Microsoft Role-based SC-200 Questions & Answers

• Question 11:

  HOTSPOT

  You have the following KQL query.

  

  Hot Area:

  

  Correct Answer:

  

• Question 12:

  HOTSPOT

  You have an Azure subscription.

  You plan to implement an Microsoft Sentinel workspace. You anticipate that you will ingest 20 GB of security log data per day.

  You need to configure storage for the workspace. The solution must meet the following requirements:

  Minimize costs for daily ingested data.

  Maximize the data retention period without incurring extra costs.

  What should you do for each requirement? To answer, select the appropriate options in the answer area. NOTE Each correct selection is worth one point.

  Hot Area:

  

  Correct Answer:

  

• Question 13:

  HOTSPOT

  You need to create an advanced hunting query to investigate the executive team issue.

  How should you complete the query? To answer, select the appropriate options in the answer area.

  NOTE: Each correct selection is worth one point.

  Hot Area:

  

  Correct Answer:

  

• Question 14:

  You need to complete the query for failed sign-ins to meet the technical requirements. Where can you find the column name to complete the where clause?

  A. Security alerts in Azure Security Center

  B. Activity log in Azure

  C. Azure Advisor

  D. the query windows of the Log Analytics workspace

  Correct Answer: D

• Question 15:

  The issue for which team can be resolved by using Microsoft Defender for Office 365?

  A. executive

  B. marketing

  C. security

  D. sales

  Correct Answer: B

  Reference: https://docs.microsoft.com/en-us/microsoft-365/security/office-365-security/atp-for-spo-odb-and-teams?view=o365-worldwide

• Question 16:

  You need to remediate active attacks to meet the technical requirements. What should you include in the solution?

  A. Azure Automation runbooks

  B. Azure Logic Apps

  C. Azure Functions

  D. Azure Sentinel livestreams

  Correct Answer: B

  Reference: https://docs.microsoft.com/en-us/azure/sentinel/automate-responses-with-playbooks

• Question 17:

  You need to recommend a solution to meet the technical requirements for the Azure virtual machines. What should you include in the recommendation?

  A. just-in-time (JIT) access

  B. Azure Defender

  C. Azure Firewall

  D. Azure Application Gateway

  Correct Answer: B

  Reference: https://docs.microsoft.com/en-us/azure/security-center/azure-defender

• Question 18:

  The issue for which team can be resolved by using Microsoft Defender for Endpoint?

  A. executive

  B. sales

  C. marketing

  Correct Answer: B

  Reference: https://docs.microsoft.com/en-us/windows/security/threat-protection/microsoft-defender-atp/microsoft-defender-atp-ios

• Question 19:

  You need to modify the anomaly detection policy settings to meet the Cloud App Security requirements. Which policy should you modify?

  A. Activity from suspicious IP addresses

  B. Activity from anonymous IP addresses

  C. Impossible travel

  D. Risky sign-in

  Correct Answer: C

  Reference: https://docs.microsoft.com/en-us/cloud-app-security/anomaly-detection-policy

• Question 20:

  You need to implement the Azure Information Protection requirements. What should you configure first?

  A. Device health and compliance reports settings in Microsoft Defender Security Center

  B. scanner clusters in Azure Information Protection from the Azure portal

  C. content scan jobs in Azure Information Protection from the Azure portal

  D. Advanced features from Settings in Microsoft Defender Security Center

  Correct Answer: D

  Reference: https://docs.microsoft.com/en-us/windows/security/threat-protection/microsoft-defender-atp/information-protection-in-windows-overview