Labour Day Special - 65% Discount Offer - Ends in 0d 00h 00m 00s - Coupon code: c4sdisc65

SC-200 PDF

$49

$139.99

3 Months Free Update

  • Printable Format
  • Value of Money
  • 100% Pass Assurance
  • Verified Answers
  • Researched by Industry Experts
  • Based on Real Exams Scenarios
  • 100% Real Questions

SC-200 PDF + Testing Engine

$66.5

$189.99

3 Months Free Update

  • Exam Name: Microsoft Security Operations Analyst
  • Last Update: Apr 23, 2024
  • Questions and Answers: 245
  • Free Real Questions Demo
  • Recommended by Industry Experts
  • Best Economical Package
  • Immediate Access

SC-200 Engine

$56

$159.99

3 Months Free Update

  • Best Testing Engine
  • One Click installation
  • Recommended by Teachers
  • Easy to use
  • 3 Modes of Learning
  • State of Art Technology
  • 100% Real Questions included

SC-200 Practice Exam Questions with Answers Microsoft Security Operations Analyst Certification

Question # 6

You have a Microsoft 365 E5 subscription that contains 100 Linux devices. The devices are onboarded to Microsoft Defender 365. You need to initiate the collection of investigation packages from the devices by using the Microsoft 365 Defender portal. Which response action should you use?

A.

Run antivirus scan

B.

Initiate Automated Investigation

C.

Collect investigation package

D.

Initiate Live Response Session

Full Access
Question # 7

You have a Microsoft 365 subscription that uses Microsoft Defender for Endpoint.

You need to add threat indicators for all the IP addresses in a range of 171.23.3432-171.2334.63. The solution must minimize administrative effort.

What should you do in the Microsoft 365 Defender portal?

A.

Create an import file that contains the IP address of 171.23.34.32/27. Select Import and import the file.

B.

Select Add indicator and set the IP address to 171.2334.32-171.23.34.63.

C.

Select Add indicator and set the IP address to 171.23.34.32/27

D.

Create an import file that contains the individual IP addresses in the range. Select Import and import the file.

Full Access
Question # 8

You are investigating an incident by using Microsoft 365 Defender.

You need to create an advanced hunting query to count failed sign-in authentications on three devices named CFOLaptop. CEOLaptop, and COOLaptop.

How should you complete the query? To answer, select the appropriate options in the answer area.

NOTE Each correct selection is worth one point

SC-200 question answer

Full Access
Question # 9

You receive an alert from Azure Defender for Key Vault.

You discover that the alert is generated from multiple suspicious IP addresses.

You need to reduce the potential of Key Vault secrets being leaked while you investigate the issue. The solution must be implemented as soon as possible and must minimize the impact on legitimate users.

What should you do first?

A.

Modify the access control settings for the key vault.

B.

Enable the Key Vault firewall.

C.

Create an application security group.

D.

Modify the access policy for the key vault.

Full Access
Question # 10

You need to create a query to investigate DNS-related activity. The solution must meet the Microsoft Sentinel requirements. How should you complete the Query? To answer, select the appropriate options in the answer area NOTE: Each correct selection is worth one point.

SC-200 question answer

Full Access
Question # 11

You have an Azure subscription that has Azure Defender enabled for all supported resource types.

You create an Azure logic app named LA1.

You plan to use LA1 to automatically remediate security risks detected in Defenders for Cloud.

You need to test LA1 in Defender for Cloud.

What should you do? To answer, select the appropriate options in the answer area.

NOTE: Each correct selection is worth one point.

SC-200 question answer

Full Access
Question # 12

Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.

After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.

You are configuring Azure Sentinel.

You need to create an incident in Azure Sentinel when a sign-in to an Azure virtual machine from a malicious IP address is detected.

Solution: You create a scheduled query rule for a data connector.

Does this meet the goal?

A.

Yes

B.

No

Full Access
Question # 13

You have a Microsoft 365 subscription that uses Microsoft 365 Defender A remediation action for an automated investigation quarantines a file across multiple devices. You need to mark the file as safe and remove the file from quarantine on the devices. What should you use m the Microsoft 365 Defender portal?

A.

From Threat tracker, review the queries.

B.

From the History tab in the Action center, revert the actions.

C.

From the investigation page, review the AIR processes.

D.

From Quarantine from the Review page, modify the rules.

Full Access
Question # 14

You have a Microsoft 365 E5 subscription that uses Microsoft Defender for Endpoint. You need to create a detection rule that meets the following requirements:

• Is triggered when a device that has critical software vulnerabilities was active during the last hour

• Limits the number of duplicate results

How should you complete the KQL query? To answer, select the appropriate options in the answer area.

NOTE: Each correct selection is worth one point.

SC-200 question answer

Full Access
Question # 15

You have an Azure Functions app that generates thousands of alerts in Azure Security Center each day for normal activity.

You need to hide the alerts automatically in Security Center.

Which three actions should you perform in sequence in Security Center? Each correct answer presents part of the solution.

NOTE: Each correct selection is worth one point.

SC-200 question answer

Full Access
Question # 16

You have an Azure subscription that uses Microsoft Defender for Cloud and contains 100 virtual machines that run Windows Server.

You need to configure Defender for Cloud to collect event data from the virtual machines. The solution must minimize administrative effort and costs.

Which two actions should you perform? Each correct answer presents part of the solution.

NOTE: Each correct selection is worth one point.

A.

From the workspace created by Defender for Cloud, set the data collection level to Common

B.

From the Microsoft Endpoint Manager admin center, enable automatic enrollment.

C.

From the Azure portal, create an Azure Event Grid subscription.

D.

From the workspace created by Defender for Cloud, set the data collection level to All Events

E.

From Defender for Cloud in the Azure portal, enable automatic provisioning for the virtual machines.

Full Access
Question # 17

You need to correlate data from the SecurityEvent Log Anarytks table to meet the Microsoft Sentinel requirements for using UEBA. Which Log Analytics table should you use?

A.

SentwlAuoNt

B.

AADRiskyUsers

C.

IdentityOirectoryEvents

D.

Identityinfo

Full Access
Question # 18

You need to create a query for a workbook. The query must meet the following requirements:

  • List all incidents by incident number.
  • Only include the most recent log for each incident.

How should you complete the query? To answer, select the appropriate options in the answer area.

NOTE: Each correct selection is worth one point.

SC-200 question answer

Full Access
Question # 19

Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.

After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.

You are configuring Microsoft Defender for Identity integration with Active Directory.

From the Microsoft Defender for identity portal, you need to configure several accounts for attackers to exploit.

Solution: You add each account as a Sensitive account.

Does this meet the goal?

A.

Yes

B.

No

Full Access
Question # 20

You plan to create a custom Azure Sentinel query that will provide a visual representation of the security alerts generated by Azure Security Center.

You need to create a query that will be used to display a bar graph. What should you include in the query?

A.

extend

B.

bin

C.

count

D.

workspace

Full Access
Question # 21

You have an Azure subscription that uses Microsoft Defender for Cloud.

You need to create a workflow that will send a Microsoft Teams message to the IT department of your company when a new Microsoft Secure Score action is generated.

Which three actions should you perform in sequence? To answer, move the appropriate actions from the list of actions to the answer area and arrange them in the correct order.

SC-200 question answer

Full Access
Question # 22

Your company stores the data for every project in a different Azure subscription. All the subscriptions use the same Azure Active Directory (Azure AD) tenant.

Every project consists of multiple Azure virtual machines that run Windows Server. The Windows events of the virtual machines are stored in a Log Analytics workspace in each machine’s respective subscription.

You deploy Azure Sentinel to a new Azure subscription.

You need to perform hunting queries in Azure Sentinel to search across all the Log Analytics workspaces of all the subscriptions.

Which two actions should you perform? Each correct answer presents part of the solution.

NOTE: Each correct selection is worth one point.

A.

Add the Security Events connector to the Azure Sentinel workspace.

B.

Create a query that uses the workspace expression and the union operator.

C.

Use the alias statement.

D.

Create a query that uses the resource expression and the alias operator.

E.

Add the Azure Sentinel solution to each workspace.

Full Access
Question # 23

You have an Azure subscription that uses Microsoft Defender for Cloud and contains a resource group named RG1. RG1. You need to configure just in time (JIT) VM access for the virtual machines in RG1. The solution must meet the following

• Limit the maximum request time to two hours.

• Limit protocol access to Remote Desktop Protocol (RDP) only.

• Minimize administrative effort.

What should you use?

A.

Azure AD Privileged Identity Management (PIM)

B.

Azure Policy

C.

Azure Front Door

D.

Azure Bastion

Full Access
Question # 24

You provision Azure Sentinel for a new Azure subscription. You are configuring the Security Events connector.

While creating a new rule from a template in the connector, you decide to generate a new alert for every event. You create the following rule query.

SC-200 question answer

By which two components can you group alerts into incidents? Each correct answer presents a complete

solution.

NOTE: Each correct selection is worth one point.

A.

user

B.

resource group

C.

IP address

D.

computer

Full Access
Question # 25

You need to recommend remediation actions for the Azure Defender alerts for Fabrikam.

What should you recommend for each threat? To answer, select the appropriate options in the answer area.

NOTE: Each correct selection is worth one point.

SC-200 question answer

Full Access
Question # 26

The issue for which team can be resolved by using Microsoft Defender for Office 365?

A.

executive

B.

marketing

C.

security

D.

sales

Full Access
Question # 27

You need to recommend a solution to meet the technical requirements for the Azure virtual machines. What should you include in the recommendation?

A.

just-in-time (JIT) access

B.

Azure Defender

C.

Azure Firewall

D.

Azure Application Gateway

Full Access
Question # 28

You need to implement Azure Defender to meet the Azure Defender requirements and the business requirements.

What should you include in the solution? To answer, select the appropriate options in the answer area.

NOTE: Each correct selection is worth one point.

SC-200 question answer

Full Access
Question # 29

You need to implement Microsoft Defender for Cloud to meet the Microsoft Defender for Cloud requirements and the business requirements. What should you include in the solution? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.

SC-200 question answer

Full Access
Question # 30

You need to restrict cloud apps running on CLIENT1 to meet the Microsoft Defender for Endpoint requirements.

Which two configurations should you modify? Each correct answer present part of the solution.

NOTE: Each correct selection is worth one point.

A.

the Onboarding settings from Device management in Microsoft Defender Security Center

B.

Cloud App Security anomaly detection policies

C.

Advanced features from Settings in Microsoft Defender Security Center

D.

the Cloud Discovery settings in Cloud App Security

Full Access
Question # 31

You need to restrict cloud apps running on CUENT1 to meet the Microsoft Defender for Endpoint requirements. Which two configurations should you modify? Each correct answer presents part of the solution. NOTE: Each correct selection is worth one point.

A.

the Cloud Discovery settings in Microsoft Defender for Cloud Apps

B.

the Onboarding settings from Device management in Settings in Microsoft 365 Defender portal

C.

Microsoft Defender for Cloud Apps anomaly detection policies

D.

Advanced features from the Endpoints Settings in the Microsoft 365 Defender portal

Full Access
Question # 32

You need to add notes to the events to meet the Azure Sentinel requirements.

Which three actions should you perform in sequence? To answer, move the appropriate actions from the list of action to the answer area and arrange them in the correct order.

SC-200 question answer

Full Access
Question # 33

You need to implement the Azure Information Protection requirements. What should you configure first?

A.

Device health and compliance reports settings in Microsoft Defender Security Center

B.

scanner clusters in Azure Information Protection from the Azure portal

C.

content scan jobs in Azure Information Protection from the Azure portal

D.

Advanced features from Settings in Microsoft Defender Security Center

Full Access
Question # 34

You need to modify the anomaly detection policy settings to meet the Microsoft Defender for Cloud Apps requirements and resolve the reported problem.

Which policy should you modify?

A.

Activity from suspicious IP addresses

B.

Risky sign-in

C.

Activity from anonymous IP addresses

D.

Impossible travel

Full Access
Question # 35

You need to modify the anomaly detection policy settings to meet the Cloud App Security requirements. Which policy should you modify?

A.

Activity from suspicious IP addresses

B.

Activity from anonymous IP addresses

C.

Impossible travel

D.

Risky sign-in

Full Access
Question # 36

You need to create the analytics rule to meet the Azure Sentinel requirements.

What should you do? To answer, select the appropriate options in the answer area.

NOTE: Each correct selection is worth one point.

SC-200 question answer

Full Access
Question # 37

Which rule setting should you configure to meet the Microsoft Sentinel requirements?

A.

From Set rule logic, turn off suppression.

B.

From Analytic rule details, configure the tactics.

C.

From Set rule logic, map the entities.

D.

From Analytic rule details, configure the severity.

Full Access
Question # 38

You need to create the test rule to meet the Azure Sentinel requirements. What should you do when you create the rule?

A.

From Set rule logic, turn off suppression.

B.

From Analytics rule details, configure the tactics.

C.

From Set rule logic, map the entities.

D.

From Analytics rule details, configure the severity.

Full Access
Question # 39

You need to ensure that the configuration of HuntingQuery1 meets the Microsoft Sentinel requirements.

What should you do?

A.

Add HuntingQuery1 to a livestream.

B.

Create a watch list.

C.

Create an Azure Automation rule.

D.

Add HuntingQuery1 to favorites.

Full Access
Question # 40

You need to implement the ASIM query for DNS requests. The solution must meet the Microsoft Sentinel requirements. How should you configure the query? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.

SC-200 question answer

Full Access
Question # 41

You need to implement the Defender for Cloud requirements.

What should you configure for Server2?

A.

the Microsoft Antimalware extension

B.

an Azure resource lock

C.

an Azure resource tag

D.

the Azure Automanage machine configuration extension for Windows

Full Access
Question # 42

You need to ensure that the Group1 members can meet the Microsoft Sentinel requirements.

Which role should you assign to Group1?

A.

Microsoft Sentinel Automation Contributor

B.

Logic App Contributor

C.

Automation Operator

D.

Microsoft Sentinel Playbook Operator

Full Access
Question # 43

You need to configure event monitoring for Server1. The solution must meet the Microsoft Sentinel requirements. What should you create first?

A.

a Microsoft Sentinel automation rule

B.

a Microsoft Sentinel scheduled query rule

C.

a Data Collection Rule (DCR)

D.

an Azure Event Grid topic

Full Access
Question # 44

You need to monitor the password resets. The solution must meet the Microsoft Sentinel requirements.

What should you do? To answer, select the appropriate options in the answer area.

NOTE: Each correct selection is worth one point.

SC-200 question answer

Full Access
Question # 45

You need to implement the scheduled rule for incident generation based on rulequery1.

What should you configure first?

A.

entity mapping

B.

custom details

C.

event grouping

D.

alert details

Full Access
Question # 46

You need to implement the Defender for Cloud requirements.

Which subscription-level role should you assign to Group1?

A.

Security Admin

B.

Owner

C.

Security Assessment Contributor

D.

Contributor

Full Access
Question # 47

You need to implement the Microsoft Sentinel NRT rule for monitoring the designated break glass account. The solution must meet the Microsoft Sentinel requirements.

How should you complete the query? To answer, select the appropriate options in the answer area.

NOTE: Each correct selection is worth one point.

SC-200 question answer

Full Access
Question # 48

You need to ensure that the processing of incidents generated by rulequery1 meets the Microsoft Sentinel requirements.

What should you create first?

A.

a playbook with an incident trigger

B.

a playbook with an entity trigger

C.

an Azure Automation rule

D.

a playbook with an alert trigger

Full Access
Question # 49

You need to implement the query for Workbook1 and Webapp1. The solution must meet the Microsoft Sentinel requirements. How should you configure the query? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.

SC-200 question answer

Full Access