Online Access Free SC-200 Exam Questions

No.# Correct Answer:
1. Microsoft Sentinel Responder
2. Directory readers

No.# i think its YES

No.# Modify the analytics rule.

No.# Policy template type: Activity Policy
Filter based on: IP address tag

Tested on the MCAS portal. When you select Activity policy only you get to filter from IP address.

No.# D
"Azure Storage Analytics performs logging and provides metrics data for a storage account. You can use this data to trace requests, analyze usage trends, and diagnose issues with your storage account."

No.# B. Create an exclusion tag.
https://learn.microsoft.com/en-us/azure/defender-for-cloud/enable-agentless-scanning-vms

No.# Answer is:
1. Live Response for server
2. Automation Level
It is explained here: https://learn.microsoft.com/en-us/defender-endpoint/automation-levels
"With no automation, automated investigation doesn't run on your organization's devices. As a result, no remediation actions are taken or pending as a result of automated investigation"

No.# corrct:
Use playbooks together with automation rules to automate your incident response and remediate security threats detected by Microsoft Sentine

No.# i think its B. Azure Machine Learning

No.# 3-2-5

No.# C - Modify the filter for the Security alerts page.

Answer B would prevent future alerts from being supressed but the question is asking to view alerts created in the last 5 days - these would have been dismissed by the supression rule and to view them you need to alter the filter to display dismissed alerts.

Ref: https://docs.microsoft.com/en-us/azure/security-center/alerts-suppression-rules#what-are-suppression-rules

No.# B
To add an environment, you need to sign in to the Azure portal, go to Microsoft Defender for Cloud > Environment settings, select Add environment, and then select GitHub. You also need to enter a name, select your subscription, resource group, and region.

No.# 3-4-2

No.# C. msticpy

msticpy is a Python library that can be used to quickly and easily create visuals in Jupyter notebooks for Microsoft Sentinel. It has built-in support for Kusto queries, making it easy to retrieve and visualize the results of custom queries you've created in your Sentinel workspace. Additionally, msticpy contains a number of pre-built visualizations and functions that can be easily incorporated into your notebooks, minimizing development effort. So, it is the best option to create the visuals.

No.# 1 - Event Hub: https://docs.microsoft.com/en-us/azure/defender-for-cloud/export-to-siem#stream-alerts-with-continuous-export
2 - Azure Policy - https://docs.microsoft.com/en-us/azure/defender-for-cloud/continuous-export?tabs=azure-policy#configure-continuous-export-at-scale-using-the-supplied-policies

No.# n order to identify the impacted entities in an aggregated alert, you should review the "Events" tab of the DLP alert management dashboard in the Microsoft 365 compliance center. This tab will display a list of all the events that triggered the alert, including the specific entities (e.g. files, emails, etc.) that were affected. You can further investigate each event to identify the specific user, device and action that caused the alert to be triggered.

No.# A. In the grid query, include the take operator.

The take operator allows you to limit the number of rows returned by a query. By including the take operator in the grid query and specifying a maximum of 100 rows, you can ensure that the grid in Workbook1 contains a maximum of 100 rows.

For example, you could use the following query:
| take 100

No.# A. Azure Sentinel Contributor

No.# A. Create an Azure Policy assignment.

No.# Option C, disabling legacy protocols, is not relevant to the question since it's a security measure that restricts the use of legacy protocols that may be less secure than modern protocols.

Option D, enforcing LDAP signing, is also not relevant to the question since it's a security measure that ensures that LDAP traffic is signed and encrypted.

Option A, installing the Local Administrator Password Solution (LAPS) extension, is not relevant to the question since it's a solution that automatically manages local administrator account passwords to help prevent credential theft.

Therefore, the correct answer is B. Modify the properties of the computer objects listed as exposed entities.