SC-200 practice questions 371–380

1. Question 371 · 392 in bank

   You have a Microsoft 365 E5 subscription that uses Microsoft Copilot for Security. You start a Copilot for Security session and enter five prompts that each provide responses. You need to create a promptbook that will use the prompts but will NOT contain the responses. The solution must minimize administrative effort. What should you do?

   • ASelect each prompt, and then select Create promptbook.
   • BCreate a new promptbook and include each prompt.
   • CEnter a new prompt that has the following input: Create a promptbook from my session prompts.
   • DShare the session, and then select Create promptbook.

   Show answer

   Answer: A

   Explanation

   Option C: Entering a new prompt such as "Create a promptbook from my session prompts" is not a recognized command in Security Copilot. The system does not support creating promptbooks through natural language prompts. Option D: Sharing a session allows collaboration but does not provide an option to create a promptbook directly from the shared session. The "Create promptbook" function is separate and requires manual selection of prompts.

   Source: Adapted from community discussion — trut_hz

   References

   • Microsoft Learn

   Next question

2. Question 372 · 392 in bank

   You have 1,000 on-premises Windows 11 Pro devices that are onboarded to Microsoft Defender for Endpoint. You have a Microsoft 365 subscription that uses Microsoft Defender XDR. You identify that an attacker performed the following actions on a device: • Modified the filesystem path of a registry-based antivirus exclusion • Downloaded a malicious file to the file system path You initiate a live response session on the device. You need to undo the registry change. Which command should you run?

   • Aremediate
   • Bregistry
   • Cscan
   • Danalyze

   Show answer

   Answer: A

   Explanation

   A - remediate - is the correct answer to remediate the registry B - registry - this just shows the registries, you cannot do anything else C - scan - this will scan and remediate malware, not modified registries D - analyze - same as scan, it does not provide any form of restoration Ref- https://learn.microsoft.com/en-us/defender-endpoint/live-response

   Source: Adapted from community discussion — xRiot007

   References

   • Microsoft Learn

   Next question

3. Question 373 · 392 in bank

   Your on-premises network contains two Active Directory Domain Services (AD DS) domains named contoso.com and fabrikam.com. Contoso.com contains a group named Group1. Fabrikam.com contains a group named Group2. You have a Microsoft Sentinel workspace named WS1 that contains a scheduled query rule named Rule1. Rule1 generates alerts in response to anomalous AD DS security events. Each alert creates an incident. You need to implement an incident triage solution that meets the following requirements: • Security incidents from contoso.com must be assigned to Group1. • Security incidents from fabrikam.com must be assigned to Group2. • Administrative effort must be minimized. What should you include in the solution?

   • Aa playbook that is triggered by the creation of an incident
   • Ba playbook that is triggered by the creation of an alert
   • Cone automation rule assigned to Rule1
   • Dtwo automation rules assigned to Rule1

   Show answer

   Answer: D

   Next question

4. Question 374 · 392 in bank

   You have a Microsoft 365 subscription. You have the following KQL query.

   

   You need to ensure that you can create a Microsoft Defender XDR custom detection rule by using the query. What should you add to the query?

   • A| summarize (Timestamp, ReportId)=arg_max(Timestamp, ReportId), count() by DeviceId
   • B| summarize (ReportId)=make_set(ReportId), count() by DeviceId
   • C| summarize (Timestamp, DeviceName)=arg_min(Timestamp, DeviceName), count() by DeviceId
   • D| summarize (Timestamp)=range(Timestamp), count() by DeviceId

   Show answer

   Answer: A

   Next question

5. Question 375 · 392 in bank

   HOTSPOT - You have a Microsoft 365 E5 subscription that uses Microsoft Defender for Office 365. You need to build a hunting query that will list events involving potentially malicious emails that were detected but NOT removed successfully from mailboxes after delivery. The solution must ensure that the events are correlated with the sign-in events of the email recipients. How should you complete the query? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   ZAP - if ZAP fails (ActionResult == "Error"), the email is detected, but not removed. AccountUpn - this correlates with the user email

   Source: Adapted from community discussion — xRiot007

   

   Next question

6. Question 376 · 392 in bank

   DRAG DROP - You have a Microsoft Sentinel workspace named SW1. In SW1, you enable User and Entity Behavior Analytics (UEBA). You need to use KQL to perform the following tasks: • View the entity data that has fields for each type of entity. • Assess the quality of rules by analyzing how well a rule performs. Which table should you use in KQL for each task? To answer, drag the appropriate tables to the correct tasks. Each table may be used once, more than once, or not at all. You may need to drag the split bar between panes or scroll to view content. NOTE: Each correct selection is worth one point.

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   

   Next question

7. Question 377 · 392 in bank

   Your on-premises network contains an Active Directory Domain Services (AD DS) forest. You have a Microsoft Entra tenant that uses Microsoft Defender for Identity. The AD DS forest syncs with the tenant. You need to create a hunting query that will identify LDAP simple binds to the AD DS domain controllers. Which table should you query?

   • AAADServicePrincipalRiskEvents
   • BAADDomainServicesAccountLogon
   • CSigninLogs
   • DIdentityLogonEvents

   Show answer

   Answer: D

   References

   • Microsoft Learn
   • Microsoft Learn

   Next question

8. Question 378 · 392 in bank

   HOTSPOT - You have a Microsoft 365 subscription. You need to identify all the security principals that submitted requests to change or delete groups. How should you complete the KQL query? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   The original answer is correct but this explanation is false RequestMethod DIFFERS FROM "GET" meaning it will return requests that are not simple get, but can be POST, PUT, UPDATE, DELETE...

   Source: Adapted from community discussion — kukuliquid

   

   Next question

9. Question 379 · 392 in bank

   You have a Microsoft 365 subscription that uses Microsoft Defender for Endpoint Plan 2 and contains a macOS device named Device1. You need to investigate a Defender for Endpoint agent alert on Device1. The solution must meet the following requirements: • Identify all the active network connections on Device1. • Identify all the running processes on Device1. • Retrieve the login history of Device1. • Minimize administrative effort. What should you do first from the Microsoft Defender portal?

   • AFrom Devices, click Collect investigation package for Device1.
   • BFrom Advanced features in Endpoints, enable Live Response unsigned script execution.
   • CFrom Devices, initiate a live response session on Device1.
   • DFrom Advanced features in Endpoints, disable Authenticated telemetry.

   Show answer

   Answer: A

   Explanation

   Answer A: The investigation package collected by defender includes all the required information and is considerable less admin effort than running a live response session and collecting this information interactively. https://learn.microsoft.com/en-us/defender-endpoint/respond-machine-alerts?view=o365-worldwide#collect-investigation-package-from-devices

   Source: Adapted from community discussion — wheeldj

   References

   • Microsoft Learn

   Next question

10. Question 380 · 392 in bank

    HOTSPOT - You have a Microsoft Sentinel workspace. You plan to visualize data from Microsoft SharePoint Online and OneDrive sites. You need to create a KQL query for the visual. The solution must meet the following requirements: • Select all workloads as a single operation. • Include two parameters named Operations and Users. • In the results, exclude empty values for the site URLs. How should you complete the query? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.

    

    This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

    Show the answer figure

    Answer: See figure below

    Explanation

    OfficeActivity | where Operation in ((Operations)) | where OfficeWorkload in ('OneDrive', 'SharePoint') | where SiteUrl != " " | summarize Number = count() by Site_Url, UserId, Operation, TimeGenerated First Dropdown: where Operation in ((Operations)) Second Dropdown: where SiteUrl != " "

    Source: Adapted from community discussion — g_man_rap

    

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

SC-200 practice, question 371. 392 questions available.