SC-200 practice questions 291–300

1. Question 291 · 392 in bank

   You have a Microsoft Sentinel workspace that contains a custom workbook named Workbook1. You need to create a visual based on the SecurityEvent table. The solution must meet the following requirements: • Identify the number of security events ingested during the past week. • Display the count of events by day in a timechart. What should you add to Workbook1?

   • Aa query
   • Ba metric
   • Ca group
   • Dlinks or tabs

   Show answer

   Answer: A

   Explanation

   A query allows you to retrieve specific data from the SecurityEvent table. You can write a query that filters events based on the past week’s timestamp and aggregates the count of events by day. The timechart visualization will display this aggregated data over time, showing the event count trends.

   Source: Adapted from community discussion — ServerBrain

   Next question

2. Question 292 · 392 in bank

   HOTSPOT - You have an Azure subscription that contains 50 virtual machines. You plan to deploy Microsoft Defender for Cloud. You need to enable agentless scanning for 40 virtual machines. The solution must create disk snapshots of the virtual machines and perform out-of-band analysis of the snapshots. What should you do? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   Answer is correct: - Agentless scanning is available through Defender CSPM plan (in Defender for Cloud) https://learn.microsoft.com/en-us/azure/defender-for-cloud/enable-agentless-scanning-vms - To exclude VMs from scanning, you have to use tagging https://learn.microsoft.com/en-us/azure/defender-for-cloud/enable-agentless-scanning-vms#exclude-machines-from-scanning

   Source: Adapted from community discussion — talosDevbot

   References

   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn

   

   Next question

3. Question 293 · 392 in bank

   You have an Azure subscription. You need to stream the Microsoft Graph activity logs to a third-party security information and event management (SIEM) tool. The solution must minimize administrative effort. To where should you stream the logs?

   • Aan Azure Event Hubs namespace
   • Ban Azure Storage account
   • Can Azure Event Grid namespace
   • Da Log Analytics workspace

   Show answer

   Answer: A

   Explanation

   "The logs are stored in Log Analytics for analysis, and you can export them to Azure Storage for long-term storage, or stream with Azure Event Hubs to external SIEM tools for alerting, analysis, or archival" https://learn.microsoft.com/en-us/graph/microsoft-graph-activity-logs-overview

   Source: Adapted from community discussion — talosDevbot

   References

   • Microsoft Learn

   Next question

4. Question 294 · 392 in bank

   You have a Microsoft 365 subscription that contains the following resources: • 100 users that are assigned a Microsoft 365 E5 license • 100 Windows 11 devices that are joined to the Microsoft Entra tenant The users access their Microsoft Exchange Online mailbox by using Outlook on the web. You need to ensure that if a user account is compromised, the Outlook on the web session token can be revoked. What should you configure?

   • Asecurity defaults in Microsoft Entra
   • BMicrosoft Entra Verified ID
   • Ca Conditional Access policy in Microsoft Entra
   • DMicrosoft Entra ID Protection

   Show answer

   Answer: C

   Explanation

   C is the correct answer. - Microsoft Entra ID Protection calculcates the risk. - A conditional Access policy enforces the access controls and blocks the user based on the calculated risk. ID Protection analyzes signals about user accounts and calculates a risk score based on the probability that the user is compromised. If a user has risky sign-in behavior, or their credentials leak, ID Protection uses these signals to calculate the user risk level. Administrators can configure user risk-based Conditional Access policies to enforce access controls based on user risk, including requirements such as: - Block access See: https://learn.microsoft.com/en-us/entra/id-protection/concept-identity-protection-policies#user-risk-based-conditional-access-policy

   Source: Adapted from community discussion — certinfra

   References

   • Microsoft Learn
   • Microsoft Learn

   Next question

5. Question 295 · 392 in bank

   You need to implement the Azure Information Protection requirements. What should you configure first?

   • ADevice health and compliance reports settings in Microsoft Defender Security Center
   • Bscanner clusters in Azure Information Protection from the Azure portal
   • Ccontent scan jobs in Azure Information Protection from the Azure portal
   • DAdvanced features from Settings in Microsoft Defender Security Center

   Show answer

   Answer: D

   Explanation

   Correct answer D. The question is outdated because this feature is no longer required."Seamless Endpoint DLP onboarding for Microsoft Defender for Endpoint customers" and "On March 29, 2021, the current integration between Microsoft Defender for Endpoint and AIP will be deprecated." ref: https://techcommunity.microsoft.com/t5/microsoft-defender-for-endpoint/protecting-sensitive-information-on-devices/ba-p/2143555 The answer is still valid since the question is outdated: "The integration is controlled by an on/off toggle in the Microsoft Defender Security Center under Settings -> Advanced features:"

   Source: Adapted from community discussion — Lion007

   References

   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn

   Next question

6. Question 296 · 392 in bank

   DRAG DROP - You have a Microsoft Sentinel workspace that contains the following Advanced Security Information Model (ASIM) parsers: • _Im_ProcessCreate • imProcessCreate You create a new source-specific parser named vimProcessCreate. You need to modify the parsers to meet the following requirements: • Call all the ProcessCreate parsers. • Standardize fields to the Process schema. Which parser should you modify to meet each requirement? To answer, drag the appropriate parsers to the correct requirements. Each parser may be used once, more than once, or not at all. You may need to drag the split bar between panes or scroll to view content. NOTE: Each correct selection is worth one point.

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   Call all the ProcessCreate parsers: The appropriate parser here is vimProcessCreate because it's the custom parser you created for your specific source, and it should be responsible for calling the other ProcessCreate parsers to ensure all relevant data is processed. Standardize fields to the Process schema: The parser that should be modified for standardizing fields is _Im_ProcessCreate. This parser is generally responsible for normalizing data fields according to the ASIM Process schema. Since it's a standard parser, it should already be configured to ensure fields match the Process schema.

   Source: Adapted from community discussion — g_man_rap

   

   Next question

7. Question 297 · 392 in bank

   HOTSPOT - You have on-premises servers that run Windows Server. You have a Microsoft Sentinel workspace named SW1. SW1 is configured to collect Windows Security log entries from the servers by using the Azure Monitor Agent data connector. You plan to limit the scope of collected events to events 4624 and 4625 only. You need to use a PowerShell script to validate the syntax of the filter applied to the connector. How should you complete the script? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   References

   • Microsoft Learn
   • Microsoft Learn

   

   Next question

8. Question 298 · 392 in bank

   You have a Microsoft 365 subscription that uses Microsoft Defender for Endpoint Plan 2 and contains 500 Windows devices. You plan to create a Microsoft Defender XDR custom deception rule. You need to ensure that the rule will be applied to only 10 specific devices. What should you do first?

   • AAdd custom lures to the rule.
   • BAdd the IP address of each device to the list of decoy accounts and hosts of the rule.
   • CAdd the devices to a group.
   • DAssign a tag to the devices.

   Show answer

   Answer: D

   Explanation

   Identify the devices where you intend to plant the lures in the scope section. You can select to plant lures in all Windows client devices or in clients with specific tags. The deception feature currently covers Windows clients. https://learn.microsoft.com/en-us/defender-xdr/configure-deception

   Source: Adapted from community discussion — don_binak

   References

   • Microsoft Learn

   Next question

9. Question 299 · 392 in bank

   You have an Azure subscription named Sub1 that uses Microsoft Defender for Cloud. You need to assign the PCI DSS 4.0 initiative to Sub1 and have the initiative displayed in the Defender for Cloud Regulatory compliance dashboard. From Security policies in the Environment settings, you discover that the option to add more industry and regulatory standards is unavailable. What should you do first?

   • AConfigure the Continuous export settings for Log Analytics.
   • BEnable the Cloud Security Posture Management (CSPM) plan for the subscription.
   • CConfigure the Continuous export settings for Azure Event Hubs.
   • DDisable the Microsoft Cloud Security Benchmark (MCSB) assignment.

   Show answer

   Answer: B

   Explanation

   Option B: Enable the Cloud Security Posture Management (CSPM) plan for the subscription. Correct. The Cloud Security Posture Management (CSPM) plan in Microsoft Defender for Cloud includes features like regulatory compliance tracking. If the CSPM plan is not enabled, you won't have access to add or manage regulatory compliance initiatives, which is why the option is unavailable in your current settings.

   Source: Adapted from community discussion — g_man_rap

   References

   • Microsoft Learn

   Next question

10. Question 300 · 392 in bank

    You have a Microsoft Sentinel workspace named SW1. You need to identify which anomaly rules are enabled in SW1. What should you review in Microsoft Sentinel?

    • AContent hub
    • BEntity behavior
    • CAnalytics
    • DSettings

    Show answer

    Answer: C

    Explanation

    C: Analytics You can now find anomaly rules displayed in a grid in the Anomalies tab in the Analytics page. https://learn.microsoft.com/en-us/azure/sentinel/work-with-anomaly-rules

    Source: Adapted from community discussion — rsanx42

    References

    • Microsoft Learn

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

SC-200 practice, question 291. 392 questions available.