SC-200 practice questions 211–220

1. Question 211 · 392 in bank

   You have a Microsoft Sentinel workspace. You receive multiple alerts for failed sign-in attempts to an account. You identify that the alerts are false positives. You need to prevent additional failed sign-in alerts from being generated for the account. The solution must meet the following requirements: • Ensure that failed sign-in alerts are generated for other accounts. • Minimize administrative effort What should do?

   • AModify the analytics rule.
   • BCreate a watchlist.
   • CAdd an activity template to the entity behavior.
   • DCreate an automation rule.

   Show answer

   Answer: A

   Explanation

   Agreed. In the article it states: "This article describes two methods for avoiding false positives: Automation rules create exceptions without modifying analytics rules. Scheduled analytics rules modifications permit more detailed and permanent exceptions."

   Source: Adapted from community discussion — MoSea

   References

   • Microsoft Learn
   • Microsoft Learn

   Next question

2. Question 212 · 392 in bank

   HOTSPOT - You have a Microsoft 365 E5 subscription that contains two users named User1 and User2. You have the hunting query shown in the following exhibit.

   

   The users perform the following actions: • User1 assigns User2 the Global administrator role. • User1 creates a new user named User3 and assigns the user a Microsoft Teams license. • User2 creates a new user named User4 and assigns the user the Security reader role. • User2 creates a new user named User5 and assigns the user the Security operator role. For each of the following statements, select Yes if the statement is true. Otherwise, select No. NOTE: Each correct selection is worth one point.

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   First part of the query looks for Add user events in Auditlogs, second part of the query looks for "Create role assignment' events in Azureactivity and third part joins both searches so both parts need to match for the final search result. No - The query is intended to search for user creation events with role assignment, this does not match that. No - Matches first part of the query but not the second. User is assigned a Microsoft Teams license which is not a role. Yes - A new user is created and assigned the Security Operator role which matches both parts of the query.

   Source: Adapted from community discussion — DChilds

   References

   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn

   

   Next question

3. Question 213 · 392 in bank

   HOTSPOT - You have the following KQL query.

   

   For each of the following statements, select Yes if the statement is true. Otherwise. select No. NOTE: Each correct selection is worth one point.

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   The account entity is set as the username not the opposite The username is not set as the account entity it's the opposite 1 should be no the watchlist can be updated so https://learn.microsoft.com/en-us/azure/sentinel/watchlists-manage#edit-a-watchlist-item 2 should be No IPList var refers to the entity type Ip Address yes https://learn.microsoft.com/en-us/azure/sentinel/entities-reference#entity-types-and-identifiers 3 should be Yes So my guess N,N,Y

   Source: Adapted from community discussion — Fcnet

   References

   • Microsoft Learn
   • Microsoft Learn

   

   Next question

4. Question 214 · 392 in bank

   HOTSPOT - You have a Microsoft Sentinel workspace. You develop a custom Advanced Security Information Model (ASIM) parser named Parser1 that produces a schema named Schema1. You need to validate Schema1. How should you complete the command? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   References

   • Microsoft Learn
   • Microsoft Learn

   

   Next question

5. Question 215 · 392 in bank

   HOTSPOT - You have a Microsoft Sentinel workspace that has User and Entity Behavior Analytics (UEBA) enabled. You need to identify all the log entries that relate to security-sensitive user actions performed on a server named Server1. The solution must meet the following requirements: • Only include security-sensitive actions by users that are NOT members of the IT department. • Minimize the number of false positives. How should you complete the query? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   To correlate Microsoft Entra sign-in logs with the IdentityInfo table in an alert that's triggered if an application is accessed by someone who isn't a member of a specific security group: SigninLogs | where AppDisplayName == "GithHub.Com" | join kind=inner ( IdentityInfo | summarize arg_max(TimeGenerated, *) by AccountObjectId) on $left.UserId == $right.AccountObjectId | where GroupMembership !contains "Developers" https://learn.microsoft.com/en-us/azure/sentinel/investigate-with-ueba#embed-identityinfo-data-in-your-analytics-rules-public-preview

   Source: Adapted from community discussion — Kurdd

   References

   • Microsoft Learn

   

   Next question

6. Question 216 · 392 in bank

   HOTSPOT - You have a Microsoft Sentinel workspace. You need to create a KQL query that will identify successful sign-ins from multiple countries during the last three hours. How should you complete the query? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   

   Next question

7. Question 217 · 392 in bank

   HOTSPOT - You have an Azure subscription. You plan to implement a Microsoft Sentinel workspace. You anticipate that you will ingest 20 GB of security log data per day. You need to configure storage for the workspace. The solution must meet the following requirements: • Minimize costs for daily ingested data. • Maximize the data retention period without incurring extra costs. What should you do for each requirement? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   Answer is Correct 1. Commitment Tiers allow you to reserve a fixed amount of daily data ingestion capacity for Azure Monitor and Azure Sentinel for a fixed, predictable daily fee. 2. Data ingested into either classic or workspace-based Application Insights is retained for 90 days without any charge. Ref: https://azure.microsoft.com/en-us/pricing/details/monitor/

   Source: Adapted from community discussion — liliap

   References

   • azure.microsoft.com documentation
   • azure.microsoft.com documentation
   • azure.microsoft.com documentation

   

   Next question

8. Question 218 · 392 in bank

   HOTSPOT - You have a Microsoft Sentinel workspace named sws1. You plan to create an Azure logic app that will raise an incident in an on-premises IT service management system when an incident is generated in sws1. You need to configure the Microsoft Sentinel connector credentials for the logic app. The solution must meet the following requirements: • Minimize administrative effort. • Use the principle of least privilege. How should you configure the credentials? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   Surely Reader is all that is required if MS Reader can view Incidents (doesn't mention in scenario whether the Logic App will manage the Incident on Sentinel side, only raise an incident in an ITSM elsewhere when incident is raised in sentinel <> view required only?

   Source: Adapted from community discussion — PhoenixSlasher

   References

   • Microsoft Learn
   • Microsoft Learn

   

   Next question

9. Question 219 · 392 in bank

   You have a playbook in Azure Sentinel. When you trigger the playbook, it sends an email to a distribution group. You need to modify the playbook to send the email to the owner of the resource instead of the distribution group. What should you do?

   • AAdd a parameter and modify the trigger.
   • BAdd a custom data connector and modify the trigger.
   • CAdd a condition and modify the action.
   • DAdd an alert and modify the action.

   Show answer

   Answer: A

   Explanation

   The answer is correct. You need to add a new parameter in Send email action. That parameter specifies who you want to send to.

   Source: Adapted from community discussion — teehex

   References

   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn

   Next question

10. Question 220 · 392 in bank

    Select 2

    You have a Microsoft Sentinel workspace. You need to prevent a built-in Advanced Security Information Model (ASIM) parser from being updated automatically. What are two ways to achieve this goal? Each correct answer presents a complete solution. NOTE: Each correct selection is worth one point.

    • ACreate a hunting query that references the built-in parser.
    • BBuild a custom unifying parser and include the built-in parser version.
    • CRedeploy the built-in parser and specify a CallerContext parameter of Any and a SourceSpecificParser parameter of Any.
    • DRedeploy the built-in parser and specify a CallerContext parameter of Built-in.
    • ECreate an analytics rule that includes the built-in parser.

    Show answer

    Answer: BC

    Explanation

    Why do i pay money for that services when the answer is wrong? I made the test exam from Microsoft. Correct Answers are: - Redeploy the built-in parser and specify a CallerContext value of Any and a SourceSpecificParser value of Any. - Create an analytics rule and include the built-in parser.

    Source: Adapted from community discussion — xxjanixxasd

    References

    • Microsoft Learn

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

SC-200 practice, question 211. 392 questions available.