SC-200 Practice Test Questions Answers Updated 307 Questions [Q109-Q132]

5/5 - (2 votes)

SC-200 Practice Test Questions Answers Updated 307 Questions

SC-200 dumps & Microsoft Certified: Security Operations Analyst Associate Sure Practice with 307 Questions

A Comprehensive Guide on How to Pass the Microsoft SC-200 Exam

Get Microsoft SC-200 certification successfully Using this Prep Material

Get Your Microsoft SC-200 Certified With Ease: a study guide around the top resources for studying and passing the Microsoft certification exam

Microsoft Platform and Infrastructure Security is a suite of products designed to enable IT to manage, secure, and protect the business information that drives top-line revenue growth and bottom-line profitability. Microsoft Platform and Infrastructure Security allow organizations to integrate security, reduce costs, improve productivity, and simplify IT management. If you are a job-seeker or an employee who is aiming to get Microsoft Platform and Infrastructure Security certification, then this article will help you a lot. It will provide you with basic information about the Microsoft Platform and Infrastructure Security certification exam (Microsoft SC-200). SC-200 Dumps is the most trusted and reliable source for getting Microsoft SC-200 certified.

If you work in the IT field, chances are you are a Microsoft fan. If you are looking to move up your career ladder, earning a security compliance certification is an important step forward.

Microsoft SC-200 certification exam is an excellent way for security professionals to demonstrate their expertise in security operations. Microsoft Security Operations Analyst certification exam is based on the latest security operations best practices and methodologies, and it is designed to validate your skills in a variety of areas, including incident response, threat intelligence, and security controls. By passing the exam, you will demonstrate your ability to identify and mitigate security threats, analyze security data, and respond to security incidents.

NEW QUESTION 109
You have the following SQL query.

NEW QUESTION 110
You have a custom detection rule that includes the following KQL query.

For each of the following statements, select Yes if True. Otherwise select No.
NOTE: Each correct selection is worth one point.

NEW QUESTION 111
You have a Microsoft Sentinel workspace named sws1.
You need to create a hunting query to identify users that list storage keys of multiple Azure Storage accounts.
The solution must exclude users that list storage keys for a single storage account.
How should you complete the query? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.

NEW QUESTION 112
You have a Microsoft 365 subscription that uses Microsoft Purview and Microsoft Teams.
You have a team named Team1 that has a project named Project 1.
You need to identify any Project1 files that were stored on the team site of Team1 between February 1, 2023, and February 10, 2023.
Which KQL query should you run?

NEW QUESTION 113
You have a Microsoft 365 E5 subscription that uses Microsoft Defender and an Azure subscription that uses Azure Sentinel.
You need to identify all the devices that contain files in emails sent by a known malicious email sender. The query will be based on the match of the SHA256 hash.
How should you complete the query? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.

NEW QUESTION 114
You need to use an Azure Sentinel analytics rule to search for specific criteria in Amazon Web Services (AWS) logs and to generate incidents.
Which three actions should you perform in sequence? To answer, move the appropriate actions from the list of actions to the answer area and arrange them in the correct order.
a Microsoft 365 E5

NEW QUESTION 115
From Azure Sentinel, you open the Investigation pane for a high-severity incident as shown in the following exhibit.

Use the drop-down menus to select the answer choice that completes each statement based on the information presented in the graphic.
NOTE: Each correct selection is worth one point.

NEW QUESTION 116
You use Azure Sentinel.
You need to receive an immediate alert whenever Azure Storage account keys are enumerated. Which two actions should you perform? Each correct answer presents part of the solution.
NOTE: Each correct selection is worth one point.

Create a livestream

Add a data connector

Create an analytics rule

Create a hunting query.

Create a bookmark.

NEW QUESTION 117
You have a Microsoft Sentinel workspace that has User and Entity Behavior Analytics (UEBA) enabled.
You need to identify all the log entries that relate to security-sensitive user actions performed on a server named Server1. The solution must meet the following requirements:
* Only include security-sensitive actions by users that are NOT members of the IT department.
* Minimize the number of false positives.
How should you complete the query? To answer, select the appropriate options in the answer are a. NOTE: Each correct selection is worth one point.

NEW QUESTION 118
You need to implement the Azure Information Protection requirements. What should you configure first?

content scan jobs in Azure Information Protection from the Azure portal

scanner clusters in Azure Information Protection from the Azure portal

Device health and compliance reports settings in Microsoft Defender Security Center

Advanced features from Settings in Microsoft Defender Security Center

NEW QUESTION 119
You have an Azure subscription that uses Microsoft Defender for Cloud and contains a storage account named storage1. You receive an alert that there was an unusually high volume of delete operations on the blobs in storage1. You need to identify which blobs were deleted. What should you review?

the activity logs of storage1

the Azure Storage Analytics logs

the alert details

the related entities of the alert

NEW QUESTION 120
You need to implement Azure Defender to meet the Azure Defender requirements and the business requirements.
What should you include in the solution? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.

NEW QUESTION 121
You have an Azure subscription that contains 100 Linux virtual machines.
You need to configure Microsoft Sentinel to collect event logs from the virtual machines.
Which three actions should you perform in sequence? To answer, move the appropriate actions from the list of actions to the answer area and arrange them in the correct order.

NEW QUESTION 122
You have an existing Azure logic app that is used to block Azure Active Directory (Azure AD) users. The logic app is triggered manually.
You deploy Azure Sentinel.
You need to use the existing logic app as a playbook in Azure Sentinel.
What should you do first?

And a new scheduled query rule.

Add a data connector to Azure Sentinel.

Configure a custom Threat Intelligence connector in Azure Sentinel.

Modify the trigger in the logic app.

NEW QUESTION 123
You have an Azure Functions app that generates thousands of alerts in Azure Security Center each day for normal activity.
You need to hide the alerts automatically in Security Center.
Which three actions should you perform in sequence in Security Center? Each correct answer presents part of the solution.
NOTE: Each correct selection is worth one point.

NEW QUESTION 124
You have an Azure subscription that contains 100 Linux virtual machines.
You need to configure Microsoft Sentinel to collect event logs from the virtual machines.
Which three actions should you perform in sequence? To answer, move the appropriate actions from the list of actions to the answer area and arrange them in the correct order.

NEW QUESTION 125
You need to create the analytics rule to meet the Azure Sentinel requirements.
What should you do? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.

NEW QUESTION 126
You have an Azure subscription that contains 100 Linux virtual machines.
You need to configure Microsoft Sentinel to collect event logs from the virtual machines.
Which three actions should you perform in sequence? To answer, move the appropriate actions from the list of actions to the answer area and arrange them in the correct order.

NEW QUESTION 127
You have an Azure subscription that uses Microsoft Defender for Cloud. You need to filter the security alerts view to show the following alerts:
* Unusual user accessed a key vault
* Log on from an unusual location
* Impossible travel activity
Which severity should you use?

Informational

Low

Medium

High

NEW QUESTION 128
You have an Microsoft Sentinel workspace named SW1.
You plan to create a custom workbook that will include a time chart.
You need to create a query that will identify the number of security alerts per day for each provider.
How should you complete the query? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.

NEW QUESTION 129
You have a custom detection rule that includes the following KQL query.

For each of the following statements, select Yes if True. Otherwise select No.
NOTE: Each correct selection is worth one point.

NEW QUESTION 130
You have a custom analytics rule to detect threats in Azure Sentinel.
You discover that the analytics rule stopped running. The rule was disabled, and the rule name has a prefix of AUTO DISABLED.
What is a possible cause of the issue?

There are connectivity issues between the data sources and Log Analytics.

The number of alerts exceeded 10,000 within two minutes.

The rule query takes too long to run and times out.

Permissions to one of the data sources of the rule query were modified.

NEW QUESTION 131
You create a new Azure subscription and start collecting logs for Azure Monitor.
You need to configure Azure Security Center to detect possible threats related to sign-ins from suspicious IP addresses to Azure virtual machines. The solution must validate the configuration.
Which three actions should you perform in a sequence? To answer, move the appropriate actions from the list of action to the answer area and arrange them in the correct order.

NEW QUESTION 132
You are informed of a new common vulnerabilities and exposures (CVE) vulnerability that affects your environment.
You need to use Microsoft Defender Security Center to request remediation from the team responsible for the affected systems if there is a documented active exploit available.
Which three actions should you perform in sequence? To answer, move the appropriate actions from the list of actions to the answer area and arrange them in the correct order.