Online Access Free SC-200 Exam Questions

No.# NNN - KQL queries can only be run against interactive data. Total retention period is used to specify the period data needs to be archived for. Archived data cannot be accessed via KQL you have to run special Search or Restore jobs to access this data. So increasing the total retention period will have no effect on the data returned by any of the queries.

https://learn.microsoft.com/en-us/azure/azure-monitor/logs/data-retention-archive?tabs=portal-3%2Cportal-1%2Cportal-2

No.# A. entity mapping

No.# IdentityInfo => to get Department and AccountObjectId
https://learn.microsoft.com/en-us/microsoft-365/security/defender/advanced-hunting-identityinfo-table?view=o365-worldwide

and IdentityLogonEvents => for the interactive singings.

No.# To the AD DS domain controllers, deploy:
Microsoft Defender for Identity sensors

Why?
Microsoft Defender for Identity sensors collect data from Active Directory Domain Services to monitor user and entity activities. This data is critical for enabling UEBA in Sentinel as it provides insights into suspicious behavior and patterns.
For Sentinel1, configure:
The Security Events data source

Why?
The Security Events data source ingests events like authentication logs, account lockouts, and access attempts from AD DS. These logs are essential for UEBA to analyze user behaviors and detect anomalies.

No.# Answer: _Im_Dns | A filtering parameter

https://learn.microsoft.com/en-us/azure/sentinel/normalization-about-parsers

No.# Join & make-series are the correct answers

No.# Count for bar graphs, Bin for time charts

No.# "Live response for servers," is not relevant to the question since it's a feature that allows you to perform remote live investigations and remediation actions on servers.

"Endpoint detection and response (EDR) in block mode," is also not relevant to the question as it is a setting that enables EDR to automatically block malicious files and processes detected on endpoints.

"Web content filtering," is also not relevant as it is a feature that allows you to block access to specific websites or web content.

Therefore, the correct answer is D. Custom network indicators.

No.# Answer is:
1. Live Response for server
2. Automation Level
It is explained here: https://learn.microsoft.com/en-us/defender-endpoint/automation-levels
"With no automation, automated investigation doesn't run on your organization's devices. As a result, no remediation actions are taken or pending as a result of automated investigation"

No.# B: Attack Surface Reduction rules.

https://learn.microsoft.com/en-us/microsoft-365/security/defender-endpoint/attack-surface-reduction-rules-reference?view=o365-worldwide

Block all Office applications from creating child processes
Block executable content from email client and webmail

No.# A. From the workspace created by Defender for Cloud, set the data collection level to Common

C. From Defender for Cloud in the Azure portal, enable automatic provisioning for the virtual machines.

No.# C is the correct answer.
Conditional Access policies in Microsoft Entra (formerly Azure AD) allow administrators to enforce specific conditions for access to resources, including revoking session tokens when certain conditions are met. For example, you can configure a Conditional Access policy to require re-authentication or revoke tokens if a user is flagged as compromised or if suspicious activity is detected.
Security defaults and Microsoft Entra ID Protection can help secure user identities but do not provide direct control over session token revocation.
Microsoft Entra Verified ID is unrelated to token revocation as it deals with decentralized identity verification.
https://learn.microsoft.com/en-us/entra/identity-platform/configurable-token-lifetimes?utm_source=perplexity

- Microsoft Entra ID Protection calculcates the risk.
- A conditional Access policy enforces the access controls and blocks the user based on the calculated risk.

ID Protection analyzes signals about user accounts and calculates a risk score based on the probability that the user is compromised. If a user has risky sign-in behavior, or their credentials leak, ID Protection uses these signals to calculate the user risk level. Administrators can configure user risk-based Conditional Access policies to enforce access controls based on user risk, including requirements such as:
- Block access

See:
https://learn.microsoft.com/en-us/entra/id-protection/concept-identity-protection-policies#user-risk-based-conditional-access-policy...

No.# A. Create an Azure Policy assignment.

No.# A. Azure Machine Learning

No.# Connect-IPPSSession
New-ComplianceSearch
Start-ComplianceSearch
https://learn.microsoft.com/en-us/purview/ediscovery-search-for-and-delete-email-messages

No.# 1. Configure workflow automation
2. Configure a trigger condition
3. Create a logic app that has the Defender for Cloud recommendation trigger

https://learn.microsoft.com/en-us/azure/defender-for-cloud/workflow-automation

No.# 3-4-2.

No.# A. Identityinfo

No.# All Microsoft Sentinel built-in roles grant read access to the data in your Microsoft Sentinel workspace.

Microsoft Sentinel Reader can view data, incidents, workbooks, and other Microsoft Sentinel resources.

Microsoft Sentinel Responder can, in addition to the above, manage incidents (assign, dismiss, etc.).

Microsoft Sentinel Contributor can, in addition to the above, create and edit workbooks, analytics rules, and other Microsoft Sentinel resources.

Microsoft Sentinel Playbook Operator can list, view, and manually run playbooks.

Microsoft Sentinel Automation Contributor allows Microsoft Sentinel to add playbooks to automation rules. It isn't meant for user accounts.

No.# correct Answer - C, Evidence and Response.

Question emphasizes on 'incident'. Though you can view affected entities by clicking on Alerts tab > Alert list, it will be for that particular alert one alert doesn't necessarily be an incident. An incident can have multiple alerts. So you need to click on Incidents tab, open the Incident, go to Evidences and Response tab and look there.