SC-200 practice questions 11–20

1. Question 11 · 392 in bank

   HOTSPOT - You purchase a Microsoft 365 subscription. You plan to configure Microsoft Cloud App Security. You need to create a custom template-based policy that detects connections to Microsoft 365 apps that originate from a botnet network. What should you use? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point. Hot Area:

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   Reference: https://docs.microsoft.com/en-us/cloud-app-security/anomaly-detection-policy

   Source: Adapted from community discussion — Efficia

   References

   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn

   

   Next question

2. Question 12 · 392 in bank

   You need to receive a security alert when a user attempts to sign in from a location that was never used by the other users in your organization to sign in. Which anomaly detection policy should you use?

   • AImpossible travel
   • BActivity from anonymous IP addresses
   • CActivity from infrequent country
   • DMalware detection

   Show answer

   Answer: C

   Explanation

   Activity from infrequent country is the correct answer. First, both "Impossible travel" and "Activity from infrequent country" are detection rule that help prevent breaches from foreign attackers. The difference between the rule is the type of historical data. "Impossible travel" actually compares between the new location's sign-in with the last known one. So it basically means if someone already logged into a location (corporate network with USA-based IP range) and now he is logged into a China network then it is likely the user is compromised (assume the organization doesn't have any traffic/record/association with China network). Moreover it is based on geographically distant locations within a time period shorter. So in my example China is too far from USA. "Activity from infrequent country" is a bit different. Instead of comparing with the last known location, it detects if an account is logged in from a country that has never been accessed by any user in the organization. This rule is based on user behavior using entity behavioral analytics and machine learning.

   Source: Adapted from community discussion — teehex

   References

   • Microsoft Learn
   • Microsoft Learn

   Next question

3. Question 13 · 392 in bank

   Your company has a single office in Istanbul and a Microsoft 365 subscription. The company plans to use conditional access policies to enforce multi-factor authentication (MFA). You need to enforce MFA for all users who work remotely. What should you include in the solution?

   • Aa fraud alert
   • Ba user risk policy
   • Ca named location
   • Da sign-in user policy

   Show answer

   Answer: C

   Explanation

   The key here is "all users who work remotely." Only a named location can be used to define a CA rule to allow MFA for everyone except a trusted location like the office's internal IP ranges.

   Source: Adapted from community discussion — Sango

   References

   • Microsoft Learn
   • Microsoft Learn

   Next question

4. Question 14 · 392 in bank

   Select 2

   You are configuring Microsoft Cloud App Security. You have a custom threat detection policy based on the IP address ranges of your company's United States-based offices. You receive many alerts related to impossible travel and sign-ins from risky IP addresses. You determine that 99% of the alerts are legitimate sign-ins from your corporate offices. You need to prevent alerts for legitimate sign-ins from known locations. Which two actions should you perform? Each correct answer presents part of the solution. NOTE: Each correct selection is worth one point.

   • AConfigure automatic data enrichment.
   • BAdd the IP addresses to the corporate address range category.
   • CIncrease the sensitivity level of the impossible travel anomaly detection policy.
   • DAdd the IP addresses to the other address range category and add a tag.
   • ECreate an activity policy that has an exclusion for the IP addresses.

   Show answer

   Answer: AB

   Explanation

   Apologies, the answer provided is correct. I just know checked the site myself and the options exist, you add the IP address range and a tag and then you check to override the data enrichment by providing a location that goes along with that IP range. So, A & D stand correct.

   Source: Adapted from community discussion — JohnAvlakiotis

   References

   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn

   Next question

5. Question 15 · 392 in bank

   Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution. After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen. You are configuring Microsoft Defender for Identity integration with Active Directory. From the Microsoft Defender for identity portal, you need to configure several accounts for attackers to exploit. Solution: You add each account as a Sensitive account. Does this meet the goal?

   • AYes
   • BNo

   Show answer

   Answer: B

   Explanation

   B is the answer. https://learn.microsoft.com/en-us/defender-for-identity/entity-tags#sensitive--tags The Sensitive tag is used to identify high value assets. The lateral movement path also relies on an entity's sensitivity status. Some entities are considered sensitive automatically by Defender for Identity, and others can be added manually.

   Source: Adapted from community discussion — zellck

   References

   • Microsoft Learn

   Next question

6. Question 16 · 392 in bank

   You have a Microsoft 365 tenant that uses Microsoft Exchange Online and Microsoft Defender for Office 365. What should you use to identify whether zero-hour auto purge (ZAP) moved an email message from the mailbox of a user?

   • Athe Threat Protection Status report in Microsoft Defender for Office 365
   • Bthe mailbox audit log in Exchange
   • Cthe Safe Attachments file types report in Microsoft Defender for Office 365
   • Dthe mail flow report in Exchange

   Show answer

   Answer: A

   Explanation

   A) answer refers to Threat Explorer To determine if ZAP moved your message, you have the following options: Number of messages: Use the Mailflow view in the Mailflow status report to see the number of ZAP-affected messages for the specified date range. Message details: Use Threat Explorer (and real-time detections) to filter All email events by the value ZAP for the Additional action column. answer D (Exchange mailflow) ≠ Mailflow view in the Mailflow status report

   Source: Adapted from community discussion — us3r

   References

   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn

   Next question

7. Question 17 · 392 in bank

   You have a Microsoft 365 subscription that contains 1,000 Windows 10 devices. The devices have Microsoft Office 365 installed. You need to mitigate the following device threats: ✑ Microsoft Excel macros that download scripts from untrusted websites ✑ Users that open executable attachments in Microsoft Outlook ✑ Outlook rules and forms exploits What should you use?

   • AMicrosoft Defender Antivirus
   • Battack surface reduction rules in Microsoft Defender for Endpoint
   • CWindows Defender Firewall
   • Dadaptive application control in Azure Defender

   Show answer

   Answer: B

   Explanation

   B: Attack Surface Reduction rules. https://learn.microsoft.com/en-us/microsoft-365/security/defender-endpoint/attack-surface-reduction-rules-reference?view=o365-worldwide Block all Office applications from creating child processes Block executable content from email client and webmail

   Source: Adapted from community discussion — Metasploit

   References

   • Microsoft Learn

   Next question

8. Question 18 · 392 in bank

   You have a third-party security information and event management (SIEM) solution. You need to ensure that the SIEM solution can generate alerts for Azure Active Directory (Azure AD) sign-events in near real time. What should you do to route events to the SIEM solution?

   • ACreate an Azure Sentinel workspace that has a Security Events connector.
   • BConfigure the Diagnostics settings in Azure AD to stream to an event hub.
   • CCreate an Azure Sentinel workspace that has an Azure Active Directory connector.
   • DConfigure the Diagnostics settings in Azure AD to archive to a storage account.

   Show answer

   Answer: B

   Explanation

   Routing logs to an Azure event hub allows you to integrate with third-party SIEM tools like Sumologic and Splunk. https://docs.microsoft.com/en-us/azure/active-directory/reports-monitoring/tutorial-azure-monitor-stream-logs-to-event-hub

   Source: Adapted from community discussion — rdy4u

   References

   • Microsoft Learn
   • Microsoft Learn

   Next question

9. Question 19 · 392 in bank

   DRAG DROP - You have an Azure subscription linked to an Azure Active Directory (Azure AD) tenant. The tenant contains two users named User1 and User2. You plan to deploy Azure Defender. You need to enable User1 and User2 to perform tasks at the subscription level as shown in the following table.

   

   The solution must use the principle of least privilege. Which role should you assign to each user? To answer, drag the appropriate roles to the correct users. Each role may be used once, more than once, or not at all. You may need to drag the split bar between panes or scroll to view content. Select and Place:

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   Box 1: Owner - Only the Owner can assign initiatives. Box 2: Contributor - Only the Contributor or the Owner can apply security recommendations. Reference: https://docs.microsoft.com/en-us/azure/defender-for-cloud/permissions

   Source: Adapted from community discussion — Lion007

   References

   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn

   

   Next question

10. Question 20 · 392 in bank

    HOTSPOT - You have a Microsoft 365 E5 subscription that contains 200 Windows 10 devices enrolled in Microsoft Defender for Endpoint. You need to ensure that users can access the devices by using a remote shell connection directly from the Microsoft 365 Defender portal. The solution must use the principle of least privilege. What should you do in the Microsoft 365 Defender portal? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point. Hot Area:

    

    This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

    Show the answer figure

    Answer: See figure below

    Explanation

    Box 1: Turn on Live Response - Live response is a capability that gives you instantaneous access to a device by using a remote shell connection. This gives you the power to do in-depth investigative work and take immediate response actions. Box: 2 - Network assessment jobs allow you to choose network devices to be scanned regularly and added to the device inventory. Reference: https://docs.microsoft.com/en-us/microsoft-365/security/defender-endpoint/respond-machine-alerts?view=o365-worldwide https://docs.microsoft.com/en-us/microsoft-365/security/defender-endpoint/network-devices?view=o365-worldwide

    Source: Adapted from community discussion — Lion007

    References

    • Microsoft Learn
    • Microsoft Learn
    • Microsoft Learn

    

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

SC-200 practice, question 11. 392 questions available.