SC-200 practice questions 361–370

1. Question 361 · 392 in bank

   You have a Microsoft 365 subscription that contains a user named User1 and two Windows devices named Device1 and Device2. Device1 and Device2 are onboarded to Microsoft Defender for Endpoint. The following events occur. • User1 signs in to Device1. • Automatic attack disruption in Microsoft Defender XDR responds to an attack on Device1 and contains User1. • User1 attempts to connect to Device2. Which protocols will Device2 block when User1 attempts to connect to Device2?

   • ARDP only
   • BRPC only
   • CSMB only
   • DRDP and RPC only
   • ESMB and RPC only
   • FRDP, RPC, and SMB

   Show answer

   Answer: F

   Explanation

   When Automatic Attack Disruption in Microsoft Defender XDR contains a user due to an identified attack, it takes specific actions to isolate the user and prevent the spread of the attack. One of these actions is blocking specific protocols to limit lateral movement and access to other devices. For User1, attempting to connect to another device (Device2) after being contained will result in blocking access via the following protocols: RDP (Remote Desktop Protocol): Commonly used for remote management and often exploited in lateral movement attacks. RPC (Remote Procedure Call): Used for remote execution of tasks and communication between Windows systems; also a common target for attackers. SMB (Server Message Block): Facilitates file sharing and other operations between devices. Attackers frequently exploit SMB vulnerabilities for lateral movement and data exfiltration.

   Source: Adapted from community discussion — trut_hz

   References

   • Microsoft Learn

   Next question

2. Question 362 · 392 in bank

   You have an Azure subscription that contains a Microsoft Sentinel workspace named WS1. WS1 has the Azure Activity connector and the Microsoft Entra ID connector configured. You need to investigate which accounts have the most alerts and any corresponding incident information for each alert. The solution must minimize administrative effort. What should you do first in WS1?

   • AUse User and Entity Behavior Analytics (UEBA) to detect anomalies.
   • BEnable User and Entity Behavior Analytics (UEBA).
   • CFrom Content hub, install the Microsoft Purview insider risk management solution.
   • DFrom Content hub, install Cloud Identity Threat Protection Essentials.

   Show answer

   Answer: B

   Next question

3. Question 363 · 392 in bank

   You have a Microsoft 365 E5 subscription that uses Microsoft Copilot for Security. You plan to run the following code to create a custom Copilot for Security plugin.

   

   You need to specify a format and complete the code segment.

   

   Which format should you use for the variable?

   • AAPI
   • BGPT
   • CKQL
   • DSQL

   Show answer

   Answer: C

   Explanation

   Incorrect, According to https://learn.microsoft.com/en-us/copilot/security/custom-plugins Although it can use API as a format originally when setting up, when creating a CoPilot Custom Plugin using the Skills Field, API cannot be used at all, leaving only GPT or KQL. When using this however, i would go with KQL as a specified format.

   Source: Adapted from community discussion — RoombaDoinZoomba

   References

   • Microsoft Learn
   • Microsoft Learn

   Next question

4. Question 364 · 392 in bank

   You have a Microsoft 365 E5 subscription that uses Microsoft Defender XDR. You are investigating an incident. You need to review the incident tasks that were performed. What can you use on the Incident page?

   • ATasks only
   • BTasks and Activity log only
   • CTasks and Alert timeline only
   • DTasks, Activity log, and Alert timeline

   Show answer

   Answer: B

   References

   • Microsoft Learn

   Next question

5. Question 365 · 392 in bank

   HOTSPOT - You have an Azure subscription. You have a Microsoft Sentinel workbook that contains the following text parameters: • text1 • grouptime1 You need to display the count of security alerts. The count must be filtered based on the text1 parameter and grouped by the grouptime1 parameter. How should you complete the KOL query? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   

   Next question

6. Question 366 · 392 in bank

   HOTSPOT - You have a Microsoft 365 subscription that contains a Windows device named Device1. Device1 is onboarded to Microsoft Defender for Endpoint. You initiate a live response session on Device1. You need to execute a long running script. The solution must ensure that you can run additional commands during the session while the script is running. How should you complete the live response command? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   I think Correct command:run script1.ps1 & The run command is used in Microsoft Defender for Endpoint's live response session to execute scripts or commands. This command is specifically designed to allow running scripts or executables during a live response session.

   Source: Adapted from community discussion — KellyCZ

   References

   • Microsoft Learn

   

   Next question

7. Question 367 · 392 in bank

   HOTSPOT - You have an Azure subscription that contains a user named User1 and a Microsoft Sentinel workspace named WS1. You need to ensure that User1 can enable User and Entity Behavior Analytics (UEBA) for WS1. The solution must follow the principle of least privilege. Which roles should you assign to User1? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   References

   • Microsoft Learn
   • Microsoft Learn

   

   Next question

8. Question 368 · 392 in bank

   You need to recommend a solution to meet the technical requirements for the Azure virtual machines. What should you include in the recommendation?

   • Ajust-in-time (JIT) access
   • BAzure Defender
   • CAzure Firewall
   • DAzure Application Gateway

   Show answer

   Answer: B

   Explanation

   Correct answer. I first went to just-in-time, but this is for hardening the network against brute force, while Defender for Cloud (Azure Defender) is to harden the virual machine itself against brute force attacks. "^Defender for Cloud^ helps you limit exposure to ^brute force attacks^. By reducing access to virtual machine ports, using the just-in-time VM access, you can ^harden your network^ by preventing unnecessary access." Ref: https://docs.microsoft.com/en-us/azure/defender-for-cloud/defender-for-cloud-introduction#defend-your-azure-native-resources

   Source: Adapted from community discussion — Lion007

   References

   • Microsoft Learn

   Next question

9. Question 369 · 392 in bank

   HOTSPOT - You have a Microsoft 365 E5 subscription that uses Microsoft Exchange Online. You identify the suspicious emails shown in the following table.

   

   In Microsoft Purview, you create the content searches shown in the following table.

   

   For each of the following statements, select Yes if the statement is true. Otherwise, select No. NOTE: Each correct selection is worth one point.

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   

   Next question

10. Question 370 · 392 in bank

    You have a Microsoft 365 E5 subscription that uses Microsoft Copilot for Security. You have a Copilot for Security workspace that uses the following plugins: • Microsoft Entra • Microsoft Defender XDR From the Microsoft Defender portal, you use Copilot for Security to investigate a reported incident. You need to run a promptbook that will include information from Microsoft Entra ID Protection in the investigation. What should you do first?

    • AFrom the Microsoft Defender portal, create an incident report.
    • BOpen the investigation in the Copilot for Security standalone experience.
    • COpen the investigation in Microsoft Sentinel.
    • DFrom the Microsoft Defender portal, create an advanced hunting query.

    Show answer

    Answer: B

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

SC-200 practice, question 361. 392 questions available.