SC-200 practice questions 51–60

1. Question 51 · 392 in bank

   HOTSPOT - You have a Microsoft 365 E5 subscription that uses Microsoft Defender 365. Your network contains an on-premises Active Directory Domain Services (AD DS) domain that syncs with Azure AD. You need to identify LDAP requests by AD DS users to enumerate AD DS objects. How should you complete the KQL query? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   1. IdentityQueryEvents When considering a table with AccountSid and it's about the LDAP request, it is "IdentityQueryEvents." 2. isnotempty For determining whether there is a value in the AccountSid, it is "isnotempty."

   Source: Adapted from community discussion — trashbox

   References

   • Microsoft Learn
   • Microsoft Learn

   

   Next question

2. Question 52 · 392 in bank

   You have a Microsoft 365 E5 subscription that uses Microsoft Defender 365. You need to ensure that you can investigate threats by using data in the unified audit log of Microsoft Defender for Cloud Apps. What should you configure first?

   • Athe User enrichment settings
   • Bthe Azure connector
   • Cthe Office 365 connector
   • Dthe Automatic log upload settings

   Show answer

   Answer: C

   Explanation

   Answer is C: A. User enrichment settings in the context of Defender for Cloud Apps typically involve enriching user data with additional info from external sources. While user enrichment can be beneficial, it is not directly related to investigating threats using the unified audit log. B. The Azure connector is generally used for connecting Defender for Cloud Apps to Azure services. It is not specifically related to investigating threats in the unified audit log. C. Configuring the Office 365 connector allows Microsoft Defender for Cloud Apps to collect and analyze audit logs, which are vital for investigating and responding to security threats. D. While automatic log upload settings are important for ensuring that the logs are regularly uploaded, it's the configuration of the specific connectors (such as the Office 365 connector) that determines which logs are collected and made available for investigation.

   Source: Adapted from community discussion — Porter5000

   References

   • Microsoft Learn

   Next question

3. Question 53 · 392 in bank

   You have two Microsoft Entra tenants named Tenant1 and Tenant2. Each tenant is linked to an Azure subscription. Tenant1 contains a group named Group1. Tenant2 contains a group named Group2. You need to implement Microsoft Sentinel for each tenant. The solution must meet the following requirements: • Ensure that Group1 can manage security incidents for Tenant1 and Tenant2 in a single workspace. • Ensure that Group2 can manage security incidents only for Tenant2. • Minimize the use of guest accounts. • Minimize administrative effort. • Minimize costs. What should you include in the solution?

   • Aone workspace and Privileged Identity Management (PIM)
   • Bone workspace and multiple role-based access control (RBAC) role assignments
   • Ctwo workspaces and Azure Lighthouse
   • Dtwo workspaces and granular delegated admin privileges (GDAP)

   Show answer

   Answer: C

   Next question

4. Question 54 · 392 in bank

   51 HOTSPOT You have a custom detection rule that includes the following KQL query.

   

   For each of the following statements, select Yes if True. Otherwise, select No. NOTE: Each correct selection is worth one point.

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   NO - https://learn.microsoft.com/en-us/microsoft-365/security/defender/custom-detection-rules?view=o365-worldwide#actions-on-emails "The columns NetworkMessageId and RecipientEmailAddress must be present in the output results of the query to apply actions to email messages." Since NetworkMessageID is not mentioned in the sumarize, it won't work. YES - https://learn.microsoft.com/en-us/microsoft-365/security/defender/custom-detection-rules?view=o365-worldwide#actions-on-devices YES - https://learn.microsoft.com/en-us/microsoft-365/security/defender/custom-detection-rules?view=o365-worldwide#actions-on-files I couldn't actually test it now, but if someone could give it a test to confirm that would be great. :)

   Source: Adapted from community discussion — cris_exam

   References

   • Microsoft Learn

   

   Next question

5. Question 55 · 392 in bank

   You have a Microsoft 365 subscription that uses Microsoft Defender XDR. The subscription contains 500 devices that are joined to Microsoft Entra, are in the Microsoft Defender for Endpoint default device group, and are managed by using Microsoft Intune. You need to implement Microsoft Defender Vulnerability Management. The solution must minimize the administrative effort. What should you do first in the Microsoft Defender portal?

   • AFrom Configuration management, configure the Enforcement scope settings.
   • BConfigure auto remediation for the default device group.
   • CSet Microsoft Intune connection to On.
   • DSet Live Response to On.

   Show answer

   Answer: C

   Next question

6. Question 56 · 392 in bank

   You have 1,000 on-premises Windows 11 Pro devices that are onboarded to Microsoft Defender for Endpoint. You have a Microsoft 365 subscription that uses Microsoft Defender XDR. You identify that an attacker performed the following actions on a device: • Modified the file system path of a registry-based antivirus exclusion • Downloaded a malicious file to the file system path You initiate a live response session on the device. You need to remove the malicious file. Which command should you run?

   • Acollect
   • Bgetfile
   • Cundo
   • Dremediate

   Show answer

   Answer: D

   Next question

7. Question 57 · 392 in bank

   You have an Azure subscription that uses Microsoft Defender for Servers Plan 1 and contains a server named Server1. You enable agentless scanning. You need to prevent Server1 from being scanned. The solution must minimize administrative effort. What should you do?

   • ACreate an exclusion tag.
   • BUpgrade the subscription to Defender for Servers Plan 2.
   • CCreate a governance rule.
   • DCreate an exclusion group.

   Show answer

   Answer: A

   Explanation

   Agentless malware scanning is only available if you have enabled Defender for Servers plan 2 so I assume you need to upgrade plan first

   Source: Adapted from community discussion — Vitalija

   References

   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn

   Next question

8. Question 58 · 392 in bank

   You have a Microsoft 365 subscription that uses Microsoft Defender XDR. All endpoint devices are onboarded to Microsoft Defender for Endpoint. You have an Azure subscription that contains a Microsoft Sentinel workspace named Workspace1. All Microsoft Defender XDR events are ingested into Workspace1. You have a Microsoft Entra tenant. You create a KQL query named query1 that searches device logs for a known vulnerability. You need to ensure that query1 runs every hour. The solution must minimize administrative effort. What should you configure?

   • Aa custom detection rule
   • Bautomated investigation and response (AIR)
   • Ca watchlist
   • Dan automation rule

   Show answer

   Answer: A

   Next question

9. Question 59 · 392 in bank

   HOTSPOT - Your network contains an on-premises Active Directory Domain Services (AD DS) domain that syncs with Azure AD. You have a Microsoft 365 E5 subscription that uses Microsoft Defender 365. You need to identify all the interactive authentication attempts by the users in the finance department of your company. How should you complete the KQL query? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   Signinlogs contains both interactive and non interactive logon events. In this case they specifically want to have interactive logon events hence the Identitylogonevents which only contains those.

   Source: Adapted from community discussion — jinxie

   References

   • Microsoft Learn
   • Microsoft Learn

   

   Next question

10. Question 60 · 392 in bank

    Select 3

    Your company uses Microsoft Defender for Endpoint. The company has Microsoft Word documents that contain macros. The documents are used frequently on the devices of the company's accounting team. You need to hide false positive in the Alerts queue, while maintaining the existing security posture. Which three actions should you perform? Each correct answer presents part of the solution. NOTE: Each correct selection is worth one point.

    • AResolve the alert automatically.
    • BHide the alert.
    • CCreate a suppression rule scoped to any device.
    • DCreate a suppression rule scoped to a device group.
    • EGenerate the alert.

    Show answer

    Answer: BDE

    Explanation

    You can Hide or Resolve alert and all of those actions you can perform on any device or device groups or single device. But in question there is accounting team so there will be device group. Answer should be ABD

    Source: Adapted from community discussion — KingSize

    References

    • Microsoft Learn
    • Microsoft Learn

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

SC-200 practice, question 51. 392 questions available.