SC-200 practice questions 341–350

1. Question 341 · 392 in bank

   HOTSPOT - You have an Azure subscription that contains the users shown in the following table.

   

   The subscription contains instances of Azure Firewall as shown in the following table.

   

   You have a Microsoft 365 E5 subscription that uses Microsoft Copilot for Security. You have the Copilot for Security role assignments shown in the following table.

   

   Each user runs a Copilot for Security session. For each of the following statements, select Yes if the statement is true. Otherwise, select No. NOTE: Each correct selection is worth one point.

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   

   Next question

2. Question 342 · 392 in bank

   You have a Microsoft 365 E5 subscription that contains a user named User1. The subscription uses Microsoft 365 Copilot for Security. Copilot for Security uses the Sentinel plugin. User1 is assigned the Copilot Contributor role. During an investigation, User1 submits a prompt and receives a notification that Copilot for Security cannot respond to requests because the security compute unit (SCU) usage is nearing the provisioned capacity limit. You need to ensure that User1 can use Copilot for Security to generate a successful response. What should User1 do?

   • AWait one hour and resubmit the prompt.
   • BUpdate the provisioned SCUs.
   • CRun the Microsoft Sentinel Optimization Workbook.
   • DOpen a second Copilot for Security session and submit the prompt.

   Show answer

   Answer: B

   Explanation

   When the usage in your organization is nearing the limit, you are notified of it when submitting the prompts. To avoid disruption, you can contact the Azure capacity owner or contributor to increase the security compute units or limit the number of prompts. https://learn.microsoft.com/en-us/copilot/security/manage-usage

   Source: Adapted from community discussion — Blasty

   References

   • Microsoft Learn

   Next question

3. Question 343 · 392 in bank

   You have a Microsoft Sentinel workspace. You are investigating an incident that involves the following entities: • A host named Host1 • A user account named User1 • An IP address of 175.45.176.99 You need to update the threat intelligence list to include the entities. Which entities can you add on the Incident page?

   • A175.45.176.99 only
   • BHost1 only
   • CUser1 only
   • D175.45.176.99 and Host1 only
   • EHost1 and User1 only
   • F175.45.176.99, Host1, and User1

   Show answer

   Answer: A

   Explanation

   Add only the following types of entities as threat indicators: Domain name IP address (IPv4 and IPv6) URL File (hash) https://learn.microsoft.com/en-us/defender-endpoint/live-response

   Source: Adapted from community discussion — 54c341a

   References

   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn

   Next question

4. Question 344 · 392 in bank

   HOTSPOT - You have an Azure subscription named Sub1 that contains the resources shown in the following table.

   

   You plan to configure Rule1 to trigger Lapp1 when an incident is generated. You need to recommend the role-based access control (RBAC) role that you should assign to WS1, and the scope at which should you assign the role. The solution must follow the principle of least privilege. What should you recommend? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   

   Next question

5. Question 345 · 392 in bank

   DRAG DROP - You have an on-premises Windows 11 Pro device named Device1 that is onboarded to Microsoft Defender for Endpoint. You have a Microsoft 365 subscription. You need to identify the processes running on Device1 and which network connections the processes have open. The solution must minimize administrative effort. Which four actions should you perform in the Microsoft Defender portal in sequence? To answer, move the appropriate actions from the list of actions to the answer area and arrange them in the correct order.

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   References

   • Microsoft Learn
   • Microsoft Learn

   

   Next question

6. Question 346 · 392 in bank

   HOTSPOT - You have the Azure subscriptions shown in the following table.

   

   You have a Microsoft Entra tenant that contains the users shown in the following table.

   

   The users have the Azure roles shown in the following table.

   

   You configure Microsoft Copilot for Security capacities as shown in the following table.

   

   For each of the following statements, select Yes if the statement is true. Otherwise, select No. NOTE: Each correct selection is worth one point.

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   

   Next question

7. Question 347 · 392 in bank

   HOTSPOT - You have an Azure subscription name Sub1 that is linked to a Microsoft Entra tenant named contoso.com. Sub1 contains a Log Analytics workspace named Workspace1. All the logs from contoso.com are streamed to Workspace1. You have a Microsoft 365 E5 subscription. You need to query Workspace1 for the following: • HTTP requests to the Microsoft Graph service of contoso.com • Third-party app sign-in activities that use certificates or secrets How should you complete the KQL query? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   

   Next question

8. Question 348 · 392 in bank

   HOTSPOT - You have a Microsoft 365 E5 subscription that contains a Microsoft SharePoint Online site named Site1. In Site1, you identify the suspicious files shown in the following table.

   

   In Microsoft Purview, you create the content searches shown in the following table.

   

   For each of the following statements, select Yes if the statement is true. Otherwise, select No. NOTE: Each correct selection is worth one point.

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   References

   • Microsoft Learn

   

   Next question

9. Question 349 · 392 in bank

   You have an Azure subscription that contains a user named User1 and a Microsoft Sentinel workspace named WS1. WS1 uses Microsoft Defender for Cloud. You have the Microsoft security analytics rules shown in the following table.

   

   User1 performs an action that matches Rule1, Rule2, Rule3, and Rule4. How many incidents will be created in WS1?

   • A1
   • B2
   • C3
   • D4

   Show answer

   Answer: D

   Explanation

   1 analytics rule generates alerts based on the KQL query you use, these alerts are grouped together or not , according to you configuration choice and these alerts can be turned into incidents if you so choose. You can group the incidents into one single incidents too based on multiple factors like, say: all common entities, or one common entity or again, group them all together no matter what the entities are. This is all configurable on a per Analytics Rule basis. So One Analytics Rule generates one incident or alert or multiple incidents or alerts . Here You have four Analytics rules that detect different things where all the conditions for each rules match a particular event. So 1 incident at least per rule would be created following that logic, therefore 4 incidents.

   Source: Adapted from community discussion — Tuitor01

   References

   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn

   Next question

10. Question 350 · 392 in bank

    You have an on-premises network. You have a Microsoft 365 E5 subscription that uses Microsoft Defender for Identity. From the Microsoft Defender portal, you investigate an incident on a device named Device1 of a user named User1. The incident contains the following Defender for Identity alert. Suspected identity theft (pass-the-ticket) (external ID 2018) You need to contain the incident without affecting users and devices. The solution must minimize administrative effort. What should you do?

    • ADisable User1 only.
    • BQuarantine Device1 only.
    • CReset the password for all the accounts that previously signed in to Device1.
    • DDisable User1 and quarantine Device1.
    • EDisable User1, quarantine Device1, and reset the password for all the accounts that previously signed in to Device1.

    Show answer

    Answer: E

    Explanation

    The “Pass-the-Ticket” attack is a method where an attacker steals a Kerberos ticket and uses it from a different device. The attack is based on the theft of a ticket and not on the theft of an account’s credentials, so disabling User1 or resetting passwords would not necessarily contain the incident. Quarantining Device1 would prevent the stolen ticket from being used further without affecting other users or devices. This approach also minimizes administrative effort as it focuses on the device where the incident was identified.

    Source: Adapted from community discussion — Hawklx

    References

    • Microsoft Learn

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

SC-200 practice, question 341. 392 questions available.