SC-200 practice questions 71–80

1. Question 71 · 392 in bank

   You have a Microsoft Sentinel workspace named Workspace1 and a firewall named FW1. FW1 logs are ingested into Workspace1. Typically, firewall events are ingested approximately two minutes after the event occurs, and occasionally up to five minutes after. A scheduled analytics rule runs every five minutes and queries the TimeGenerated value for the last five minutes. You need to minimize missed detections caused by ingestion delays and prevent duplicate alerts across rule runs. How should you change the analytics rule query?

   • AIncrease the rule frequency to one minute and keep the lookback window on TimeGenerated at five minutes.
   • BKeep the lookback window on TimeGenerated at five minutes and add | where ingestion_time() > ago(5m).
   • CIncrease the lookback window on TimeGenerated to 10 minutes and add | where ingestion_time() > ago(5m).
   • DIncrease the lookback window on TimeGenerated to 10 minutes and do NOT add ingestion_time() filter.

   Show answer

   Answer: B

   Next question

2. Question 72 · 392 in bank

   You have a Microsoft 365 E5 subscription that contains 100 Windows 10 devices. You onboard the devices to Microsoft Defender 365. You need to ensure that you can initiate remote shell connections to the onboarded devices from the Microsoft 365 Defender portal. What should you do first?

   • AModify the permissions for Microsoft 365 Defender.
   • BCreate a device group.
   • CFrom Advanced features in the Endpoints settings of the Microsoft 365 Defender portal, enable automated investigation.
   • DConfigure role-based access control (RBAC).

   Show answer

   Answer: C

   Explanation

   To initiate remote shell connections to onboarded devices from the Microsoft 365 Defender portal, you need to enable Live Response. Live Response is part of the Automated investigation and remediation (AIR) capabilities in Microsoft Defender for Endpoint, which allows administrators to remotely run commands on devices.

   Source: Adapted from community discussion — trut_hz

   References

   • Microsoft Learn

   Next question

3. Question 73 · 392 in bank

   You have a Microsoft Sentinel workspace that contains Common Event Format (CEF) data. You need to run a query against the CEF data. Which table should you query?

   • ASyslog
   • BSecurityEvent
   • CCommonSecurityLog
   • DTrreatIntelligentIndicator

   Show answer

   Answer: C

   Next question

4. Question 74 · 392 in bank

   HOTSPOT - You have a Microsoft 365 E5 subscription that uses Microsoft Defender for Endpoint. You need to create a detection rule that meets the following requirements: • Is triggered when a device that has critical software vulnerabilities was active during the last hour • Limits the number of duplicate results How should you complete the KQL query? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   part1: |distinct DeviceID Because DeviceID is required to successfully join the tables and distinct to limit the returns to unique devices part2: |project Timestamp, DeviceID, ReportID Your need Timestamp, DeviceID and ReportID in the return to create a custom detection rule https://learn.microsoft.com/en-us/microsoft-365/security/defender/custom-detection-rules?view=o365-worldwide#required-columns-in-the-query-results

   Source: Adapted from community discussion — wheeldj

   References

   • Microsoft Learn

   

   Next question

5. Question 75 · 392 in bank

   You have a Microsoft 365 subscription that uses Microsoft Security Copilot. You have the files shown in the following table.

   

   Each file contains a copy of your company's compliance policy. You need to ensure that Security Copilot responses are informed by the compliance policy. Which files can be uploaded to Security Copilot?

   • AFile1.docx only
   • BFile3.txt only
   • CFile1.docx and File3.txt only
   • DFile2.pdf and File3.txt only
   • EFile1.docx, File2.pdf, and File3.txt

   Show answer

   Answer: D

   Next question

6. Question 76 · 392 in bank

   HOTSPOT - You have a Microsoft 365 E5 subscription that uses Microsoft Teams. You need to perform a content search of Teams chats for a user by using the Microsoft Purview compliance portal. The solution must minimize the scope of the search. How should you configure the content search? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   The answer is correct: Exchange mailboxes Kind Categories are "The categories to search. Categories can be defined by users by using Outlook or Outlook on the web... The possible values are red, blue, green, etc." ItemClass: "Use this property to search specific third-party data types that your organization imported to Office 365." We are not importing any third-party data types. Kind: "The type of email message to search for. Possible values: contacts, microsoftteams, meetings, etc." https://learn.microsoft.com/en-us/purview/ediscovery-keyword-queries-and-search-conditions

   Source: Adapted from community discussion — jr_cyber

   References

   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn

   

   Next question

7. Question 77 · 392 in bank

   You have a Microsoft 365 E5 subscription that contains 100 Linux devices. The devices are onboarded to Microsoft Defender 365. You need to initiate the collection of investigation packages from the devices by using the Microsoft 365 Defender portal. Which response action should you use?

   • ARun antivirus scan
   • BInitiate Automated Investigation
   • CCollect investigation package
   • DInitiate Live Response Session

   Show answer

   Answer: C

   Explanation

   Ran it in Copilot and its C To initiate the collection of investigation packages from the Linux devices onboarded to Microsoft Defender for Endpoint, you should use: C. Collect investigation package: This action allows you to download an investigation package (ZIP file) containing relevant data and evidence related to the alert or incident. By selecting this option, you can gather the necessary information for further analysis and response.

   Source: Adapted from community discussion — Avaris

   References

   • Microsoft Learn
   • Microsoft Learn

   Next question

8. Question 78 · 392 in bank

   Select 2

   You need to configure Microsoft Defender for Cloud Apps to generate alerts and trigger remediation actions in response to external sharing of confidential files. Which two actions should you perform in the Microsoft 365 Defender portal? Each correct answer presents part of the solution. NOTE: Each correct selection is worth one point.

   • AFrom Settings, select Cloud App, select Microsoft Information Protection, and then select Only scan files for Microsoft Information Protection sensitivity labels and content inspection warnings from this tenant.
   • BFrom Cloud apps, select Files, and then filter File Type to Document.
   • CFrom Settings, select Cloud App, select Microsoft Information Protection, select Files, and then enable file monitoring.
   • DFrom Cloud apps, select Files, and then filter App to Office 365.
   • EFrom Cloud apps, select Files, and then select New policy from search.
   • FFrom Settings, select Cloud App, select Microsoft Information Protection, and then select Automatically scan new files for Microsoft Information Protection sensitivity labels and content inspection warnings.

   Show answer

   Answer: CF

   Explanation

   Review question #18 to get the correct answers From Settings, select Information Protection, select Files, and then enable file monitoring . From Settings, select Information Protection, select Azure Information Protection, and then select Automatically scan new files for Azure Information Protection classification labels and content inspection warnings

   Source: Adapted from community discussion — Murtuza

   Next question

9. Question 79 · 392 in bank

   You have a Microsoft Sentinel workspace named Workspace1. In Workspace1, you create a Microsoft Sentinel workbook named WB1. You need to add a query to WB1 that will return a list of all the watchlists in Workspace1. To what should you set Data source for the query?

   • ASQL database
   • BLogs (Analytics)
   • CStorage account
   • DAzure Resource Graph

   Show answer

   Answer: B

   Next question

10. Question 80 · 392 in bank

    DRAG DROP - You open the Cloud App Security portal as shown in the following exhibit.

    

    Your environment does NOT have Microsoft Defender for Endpoint enabled. You need to remediate the risk for the Launchpad app. Which four actions should you perform in sequence? To answer, move the appropriate actions from the list of actions to the answer area and arrange them in the correct order. Select and Place:

    

    This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

    Show the answer figure

    Answer: See figure below

    Explanation

    Reference: https://docs.microsoft.com/en-us/cloud-app-security/governance-discovery

    Source: Adapted from community discussion — hteams

    References

    • Microsoft Learn
    • Microsoft Learn

    

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

SC-200 practice, question 71. 392 questions available.