SC-200 practice questions 1–10

1. Question 1 · 392 in bank

   DRAG DROP - You are investigating an incident by using Microsoft 365 Defender. You need to create an advanced hunting query to count failed sign-in authentications on three devices named CFOLaptop, CEOLaptop, and COOLaptop. How should you complete the query? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point. Select and Place:

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   DeviceLogonEvents | where DeviceName in ("CFOLaptop" , "CEOLaptop" ) and ActionType == "LogonFailed" | summarize LogonFailures=count() by DeviceName , LogonType This is the correct answer , I tested it .

   Source: Adapted from community discussion — DigitalNomad

   References

   • Microsoft Learn
   • Microsoft Learn

   

   Next question

2. Question 2 · 392 in bank

   Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution. After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen. You are configuring Microsoft Defender for Identity integration with Active Directory. From the Microsoft Defender for identity portal, you need to configure several accounts for attackers to exploit. Solution: From Entity tags, you add the accounts as Honeytoken accounts. Does this meet the goal?

   • AYes
   • BNo

   Show answer

   Answer: A

   References

   • Microsoft Learn

   Next question

3. Question 3 · 392 in bank

   Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution. After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen. You are configuring Microsoft Defender for Identity integration with Active Directory. From the Microsoft Defender for identity portal, you need to configure several accounts for attackers to exploit. Solution: From Azure AD Identity Protection, you configure the sign-in risk policy. Does this meet the goal?

   • AYes
   • BNo

   Show answer

   Answer: B

   Explanation

   Honeytoken entities are used as traps for malicious actors. Any authentication associated with these honeytoken entities triggers an alert. Settings>Identities>Entity tags>Honey Token> Add Users or Devices

   Source: Adapted from community discussion — Metasploit

   Next question

4. Question 4 · 392 in bank

   Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution. After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen. You are configuring Microsoft Defender for Identity integration with Active Directory. From the Microsoft Defender for identity portal, you need to configure several accounts for attackers to exploit. Solution: You add the accounts to an Active Directory group and add the group as a Sensitive group. Does this meet the goal?

   • AYes
   • BNo

   Show answer

   Answer: B

   Explanation

   This is what honeytoken accounts are meant for (i.e. dormant accounts that generate alerts if accessed). Sensitivity tags are meant for active users and groups.

   Source: Adapted from community discussion — stromnessian

   References

   • Microsoft Learn

   Next question

5. Question 5 · 392 in bank

   You implement Safe Attachments policies in Microsoft Defender for Office 365. Users report that email messages containing attachments take longer than expected to be received. You need to reduce the amount of time it takes to deliver messages that contain attachments without compromising security. The attachments must be scanned for malware, and any messages that contain malware must be blocked. What should you configure in the Safe Attachments policies?

   • ADynamic Delivery
   • BReplace
   • CBlock and Enable redirect
   • DMonitor and Enable redirect

   Show answer

   Answer: A

   Explanation

   Correct Dynamic Delivery Delivers messages immediately, but replaces attachments with placeholders until Safe Attachments scanning is complete. For details, see the Dynamic Delivery in Safe Attachments policies section later in this article. Avoid message delays while protecting recipients from malicious files. Enable recipients to preview attachments in safe mode while scanning is taking place.

   Source: Adapted from community discussion — jasonfmj

   References

   • Microsoft Learn
   • Microsoft Learn

   Next question

6. Question 6 · 392 in bank

   HOTSPOT - You are informed of an increase in malicious email being received by users. You need to create an advanced hunting query in Microsoft 365 Defender to identify whether the accounts of the email recipients were compromised. The query must return the most recent 20 sign-ins performed by the recipients within an hour of receiving the known malicious email. How should you complete the query? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point. Hot Area:

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   Reference: https://docs.microsoft.com/en-us/microsoft-365/security/defender/advanced-hunting-query-emails-devices?view=o365-worldwide

   Source: Adapted from community discussion — pedromonteirozikado

   References

   • Microsoft Learn
   • Microsoft Learn

   

   Next question

7. Question 7 · 392 in bank

   You receive a security bulletin about a potential attack that uses an image file. You need to create an indicator of compromise (IoC) in Microsoft Defender for Endpoint to prevent the attack. Which indicator type should you use?

   • Aa URL/domain indicator that has Action set to Alert only
   • Ba URL/domain indicator that has Action set to Alert and block
   • Ca file hash indicator that has Action set to Alert and block
   • Da certificate indicator that has Action set to Alert and block

   Show answer

   Answer: C

   Explanation

   The correct answer it seems like, as steps for to Create an indicator for files from the settings page 1. In the navigation pane, select Settings > Endpoints > Indicators (under Rules). 2. Select the File hashes tab. 3. Select Add indicator. 4. Specify the following details: 5. Indicator - Specify the entity details and define the expiration of the indicator. * Action - Specify the action to be taken and provide a description. * Scope - Define the scope of the device group. * Review the details in the Summary tab, then select Save.

   Source: Adapted from community discussion — HSBNZ

   Next question

8. Question 8 · 392 in bank

   Select 2

   Your company deploys the following services: ✑ Microsoft Defender for Identity ✑ Microsoft Defender for Endpoint ✑ Microsoft Defender for Office 365 You need to provide a security analyst with the ability to use the Microsoft 365 security center. The analyst must be able to approve and reject pending actions generated by Microsoft Defender for Endpoint. The solution must use the principle of least privilege. Which two roles should assign to the analyst? Each correct answer presents part of the solution. NOTE: Each correct selection is worth one point.

   • Athe Compliance Data Administrator in Azure Active Directory (Azure AD)
   • Bthe Active remediation actions role in Microsoft Defender for Endpoint
   • Cthe Security Administrator role in Azure Active Directory (Azure AD)
   • Dthe Security Reader role in Azure Active Directory (Azure AD)

   Show answer

   Answer: BD

   Explanation

   Provided answer B and D is correct. Security Reader - can access M365 Security Center. Active Remediation Actions role in Defender for Endpoint meets need to 'approve and reject' pending actions with respect to Defender For Endpoint. Requirement does not need more.

   Source: Adapted from community discussion — PhilAus

   References

   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn

   Next question

9. Question 9 · 392 in bank

   HOTSPOT - You have a Microsoft 365 E5 subscription that uses Microsoft Defender and an Azure subscription that uses Azure Sentinel. You need to identify all the devices that contain files in emails sent by a known malicious email sender. The query will be based on the match of the SHA256 hash. How should you complete the query? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point. Hot Area:

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   Reference: https://docs.microsoft.com/en-us/microsoft-365/security/defender/advanced-hunting-query-emails-devices?view=o365-worldwide

   Source: Adapted from community discussion — HSBNZ

   References

   • Microsoft Learn

   

   Next question

10. Question 10 · 392 in bank

    Select 2

    You need to configure Microsoft Cloud App Security to generate alerts and trigger remediation actions in response to external sharing of confidential files. Which two actions should you perform in the Cloud App Security portal? Each correct answer presents part of the solution. NOTE: Each correct selection is worth one point.

    • AFrom Settings, select Information Protection, select Azure Information Protection, and then select Only scan files for Azure Information Protection classification labels and content inspection warnings from this tenant.
    • BSelect Investigate files, and then filter App to Office 365.
    • CSelect Investigate files, and then select New policy from search.
    • DFrom Settings, select Information Protection, select Azure Information Protection, and then select Automatically scan new files for Azure Information Protection classification labels and content inspection warnings.
    • EFrom Settings, select Information Protection, select Files, and then enable file monitoring.
    • FSelect Investigate files, and then filter File Type to Document.

    Show answer

    Answer: DE

    Explanation

    D. From Settings, select Information Protection, select Azure Information Protection, and then select Automatically scan new files for Azure Information Protection classification labels and content inspection warnings. This will enable Cloud App Security to automatically scan new files for Azure Information Protection classification labels and content inspection warnings, which can be used to detect and protect confidential files. E. From Settings, select Information Protection, select Files, and then enable file monitoring. This will enable Cloud App Security to monitor files for external sharing and other activities, and to generate alerts and trigger remediation actions in response to potential threats or policy violations.

    Source: Adapted from community discussion — jrjrjrchlv

    References

    • Microsoft Learn
    • Microsoft Learn
    • Microsoft Learn
    • Microsoft Learn

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

SC-200 practice, question 1. 392 questions available.