SC-200 practice questions 351–360

1. Question 351 · 392 in bank

   HOTSPOT - You have an Azure subscription that contains a Log Analytics workspace named Workspace1. You configure Azure activity logs and Microsoft Entra ID logs to be forwarded to Workspace1. You need to identify which Azure resources have been queried or modified by risky users. How should you complete the KQL query? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   IMO, but i can be wrong 1. Should be MicrosoftGraphActivityLog 2. Should be (parse_url(RequestUri).Path) Explanation Below: Why MicrosoftGraphActivityLog ? We are looking for Azure Resource queried or modified. Microsoft Graph Activity Logs provide details of API requests made to Microsoft Graph for resources in the tenant. Why Parse_url ? By elimination: path_path > SourceSystem - that belongs to Azure Activity does not make sense The type of agent the event was collected by. For example, OpsManager for Windows agent, either direct connect or Operations Manager, Linux for all Linux agents, or Azure for Azure Diagnostics Parse_xml(ATContent) is nowhere to be found. Apparently in AADRiskeyUser but "reserved for future use" Thus we have Parse_url(RequestUri).Path It belongs to MicrosoftGraphActivityLogs It makes sense with the regex we can find after that looks like to contain v1.0', which looks like graph API url.

   Source: Adapted from community discussion — kukuliquid

   References

   • Microsoft Learn
   • Microsoft Learn

   

   Next question

2. Question 352 · 392 in bank

   HOTSPOT - You have a Microsoft 365 subscription that uses Microsoft Defender XDR and contains a Windows device named Device1. You investigate a suspicious process named Prod on Device1 by using a live response session. You need to perform the following actions: • Stop Prod. • Send Prod for further review. Which live response command should you run for each action? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   Stop Proc1: Select: remediate Reason: The remediate command in Microsoft Defender XDR is used to stop a process or remediate a threat. This is the appropriate command to stop the suspicious process named Prod. Send Proc1 for further review: Select: getfile Reason: The getfile command is used to collect a file or process for further analysis. This command is appropriate when you want to send the process or its related files for further review.

   Source: Adapted from community discussion — g_man_rap

   References

   • Microsoft Learn

   

   Next question

3. Question 353 · 392 in bank

   HOTSPOT - You have a Microsoft 365 E5 subscription that uses Microsoft Defender for Endpoint and contains a Windows device named Device1. You need to investigate a suspicious executable file detected on Device1. The solution must meet the following requirements: • Identify the image file path of the file. • Identify when the file was first detected on Device1. What should you review from the timeline of the detection event? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   To identify the image file path: Review the Event entities graph: This graph will display the relationships and interactions involving the file, including the full image file path. By examining the graph, you can trace the file’s creation and its path on Device1. To identify when the file was first detected: Open the file page from Entities: This page provides detailed information about the file, including the timestamp of when the file was first detected on Device1. You can access this information directly from the entities list related to the detection event.

   Source: Adapted from community discussion — laddu001

   

   Next question

4. Question 354 · 392 in bank

   You have a Microsoft 365 subscription that uses Microsoft Defender for Endpoint Plan 2 and contains 1,000 Windows devices. You have a PowerShell script named Script1.ps1 that is signed digitally. You need to ensure that you can run Script1.ps1 in a live response session on one of the devices. What should you do first from the live response session?

   • ARun the library command.
   • BUpload Script1.ps1 to the library.
   • CRun the putfile command.
   • DModify the PowerShell execution policy of the device.

   Show answer

   Answer: B

   References

   • Microsoft Learn

   Next question

5. Question 355 · 392 in bank

   HOTSPOT - You have an Azure subscription that contains a user named User1 and a Microsoft Sentinel workspace named WS1. You deploy Advanced Security Information Model (ASIM) authentication parsers to WS1. You need to use the parsers to query the authentication events generated by User1 during the last 24 hours. The solution must maximize the performance of the query. How should you complete the query? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   References

   • Microsoft Learn

   

   Next question

6. Question 356 · 392 in bank

   HOTSPOT - You need to recommend remediation actions for the Azure Defender alerts for Fabrikam. What should you recommend for each threat? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point. Hot Area:

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   Reference: https://docs.microsoft.com/en-us/azure/key-vault/general/security-features https://docs.microsoft.com/en-us/azure/key-vault/general/secure-your-key-vault

   Source: Adapted from community discussion — swgu

   

   Next question

7. Question 357 · 392 in bank

   You have 500 on-premises Windows 11 devices that use Microsoft Defender for Endpoint. You enable Network device discovery. You need to create a hunting query that will identify discovered network devices and return the identity of the onboarded device that discovered each network device. Which built-in function should you use?

   • ASeenBy()
   • BDeviceFromIP()
   • Cnext()
   • Dcurrent_cluster_endpoint()

   Show answer

   Answer: A

   Explanation

   Correct. By invoking the SeenBy function, in your advanced hunting query, you can get detail on which onboarded device a discovered device was seen by. This information can help determine the network location of each discovered device and subsequently, help to identify it in the network. https://learn.microsoft.com/en-us/defender-endpoint/device-discovery

   Source: Adapted from community discussion — rsanx42

   References

   • Microsoft Learn
   • Microsoft Learn

   Next question

8. Question 358 · 392 in bank

   You have an Azure subscription that contains a resource group named RG1. RG1 contains a Microsoft Sentinel workspace. The subscription is linked to a Microsoft Entra tenant that contains a user named User1. You need to ensure that User1 can deploy and customize Microsoft Sentinel workbook templates. The solution must follow the principle of least privilege. Which role should you assign to User1 for RG1?

   • AMicrosoft Sentinel Contributor
   • BWorkbook Contributor
   • CMicrosoft Sentinel Automation Contributor
   • DContributor

   Show answer

   Answer: B

   Explanation

   Actions Description Microsoft.Insights/workbooks/write Create or update a workbook Microsoft.Insights/workbooks/delete Delete a workbook Microsoft.Insights/workbooks/read Read a workbook Microsoft.Insights/workbooks/revisions/read Get the workbook revisions Microsoft.Insights/workbooktemplates/write Create or update a workbook template Microsoft.Insights/workbooktemplates/delete Delete a workbook template Microsoft.Insights/workbooktemplates/read Read a workbook template https://learn.microsoft.com/en-us/azure/role-based-access-control/built-in-roles/monitor#workbook-contributor

   Source: Adapted from community discussion — Itsmebigal

   References

   • Microsoft Learn

   Next question

9. Question 359 · 392 in bank

   HOTSPOT - You have a Microsoft 365 subscription that uses Microsoft Defender XDR. You need to create a custom detection rule that will identify devices that had more than five antivirus detections within the last 24 hours. How should you complete the query? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   DeviceEvents | where ingestion_time() > ago(1d) | where ActionType == "AntivirusDetection" | summarize (Timestamp, ReportId)=arg_max(Timestamp, ReportId), count() by DeviceId | where count_ > 5

   Source: Adapted from community discussion — smosmo

   References

   • Microsoft Learn

   

   Next question

10. Question 360 · 392 in bank

    HOTSPOT - You need to build a KQL query in a Microsoft Sentinel workspace. The query must return the SecurityEvent record for accounts that have the last record with an EventID value of 4624. How should you complete the query? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.

    

    This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

    Show the answer figure

    Answer: See figure below

    

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

SC-200 practice, question 351. 392 questions available.