Defender for Cloud using continuous export and Azure Event Hubs. Note: To stream alerts at the tenant level, use this //Azure policy// and set the scope at the root management group.

    3. S

       Subhakaran

       2023-02-13

       3 upvotes

       Between Log Analytics Workspace and Event Hubs, using Log Analytics Workspace requires less administrative effort. With Log Analytics Workspace, you can configure Defender for Cloud to stream logs to the workspace and then set up a Log Analytics action group to forward the logs to the syslog server. This can be done in the Azure portal, which provides a simple and intuitive interface for setting up log forwarding. In comparison, using Event Hubs requires you to set up and configure the Event Hubs Forwarder or an event hub consumer to stream the logs from the Event Hub to the syslog server. This may require additional setup and configuration, which can increase the administrative effort required to stream the Defender for Cloud logs to a syslog server. Therefore, if you want to minimize administrative effort, I would recommend using Log Analytics Workspace to stream the Defender for Cloud logs to a syslog server.

    4. R

       RafaAbel

       2022-09-02

       3 upvotes

       "Export logs to an" answer is wrong. The question says to export to a Syslog and Syslog is not used by Microsoft Sentinel since is already natively integrated, the answer should be Event Hub. https://docs.microsoft.com/en-us/azure/defender-for-cloud/export-to-siem

25. Question 25 of 25

    HOTSPOT - You have a Microsoft 365 E5 subscription that contains two users named User1 and User2. You have the hunting query shown in the following exhibit.

    

    The users perform the following actions: • User1 assigns User2 the Global administrator role. • User1 creates a new user named User3 and assigns the user a Microsoft Teams license. • User2 creates a new user named User4 and assigns the user the Security reader role. • User2 creates a new user named User5 and assigns the user the Security operator role. For each of the following statements, select Yes if the statement is true. Otherwise, select No. NOTE: Each correct selection is worth one point.

    

    This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

    Show the answer figure

    Answer

    Explanation

    First part of the query looks for Add user events in Auditlogs, second part of the query looks for "Create role assignment' events in Azureactivity and third part joins both searches so both parts need to match for the final search result. No - The query is intended to search for user creation events with role assignment, this does not match that. No - Matches first part of the query but not the second. User is assigned a Microsoft Teams license which is not a role. Yes - A new user is created and assigned the Security Operator role which matches both parts of the query.

    Adapted from community discussion by DChilds · 2024-04-16 · 4 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    Supporting references

    • Microsoft Learn
    • Microsoft Learn
    • Microsoft Learn
    • Microsoft Learn
    • Microsoft Learn

    Answer figure

    

    View community discussion4

    Candidate context

    Question 25 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by SC-200 or CertExamHQ.

    1. E

       estyj

       2024-01-03

       18 upvotes

       NNY Actions of User1 is project-away will be excluded from results. Only actions of user2 will be shown. https://learn.microsoft.com/en-us/azure/data-explorer/kusto/query/projectawayoperator

    2. D

       DChilds

       2024-04-16

       4 upvotes

       First part of the query looks for Add user events in Auditlogs, second part of the query looks for "Create role assignment' events in Azureactivity and third part joins both searches so both parts need to match for the final search result. No - The query is intended to search for user creation events with role assignment, this does not match that. No - Matches first part of the query but not the second. User is assigned a Microsoft Teams license which is not a role. Yes - A new user is created and assigned the Security Operator role which matches both parts of the query.

    3. D

       danb67

       2023-10-14

       4 upvotes

       It's N/N/N Why would user two be present in both tables? The 1st part of the query is looking for target resource. Therefore User5 would exist in the 1st table. The 2nd part of the query is looking for the caller (the person that did the assignment) and that would be user 2. So neither user 2 nor user 5 exists in both tables. Therefore using innerunnique would not produce a result as there needs to be a match in both tables. Tested in a lab also.

    4. D

       danb67

       2023-10-15

       3 upvotes

       In order for this to produce results then a user would have to appear in both tables as we are using innerunique(default join kind) Since the 1st part of the query is looking for target resource (the user that was created) and the 2nd part of the query is looking for caller (the user that did the action) Then the only time we would get a hit is if a user that had just been created then performed the add operation. Is this not what this query is looking for? To see if a new user account starts messing with roles/group membership? In this given example none of the newly created users then does and messes with group/roles so no hits here and I double down on N/N/N

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

SC-200 practice, question 1 of 25