SC-200 practice questions 331–340

1. Question 331 · 392 in bank

   You have a Microsoft 365 subscription that uses Microsoft Defender XDR. You are investigating an attacker that is known to use the Microsoft Graph API as an attack vector. The attacker performs the tactics shown the following table.

   

   You need to search for malicious activities in your organization. Which tactics can you analyze by using the MicrosoftGraphActivityLogs table?

   • ATactic1 only
   • BTactic2 only
   • CTactic1 and Tactic3 only
   • DTactic2 and Tactic3 only
   • ETactic1, Tactic2, and Tactic3

   Show answer

   Answer: E

   Explanation

   is options are incorrect: Tactic3: Deletes Azure virtual machines Deleting Azure virtual machines is more of an Azure Resource Manager (ARM) operation rather than a Microsoft 365 or Microsoft Graph API-specific action. This would typically be logged in Azure Activity Logs, not the MicrosoftGraphActivityLogs.

   Source: Adapted from community discussion — g_man_rap

   Next question

2. Question 332 · 392 in bank

   HOTSPOT - You have an Azure subscription that contains a Microsoft Sentinel workspace named WS1. You need to ensure that the incidents in WS1 include a list of actions that must be performed. The solution must meet the following requirements: • Ensure that you can build a tailored list of actions for each type of incident. • Minimize administrative effort. What should you do? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   Document the actions by configuring: Tasks Tasks are used in Microsoft Sentinel to document the specific actions that need to be taken when responding to an incident. This allows you to create a checklist or playbook of actions, ensuring that all steps are followed according to the defined procedures. Build the list of actions by selecting: Incident settings Incident settings allow you to define how incidents are managed, including specifying the actions that need to be taken. This configuration helps in customizing the response process for different types of incidents, ensuring a tailored approach while minimizing the administrative burden.

   Source: Adapted from community discussion — g_man_rap

   References

   • Microsoft Learn

   

   Next question

3. Question 333 · 392 in bank

   HOTSPOT - You have a Microsoft 365 subscription that uses Microsoft Defender for Endpoint Plan 2 and contains a Windows device named Device1. You initiate a live response session on Device1 and launch an executable file named File1.exe in the background. You need to perform the following actions: • Identify the command ID of File1.exe. • Interact with File1.exe. Which live response command should you run for each action? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   jobs: In live response, background tasks (e.g., scripts or async commands) are tracked as jobs. Example: If you ran run File1.exe or a script to launch it in the background, jobs lists it with a Command ID (e.g., “Cmd_1234”). Assumption: “Background” implies a job-like execution, making jobs the best fit. fg: Defender live response borrows from job control concepts (e.g., Unix-like fg for foreground). Example: After identifying the Command ID (e.g., Cmd_1234 from jobs), run fg Cmd_1234 to interact with File1.exe. Assumption: “Interact” means resuming control of the background process.

   Source: Adapted from community discussion — Optimizor_IT

   References

   • Microsoft Learn
   • Microsoft Learn

   

   Next question

4. Question 334 · 392 in bank

   HOTSPOT - You have a Microsoft 365 subscription that uses Microsoft Purview and contains a Microsoft SharePoint Online site named Site1. Site1 contains the files shown in the following table.

   

   From Microsoft Purview, you create the content search queries shown in the following table.

   

   For each of the following statements, select Yes if the statement is true. Otherwise, select No. NOTE: Each correct selection is worth one point.

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   Keep in mind: https://learn.microsoft.com/en-us/purview/ediscovery-keyword-queries-and-search-conditions Using quotes stops wild cards and any operations inside the quotes The Boolean operators AND, OR, NOT, and NEAR must be uppercase. A space between two keywords or two property:value expressions is the same as using OR

   Source: Adapted from community discussion — smosmo

   References

   • Microsoft Learn

   

   Next question

5. Question 335 · 392 in bank

   You have a Microsoft Sentinel workspace named SW1. In SW1, you investigate an incident that is associated with the following entities: • Host • IP address • User account • Malware name Which entity can be labeled as an indicator of compromise (IoC) directly from the incident's page?

   • Amalware name
   • Bhost
   • Cuser account
   • DIP address

   Show answer

   Answer: D

   References

   • Microsoft Learn

   Next question

6. Question 336 · 392 in bank

   HOTSPOT - You have a Microsoft 365 subscription that uses Microsoft Defender XDR and Microsoft Defender for Endpoint. The subscription contains the devices shown in the following table.

   

   You discover the following forensic data: • During the startup of Device1, a connection is established to Device2 via port 5555. • Device2 connects to Device3 by using port 5555. • Device4 connects to Device1 by using port 5555. You perform the following actions: • Initiate a live response session on Device1 and run the processes • From Devices in the Microsoft Defender portal, isolate Device1 and Device2. For each of the following statements, select Yes if True. Otherwise select No. NOTE: Each correct selection is worth one point.

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   There is no such thing as Autoruns command in live response, the closest command is startupfolders. Here the command is "processes" that doesn't return startup processes. so it should be Y,N,N

   Source: Adapted from community discussion — Tuitor01

   

   Next question

7. Question 337 · 392 in bank

   HOTSPOT - You have a Microsoft 365 E5 subscription that uses Microsoft Defender XDR and contains a Windows device named Device1. You detect malicious activity on Device1. You initiate a live response session on Device1. You need to perform the following actions: • Download a file from the live response library. • Stop a process that is running on Device1. Which live response command should you run for each action? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   putfile Puts a file from the library to the device. Files are saved in a working folder and are deleted when the device restarts by default. It's indeed put file; get file is sued to download a file from the device na don't from the library

   Source: Adapted from community discussion — Tuitor01

   References

   • Microsoft Learn

   

   Next question

8. Question 338 · 392 in bank

   You have a Microsoft 365 subscription that uses Microsoft Defender for Endpoint and contains the devices shown in the following table.

   

   You initiate a live response session on each device. You need to collect a Defender for Endpoint investigation package from each device. On which devices can you collect the package by running advanced live response commands from the command-line interface (CLI)?

   • ADevice1 and Device2 only
   • BDevice1, Device2, and Device3 only
   • CDevice3 and Device4 only
   • DDevice1, Device2, Device3, and Device4

   Show answer

   Answer: C

   Explanation

   Answer is device 3 and 4 collect ---> Collects forensics package from device. N (windows ) Y (linux) Y (mac) https://learn.microsoft.com/en-us/defender-endpoint/live-response

   Source: Adapted from community discussion — Onimole

   References

   • Microsoft Learn

   Next question

9. Question 339 · 392 in bank

   HOTSPOT - You have a Microsoft Sentinel workspace. You need to configure the Fusion analytics rule to temporarily suppress incidents generated by a Microsoft Defender connector. The solution must meet the following requirements: • Minimize impact on the ability to detect multistage attacks. • Minimize administrative effort. How should you configure the rule? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   The question explicitly states "configure the Fusion analytics rule." Fusion is designed to analyze incidents, not individual alerts. Therefore, the trigger must be based on incidents.Trigger: When incident is created Actions: Change status

   Source: Adapted from community discussion — HAjouz

   

   Next question

10. Question 340 · 392 in bank

    You have a Microsoft Sentinel workspace. You are investigating an incident that involves multiple alerts, events, and entities. You need to create a bookmark for the investigation. The solution must minimize administrative effort. Which settings should you use?

    • AIncidents
    • BHunting
    • CContent hub
    • DLogs

    Show answer

    Answer: B

    Explanation

    GPT4: Here’s why Hunting is the appropriate setting: Hunting: This is where you can run queries to proactively search for threats in your environment. When you find something suspicious or noteworthy during your hunting activities, you can create a bookmark to save the specific event or finding for further investigation or correlation with other data.

    Source: Adapted from community discussion — chirva

    References

    • Microsoft Learn

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

SC-200 practice, question 331. 392 questions available.