SC-200 practice questions 91–100

1. Question 91 · 392 in bank

   HOTSPOT - You have a Microsoft 365 E5 subscription. You plan to perform cross-domain investigations by using Microsoft 365 Defender. You need to create an advanced hunting query to identify devices affected by a malicious email attachment. How should you complete the query? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point. Hot Area:

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   Reference: https://docs.microsoft.com/en-us/microsoft-365/security/mtp/advanced-hunting-query-emails-devices?view=o365-worldwide

   Source: Adapted from community discussion — teehex

   References

   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn

   

   Next question

2. Question 92 · 392 in bank

   Select 2

   You have the following advanced hunting query in Microsoft 365 Defender.

   

   You need to receive an alert when any process disables System Restore on a device managed by Microsoft Defender during the last 24 hours. Which two actions should you perform? Each correct answer presents part of the solution. NOTE: Each correct selection is worth one point.

   • ACreate a detection rule.
   • BCreate a suppression rule.
   • CAdd | order by Timestamp to the query.
   • DReplace DeviceProcessEvents with DeviceNetworkEvents.
   • EAdd DeviceId and ReportId to the output of the query.

   Show answer

   Answer: AE

   Explanation

   Correct query is DeviceProcessEvents | where Timestamp > ago (24h) //Pivoting for rundll32 | where InitiatingProcessFileName =~ 'rundll32.exe' //Looking for empty command line and InitiatingProcessCommandLine !contains " " and InitiatingProcessCommandLine != "" //Looking for schtasks.exe as the created process and FileName in~ ('schtasks.exe') //Disabling system restore and ProcessCommandLine has 'Change' and ProcessCommandLine has 'SystemRestore' and ProcessCommandLine has 'disable' | project Timestamp, AccountName, ProcessCommandLine, DeviceId, ReportId Given answer is correct. - Create detection rule - Add ReportId and DeviceId to the output. Both fields are supported in DeviceProcessEvents table.(https://docs.microsoft.com/en-us/microsoft-365/security/defender/advanced-hunting-deviceprocessevents-table?view=o365-worldwide) The sample query can be found here https://docs.microsoft.com/en-us/microsoft-365/security/defender/advanced-hunting-find-ransomware?view=o365-worldwide#turning-off-system-restore

   Source: Adapted from community discussion — teehex

   References

   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn

   Next question

3. Question 93 · 392 in bank

   Select 3

   You are investigating a potential attack that deploys a new ransomware strain. You have three custom device groups. The groups contain devices that store highly sensitive information. You plan to perform automated actions on all devices. You need to be able to temporarily group the machines to perform actions on the devices. Which three actions should you perform? Each correct answer presents part of the solution. NOTE: Each correct selection is worth one point.

   • AAssign a tag to the device group.
   • BAdd the device users to the admin role.
   • CAdd a tag to the machines.
   • DCreate a new device group that has a rank of 1.
   • ECreate a new admin role.
   • FCreate a new device group that has a rank of 4.

   Show answer

   Answer: ACD

   Explanation

   Setting the scene: There are 3 device groups. You want to take action on all devices. Meaning you want 1(One) Device group with all devices. --> A: So you create this custom group(AllDeviceTempGroup) and add a Tag filter(RansomIRTag) to group devices into this device group. You see that there are no devices in this group. Why? You have not tagged your devices yet. --> B: You add the tag, RansomIRTag, to all devices. You notice that your devices have not populated your new device group, AllDeviceTempGroup. Why? In the details of the question, you are informed that these devices already have a group. Which means if your group is not promoted to highest rank, then the devices will choose their original group instead. -->C: Promote AllDeviceTempGroup to highest rank.

   Source: Adapted from community discussion — Metasploit

   References

   • Microsoft Learn

   Next question

4. Question 94 · 392 in bank

   Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution. After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen. You use Azure Security Center. You receive a security alert in Security Center. You need to view recommendations to resolve the alert in Security Center. Solution: From Security alerts, you select the alert, select Take Action, and then expand the Prevent future attacks section. Does this meet the goal?

   • AYes
   • BNo

   Show answer

   Answer: B

   Explanation

   Answer is (B) No, because the question is asking for recommendations on the current alert that you are viewing(Mitigate the threat) and not on security recommendations in general(Prevent Future attacks) for the device associated with the alert.. https://learn.microsoft.com/en-us/azure/defender-for-cloud/managing-and-responding-alerts#respond-to-security-alerts (Mitigate the threat) - provides manual remediation steps for this security alert (Provides recommendations on what to do to resolve the alert) (Prevent future attacks) - provides security recommendations to help reduce the attack surface, increase security posture, and thus prevent future attacks.(Provides recommendations for security in general such as Remediate Vulnerabilities and win defender should be activated on all devices)

   Source: Adapted from community discussion — Metasploit

   References

   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn

   Next question

5. Question 95 · 392 in bank

   Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution. After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen. You use Azure Security Center. You receive a security alert in Security Center. You need to view recommendations to resolve the alert in Security Center. Solution: From Regulatory compliance, you download the report. Does this meet the goal?

   • AYes
   • BNo

   Show answer

   Answer: B

   Explanation

   The correction option would be to choose "mitigate the threat" as the recommendations from this tab resolves the alert, whereas the other "Prevent.." Just provides recommendations in general.

   Source: Adapted from community discussion — Metasploit

   Next question

6. Question 96 · 392 in bank

   Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution. After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen. You use Azure Security Center. You receive a security alert in Security Center. You need to view recommendations to resolve the alert in Security Center. Solution: From Security alerts, you select the alert, select Take Action, and then expand the Mitigate the threat section. Does this meet the goal?

   • AYes
   • BNo

   Show answer

   Answer: A

   References

   • Microsoft Learn

   Next question

7. Question 97 · 392 in bank

   You have an Azure subscription that has Azure Defender enabled for all supported resource types. You need to configure the continuous export of high-severity alerts to enable their retrieval from a third-party security information and event management (SIEM) solution. To which service should you export the alerts?

   • AAzure Cosmos DB
   • BAzure Event Grid
   • CAzure Event Hubs
   • DAzure Data Lake

   Show answer

   Answer: C

   Explanation

   Correct answer, from the provided link in the answer it is explained: Continuous export lets you fully customize what will be exported, and where it will go. For example, you can configure it so that: All high severity alerts are sent to an Azure Event Hub All medium or higher severity findings from vulnerability assessment scans of your SQL servers are sent to a specific Log Analytics workspace Specific recommendations are delivered to an Event Hub or Log Analytics workspace whenever they're generated The secure score for a subscription is sent to a Log Analytics workspace whenever the score for a control changes by 0.01 or more

   Source: Adapted from community discussion — HSBNZ

   References

   • Microsoft Learn

   Next question

8. Question 98 · 392 in bank

   You are responsible for responding to Azure Defender for Key Vault alerts. During an investigation of an alert, you discover unauthorized attempts to access a key vault from a Tor exit node. What should you configure to mitigate the threat?

   • AKey Vault firewalls and virtual networks
   • BAzure Active Directory (Azure AD) permissions
   • Crole-based access control (RBAC) for the key vault
   • Dthe access policy settings of the key vault

   Show answer

   Answer: A

   Explanation

   A is correct. B has nothing to do with Key Vault. C & D only check against user permissions to key vault and not suspicious IP addresses.

   Source: Adapted from community discussion — Eltooth

   Next question

9. Question 99 · 392 in bank

   HOTSPOT - You need to use an Azure Resource Manager template to create a workflow automation that will trigger an automatic remediation when specific security alerts are received by Azure Security Center. How should you complete the portion of the template that will provision the required Azure resources? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point. Hot Area:

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   Reference: https://docs.microsoft.com/en-us/azure/security-center/quickstart-automation-alert

   Source: Adapted from community discussion — Murtuza

   

   Next question

10. Question 100 · 392 in bank

    You have an Azure subscription that contains a Log Analytics workspace. You need to enable just-in-time (JIT) VM access and network detections for Azure resources. Where should you enable Azure Defender?

    • Aat the subscription level
    • Bat the workspace level
    • Cat the resource level

    Show answer

    Answer: A

    Explanation

    "Enabling it at the workspace level doesn't enable just-in-time VM access, adaptive application controls, and network detections for Azure resources. In addition, the only Microsoft Defender plans available at the workspace level are Microsoft Defender for servers and Microsoft Defender for SQL servers on machines." Reference: https://docs.microsoft.com/en-us/azure/defender-for-cloud/enable-enhanced-security

    Source: Adapted from community discussion — Daniel9527

    References

    • Microsoft Learn
    • Microsoft Learn
    • Microsoft Learn
    • Microsoft Learn
    • Microsoft Learn

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

SC-200 practice, question 91. 392 questions available.