SC-200 practice questions 111–120

1. Question 111 · 392 in bank

   DRAG DROP - You have an Azure subscription. You need to delegate permissions to meet the following requirements: ✑ Enable and disable Azure Defender. ✑ Apply security recommendations to resource. The solution must use the principle of least privilege. Which Azure Security Center role should you use for each requirement? To answer, drag the appropriate roles to the correct requirements. Each role may be used once, more than once, or not at all. You may need to drag the split bar between panes or scroll to view content. NOTE: Each correct selection is worth one point. Select and Place:

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   Reference: https://docs.microsoft.com/en-us/azure/security-center/security-center-permissions

   Source: Adapted from community discussion — PJR

   References

   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn

   

   Next question

2. Question 112 · 392 in bank

   HOTSPOT - You have an Azure subscription that uses Azure Defender. You plan to use Azure Security Center workflow automation to respond to Azure Defender threat alerts. You need to create an Azure policy that will perform threat remediation automatically. What should you include in the solution? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point. Hot Area:

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   Reference: https://docs.microsoft.com/en-us/azure/governance/policy/concepts/effects https://docs.microsoft.com/en-us/azure/security-center/workflow-automation

   Source: Adapted from community discussion — Mthaher

   References

   • Microsoft Learn

   

   Next question

3. Question 113 · 392 in bank

   Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution. After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen. You have Linux virtual machines on Amazon Web Services (AWS). You deploy Azure Defender and enable auto-provisioning. You need to monitor the virtual machines by using Azure Defender. Solution: You enable Azure Arc and onboard the virtual machines to Azure Arc. Does this meet the goal?

   • AYes
   • BNo

   Show answer

   Answer: A

   Explanation

   You need both Azure Arc to see the VM and the LAW agent. Now, the agent can be automatically deployed after Azure Arc is deployed. Answer should be A) Yes.

   Source: Adapted from community discussion — Tanasi

   References

   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn

   Next question

4. Question 114 · 392 in bank

   Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution. After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen. You have Linux virtual machines on Amazon Web Services (AWS). You deploy Azure Defender and enable auto-provisioning. You need to monitor the virtual machines by using Azure Defender. Solution: You manually install the Log Analytics agent on the virtual machines. Does this meet the goal?

   • AYes
   • BNo

   Show answer

   Answer: B

   Explanation

   It's B because it doesn't mention Azure Arc, it just says Log analytics agent (which by the way is going to be deprecated and replaced by Azure monitor agent) https://docs.microsoft.com/en-us/azure/azure-monitor/agents/azure-monitor-agent-overview?tabs=PowerShellWindows

   Source: Adapted from community discussion — Drui

   References

   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn

   Next question

5. Question 115 · 392 in bank

   HOTSPOT - You have an Azure subscription that has Azure Defender enabled for all supported resource types. You create an Azure logic app named LA1. You plan to use LA1 to automatically remediate security risks detected in Azure Security Center. You need to test LA1 in Security Center. What should you do? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point. Hot Area:

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   Reference: https://docs.microsoft.com/en-us/azure/security-center/workflow-automation#create-a-logic-app-and-define-when-it-should-automatically-run

   Source: Adapted from community discussion — Jos8

   References

   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn

   

   Next question

6. Question 116 · 392 in bank

   You have five on-premises Linux servers. You have an Azure subscription that uses Microsoft Defender for Cloud. You need to use Defender for Cloud to protect the Linux servers. What should you install on the servers first?

   • Athe Dependency agent
   • Bthe Log Analytics agent
   • Cthe Azure Connected Machine agent
   • Dthe Guest Configuration extension

   Show answer

   Answer: C

   Explanation

   The Azure Connected Machine agent is required to connect the on-premises Linux servers to the Azure subscription and integrate them with Microsoft Defender for Cloud. The agent enables communication between the servers and the Defender for Cloud service, allowing security events and data to be collected and analyzed. Once the Azure Connected Machine agent is installed, you can then install the Log Analytics agent to collect security data from the servers and send it to the Log Analytics workspace in Azure. This will allow you to use Defender for Cloud to monitor the security of your Linux servers, identify threats, and respond to security incidents.

   Source: Adapted from community discussion — Lone__Wolf

   References

   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn

   Next question

7. Question 117 · 392 in bank

   DRAG DROP - You have an Azure subscription. The subscription contains 10 virtual machines that are onboarded to Microsoft Defender for Cloud. You need to ensure that when Defender for Cloud detects digital currency mining behavior on a virtual machine, you receive an email notification. The solution must generate a test email. Which three actions should you perform in sequence? To answer, move the appropriate actions from the list of actions to the answer area and arrange them in the correct order. Select and Place:

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   Step 1: From Logic App Designer, create a logic app. Create a logic app and define when it should automatically run 1. From Defender for Cloud's sidebar, select Workflow automation. 2. To define a new workflow, click Add workflow automation. The options pane for your new automation opens. Here you can enter: A name and description for the automation. The triggers that will initiate this automatic workflow. For example, you might want your Logic App to run when a security alert that contains "SQL" is generated. The Logic App that will run when your trigger conditions are met. 3. From the Actions section, select visit the Logic Apps page to begin the Logic App creation process. 4. Etc. Step 2: From Logic App Designer, run a trigger. Manually trigger a Logic App - You can also run Logic Apps manually when viewing any security alert or recommendation. Step 3: From Workflow automation in Defender for cloud, add a workflow automation. Configure workflow automation at scale using the supplied policies Automating your organization's monitoring and incident response processes can greatly improve the time it takes to investigate and mitigate security incidents. Reference: https://docs.microsoft.com/en-us/azure/defender-for-cloud/workflow-automation

   Source: Adapted from community discussion — Marchiano

   References

   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn

   

   Next question

8. Question 118 · 392 in bank

   DRAG DROP - You have a Microsoft subscription that has Microsoft Defender for Cloud enabled. You configure the Azure logic apps shown in the following table.

   

   You need to configure an automatic action that will run if a Suspicious process executed alert is triggered. The solution must minimize administrative effort. Which three actions should you perform in sequence? To answer, move the appropriate actions from the list of actions to the answer area and arrange them in the correct order.

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   Actually correct! Just pay attention to the link content. "Trigger automated response - provides the option to trigger a logic app as a response to this security alert" while "Prevent future attacks - provides security recommendations to help reduce the attack surface, increase security posture, and thus prevent future attacks"

   Source: Adapted from community discussion — RodrigoLima

   References

   • Microsoft Learn

   

   Next question

9. Question 119 · 392 in bank

   You have an Azure subscription that has Microsoft Defender for Cloud enabled. You have a virtual machine named Server1 that runs Windows Server 2022 and is hosted in Amazon Web Services (AWS). You need to collect logs and resolve vulnerabilities for Server1 by using Defender for Cloud. What should you install first on Server1?

   • Athe Microsoft Monitoring Agent
   • Bthe Azure Monitor agent
   • Cthe Azure Arc agent
   • Dthe Azure Pipelines agent

   Show answer

   Answer: C

   Explanation

   Typical Microsoft Question.. In order to collect logs and connect to Defender for Cloud you need Azure monitor Agent, but first you also need to connect the machine to Azure so you have to install Azure Arc Agent which is actually called Azure Connected Machine Agent. So answering this question is impossible because the answers provided are as stupid as the question

   Source: Adapted from community discussion — teouba

   References

   • Microsoft Learn
   • Microsoft Learn

   Next question

10. Question 120 · 392 in bank

    You have an Azure subscription that uses Microsoft Defender for Cloud and contains a storage account named storage1. You receive an alert that there was an unusually high volume of delete operations on the blobs in storage1. You need to identify which blobs were deleted. What should you review?

    • Athe activity logs of storage1
    • Bthe Azure Storage Analytics logs
    • Cthe alert details
    • Dthe related entities of the alert

    Show answer

    Answer: B

    Explanation

    Seems like the answer is actually correct. "Azure Storage Analytics performs logging and provides metrics data for a storage account. You can use this data to trace requests, analyze usage trends, and diagnose issues with your storage account."

    Source: Adapted from community discussion — RodrigoLima

    References

    • Microsoft Learn
    • Microsoft Learn
    • Microsoft Learn
    • Microsoft Learn

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

SC-200 practice, question 111. 392 questions available.