SC-200 practice questions 101–110

1. Question 101 · 392 in bank

   Select 2

   You use Azure Defender. You have an Azure Storage account that contains sensitive information. You need to run a PowerShell script if someone accesses the storage account from a suspicious IP address. Which two actions should you perform? Each correct answer presents part of the solution. NOTE: Each correct selection is worth one point.

   • AFrom Azure Security Center, enable workflow automation.
   • BCreate an Azure logic app that has a manual trigger.
   • CCreate an Azure logic app that has an Azure Security Center alert trigger.
   • DCreate an Azure logic app that has an HTTP trigger.
   • EFrom Azure Active Directory (Azure AD), add an app registration.

   Show answer

   Answer: AC

   Explanation

   A +C looks ok. Seems correct you want a security trigger for the login and you use this trigger to start the automation workflow with the powershellscript

   Source: Adapted from community discussion — Discuss4certi

   References

   • Microsoft Learn

   Next question

2. Question 102 · 392 in bank

   HOTSPOT - You manage the security posture of an Azure subscription that contains two virtual machines name vm1 and vm2. The secure score in Azure Security Center is shown in the Security Center exhibit. (Click the Security Center tab.)

   

   Azure Policy assignments are configured as shown in the Policies exhibit. (Click the Policies tab.)

   

   For each of the following statements, select Yes if the statement is true. Otherwise, select No. NOTE: Each correct selection is worth one point. Hot Area:

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   Reference: https://techcommunity.microsoft.com/t5/azure-security-center/security-control-restrict-unauthorized-network-access/ba-p/1593833 https://techcommunity.microsoft.com/t5/azure-security-center/security-control-secure-management-ports/ba-p/1505770

   Source: Adapted from community discussion — Beitran

   References

   • Microsoft Learn

   

   Next question

3. Question 103 · 392 in bank

   DRAG DROP - You are informed of a new common vulnerabilities and exposures (CVE) vulnerability that affects your environment. You need to use Microsoft Defender Security Center to request remediation from the team responsible for the affected systems if there is a documented active exploit available. Which three actions should you perform in sequence? To answer, move the appropriate actions from the list of actions to the answer area and arrange them in the correct order. Select and Place:

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   Reference: https://techcommunity.microsoft.com/t5/core-infrastructure-and-security/microsoft-defender-atp-remediate-apps-using-mem/ba-p/1599271

   Source: Adapted from community discussion — Eltooth

   

   Next question

4. Question 104 · 392 in bank

   You use Azure Security Center. You receive a security alert in Security Center. You need to view recommendations to resolve the alert in Security Center. What should you do?

   • AFrom Security alerts, select the alert, select Take Action, and then expand the Prevent future attacks section.
   • BFrom Security alerts, select Take Action, and then expand the Mitigate the threat section.
   • CFrom Regulatory compliance, download the report.
   • DFrom Recommendations, download the CSV report.

   Show answer

   Answer: B

   Explanation

   it is B. With the 'Mitigate the threat' action you receive recommendations to mitigate this threat. The 'Prevent future attacks' action provides security recommendations to help reduce the attack surface, increase security posture, and thus prevent future attacks.

   Source: Adapted from community discussion — NickHSO

   References

   • Microsoft Learn
   • Microsoft Learn

   Next question

5. Question 105 · 392 in bank

   You receive an alert from Azure Defender for Key Vault. You discover that the alert is generated from multiple suspicious IP addresses. You need to reduce the potential of Key Vault secrets being leaked while you investigate the issue. The solution must be implemented as soon as possible and must minimize the impact on legitimate users. What should you do first?

   • AModify the access control settings for the key vault.
   • BEnable the Key Vault firewall.
   • CCreate an application security group.
   • DModify the access policy for the key vault.

   Show answer

   Answer: B

   Explanation

   The given answer is correct. You create firewall rules and adds trusted range to ensure Key Vault can only be accessed from those trusted IP addresses while you are doing investigation.

   Source: Adapted from community discussion — teehex

   References

   • Microsoft Learn

   Next question

6. Question 106 · 392 in bank

   You have a suppression rule in Azure Security Center for 10 virtual machines that are used for testing. The virtual machines run Windows Server. You are troubleshooting an issue on the virtual machines. In Security Center, you need to view the alerts generated by the virtual machines during the last five days. What should you do?

   • AChange the rule expiration date of the suppression rule.
   • BChange the state of the suppression rule to Disabled.
   • CModify the filter for the Security alerts page.
   • DView the Windows event logs on the virtual machines.

   Show answer

   Answer: C

   Explanation

   I think this is incorrect and the answer should be C - Modify the filter for the Security alerts page. Answer B would prevent future alerts from being supressed but the question is asking to view alerts created in the last 5 days - these would have been dismissed by the supression rule and to view them you need to alter the filter to display dismissed alerts. Ref: https://docs.microsoft.com/en-us/azure/security-center/alerts-suppression-rules#what-are-suppression-rules

   Source: Adapted from community discussion — PJR

   References

   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn

   Next question

7. Question 107 · 392 in bank

   HOTSPOT - You have an Azure Storage account that will be accessed by multiple Azure Function apps during the development of an application. You need to hide Azure Defender alerts for the storage account. Which entity type and field should you use in a suppression rule? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point. Hot Area:

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   Reference: https://techcommunity.microsoft.com/t5/azure-security-center/suppression-rules-for-azure-security-center-alerts-are-now/ba-p/1404920

   Source: Adapted from community discussion — Eltooth

   

   Next question

8. Question 108 · 392 in bank

   You create an Azure subscription. You enable Azure Defender for the subscription. You need to use Azure Defender to protect on-premises computers. What should you do on the on-premises computers?

   • AInstall the Log Analytics agent.
   • BInstall the Dependency agent.
   • CConfigure the Hybrid Runbook Worker role.
   • DInstall the Connected Machine agent.

   Show answer

   Answer: A

   Explanation

   I would say install connected machine agent (use Azure Arc) to mimic on prem server as azure resource and enable for it Microsoft defender for Cloud. It will use log analitics agent to parse logs but log analitics agent itself will not connect on prem server to Defender. https://docs.microsoft.com/en-us/azure/defender-for-cloud/quickstart-onboard-machines?pivots=azure-arc

   Source: Adapted from community discussion — rabusiak

   References

   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn

   Next question

9. Question 109 · 392 in bank

   A security administrator receives email alerts from Azure Defender for activities such as potential malware uploaded to a storage account and potential successful brute force attacks. The security administrator does NOT receive email alerts for activities such as antimalware action failed and suspicious network activity. The alerts appear in Azure Security Center. You need to ensure that the security administrator receives email alerts for all the activities. What should you configure in the Security Center settings?

   • Athe severity level of email notifications
   • Ba cloud connector
   • Cthe Azure Defender plans
   • Dthe integration settings for Threat detection

   Show answer

   Answer: A

   Explanation

   The correct answer is A. the severity level of email notifications. To ensure that the security administrator receives email alerts for all the activities, you need to configure the severity level of email notifications in the Security Center settings. By default, email notifications are only sent for alerts with high severity. You can change this setting to include alerts with medium or low severity as well. This way, you can receive email alerts for activities such as antimalware action failed and suspicious network activity, which have medium or low severity

   Source: Adapted from community discussion — mali1969

   References

   • Microsoft Learn

   Next question

10. Question 110 · 392 in bank

    DRAG DROP - You have an Azure Functions app that generates thousands of alerts in Azure Security Center each day for normal activity. You need to hide the alerts automatically in Security Center. Which three actions should you perform in sequence in Security Center? Each correct answer presents part of the solution. NOTE: Each correct selection is worth one point. Select and Place:

    

    This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

    Show the answer figure

    Answer: See figure below

    Explanation

    Reference: https://techcommunity.microsoft.com/t5/azure-security-center/suppression-rules-for-azure-security-center-alerts-are-now/ba-p/1404920

    Source: Adapted from community discussion — amsioso

    References

    • Microsoft Learn
    • Microsoft Learn

    

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

SC-200 practice, question 101. 392 questions available.