SC-200 practice questions 181–190

1. Question 181 · 392 in bank

   Select 2

   You use Azure Sentinel. You need to receive an alert in near real-time whenever Azure Storage account keys are enumerated. Which two actions should you perform? Each correct answer presents part of the solution. NOTE: Each correct selection is worth one point.

   • ACreate a livestream
   • BAdd a data connector
   • CCreate an analytics rule
   • DCreate a hunting query.
   • ECreate a bookmark.

   Show answer

   Answer: AD

   Explanation

   Use hunting livestream to create interactive sessions that let you test newly created queries as events occur, get notifications from the sessions when a match is found, and launch investigations if necessary. You can quickly create a livestream session using any Log Analytics query.

   Source: Adapted from community discussion — rdy4u

   References

   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn

   Next question

2. Question 182 · 392 in bank

   HOTSPOT - You deploy Azure Sentinel. You need to implement connectors in Azure Sentinel to monitor Microsoft Teams and Linux virtual machines in Azure. The solution must minimize administrative effort. Which data connector type should you use for each workload? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point. Hot Area:

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   Reference: https://docs.microsoft.com/en-us/azure/sentinel/connect-office-365 https://docs.microsoft.com/en-us/azure/sentinel/connect-syslog

   References

   • Microsoft Learn
   • Microsoft Learn

   

   Next question

3. Question 183 · 392 in bank

   You are investigating an incident in Azure Sentinel that contains more than 127 alerts. You discover eight alerts in the incident that require further investigation. You need to escalate the alerts to another Azure Sentinel administrator. What should you do to provide the alerts to the administrator?

   • ACreate a Microsoft incident creation rule
   • BShare the incident URL
   • CCreate a scheduled query rule
   • DAssign the incident

   Show answer

   Answer: D

   Explanation

   D - Assign the incident is the best option, but you can also tag or bookmark the alerts that need further investigation.

   Source: Adapted from community discussion — JoeP1

   References

   • Microsoft Learn

   Next question

4. Question 184 · 392 in bank

   Select 2

   You are configuring Azure Sentinel. You need to send a Microsoft Teams message to a channel whenever an incident representing a sign-in risk event is activated in Azure Sentinel. Which two actions should you perform in Azure Sentinel? Each correct answer presents part of the solution. NOTE: Each correct selection is worth one point.

   • AEnable Entity behavior analytics.
   • BAssociate a playbook to the analytics rule that triggered the incident.
   • CEnable the Fusion rule.
   • DAdd a playbook.
   • ECreate a workbook.

   Show answer

   Answer: BD

   Explanation

   Answer is D Add a playbook B Associate a playbook to the analytics rule that triggered the incident. UEBA also requires data sources from Azure and/or Thirdparty and will be able to help analyze and investigate an incident. This is not relevant to the question. So we have to assume data connectors are in place.

   Source: Adapted from community discussion — Metasploit

   Next question

5. Question 185 · 392 in bank

   DRAG DROP - You need to use an Azure Sentinel analytics rule to search for specific criteria in Amazon Web Services (AWS) logs and to generate incidents. Which three actions should you perform in sequence? To answer, move the appropriate actions from the list of actions to the answer area and arrange them in the correct order. Select and Place:

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   Reference: https://docs.microsoft.com/en-us/azure/sentinel/detect-threats-custom

   Source: Adapted from community discussion — SubQue

   

   Next question

6. Question 186 · 392 in bank

   DRAG DROP - You have an Azure Sentinel deployment. You need to query for all suspicious credential access activities. Which three actions should you perform in sequence? To answer, move the appropriate actions from the list of actions to the answer area and arrange them in the correct order. Select and Place:

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   Reference: https://davemccollough.com/2020/11/28/threat-hunting-with-azure-sentinel/

   Source: Adapted from community discussion — StaxJaxson

   

   Next question

7. Question 187 · 392 in bank

   Select 2

   You have the following environment: Azure Sentinel -

   

   ✑ A Microsoft 365 subscription ✑ Microsoft Defender for Identity ✑ An Azure Active Directory (Azure AD) tenant You configure Azure Sentinel to collect security logs from all the Active Directory member servers and domain controllers. You deploy Microsoft Defender for Identity by using standalone sensors. You need to ensure that you can detect when sensitive groups are modified in Active Directory. Which two actions should you perform? Each correct answer presents part of the solution. NOTE: Each correct selection is worth one point.

   • AConfigure the Advanced Audit Policy Configuration settings for the domain controllers.
   • BModify the permissions of the Domain Controllers organizational unit (OU).
   • CConfigure auditing in the Microsoft 365 compliance center.
   • DConfigure Windows Event Forwarding on the domain controllers.

   Show answer

   Answer: AD

   Explanation

   Answer is correct. A: Configure the Advanced Audit Policy Configuration settings for the domain controllers For the correct events to be audited and included in the Windows Event Log, your domain controllers require accurate Advanced Audit Policy settings. https://learn.microsoft.com/en-us/defender-for-identity/configure-windows-event-collection D: Configure Windows Event Forwarding on the domain controllers. To enhance detection capabilities, Defender for Identity needs the Windows events listed in Configure event collection. These can either be read automatically by the Defender for Identity sensor or in case the Defender for Identity sensor is not deployed, it can be forwarded to the Defender for Identity standalone sensor in one of two ways, by configuring the Defender for Identity standalone sensor to listen for SIEM events or by configuring Windows Event Forwarding. https://learn.microsoft.com/en-us/defender-for-identity/configure-event-forwarding

   Source: Adapted from community discussion — Metasploit

   References

   • Microsoft Learn
   • Microsoft Learn

   Next question

8. Question 188 · 392 in bank

   You use Azure Sentinel. You need to use a built-in role to provide a security analyst with the ability to edit the queries of custom Azure Sentinel workbooks. The solution must use the principle of least privilege. Which role should you assign to the analyst?

   • AAzure Sentinel Contributor
   • BSecurity Administrator
   • CAzure Sentinel Responder
   • DLogic App Contributor

   Show answer

   Answer: A

   References

   • Microsoft Learn

   Next question

9. Question 189 · 392 in bank

   You create a hunting query in Azure Sentinel. You need to receive a notification in the Azure portal as soon as the hunting query detects a match on the query. The solution must minimize effort. What should you use?

   • Aa playbook
   • Ba notebook
   • Ca livestream
   • Da bookmark

   Show answer

   Answer: C

   Explanation

   Because livestream notifications for new events use Azure portal notifications, you see these notifications whenever you use the Azure portal. Ref https://docs.microsoft.com/en-us/azure/sentinel/livestream#receive-notifications-when-new-events-occur

   Source: Adapted from community discussion — LiamNg

   References

   • Microsoft Learn
   • Microsoft Learn

   Next question

10. Question 190 · 392 in bank

    Select 2

    You have an Azure subscription named Sub1 and a Microsoft 365 subscription. Sub1 is linked to an Azure Active Directory (Azure AD) tenant named contoso.com. You create an Azure Sentinel workspace named workspace1. In workspace1, you activate an Azure AD connector for contoso.com and an Office 365 connector for the Microsoft 365 subscription. You need to use the Fusion rule to detect multi-staged attacks that include suspicious sign-ins to contoso.com followed by anomalous Microsoft Office 365 activity. Which two actions should you perform? Each correct answer present part of the solution. NOTE: Each correct selection is worth one point.

    • ACreate custom rule based on the Office 365 connector templates.
    • BCreate a Microsoft incident creation rule based on Azure Security Center.
    • CCreate a Microsoft Cloud App Security connector.
    • DCreate an Azure AD Identity Protection connector.

    Show answer

    Answer: CD

    Explanation

    A. Create custom rule based on the Office 365 connector templates. no need to create a custom rule - Fusion rule - Advanced Multistage Attack Detection is not a part of office 365 connector templates, but uses it. B. Create a Microsoft incident creation rule based on Azure Security Center. not relevant C. Create a Microsoft Cloud App Security connector. currently we already have, AD, office 365 connectors, definitely might contribute (correlated searches) to monitor suspicious sign-in events form other clouds which use controso.com D. Create an Azure AD Identity Protection connector. this module has it's own user sign-in risk detection models, you definitely want to correlate with it's detections. https://learn.microsoft.com/en-us/azure/sentinel/configure-fusion-rules

    Source: Adapted from community discussion — 7c0a

    References

    • Microsoft Learn
    • Microsoft Learn
    • Microsoft Learn
    • Microsoft Learn
    • Microsoft Learn

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

SC-200 practice, question 181. 392 questions available.