Halloween Special - 70% Discount Offer - Ends in 0d 00h 00m 00s - Coupon code: dm70dm

SC-200 Microsoft Security Operations Analyst Questions and Answers

Questions 4

You need to implement the query for Workbook1 and Webapp1. The solution must meet the Microsoft Sentinel requirements. How should you configure the query? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.

SC-200 Question 4

Options:

Buy Now
Questions 5

You need to ensure that the processing of incidents generated by rulequery1 meets the Microsoft Sentinel requirements.

What should you create first?

Options:

A.

a playbook with an incident trigger

B.

a playbook with an entity trigger

C.

an Azure Automation rule

D.

a playbook with an alert trigger

Buy Now
Questions 6

You need to ensure that the Group1 members can meet the Microsoft Sentinel requirements.

Which role should you assign to Group1?

Options:

A.

Microsoft Sentinel Automation Contributor

B.

Logic App Contributor

C.

Automation Operator

D.

Microsoft Sentinel Playbook Operator

Buy Now
Questions 7

You need to implement the ASIM query for DNS requests. The solution must meet the Microsoft Sentinel requirements. How should you configure the query? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.

SC-200 Question 7

Options:

Buy Now
Questions 8

You need to implement the Defender for Cloud requirements.

What should you configure for Server2?

Options:

A.

the Microsoft Antimalware extension

B.

an Azure resource lock

C.

an Azure resource tag

D.

the Azure Automanage machine configuration extension for Windows

Buy Now
Questions 9

You need to monitor the password resets. The solution must meet the Microsoft Sentinel requirements.

What should you do? To answer, select the appropriate options in the answer area.

NOTE: Each correct selection is worth one point.

SC-200 Question 9

Options:

Buy Now
Questions 10

You need to identify which mean time metrics to use to meet the Microsoft Sentinel requirements. Which workbook should you use?

Options:

A.

Analytics Efficiency

B.

Security Operations Efficiency

C.

Event Analyzer

D.

Investigation insights

Buy Now
Questions 11

You have a Microsoft Sentinel workspace named SW1.

You need to identify which anomaly rules are enabled in SW1.

What should you review in Microsoft Sentine1?

Options:

A.

Settings

B.

Entity behavior

C.

Analytics

D.

Content hub

Buy Now
Questions 12

You need to implement the Defender for Cloud requirements.

Which subscription-level role should you assign to Group1?

Options:

A.

Security Admin

B.

Owner

C.

Security Assessment Contributor

D.

Contributor

Buy Now
Questions 13

You need to implement the scheduled rule for incident generation based on rulequery1.

What should you configure first?

Options:

A.

entity mapping

B.

custom details

C.

event grouping

D.

alert details

Buy Now
Questions 14

Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.

After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.

You have Linux virtual machines on Amazon Web Services (AWS).

You deploy Azure Defender and enable auto-provisioning.

You need to monitor the virtual machines by using Azure Defender.

Solution: You enable Azure Arc and onboard the virtual machines to Azure Arc.

Does this meet the goal?

Options:

A.

Yes

B.

No

Buy Now
Questions 15

You have an Azure subscription named Sub1 and a Microsoft 365 subscription. Sub1 is linked to an Azure Active Directory (Azure AD) tenant named contoso.com.

You create an Azure Sentinel workspace named workspace1. In workspace1, you activate an Azure AD connector for contoso.com and an Office 365 connector for the Microsoft 365 subscription.

You need to use the Fusion rule to detect multi-staged attacks that include suspicious sign-ins to contoso.com followed by anomalous Microsoft Office 365 activity.

Which two actions should you perform? Each correct answer present part of the solution

NOTE: Each correct selection is worth one point.

Options:

A.

Create custom rule based on the Office 365 connector templates.

B.

Create a Microsoft incident creation rule based on Microsoft Defender for Cloud.

C.

Create a Microsoft Cloud App Security connector.

D.

Create an Azure AD Identity Protection connector.

Buy Now
Questions 16

You have an Azure subscription that contains a Microsoft Sentinel workspace named WS1.

You create a hunting query that detects a new attack vector. The attack vector maps to a tactic listed in the MITRE ATT&CK database.

You need to ensure that an incident is created in WS1 when the new attack vector is detected.

What should you configure?

Options:

A.

a Fusion rule

B.

a query bookmark

C.

a scheduled query rule

D.

a hunting livestream session

Buy Now
Questions 17

You have a Microsoft 365 tenant that uses Microsoft Exchange Online and Microsoft Defender for Office 365.

What should you use to identify whether zero-hour auto purge (ZAP) moved an email message from the mailbox of a user?

Options:

A.

the Threat Protection Status report in Microsoft Defender for Office 365

B.

the mailbox audit log in Exchange

C.

the Safe Attachments file types report in Microsoft Defender for Office 365

D.

the mail flow report in Exchange

Buy Now
Questions 18

You have a Microsoft 365 E5 subscription that contains two users named User1 and User2. You have the hunting query shown in the following exhibit.

SC-200 Question 18

The users perform the following actions:

• User1 assigns User2 the Global Administrator role.

• User1 creates a new user named User3 and assigns the user a Microsoft Teams license.

• User2 creates a new user named User4 and assigns the user the Security Reader role.

• User2 creates a new user named User5 and assigns the user the Security Operator role.

For each of the following statements, select Yes if the statement is true. Otherwise, select No.

NOTE: Each correct selection is worth one point.

SC-200 Question 18

Options:

Buy Now
Questions 19

You have an Azure subscription that uses Microsoft Defender XDR.

From the Microsoft Defender portal, you perform an audit search and export the results as a file named Filel.csv that contains 10,000 rows.

You use Microsoft Excel to perform Get & Transform Data operations to parse the AuditData column from Filel.csv. The operations fail to generate columns for specific JSON properties.

You need to ensure that Excel generates columns for the specific JSON properties in the audit search results.

Solution: From Excel, you apply filters to the existing columns in Filel.csv to reduce the number of rows, and then you perform the Get & Transform Data operations to parse the AuditData column.

Does this meet the requirement?

Options:

A.

Yes

B.

No

Buy Now
Questions 20

You have a Microsoft Sentinel workspace that has User and Entity Behavior Analytics (UEBA) enabled.

You need to identify all the log entries that relate to security-sensitive user actions performed on a server named Server1. The solution must meet the following requirements:

• Only include security-sensitive actions by users that are NOT members of the IT department.

• Minimize the number of false positives.

How should you complete the query? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.

SC-200 Question 20

Options:

Buy Now
Questions 21

You plan to create a custom Azure Sentinel query that will track anomalous Azure Active Directory (Azure AD) sign-in activity and present the activity as a time chart aggregated by day.

You need to create a query that will be used to display the time chart. What should you include in the query?

Options:

A.

extend

B.

bin

C.

makeset

D.

workspace

Buy Now
Questions 22

You have an Azure subscription that use Microsoft Defender for Cloud and contains a user named User1.

You need to ensure that User1 can modify Microsoft Defender for Cloud security policies. The solution must use the principle of least privilege.

Which role should you assign to User1?

Options:

A.

Security operator

B.

Security Admin

C.

Owner

D.

Contributor

Buy Now
Questions 23

You have a suppression rule in Azure Security Center for 10 virtual machines that are used for testing. The virtual machines run Windows Server.

You are troubleshooting an issue on the virtual machines.

In Security Center, you need to view the alerts generated by the virtual machines during the last five days.

What should you do?

Options:

A.

Change the rule expiration date of the suppression rule.

B.

Change the state of the suppression rule to Disabled.

C.

Modify the filter for the Security alerts page.

D.

View the Windows event logs on the virtual machines.

Buy Now
Questions 24

You have an Azure subscription that contains a resource group named RG1. RG1 contains a Microsoft Sentinel workspace. The subscription is linked to a Microsoft Entra tenant that contains a user named User1.

You need to ensure that User1 can deploy and customize Microsoft Sentine1 workbook templates. The solution must follow the principle of least privilege.

Which role should you assign to User1 for RG1?

Options:

A.

Workbook Contributor

B.

Microsoft Sentinel Contributor

C.

Contributor

D.

Microsoft Sentinel Automation Contributor

Buy Now
Questions 25

You need to use an Azure Sentinel analytics rule to search for specific criteria in Amazon Web Services (AWS) logs and to generate incidents.

Which three actions should you perform in sequence? To answer, move the appropriate actions from the list of actions to the answer area and arrange them in the correct order.

a Microsoft 365 E5

SC-200 Question 25

Options:

Buy Now
Questions 26

You have an Azure subscription that uses Microsoft Defender for Cloud.

You have a GitHub account named Account1 that contains 10 repositories.

You need to ensure that Defender for Cloud can assess the repositories in Account1.

What should you do first in the Microsoft Defender for Cloud portal?

Options:

A.

Add an environment.

B.

Enable security policies.

C.

Enable integrations.

D.

Enable a plan.

Buy Now
Questions 27

You have a Microsoft 365 subscription that uses Microsoft Purview and contains a Microsoft SharePoint Online site named Site1. Site1 contains the files shown in the following table.

SC-200 Question 27

From Microsoft Purview, you create the content search queries shown in the following table.

SC-200 Question 27

For each of the following statements, select Yes if the statement is true. Otherwise, select No.

NOTE; Each correct selection is worth one point.

SC-200 Question 27

Options:

Buy Now
Questions 28

Your on-premises network contains 100 servers that run Windows Server.

You have an Azure subscription that uses Microsoft Sentinel.

You need to upload custom logs from the on-premises servers to Microsoft Sentinel.

What should you do? To answer, select the appropriate options m the answer area.

SC-200 Question 28

Options:

Buy Now
Questions 29

You have an Azure Sentinel deployment.

You need to query for all suspicious credential access activities.

Which three actions should you perform in sequence? To answer, move the appropriate actions from the list of actions to the answer area and arrange them in the correct order.

SC-200 Question 29

Options:

Buy Now
Questions 30

You use Azure Sentinel.

You need to receive an immediate alert whenever Azure Storage account keys are enumerated. Which two actions should you perform? Each correct answer presents part of the solution.

NOTE: Each correct selection is worth one point.

Options:

A.

Create a livestream

B.

Add a data connector

C.

Create an analytics rule

D.

Create a hunting query.

E.

Create a bookmark.

Buy Now
Questions 31

You have an Azure subscription that contains a user named User1 and a Microsoft Sentinel workspace named WS1. WS1 uses Microsoft Defender for Cloud.

You have the Microsoft security analytics rules shown in the following table.

SC-200 Question 31

User1 performs an action that matches Rule1, Rule2, Rule3, and Rule4. How many incidents will be created in WS1?

Options:

A.

1

B.

2

C.

3

D.

4

Buy Now
Questions 32

You are investigating a potential attack that deploys a new ransomware strain.

You plan to perform automated actions on a group of highly valuable machines that contain sensitive information.

You have three custom device groups.

You need to be able to temporarily group the machines to perform actions on the devices. Which three actions should you perform? Each correct answer presents part of the solution. NOTE: Each correct selection is worth one point.

Options:

A.

Add a tag to the device group.

B.

Add the device users to the admin role.

C.

Add a tag to the machines.

D.

Create a new device group that has a rank of 1.

E.

Create a new admin role.

F.

Create a new device group that has a rank of 4.

Buy Now
Questions 33

You are informed of an increase in malicious email being received by users.

You need to create an advanced hunting query in Microsoft 365 Defender to identify whether the accounts of the email recipients were compromised. The query must return the most recent 20 sign-ins performed by the recipients within an hour of receiving the known malicious email.

How should you complete the query? To answer, select the appropriate options in the answer area.

NOTE: Each correct selection is worth one point.

SC-200 Question 33

Options:

Buy Now
Questions 34

The issue for which team can be resolved by using Microsoft Defender for Office 365?

Options:

A.

executive

B.

marketing

C.

security

D.

sales

Buy Now
Questions 35

You need to remediate active attacks to meet the technical requirements.

What should you include in the solution?

Options:

A.

Azure Automation runbooks

B.

Azure Logic Apps

C.

Azure Functions

D Azure Sentinel livestreams

Buy Now
Questions 36

You need to recommend a solution to meet the technical requirements for the Azure virtual machines. What should you include in the recommendation?

Options:

A.

just-in-time (JIT) access

B.

Azure Defender

C.

Azure Firewall

D.

Azure Application Gateway

Buy Now
Questions 37

The issue for which team can be resolved by using Microsoft Defender for Endpoint?

Options:

A.

executive

B.

sales

C.

marketing

Buy Now
Questions 38

You need to implement Azure Sentinel queries for Contoso and Fabrikam to meet the technical requirements.

What should you include in the solution? To answer, select the appropriate options in the answer area.

NOTE: Each correct selection is worth one point.

SC-200 Question 38

Options:

Buy Now
Questions 39

You need to complete the query for failed sign-ins to meet the technical requirements.

Where can you find the column name to complete the where clause?

Options:

A.

Security alerts in Azure Security Center

B.

Activity log in Azure

C.

Azure Advisor

D.

the query windows of the Log Analytics workspace

Buy Now
Questions 40

You need to modify the anomaly detection policy settings to meet the Cloud App Security requirements. Which policy should you modify?

Options:

A.

Activity from suspicious IP addresses

B.

Activity from anonymous IP addresses

C.

Impossible travel

D.

Risky sign-in

Buy Now
Questions 41

You need to create an advanced hunting query to investigate the executive team issue.

How should you complete the query? To answer, select the appropriate options in the answer area.

NOTE: Each correct selection is worth one point.

SC-200 Question 41

Options:

Buy Now
Questions 42

You need to implement the Azure Information Protection requirements. What should you configure first?

Options:

A.

Device health and compliance reports settings in Microsoft Defender Security Center

B.

scanner clusters in Azure Information Protection from the Azure portal

C.

content scan jobs in Azure Information Protection from the Azure portal

D.

Advanced features from Settings in Microsoft Defender Security Center

Buy Now
Questions 43

You need to configure DC1 to meet the business requirements.

Which four actions should you perform in sequence? To answer, move the appropriate actions from the list of actions to the answer area and arrange them in the correct order.

SC-200 Question 43

Options:

Buy Now
Questions 44

You need to add notes to the events to meet the Azure Sentinel requirements.

Which three actions should you perform in sequence? To answer, move the appropriate actions from the list of action to the answer area and arrange them in the correct order.

SC-200 Question 44

Options:

Buy Now
Questions 45

Which rule setting should you configure to meet the Microsoft Sentinel requirements?

Options:

A.

From Set rule logic, turn off suppression.

B.

From Analytic rule details, configure the tactics.

C.

From Set rule logic, map the entities.

D.

From Analytic rule details, configure the severity.

Buy Now
Questions 46

You need to assign a role-based access control (RBAC) role to admin1 to meet the Azure Sentinel requirements and the business requirements.

Which role should you assign?

Options:

A.

Automation Operator

B.

Automation Runbook Operator

C.

Azure Sentinel Contributor

D.

Logic App Contributor

Buy Now
Questions 47

You need to implement Azure Defender to meet the Azure Defender requirements and the business requirements.

What should you include in the solution? To answer, select the appropriate options in the answer area.

NOTE: Each correct selection is worth one point.

SC-200 Question 47

Options:

Buy Now
Questions 48

You need to configure the Azure Sentinel integration to meet the Azure Sentinel requirements.

What should you do? To answer, select the appropriate options in the answer area.

NOTE: Each correct selection is worth one point.

SC-200 Question 48

Options:

Buy Now
Questions 49

You need to modify the anomaly detection policy settings to meet the Microsoft Defender for Cloud Apps requirements and resolve the reported problem.

Which policy should you modify?

Options:

A.

Activity from suspicious IP addresses

B.

Risky sign-in

C.

Activity from anonymous IP addresses

D.

Impossible travel

Buy Now
Questions 50

You need to create the test rule to meet the Azure Sentinel requirements. What should you do when you create the rule?

Options:

A.

From Set rule logic, turn off suppression.

B.

From Analytics rule details, configure the tactics.

C.

From Set rule logic, map the entities.

D.

From Analytics rule details, configure the severity.

Buy Now
Questions 51

You need to restrict cloud apps running on CUENT1 to meet the Microsoft Defender for Endpoint requirements. Which two configurations should you modify? Each correct answer presents part of the solution. NOTE: Each correct selection is worth one point.

Options:

A.

the Cloud Discovery settings in Microsoft Defender for Cloud Apps

B.

the Onboarding settings from Device management in Settings in Microsoft 365 Defender portal

C.

Microsoft Defender for Cloud Apps anomaly detection policies

D.

Advanced features from the Endpoints Settings in the Microsoft 365 Defender portal

Buy Now
Questions 52

You need to implement Microsoft Defender for Cloud to meet the Microsoft Defender for Cloud requirements and the business requirements. What should you include in the solution? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.

SC-200 Question 52

Options:

Buy Now
Questions 53

You need to configure the Microsoft Sentinel integration to meet the Microsoft Sentinel requirements. What should you do? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.

SC-200 Question 53

Options:

Buy Now
Questions 54

You need to create the analytics rule to meet the Azure Sentinel requirements.

What should you do? To answer, select the appropriate options in the answer area.

NOTE: Each correct selection is worth one point.

SC-200 Question 54

Options:

Buy Now
Questions 55

You need to restrict cloud apps running on CLIENT1 to meet the Microsoft Defender for Endpoint requirements.

Which two configurations should you modify? Each correct answer present part of the solution.

NOTE: Each correct selection is worth one point.

Options:

A.

the Onboarding settings from Device management in Microsoft Defender Security Center

B.

Cloud App Security anomaly detection policies

C.

Advanced features from Settings in Microsoft Defender Security Center

D.

the Cloud Discovery settings in Cloud App Security

Buy Now
Exam Code: SC-200
Exam Name: Microsoft Security Operations Analyst
Last Update: Oct 23, 2024
Questions: 294

PDF + Testing Engine

$51  $169.99

Testing Engine

$39  $129.99
buy now SC-200 testing engine

PDF (Q&A)

$33  $109.99
buy now SC-200 pdf
dumpsmate guaranteed to pass
24/7 Customer Support

DumpsMate's team of experts is always available to respond your queries on exam preparation. Get professional answers on any topic of the certification syllabus. Our experts will thoroughly satisfy you.

Site Secure

mcafee secure

TESTED 31 Oct 2024