Online Access Free SC-200 Exam Questions

No.# D - Assign the incident is the best option, but you can also tag or bookmark the alerts that need further investigation.

No.# 3-4-2
from the portal generate the script
install the agent on the on premise server with the script
install the azure monitor agent (for the data collection )

https://learn.microsoft.com/en-us/azure/azure-monitor/essentials/data-collection
https://learn.microsoft.com/en-us/azure/azure-arc/servers/learn/quick-enable-hybrid-vm

No.# based on this source the answer is medium and add ip address ranges
https://learn.microsoft.com/en-us/defender-cloud-apps/anomaly-detection-policy#tune-anomaly-detection-policies

No.# Correct answer is D
Permanent failure - rule auto-disable due to the following reasons
The target workspace (on which the rule query operated) has been deleted.
The target table (on which the rule query operated) has been deleted.
Microsoft Sentinel had been removed from the target workspace.
A function used by the rule query is no longer valid; it has been either modified or removed.
Permissions to one of the data sources of the rule query were changed.
One of the data sources of the rule query was deleted or disconnected.

No.# Only Security Admin and Owner of the Subsc. can modify policies. SecAdmin has least priv.
https://learn.microsoft.com/en-us/azure/defender-for-cloud/permissions
Security Admin: A user that belongs to this role has the same access as the Security Reader and can also update the security policy, and dismiss alerts and recommendations.

No.# Option A, is the right choice because it focuses on making sure we are very sure about where the alerts are coming from in Microsoft Defender for Identity. This helps us save time and effort when dealing with false alarms. It also allows us to respond faster to real threats.

No.# Create a YAML file based on the DNS template.

No.# an Azure logic app

No.# All you need to do is enable auto-provisioning from Defender for Cloud. There you ll be asked if you want to store security events and in what level (none, minimal, common, all).
Since there are only 2 options provided here (common & all) we go with the least effort and cost so D -> common

No.# The answer is D.

Related entities will have the details of the blobs that were deleted.
The alert details does not give the name of the blobs, but will only list the "Operations" that was performed. In this scenario, the operation name is "Storage.Blob_DeletionAnomaly".
(Ref: https://learn.microsoft.com/en-us/azure/defender-for-cloud/alerts-azure-storage#unusual-deletion-in-a-storage-account)

The question expects you to use the tool "Microsoft Defender for Cloud", so try to stick with the options/features provided by the tool & not the complete Azure platform.

No.# yes as Logic app is already available and it pre configure to trigger manual based ... now when you connect it as Playbook you need to change the Trigger from manual to ..Sentinel based so Option is D

No.# Azure Sentinel Contributor is the only provided correct role. If "Log Analytics Contributor" or "Microsoft Sentinel Automation Contributor" they would be better suited to meet the business requirement for least privilege.

Contributor: "Grants full access to manage all resources, but does not allow you to assign roles in Azure RBAC, manage assignments in Azure Blueprints, or share image galleries." Ref https://docs.microsoft.com/en-us/azure/role-based-access-control/built-in-roles#contributor

No.# Correct Answer are.
AzureActivity & Extend

No.# Answer is D.

The question did not say if AWS security hub is enabled. As per the docs, the first thing we need to configure is the AWS Security Hub.
https://learn.microsoft.com/en-us/training/modules/connect-non-azure-machines-to-azure-defender/4-connect-aws-accounts

The rest of the options (A,B,C) will be done during the later steps of the integration.

No.# Answer is B.

The question did not say if AWS security hub is enabled. As per the docs, the first thing we need to configure is the AWS Security Hub.
https://learn.microsoft.com/en-us/training/modules/connect-non-azure-machines-to-azure-defender/4-connect-aws-accounts

The rest of the options (A,C,D) will be done during the later steps of the integration.

No.# https://learn.microsoft.com/en-us/azure/sentinel/quickstart-onboard >> So since you need create the workspace first then logically you should do C first followed by D. So my answer is C.

No.# Jupyter notebooks allow you to supercharge your threat hunting and investigation by enabling documents that contain live code, visualizations, and narrative text. These documents can be codified and served for specialized visualizations, an investigation guide, and sophisticated threat hunting.

Additionally, notebooks can be used in security big data analytics for fast data processing on large datasets.

No.# A,D.

These are 2 complete solutions on their own. Not a step by step by step.
1) Add the rule and enable it.
2) Add the rule, set the rule to overwrite existing rules, and enable it.

"Set-MpPreference will always overwrite the existing set of rules. If you want to add to the existing set, use Add-MpPreference instead."
https://learn.microsoft.com/en-us/microsoft-365/security/defender-endpoint/enable-attack-surface-reduction?view=o365-worldwide#powershell

The command does not need to mention anything about block because the GUID references a Rule with already set actions.

Configuration Manager name: Block Office application from creating child processes
GUID: d4f940ab-401b-4efc-aadc-ad5f3c50688a
https://learn.microsoft.com/en-us/microsoft-365/security/defender-endpoint/attack-surface-reduction-rules-reference?source=recommendations&view=o365-worldwide#block-all-office-applications-from-creating-child-processes

No.# Create an analytics rule.

Creating an analytics rule in Microsoft Sentinel is the best way to ensure that the system automatically detects the threat with minimal administrative effort. Analytics rules allow you to create custom detections based on specific events or patterns that you want to monitor.

No.# Because livestream notifications for new events use Azure portal notifications, you see these notifications whenever you use the Azure portal.