2023 Updated Verified SC-200 Downloadable Printable Exam Dumps
The Ultimate Microsoft SC-200 Dumps PDF Review
The SC-200 exam is intended for security analysts and security operations professionals who are responsible for monitoring, detecting, and responding to security threats. SC-200 exam is also suitable for IT professionals who wish to expand their knowledge of security operations and threat management.
The Microsoft SC-200 exam comprises of 40-60 questions and has a time limit of 180 minutes. The questions are presented in multiple-choice format and may include simulations, case studies, and other types of questions. SC-200 exam is available in English and Japanese, and the cost of the exam is $165.
NEW QUESTION # 68
You need to receive a security alert when a user attempts to sign in from a location that was never used by the other users in your organization to sign in.
Which anomaly detection policy should you use?
- A. Malware detection
- B. Activity from anonymous IP addresses
- C. Activity from infrequent country
- D. Impossible travel
Answer: C
Explanation:
Reference:
https://docs.microsoft.com/en-us/cloud-app-security/anomaly-detection-policy
NEW QUESTION # 69
You need to configure the Azure Sentinel integration to meet the Azure Sentinel requirements.
What should you do? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Answer:
Explanation:
Reference:
https://docs.microsoft.com/en-us/cloud-app-security/siem-sentinel
NEW QUESTION # 70
You need to receive a security alert when a user attempts to sign in from a location that was never used by the other users in your organization to sign in.
Which anomaly detection policy should you use?
- A. Malware detection
- B. Activity from anonymous IP addresses
- C. Activity from infrequent country
- D. Impossible travel
Answer: C
Explanation:
Section: [none]
Explanation/Reference:
https://docs.microsoft.com/en-us/cloud-app-security/anomaly-detection-policy
NEW QUESTION # 71
You need to visualize Azure Sentinel data and enrich the data by using third-party data sources to identify indicators of compromise (IoC).
What should you use?
- A. hunting queries in Azure Sentinel
- B. Azure Monitor
- C. notebooks in Azure Sentinel
- D. Microsoft Cloud App Security
Answer: C
Explanation:
Section: [none]
Explanation/Reference:
https://docs.microsoft.com/en-us/azure/sentinel/notebooks
NEW QUESTION # 72
You have an Azure subscription that contains 100 Linux virtual machines.
You need to configure Microsoft Sentinel to collect event logs from the virtual machines.
Which three actions should you perform in sequence? To answer, move the appropriate actions from the list of actions to the answer area and arrange them in the correct order.
Answer:
Explanation:
1 - Add Microsoft Sentinel to a workspace.
2 - Install the Log Analytics agent for Linux on the virtual machines.
3 - Add a Security Events connector to the workspace.
NEW QUESTION # 73
You have a Microsoft 365 subscription that uses Microsoft Defender for Endpoint.
You need to add threat indicators for all the IP addresses in a range of 171.23.3432-171.2334.63. The solution must minimize administrative effort.
What should you do in the Microsoft 365 Defender portal?
- A. Select Add indicator and set the IP address to 171.2334.32-171.23.34.63.
- B. Select Add indicator and set the IP address to 171.23.34.32/27
- C. Create an import file that contains the IP address of 171.23.34.32/27. Select Import and import the file.
- D. Create an import file that contains the individual IP addresses in the range. Select Import and import the file.
Answer: B
NEW QUESTION # 74
You create a new Azure subscription and start collecting logs for Azure Monitor.
You need to configure Azure Security Center to detect possible threats related to sign-ins from suspicious IP addresses to Azure virtual machines. The solution must validate the configuration.
Which three actions should you perform in a sequence? To answer, move the appropriate actions from the list of action to the answer area and arrange them in the correct order.
Answer:
Explanation:
1 - Enable Azure Defender for the subscription.
2 - Copy an executable file on a virtual machine and rename the file as ASC_AlertTest_662jfi039N.exe.
3 - Run the executable file and specify the appropriate arguments.
Reference:
https://docs.microsoft.com/en-us/azure/security-center/security-center-alert-validation
NEW QUESTION # 75
You need to configure the Azure Sentinel integration to meet the Azure Sentinel requirements.
What should you do? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Answer:
Explanation:
Reference:
https://docs.microsoft.com/en-us/cloud-app-security/siem-sentinel
NEW QUESTION # 76
Your company uses Azure Sentinel to manage alerts from more than 10,000 IoT devices.
A security manager at the company reports that tracking security threats is increasingly difficult due to the large number of incidents.
You need to recommend a solution to provide a custom visualization to simplify the investigation of threats and to infer threats by using machine learning.
What should you include in the recommendation?
- A. notebooks
- B. livestream
- C. built-in queries
- D. bookmarks
Answer: A
Explanation:
Reference:
https://docs.microsoft.com/en-us/azure/sentinel/notebooks
NEW QUESTION # 77
Your company stores the data for every project in a different Azure subscription. All the subscriptions use the same Azure Active Directory (Azure AD) tenant.
Every project consists of multiple Azure virtual machines that run Windows Server. The Windows events of the virtual machines are stored in a Log Analytics workspace in each machine's respective subscription.
You deploy Azure Sentinel to a new Azure subscription.
You need to perform hunting queries in Azure Sentinel to search across all the Log Analytics workspaces of all the subscriptions.
Which two actions should you perform? Each correct answer presents part of the solution.
NOTE: Each correct selection is worth one point.
- A. Create a query that uses the resource expression and the alias operator.
- B. Use the alias statement.
- C. Add the Azure Sentinel solution to each workspace.
- D. Create a query that uses the workspace expression and the union operator.
- E. Add the Security Events connector to the Azure Sentinel workspace.
Answer: C,D
Explanation:
Reference:
https://docs.microsoft.com/en-us/azure/sentinel/extend-sentinel-across-workspaces-tenants
NEW QUESTION # 78
Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.
After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.
You are configuring Azure Sentinel.
You need to create an incident in Azure Sentinel when a sign-in to an Azure virtual machine from a malicious IP address is detected.
Solution: You create a scheduled query rule for a data connector.
Does this meet the goal?
- A. Yes
- B. No
Answer: B
Explanation:
Reference:
https://docs.microsoft.com/en-us/azure/sentinel/connect-azure-security-center
NEW QUESTION # 79
You have a Microsoft 365 subscription that uses Microsoft 365 Defender and contains a user named User1.
You are notified that the account of User1 is compromised.
You need to review the alerts triggered on the devices to which User1 signed in.
How should you complete the query? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Answer:
Explanation:
NEW QUESTION # 80
You have a Microsoft Sentinel workspace named sws1.
You need to create a hunting query to identify users that list storage keys of multiple Azure Storage accounts. The solution must exclude users that list storage keys for a single storage account.
How should you complete the query? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Answer:
Explanation:
NEW QUESTION # 81
The issue for which team can be resolved by using Microsoft Defender for Office 365?
- A. marketing
- B. executive
- C. sales
- D. security
Answer: A
Explanation:
Reference:
https://docs.microsoft.com/en-us/microsoft-365/security/office-365-security/atp-for-spo-odb-and-teams? view=o365-worldwide
NEW QUESTION # 82
You are informed of an increase in malicious email being received by users.
You need to create an advanced hunting query in Microsoft 365 Defender to identify whether the accounts of the email recipients were compromised. The query must return the most recent 20 sign-ins performed by the recipients within an hour of receiving the known malicious email.
How should you complete the query? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Answer:
Explanation:
Reference:
https://docs.microsoft.com/en-us/microsoft-365/security/defender/advanced-hunting-query-emails-devices?view=o365-worldwide
NEW QUESTION # 83
You are investigating a potential attack that deploys a new ransomware strain.
You plan to perform automated actions on a group of highly valuable machines that contain sensitive information.
You have three custom device groups.
You need to be able to temporarily group the machines to perform actions on the devices. Which three actions should you perform? Each correct answer presents part of the solution. NOTE: Each correct selection is worth one point.
- A. Create a new device group that has a rank of 4.
- B. Add a tag to the machines.
- C. Create a new admin role.
- D. Create a new device group that has a rank of 1.
- E. Add a tag to the device group.
- F. Add the device users to the admin role.
Answer: B,D,E
Explanation:
https://docs.microsoft.com/en-us/learn/modules/deploy-microsoft-defender-for-endpoints-environment/4-manage-access
NEW QUESTION # 84
You use Azure Sentinel.
You need to use a built-in role to provide a security analyst with the ability to edit the queries of custom Azure Sentinel workbooks. The solution must use the principle of least privilege.
Which role should you assign to the analyst?
- A. Logic App Contributor
- B. Security Administrator
- C. Azure Sentinel Contributor
- D. Azure Sentinel Responder
Answer: D
Explanation:
Explanation
Azure Sentinel Contributor can create and edit workbooks, analytics rules, and other Azure Sentinel resources.
Reference:
https://docs.microsoft.com/en-us/azure/sentinel/roles
NEW QUESTION # 85
......
Achive your Success with Latest SC-200 Exam: https://realpdf.free4torrent.com/SC-200-valid-dumps-torrent.html