SC-200 practice questions 281–290

1. Question 281 · 392 in bank

   You have a Microsoft 365 E5 subscription that contains the users shown in the following table.

   

   You configure Microsoft Entra Internet Access. Which users can manage Microsoft Entra Internet Access?

   • AUser1 only
   • BUser2 only
   • CUser3 only
   • DUser1 and User2 only
   • EUser1, User2 and User3

   Show answer

   Answer: D

   Explanation

   Looks ok as: Can Privileged Role Administrator Manage Microsoft Entra Internet Access? 👉 Directly? No. The Privileged Role Administrator cannot directly configure or manage Microsoft Entra Internet Access settings. 👉 Indirectly? Yes. They can assign the necessary roles (e.g., Global Secure Access Administrator) to other users, who can then manage Entra Internet Access.

   Source: Adapted from community discussion — a_kto_to

   Next question

2. Question 282 · 392 in bank

   HOTSPOT - You have an Azure subscription named Sub1 that contains a resource group named RG1. RG1 contains two Azure key vaults named KV1 and KV2 that use Azure role-based access control (Azure RBAC). The subscription contains the users shown in the following table.

   

   KV1 contains a secret named Secret1. KV2 contains a secret named Secret2. Which users can read the values of each secret? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   References

   • Microsoft Learn

   

   Next question

3. Question 283 · 392 in bank

   HOTSPOT - You have a Microsoft Sentinel workspace. You need to create playbooks that meet the following requirements: • Use an automation rule to trigger actions on an entity. • Call the Entities - Get Hosts action. Which types of playbooks should you use, and which parameters should you specify? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   

   Next question

4. Question 284 · 392 in bank

   HOTSPOT - You have an Azure subscription named Sub1 that is linked to a Microsoft Entra tenant named contoso.com. Contoso.com contains a user named User1. Sub1 contains a Microsoft Sentinel workspace. You provision a Microsoft Copilot for Security capacity. You need to ensure that User1 can use Copilot for Security to perform the following tasks: • Update the data sharing and feedback options. • Investigate Microsoft Sentinel incidents. The solution must follow the principle of least privilege. Which role should you assign to User1 for each task? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   References

   • Microsoft Learn
   • Microsoft Learn

   

   Next question

5. Question 285 · 392 in bank

   HOTSPOT - You have a Microsoft Sentinel workspace that has a default data retention period of 30 days. The workspace contains two custom tables as shown in the following table.

   

   Each table ingested two records per day during the past 365 days. You build KQL statements for use in analytic rules as shown in the following table.

   

   For each of the following statements, select Yes if the statement is true. Otherwise, select No. NOTE: Each correct selection is worth one point.

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   NNN - KQL queries can only be run against interactive data. Total retention period is used to specify the period data needs to be archived for. Archived data cannot be accessed via KQL you have to run special Search or Restore jobs to access this data. So increasing the total retention period will have no effect on the data returned by any of the queries. https://learn.microsoft.com/en-us/azure/azure-monitor/logs/data-retention-archive?tabs=portal-3%2Cportal-1%2Cportal-2

   Source: Adapted from community discussion — wheeldj

   References

   • Microsoft Learn
   • Microsoft Learn

   

   Next question

6. Question 286 · 392 in bank

   HOTSPOT - You have an Azure subscription that uses Microsoft Defender for Cloud. You need to use an Azure Resource Manager (ARM) template to create a workflow automation that will trigger a logic app when specific alerts are received by Microsoft Defender for Cloud. How should you complete the template? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   I would say Microsoft.Logic is the Azure Resource Provider responsible for Logic Apps. The logicAppResourceId parameter should reference this provider to properly configure the automation workflow.

   Source: Adapted from community discussion — Blasty

   References

   • Microsoft Learn
   • Microsoft Learn

   

   Next question

7. Question 287 · 392 in bank

   You have a Microsoft 365 E5 subscription. You need to search the Microsoft Purview audit log by using PowerShell on a Windows device. What should you do first?

   • AInstall the Microsoft Graph PowerShell module.
   • BEnable PowerShell remoting.
   • CInstall the Microsoft Exchange Online PowerShell module.
   • DModify the TrustedHosts list.

   Show answer

   Answer: C

   Explanation

   To search the Microsoft Purview audit log using PowerShell on a Windows device, the first step you should take is: C. Install the Microsoft Exchange Online PowerShell module. This is because you need to connect to Exchange Online PowerShell to use the Search-UnifiedAuditLog cmdlet, which is required for searching the audit log.

   Source: Adapted from community discussion — MCWDSR

   Next question

8. Question 288 · 392 in bank

   HOTSPOT - You have a Microsoft 365 E5 subscription that uses Microsoft Defender for Endpoint. You have the on-premises devices shown in the following table.

   

   You are preparing an incident response plan for devices infected by malware. You need to recommend response actions that meet the following requirements: • Block malware from communicating with and infecting managed devices. • Do NOT affect the ability to control managed devices. Which actions should you use for each device? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   Device 1 is managed by Defended so you can Isolate and investigate this device. checked in a lab tenant and there is no option to contain a managed device, only isolate Device 2 is unmanaged so you can only contain this device. https://learn.microsoft.com/en-us/defender-endpoint/respond-machine-alerts#isolate-devices-from-the-network

   Source: Adapted from community discussion — wheeldj

   References

   • Microsoft Learn

   

   Next question

9. Question 289 · 392 in bank

   You have a Microsoft 365 E5 subscription that uses Microsoft Defender XDR and contains a user named User1. You need to ensure that User1 can manage Microsoft Defender XDR custom detection rules and Endpoint security policies. The solution must follow the principle of least privilege. Which role should you assign to User1?

   • ASecurity Administrator
   • BSecurity Operator
   • CCloud Device Administrator
   • DDesktop Analytics Administrator

   Show answer

   Answer: A

   Explanation

   Regarding "endpoint security policies", the role should be Security Admin, as per this link: https://learn.microsoft.com/en-us/defender-endpoint/mde-security-settings-management "The Endpoint Security Policies page in Microsoft Defender XDR is available only for users with the security administrator role in Microsoft Defender XDR. Any other user role, such as Security Reader, cannot access the portal. When a user has the required permissions to view policies in the Microsoft Defender portal, the data is presented based on Intune permissions. If the user is in scope for Intune role-based access control, it applies to the list of policies presented in the Microsoft Defender portal. We recommend granting security administrators with the Intune built-in role, "Endpoint Security Manager" to effectively align the level of permissions between Intune and Microsoft Defender XDR."

   Source: Adapted from community discussion — Max_DeJaV

   References

   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn

   Next question

10. Question 290 · 392 in bank

    HOTSPOT - You have the resources shown in the following table.

    

    You have an Azure subscription that uses Microsoft Defender for Cloud. You need to use Defender for Cloud to protect VM1 and Server1. The solution must meet the following requirements: • Support Advanced Threat Protection and vulnerability assessment. • Register each SQL Server 2022 instance as a SQL virtual machine. • Minimize implementation and administrative effort. What should you deploy to each server? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.

    

    This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

    Show the answer figure

    Answer: See figure below

    Explanation

    I don't agree with the given answer For VM1: Deploy The Azure Monitor Agent and an Azure virtual machine extension. This setup will support Advanced Threat Protection and vulnerability assessment, and it will allow you to register the SQL Server 2022 instance as a SQL virtual machine with minimal implementation and administrative effort. For Server1: Implement The Log Analytics agent and an Azure virtual machine extension. This will also support Advanced Threat Protection and vulnerability assessment, and it will enable you to register the SQL Server 2022 instance as a SQL virtual machine, aligning with the goal of minimizing implementation and administrative effort.

    Source: Adapted from community discussion — Vokuhila

    

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

SC-200 practice, question 281. 392 questions available.