Based on Official Syllabus Topics of Actual Microsoft SC-200 Exam
Free SC-200 Dumps are Available for Instant Access
NEW QUESTION # 53
You need to implement Azure Defender to meet the Azure Defender requirements and the business requirements.
What should you include in the solution? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Answer:
Explanation:
Explanation
Graphical user interface, application Description automatically generated
NEW QUESTION # 54
You have an Azure Sentinel deployment.
You need to query for all suspicious credential access activities.
Which three actions should you perform in sequence? To answer, move the appropriate actions from the list of actions to the answer area and arrange them in the correct order.
Answer:
Explanation:
1 - From Azure Sentinel,select Hunting.
2 - Filter by tactics.
3 - Select Run All Queries.
NEW QUESTION # 55
You need to build a KQL query in a Microsoft Sentinel workspace. The query must return the SecurityEvent record for accounts that have the last record with an EventID value of 4624. How should you complete the query' To answer, select the appropriate options in the answer area.
NOTE: Each coned selection is worth one point
Answer:
Explanation:
Explanation:
NEW QUESTION # 56
You have an Azure subscription that has Microsoft Defender for Cloud enabled.
You have a virtual machine that runs Windows 10 and has the Log Analytics agent installed.
You need to simulate an attack on the virtual machine that will generate an alert.
What should you do first?
- A. Run the MMASetup executable and specify the -foo argument
- B. Modify the settings of the Microsoft Monitoring Agent.
- C. Copy a executable and rename the file as ASC_AlerTest_662jf10N,exe
- D. Run the Log Analytics Troubleshooting Tool.
Answer: C
NEW QUESTION # 57
You have an Azure subscription that has Microsoft Defender for Cloud enabled.
You have a virtual machine named Server! that runs Windows Server 2022 and is hosted in Amazon Web Services (AWS).
You need to collect logs and resolve vulnerabilities for Server1 by using Defender for Cloud.
What should you install first on Server1?
- A. the Microsoft Monitoring Agent
- B. the Azure Pipelines agent
- C. the Azure Arc agent
- D. the Azure Monitor agent
Answer: D
NEW QUESTION # 58
You have an existing Azure logic app that is used to block Azure Active Directory (Azure AD) users. The logic app is triggered manually.
You deploy Azure Sentinel.
You need to use the existing logic app as a playbook in Azure Sentinel. What should you do first?
- A. Add a data connector to Azure Sentinel.
- B. And a new scheduled query rule.
- C. Modify the trigger in the logic app.
- D. Configure a custom Threat Intelligence connector in Azure Sentinel.
Answer: C
Explanation:
https://docs.microsoft.com/en-us/azure/sentinel/playbook-triggers-actions
https://docs.microsoft.com/en-us/azure/sentinel/tutorial-respond-threats-playbook
NEW QUESTION # 59
You have five on-premises Linux servers.
You have an Azure subscription that uses Microsoft Defender for Cloud.
You need to use Defender for Cloud to protect the Linux servers.
What should you install on the servers first?
- A. the Log Analytics agent
- B. the Azure Connected Machine agent
- C. the Guest Configuration extension
- D. the Dependency agent
Answer: A
Explanation:
Defender for Cloud depends on the Log Analytics agent.
Use the Log Analytics agent if you need to:
* Collect logs and performance data from Azure virtual machines or hybrid machines hosted outside of Azure
* Etc.
Reference:
https://docs.microsoft.com/en-us/azure/defender-for-cloud/os-coverage
https://docs.microsoft.com/en-us/azure/azure-monitor/agents/agents-overview#log-analytics-agent
NEW QUESTION # 60
You have a Microsoft 365 E5 subscription that uses Microsoft Defender 36S.
Your network contains an on-premises Active Directory Domain Services (AD DS) domain that syncs with Azure AD.
You need to identify the 100 most recent sign-in attempts recorded on devices and AD DS domain controllers.
How should you complete The KQL query? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Answer:
Explanation:
NEW QUESTION # 61
You have an Azure subscription that uses Microsoft Defender for Cloud.
You need to create a workflow that will send a Microsoft Teams message to the IT department of your company when a new Microsoft Secure Score action is generated.
Which three actions should you perform in sequence? To answer, move the appropriate actions from the list of actions to the answer area and arrange them in the correct order.
Answer:
Explanation:
Explanation:
NEW QUESTION # 62
You have a Microsoft 365 subscription that uses Microsoft Defender for Endpoint Plan 2 and contains a Windows device named Device!.
You initiated a live response session on Device1.
You need to run a command that will download a 250-MB file named File! .exe from the live response library to Device1. The solution must ensure that Filel.exe is downloaded as a background process.
How should you complete the live response command? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Answer:
Explanation:
Explanation:
NEW QUESTION # 63
You have an Azure subscription that uses Azure Defender.
You plan to use Azure Security Center workflow automation to respond to Azure Defender threat alerts.
You need to create an Azure policy that will perform threat remediation automatically.
What should you include in the solution? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Answer:
Explanation:
Explanation:
Reference:
https://docs.microsoft.com/en-us/azure/governance/policy/concepts/effects
https://docs.microsoft.com/en-us/azure/security-center/workflow-automation
NEW QUESTION # 64
You have an Azure subscription that uses Microsoft Defender for Cloud and contains an Azure logic app named app1.
You need to ensure that app1 launches when a specific Defender for Cloud security alert is generated.
How should you complete the Azure Resource Manager (ARM) template? To answer, select the appropriate options in the answer area NOTE: Each correct selection is worth one point.
Answer:
Explanation:
Explanation:
NEW QUESTION # 65
You have an Azure subscription that has Azure Defender enabled for all supported resource types.
You create an Azure logic app named LA1.
You plan to use LA1 to automatically remediate security risks detected in Azure Security Center.
You need to test LA1 in Security Center.
What should you do? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Answer:
Explanation:
Reference:
https://docs.microsoft.com/en-us/azure/security-center/workflow-automation#create-a-logic-app-and-define-when-it-should-automatically-run
NEW QUESTION # 66
You have an Azure subscription that contains a virtual machine named VM1 and uses Azure Defender. Azure Defender has automatic provisioning enabled.
You need to create a custom alert suppression rule that will supress false positive alerts for suspicious use of PowerShell on VM1.
What should you do first?
- A. On VM1, run the Get-MPThreatCatalog cmdlet.
- B. On VM1 trigger a PowerShell alert.
- C. From Azure Security Center, export the alerts to a Log Analytics workspace.
- D. From Azure Security Center, add a workflow automation.
Answer: B
Explanation:
Reference:
https://docs.microsoft.com/en-us/microsoft-365/security/defender-endpoint/manage-alerts?view=o365-worldwide
NEW QUESTION # 67
You have a Microsoft 365 subscription that uses Microsoft Defender XDR.
You are investigating an attacker that is known to use the Microsoft Graph API as an attack vector. The attacker performs the tactics shown the following table.
You need to search for malicious activities in your organization.
Which tactics can you analyze by using the MicrosoftGraphActivityLogs table?
- A. Taclic1. Tac1ic2. andTactic3
- B. Tactic1 and Tactic2 only
- C. Tactic2 only
- D. Tac1ic2 and Tactic3 only
Answer: B
NEW QUESTION # 68
......
Achieving the Microsoft Security Operations Analyst certification can be a valuable asset for security professionals looking to advance their careers in the field of cybersecurity. Microsoft Security Operations Analyst certification demonstrates that the candidate has the skills and knowledge necessary to detect, investigate, and respond to security incidents in a Microsoft environment and can be a valuable addition to any security team.
The Most In-Demand SC-200 Pass Guaranteed Quiz : https://www.practicedump.com/SC-200_actualtests.html
View All SC-200 Actual Exam Questions Answers and Explanations for Free: https://drive.google.com/open?id=1j0V3N2FOW0IH584Oyk_Hv9hexXj0MuRm