Questions for the SC-200 were updated on : Sep 01 ,2024
The issue for which team can be resolved by using Microsoft Defender for Endpoint?
B
Explanation:
Reference: https://docs.microsoft.com/en-us/windows/security/threat-protection/microsoft-defender-atp/microsoft-defender-
atp-ios
The issue for which team can be resolved by using Microsoft Defender for Office 365?
B
Explanation:
Reference: https://docs.microsoft.com/en-us/microsoft-365/security/office-365-security/atp-for-spo-odb-and-
teams?view=o365-worldwide
You need to implement the Azure Information Protection requirements.
What should you configure first?
D
Explanation:
Reference: https://docs.microsoft.com/en-us/windows/security/threat-protection/microsoft-defender-atp/information-
protection-in-windows-overview
You need to modify the anomaly detection policy settings to meet the Cloud App Security requirements and resolve the
reported problem.
Which policy should you modify?
C
Explanation:
Reference: https://docs.microsoft.com/en-us/cloud-app-security/anomaly-detection-policy
DRAG DROP
You need to configure DC1 to meet the business requirements.
Which four actions should you perform in sequence? To answer, move the appropriate actions from the list of actions to the
answer area and arrange them in the correct order.
Select and Place:
Explanation:
Step 1: log in to https://portal.atp.azure.com as a global admin
Step 2: Create the instance Step 3. Connect the instance to Active Directory Step 4. Download and install the sensor.
Reference: https://docs.microsoft.com/en-us/defender-for-identity/install-step1 https://docs.microsoft.com/en-us/defender-for-
identity/install-step4
HOTSPOT
You need to recommend remediation actions for the Azure Defender alerts for Fabrikam.
What should you recommend for each threat? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Hot Area:
Explanation:
Reference: https://docs.microsoft.com/en-us/azure/key-vault/general/security-features https://docs.microsoft.com/en-
us/azure/key-vault/general/secure-your-key-vault
You need to recommend a solution to meet the technical requirements for the Azure virtual machines.
What should you include in the recommendation?
B
Explanation:
Reference:
https://docs.microsoft.com/en-us/azure/security-center/azure-defender
You need to complete the query for failed sign-ins to meet the technical requirements.
Where can you find the column name to complete the where clause?
D
You need to remediate active attacks to meet the technical requirements.
What should you include in the solution?
B
Explanation:
Reference: https://docs.microsoft.com/en-us/azure/sentinel/automate-responses-with-playbooks
HOTSPOT
You need to create an advanced hunting query to investigate the executive team issue.
How should you complete the query? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Hot Area:
Explanation:
Mitigate threats using Azure Sentinel
HOTSPOT
You need to implement Azure Sentinel queries for Contoso and Fabrikam to meet the technical requirements.
What should you include in the solution? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Hot Area:
Explanation:
Reference: https://docs.microsoft.com/en-us/azure/sentinel/extend-sentinel-across-workspaces-tenants
You need to restrict cloud apps running on CLIENT1 to meet the Microsoft Defender for Endpoint requirements.
Which two configurations should you modify? Each correct answer present part of the solution.
NOTE: Each correct selection is worth one point.
C D
Explanation:
All Cloud App Security unsanctioned apps must be blocked on the Windows 10 computers by using Microsoft Defender for
Endpoint.
Reference: https://docs.microsoft.com/en-us/cloud-app-security/mde-govern
DRAG DROP
You need to add notes to the events to meet the Azure Sentinel requirements.
Which three actions should you perform in sequence? To answer, move the appropriate actions from the list of action to the
answer area and arrange them in the correct order.
Select and Place:
Explanation:
Reference: https://docs.microsoft.com/en-us/azure/sentinel/bookmarks
HOTSPOT
You need to configure the Azure Sentinel integration to meet the Azure Sentinel requirements.
What should you do? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Hot Area:
Explanation:
Reference: https://docs.microsoft.com/en-us/cloud-app-security/siem-sentinel
You need to assign a role-based access control (RBAC) role to admin1 to meet the Azure Sentinel requirements and the
business requirements.
Which role should you assign?
C
Explanation:
Litware must meet the following requirements:
Ensure that a user named admin1 can configure Azure Sentinel playbooks. The principle of least privilege must be used
whenever possible.
Azure Sentinel Contributor can view data, incidents, workbooks, and other Azure Sentinel resources, manage incidents
(assign, dismiss, etc.), create and edit workbooks, analytics rules, and other Azure Sentinel resources.
Reference: https://docs.microsoft.com/en-us/azure/sentinel/roles