SC-200 practice questions 191–200

1. Question 191 · 392 in bank

   Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution. After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen. You are configuring Azure Sentinel. You need to create an incident in Azure Sentinel when a sign-in to an Azure virtual machine from a malicious IP address is detected. Solution: You create a livestream from a query. Does this meet the goal?

   • AYes
   • BNo

   Show answer

   Answer: B

   Explanation

   Reference: https://docs.microsoft.com/en-us/azure/sentinel/connect-azure-security-center

   Source: Adapted from community discussion — fiksarion

   Next question

2. Question 192 · 392 in bank

   HOTSPOT - You need to create a query for a workbook. The query must meet the following requirements: ✑ List all incidents by incident number. ✑ Only include the most recent log for each incident. How should you complete the query? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point. Hot Area:

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   Reference: https://www.drware.com/whats-new-soc-operational-metrics-now-available-in-sentinel/

   Source: Adapted from community discussion — rdy4u

   

   Next question

3. Question 193 · 392 in bank

   DRAG DROP - You have the resources shown in the following table.

   

   You need to prevent duplicate events from occurring in SW1. What should you use for each action? To answer, drag the appropriate resources to the correct actions. Each resource may be used once, more than once, or not at all. You may need to drag the split bar between panes or scroll to view content. NOTE: Each correct selection is worth one point. Select and Place:

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   Reference: https://docs.microsoft.com/en-us/azure/sentinel/connect-log-forwarder?tabs=rsyslog

   Source: Adapted from community discussion — Metasploit

   References

   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn

   

   Next question

4. Question 194 · 392 in bank

   Select 2

   You have an Azure subscription that uses Microsoft Sentinel. You need to minimize the administrative effort required to respond to the incidents and remediate the security threats detected by Microsoft Sentinel. Which two features should you use? Each correct answer presents part of the solution. NOTE: Each correct selection is worth one point.

   • AMicrosoft Sentinel bookmarks
   • BAzure Automation runbooks
   • CMicrosoft Sentinel automation rules
   • DMicrosoft Sentinel playbooks
   • EAzure Functions apps

   Show answer

   Answer: CD

   Explanation

   C. Microsoft Sentinel automation rules D. Microsoft Sentinel playbooks Microsoft Sentinel's Automation rules can be used to automatically trigger actions or playbooks in response to detected security incidents. This reduces the need for manual intervention and minimizes administrative effort. Playbooks in Microsoft Sentinel can be used to automate incident response tasks and remediation steps, such as quarantining an affected machine or disabling a compromised account. This allows you to quickly and consistently take action on security incidents, further reducing administrative effort.

   Source: Adapted from community discussion — WRITER00347

   Next question

5. Question 195 · 392 in bank

   You have a Microsoft Sentinel workspace named workspace1 that contains custom Kusto queries. You need to create a Python-based Jupyter notebook that will create visuals. The visuals will display the results of the queries and be pinned to a dashboard. The solution must minimize development effort. What should you use to create the visuals?

   • Aplotly
   • BTensorFlow
   • Cmsticpy
   • Dmatplotlib

   Show answer

   Answer: C

   Explanation

   C. msticpy msticpy is a Python library that can be used to quickly and easily create visuals in Jupyter notebooks for Microsoft Sentinel. It has built-in support for Kusto queries, making it easy to retrieve and visualize the results of custom queries you've created in your Sentinel workspace. Additionally, msticpy contains a number of pre-built visualizations and functions that can be easily incorporated into your notebooks, minimizing development effort. So, it is the best option to create the visuals.

   Source: Adapted from community discussion — WRITER00347

   Next question

6. Question 196 · 392 in bank

   HOTSPOT - You have a Microsoft Sentinel workspace named sws1. You need to create a hunting query to identify users that list storage keys of multiple Azure Storage accounts. The solution must exclude users that list storage keys for a single storage account. How should you complete the query? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point. Hot Area:

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   Box 1: AzureActivity - The AzureActivity table includes data from many services, including Microsoft Sentinel. To filter in only data from Microsoft Sentinel, start your query with the following code: Box 2: autocluster() Example: description: | 'Listing of storage keys is an interesting operation in Azure which might expose additional secrets and PII to callers as well as granting access to VMs. While there are many benign operations of this type, it would be interesting to see if the account performing this activity or the source IP address from which it is being done is anomalous. The query below generates known clusters of ip address per caller, notice that users which only had single operations do not appear in this list as we cannot learn from it their normal activity (only based on a single event). The activities for listing storage account keys is correlated with this learned clusters of expected activities and activity which is not expected is returned.' AzureActivity - | where OperationNameValue =~ "microsoft.storage/storageaccounts/listkeys/action" | where ActivityStatusValue == "Succeeded" | join kind= inner ( AzureActivity - | where OperationNameValue =~ "microsoft.storage/storageaccounts/listkeys/action" | where ActivityStatusValue == "Succeeded" | project ExpectedIpAddress=CallerIpAddress, Caller | evaluate autocluster() ) on Caller | where CallerIpAddress != ExpectedIpAddress | summarize StartTime = min(TimeGenerated), EndTime = max(TimeGenerated), ResourceIds = make_set(ResourceId), ResourceIdCount = dcount (ResourceId) by OperationNameValue, Caller, CallerIpAddress | extend timestamp = StartTime, AccountCustomEntity = Caller, IPCustomEntity = CallerIpAddress Reference: https://github.com/Azure/Azure-Sentinel/blob/master/Hunting%20Queries/AzureActivity/Anomalous_Listing_Of_Storage_Keys.yaml

   Source: Adapted from community discussion — Metasploit

   

   Next question

7. Question 197 · 392 in bank

   You have an existing Azure logic app that is used to block Azure Active Directory (Azure AD) users. The logic app is triggered manually. You deploy Azure Sentinel. You need to use the existing logic app as a playbook in Azure Sentinel. What should you do first?

   • AAnd a new scheduled query rule.
   • BAdd a data connector to Azure Sentinel.
   • CConfigure a custom Threat Intelligence connector in Azure Sentinel.
   • DModify the trigger in the logic app.

   Show answer

   Answer: D

   Explanation

   Some people are saying this is correct as a logic app connector, actually this is referring to that as you have literally just deployed Sentinel, you need to add the AAD Connector to get that in first before you do anything. Need the data there first.

   Source: Adapted from community discussion — JhnCanthern12

   References

   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn

   Next question

8. Question 198 · 392 in bank

   DRAG DROP - You have a Microsoft Sentinel workspace named workspace1 and an Azure virtual machine named VM1. You receive an alert for suspicious use of PowerShell on VM1. You need to investigate the incident, identify which event triggered the alert, and identify whether the following actions occurred on VM1 after the alert: The modification of local group memberships

   

   ✑ The purging of event logs Which three actions should you perform in sequence in the Azure portal? To answer, move the appropriate actions from the list of actions to the answer area and arrange them in the correct order. Select and Place:

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   Step 1: From the Investigation blade, select Insights The Investigation Insights Workbook is designed to assist in investigations of Azure Sentinel Incidents or individual IP/Account/Host/URL entities. Step 2: From the Investigation blade, select the entity that represents VM1. The Investigation Insights workbook is broken up into 2 main sections, Incident Insights and Entity Insights. Incident Insights - The Incident Insights gives the analyst a view of ongoing Sentinel Incidents and allows for quick access to their associated metadata including alerts and entity information. Entity Insights - The Entity Insights allows the analyst to take entity data either from an incident or through manual entry and explore related information about that entity. This workbook presently provides view of the following entity types: IP Address - Account - Host - URL - Step 3: From the details pane of the incident, select Investigate. Choose a single incident and click View full details or Investigate. Reference: https://github.com/Azure/Azure-Sentinel/wiki/Investigation-Insights---Overview https://docs.microsoft.com/en-us/azure/sentinel/investigate-cases

   Source: Adapted from community discussion — suspense

   

   Next question

9. Question 199 · 392 in bank

   You have a Microsoft Sentinel workspace that contains the following incident. Brute force attack against Azure Portal analytics rule has been triggered. You need to identify the geolocation information that corresponds to the incident. What should you do?

   • AFrom Overview, review the Potential malicious events map.
   • BFrom Incidents, review the details of the IPCustomEntity entity associated with the incident.
   • CFrom Incidents, review the details of the AccountCustomEntity entity associated with the incident.
   • DFrom Investigation, review insights on the incident entity.

   Show answer

   Answer: B

   Explanation

   To identify the geolocation information corresponding to the incident "Brute force attack against Azure Portal analytics rule has been triggered" in Microsoft Sentinel, you should review the details of the IPCustomEntity entity associated with the incident. The IPCustomEntity typically contains information related to IP addresses, including geolocation data such as country or region. By examining the details of the IPCustomEntity entity, you can retrieve the geolocation information associated with the IP addresses involved in the brute force attack. Therefore, option B is the correct choice for identifying the geolocation information corresponding to the incident

   Source: Adapted from community discussion — fiksarion

   Next question

10. Question 200 · 392 in bank

    You have two Azure subscriptions that use Microsoft Defender for Cloud. You need to ensure that specific Defender for Cloud security alerts are suppressed at the root management group level. The solution must minimize administrative effort. What should you do in the Azure portal?

    • ACreate an Azure Policy assignment.
    • BModify the Workload protections settings in Defender for Cloud.
    • CCreate an alert rule in Azure Monitor.
    • DModify the alert settings in Defender for Cloud.

    Show answer

    Answer: A

    Explanation

    To minimize effort I would go with A, set it once, forget it and keep it enforced. A - Can set it at Management Group level B - Nothing to do alert suppression C - Generate an alert, will not suppress another D - You can suppress an alert, but not at Management Group or Subscription level Looking at the Policy Definitions: Suppress Azure Security Center alerts to reduce alerts fatigue by deploying suppression rules on your management group or subscription. https://learn.microsoft.com/en-us/azure/defender-for-cloud/policy-reference

    Source: Adapted from community discussion — D_PaW

    References

    • Microsoft Learn
    • Microsoft Learn
    • Microsoft Learn
    • Microsoft Learn
    • Microsoft Learn

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

SC-200 practice, question 191. 392 questions available.