SC-200 practice questions 381–390

1. Question 381 · 392 in bank

   HOTSPOT - You have a Microsoft Sentinel workspace that contains a custom workbook. You need to query for a summary of security events. The solution must meet the following requirements: • Identify the number of security events ingested during the past week. • Display the count of events by day in a chart. How should you complete the query? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   SecurityEvent | where TimeGenerated >= ago(7d) // Filter events from the past 7 days | summarize EventCount = count() by bin(TimeGenerated, 1d) // Count events per day | render timechart

   Source: Adapted from community discussion — laddu001

   

   Next question

2. Question 382 · 392 in bank

   HOTSPOT - You have a Microsoft Sentinel workspace that contains a custom workbook named Workbook1. You need to create a visual in Workbook1 that will display the logon count for accounts that have logon event IDs of 4624 and 4634. How should you complete the query? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   answer from GPT4 let Logons = SecurityEvent | where EventID == 4624 | summarize LogonCount = count() by AccountName; let Logoffs = SecurityEvent | where EventID == 4634 | summarize LogoffCount = count() by AccountName; Logons | join kind=inner (Logoffs) on AccountName | project AccountName, LogonCount, LogoffCount | render barchart

   Source: Adapted from community discussion — jumborca

   

   Next question

3. Question 383 · 392 in bank

   You need to complete the query for failed sign-ins to meet the technical requirements. Where can you find the column name to complete the where clause?

   • ASecurity alerts in Azure Security Center
   • BActivity log in Azure
   • CAzure Advisor
   • Dthe query windows of the Log Analytics workspace

   Show answer

   Answer: D

   Explanation

   D is correct. By increasing the time window, we would know if the failed sign ins are common or suspecious. The corrected code would be something like: BehaviorAnalytics | where ActivityType == "FailedLogOn" | extend ActivityInsightsArray=parse_json(ActivityInsights) | extend UnusualFailedSignIns = tostring(parse_json(ActivityInsightsArray).UnusualNumberOfFailedSignInOfThisUser) | where UnusualFailedSignIns == True | summarize count() by SourceIPLocation, UserName | order by count_ desc

   Source: Adapted from community discussion — Lion007

   References

   • Microsoft Learn
   • Microsoft Learn

   Next question

4. Question 384 · 392 in bank

   You need to remediate active attacks to meet the technical requirements. What should you include in the solution?

   • AAzure Automation runbooks
   • BAzure Logic Apps
   • CAzure Functions
   • DAzure Sentinel livestreams

   Show answer

   Answer: B

   Explanation

   "Playbooks in Azure Sentinel are based on workflows built in Azure Logic Apps, a cloud service that helps you schedule, automate, and orchestrate tasks and workflows across systems throughout the enterprise. This means that playbooks can take advantage of all the power and customizability of Logic Apps' built-in templates."

   Source: Adapted from community discussion — AlaReAla

   Next question

5. Question 385 · 392 in bank

   HOTSPOT - You need to create an advanced hunting query to investigate the executive team issue. How should you complete the query? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point. Hot Area:

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   users hunting through file-related activities in cloud services should use the CloudAppEvents table instead [Column name: ActivityObjects - List of objects, such as files or folders, that were involved in the recorded activity] https://docs.microsoft.com/en-us/microsoft-365/security/defender/advanced-hunting-cloudappevents-table?view=o365-worldwide

   Source: Adapted from community discussion — fr54fr

   References

   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn

   

   Next question

6. Question 386 · 392 in bank

   HOTSPOT - You need to implement Azure Sentinel queries for Contoso and Fabrikam to meet the technical requirements. What should you include in the solution? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point. Hot Area:

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   Reference: https://docs.microsoft.com/en-us/azure/sentinel/extend-sentinel-across-workspaces-tenants

   References

   • Microsoft Learn

   

   Next question

7. Question 387 · 392 in bank

   Select 2

   You need to restrict cloud apps running on CLIENT1 to meet the Microsoft Defender for Endpoint requirements. Which two configurations should you modify? Each correct answer present part of the solution. NOTE: Each correct selection is worth one point.

   • Athe Onboarding settings from Device management in Microsoft Defender Security Center
   • BCloud App Security anomaly detection policies
   • CAdvanced features from Settings in Microsoft Defender Security Center
   • Dthe Cloud Discovery settings in Cloud App Security

   Show answer

   Answer: CD

   Explanation

   Nope - the given answers are correct. Check the provided link. It's a two part process: - Block unsanctioned apps via Cloud Discovery in MCAS - Enable advanced 'Custom network indicators' within Microsoft 365 Defender

   Source: Adapted from community discussion — Harold_Finch

   Next question

8. Question 388 · 392 in bank

   DRAG DROP - You need to add notes to the events to meet the Azure Sentinel requirements. Which three actions should you perform in sequence? To answer, move the appropriate actions from the list of action to the answer area and arrange them in the correct order. Select and Place:

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   Reference: https://docs.microsoft.com/en-us/azure/sentinel/bookmarks

   References

   • Microsoft Learn

   

   Next question

9. Question 389 · 392 in bank

   HOTSPOT - You need to configure the Azure Sentinel integration to meet the Azure Sentinel requirements. What should you do? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point. Hot Area:

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   Reference: https://docs.microsoft.com/en-us/cloud-app-security/siem-sentinel

   Source: Adapted from community discussion — Lion007

   References

   • Microsoft Learn
   • Microsoft Learn

   

   Next question

10. Question 390 · 392 in bank

    You need to assign a role-based access control (RBAC) role to admin1 to meet the Azure Sentinel requirements and the business requirements. Which role should you assign?

    • AAutomation Operator
    • BAutomation Runbook Operator
    • CAzure Sentinel Contributor
    • DAzure Sentinel Responder

    Show answer

    Answer: C

    Explanation

    Azure Sentinel Contributor is the only provided correct role. If "Log Analytics Contributor" or "Microsoft Sentinel Automation Contributor" they would be better suited to meet the business requirement for least privilege. Contributor: "Grants full access to manage all resources, but does not allow you to assign roles in Azure RBAC, manage assignments in Azure Blueprints, or share image galleries." Ref https://docs.microsoft.com/en-us/azure/role-based-access-control/built-in-roles#contributor

    Source: Adapted from community discussion — Lion007

    References

    • Microsoft Learn
    • Microsoft Learn

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

SC-200 practice, question 381. 392 questions available.