SC-200 practice questions 301–310

1. Question 301 · 392 in bank

   You have an Azure subscription that contains a Microsoft Sentinel workspace named WS1. You create a hunting query that detects a new attack vector. The attack vector maps to a tactic listed in the MITRE ATT&CK database. You need to ensure that an incident is created in WS1 when the new attack vector is detected. What should you configure?

   • Aa hunting livestream session
   • Ba query bookmark
   • Ca scheduled query rule
   • Da Fusion rule

   Show answer

   Answer: C

   Explanation

   C. a scheduled query rule: This is used to run queries on a schedule, and when a match is found, it can create an incident in Microsoft Sentinel. Given that you have a hunting query that detects a new attack vector, setting up a scheduled query rule will ensure that this query runs regularly and automatically generates an incident whenever the attack vector is detected.

   Source: Adapted from community discussion — 90158a0

   Next question

2. Question 302 · 392 in bank

   You have a Microsoft 365 E5 subscription that uses Microsoft Defender XDR. The security team at your company detects command and control (C2) agent traffic on the network. Agents communicate once every 50 hours. You need to create a Microsoft Defender XDR custom detection rule that will identify compromised devices and establish a pattern of communication. The solution must meet the following requirements: • Identify all the devices that have communicated during the past 14 days. • Minimize how long it takes to identify the devices. To what should you set the detection frequency for the rule?

   • AEvery 12 hours
   • BEvery 24 hours
   • CEvery three hours
   • DEvery hour

   Show answer

   Answer: B

   Explanation

   Rule frequency When you save a new rule, it runs and checks for matches from the past 30 days of data. The rule then runs again at fixed intervals, applying a lookback duration based on the frequency you choose: Every 24 hours—runs every 24 hours, checking data from the past 30 days Every 12 hours—runs every 12 hours, checking data from the past 48 hours Every 3 hours—runs every 3 hours, checking data from the past 12 hours Every hour—runs hourly, checking data from the past 4 hours Continuous (NRT)—runs continuously, checking data from events as they're collected and processed in near real-time (NRT), see Continuous (NRT) frequency

   Source: Adapted from community discussion — smosmo

   References

   • Microsoft Learn

   Next question

3. Question 303 · 392 in bank

   You have a Microsoft 365 subscription that uses Microsoft Defender XDR. You have a query that contains the following statements.

   

   You need to configure a custom detection rule that will use the query. The solution must minimize how long it takes to be notified about events that match the query. Which frequency should you select for the rule?

   • AEvery hour
   • BContinuous (NRT)
   • CEvery 12 hours
   • DEvery 3 hours

   Show answer

   Answer: B

   Next question

4. Question 304 · 392 in bank

   HOTSPOT - You have a Microsoft 365 E5 subscription that contains the hosts shown in the following table.

   

   You have indicators in Microsoft Defender for Endpoint as shown in the following table.

   

   ID1 and ID2 reference the same file as ID3. For each of the following statements, select Yes if the statement is true. Otherwise, select No. NOTE: Each correct selection is worth one point.

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   I don't agress. My chosen answer: NNY About the first question, in https://learn.microsoft.com/en-us/defender-endpoint/indicator-file Microsoft says: "If there are conflicting file IoC policies with the same enforcement type and target, the policy of the more secure hash will be applied. An SHA-256 file hash IoC policy will win over an SHA-1 file hash IoC policy, which will win over an MD5 file hash IoC policy if the hash types define the same file. This is always true regardless of the device group."

   Source: Adapted from community discussion — MarcoHurry

   References

   • Microsoft Learn

   

   Next question

5. Question 305 · 392 in bank

   HOTSPOT - You have a Microsoft 365 E5 subscription that uses Microsoft Defender XDR. You have a Microsoft Sentinel workspace. Microsoft Sentinel connectors are configured as shown in the following table.

   

   You use Microsoft Sentinel to investigate suspicious Microsoft Graph API activity related to Conditional Access policies. You need to search for the following activities: • Downloads of the Conditional Access policies by using PowerShell • Updates to the Conditional Access policies by using the Microsoft Entra admin center Which tables should you query for each activity? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   if the download was strictly via PowerShell (without Graph API calls), you would be better off querying SecurityEvent or AuditLogs instead.

   Source: Adapted from community discussion — rkrau

   

   Next question

6. Question 306 · 392 in bank

   You need to modify the anomaly detection policy settings to meet the Cloud App Security requirements and resolve the reported problem. Which policy should you modify?

   • AActivity from suspicious IP addresses
   • BActivity from anonymous IP addresses
   • CImpossible travel
   • DRisky sign-in

   Show answer

   Answer: C

   Explanation

   Agree - C. Users connecting to two geographically separate locations at the same time would trigger the impossible travel alert, however as these are legitimate then this setting needs to be altered to include both network addresses.

   Source: Adapted from community discussion — Eltooth

   References

   • Microsoft Learn

   Next question

7. Question 307 · 392 in bank

   HOTSPOT - You have a Microsoft 365 subscription that contains three users named User1, User2 and User3 and the resources shown in the following table.

   

   You have a Microsoft Defender XDR detection rule named Rule1 that has the following configurations: • Scope:DevGroup1 • File hash: File1.exe • Actions o Devices: Collect investigation package o User: Mark as compromised o Files: Block Each user attempts to run File1.exe on their device. For each of the following statements, select Yes if the statement is true. Otherwise, select No. NOTE: Each correct selection is worth one point.

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   

   Next question

8. Question 308 · 392 in bank

   HOTSPOT - You have a Microsoft 365 E5 subscription that contains Windows 11 and Linux CentOS devices. In Microsoft Defender XDR, Deception is set to On. You plan to create a deception rule that will use a custom lure. You need to specify the type of file, and the planting path for the custom lure. What should you specify? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   References

   • Microsoft Learn

   

   Next question

9. Question 309 · 392 in bank

   You have a Microsoft 365 E5 subscription. You need to ensure that an alert is generated in Microsoft Defender XDR when attackers attempt to connect to a specific device. The solution must minimize administrative effort. What should you do in the Microsoft Defender portal?

   • ACreate a deception rule that includes a decoy.
   • BTag an existing device as a honeytoken entity.
   • CCreate a deception rule that includes a lure.
   • DTag an existing device as a sensitive entity.

   Show answer

   Answer: B

   Explanation

   Chat: ✅ Correct Answer: B. Tag an existing device as a honeytoken entity. 🔎 Explanation: A honeytoken entity in Microsoft Defender XDR is a decoy device (or account) used to detect unauthorized access attempts. When an attacker attempts to interact with the honeytoken, it generates an alert without interfering with real business operations.

   Source: Adapted from community discussion — a_kto_to

   Next question

10. Question 310 · 392 in bank

    You have a Microsoft 365 E5 subscription that contains a Microsoft SharePoint Online site named Site1. You need to enable Microsoft Defender for Cloud Apps session control for Site1. Which type of policy should you create first?

    • Aaccess
    • Bsession
    • Capp governance
    • DConditional Access

    Show answer

    Answer: D

    Explanation

    To enable Microsoft Defender for Cloud Apps session control for your SharePoint Online site (Site1), you should create a Conditional Access policy (D) first. This policy will allow you to enforce session controls and integrate with Microsoft Defender for Cloud Apps to monitor and control user activities in real-time1. Create session policies - Microsoft Defender for Cloud Apps

    Source: Adapted from community discussion — MCWDSR

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

SC-200 practice, question 301. 392 questions available.