Microsoft Role-based SC-200 Questions & Answers

• Question 31:

  You have an Azure subscription that uses Microsoft Defender for Cloud and contains a resource group named RG1. RG1 contains 20 virtual machines that run Windows Server 2019. You need to configure just-in-time (JIT) access for the virtual machines in RG1. The solution must meet the following requirements:

  1.

  Limit the maximum request time to two hours.

  2.

  Limit protocols access to Remote Desktop Protocol (RDP) only.

  3.

  Minimize administrative effort. What should you use?

  A. Azure AD Privileged Identity Management (PIM)

  B. Azure Policy

  C. Azure Bastion

  D. Azure Front Door

  Correct Answer: C

  You can combine Azure Bastion with the JIT VM access feature of Microsoft Defender for Cloud. JIT provides just-in-time network-based access to VMs by locking down your VMs at the network level and blocking all unnecessary inbound traffic to specific management ports, like RDP or SSH. To be able to do this, it adds a deny rule to the Azure network security group (NSG), which protects the VM network interface or the subnet it belongs to.

  When a user then requests access to the VM, the service adds a temporary allow rule to the NSG. Because the allow rule has a higher priority than the deny rule, the user can connect to the VM. The user can also only connect for a limited amount of time, with a maximum of 24 hours. This time limit is specified when JIT is configured for a specific VM or VMs.

  Reference: https://wmatthyssen.com/2022/11/28/azure-bastion-combine-jit-with-azure-bastion

• Question 32:

  You have an Azure subscription that contains an Azure logic app named app1 and a Microsoft Sentinel workspace that has an Azure Active Directory (Azure AD) connector.

  You need to ensure that app1 launches when Microsoft Sentinel detects an Azure AD-generated alert.

  What should you create first?

  A. a repository connection

  B. a watchlist

  C. an analytics rule

  D. an automation rule

  Correct Answer: D

• Question 33:

  You have an Azure subscription that uses Microsoft Defender for Cloud and contains 100 virtual machines that run Windows Server.

  You need to configure Defender for Cloud to collect event data from the virtual machines. The solution must minimize administrative effort and costs.

  Which two actions should you perform? Each correct answer presents part of the solution.

  NOTE: Each correct selection is worth one point.

  A. From the workspace created by Defender for Cloud, set the data collection level to Common.

  B. From the Microsoft Endpoint Manager admin center, enable automatic enrollment.

  C. From the Azure portal, create an Azure Event Grid subscription.

  D. From the workspace created by Defender for Cloud, set the data collection level to All Events.

  E. From Defender for Cloud in the Azure portal, enable automatic provisioning for the virtual machines.

  Correct Answer: AE

  A (not D): What event types are stored for "Common" and "Minimal"?

  The Common and Minimal event sets were designed to address typical scenarios based on customer and industry standards for the unfiltered frequency of each event and their usage.

  *

  Common - A set of events that satisfies most customers and provides a full audit trail.

  This set is intended to provide a full user audit trail, including events with low volume. For example, this set contains both user logon events (event ID 4624) and user logoff events (event ID 4634). We include auditing actions like security

  group changes, key domain controller Kerberos operations, and other events that are recommended by industry organizations.

  *

  Minimal

  *

  All events

• Question 34:

  You have an Azure subscription that uses Microsoft Sentinel and contains 100 Linux virtual machines.

  You need to monitor the virtual machines by using Microsoft Sentinel. The solution must meet the following requirements:

  1.

  Minimize administrative effort.

  2.

  Minimize the parsing required to read fog data. What should you configure?

  A. a Log Analytics Data Collector API

  B. REST API integration

  C. a Common Evert Format (CEF) connector

  D. a Syslog connector

  Correct Answer: D

• Question 35:

  You have an Azure subscription that contains a user named User1.

  User1 is assigned an Azure Active Directory Premium Plan 2 license.

  You need to identify whether the identity of User1 was compromised during the last 90 days.

  What should you use?

  A. the risk detections report

  B. the risky users report

  C. Identity Secure Score recommendations

  D. the risky sign-ins report

  Correct Answer: B

  Scenario: User compromised (True positive)

  ‘Risky users

• Question 36:

  You have an Azure subscription that uses Microsoft Defender for Cloud and contains a user named User1.

  You need to ensure that User1 can modify Microsoft Defender for Cloud security policies. The solution must use the principle of least privilege.

  Which role should you assign to User1?

  A. Security operator

  B. Security Admin

  C. Owner

  D. Contributor

  Correct Answer: B

  Security Admin

  View and update permissions for Microsoft Defender for Cloud. Same permissions as the Security Reader role and can also update the security policy and dismiss alerts and recommendations.

  Incorrect:

  *

  Security Reader

  View permissions for Microsoft Defender for Cloud. Can view recommendations, alerts, a security policy, and security states, but cannot make changes.

  * owner - too much permissions

  *

  Contributor (too much permissions)

  Grants full access to manage all resources, but does not allow you to assign roles in Azure RBAC, manage assignments in Azure Blueprints, or share image galleries.

  Reference:

  https://learn.microsoft.com/en-us/azure/role-based-access-control/built-in-roles

• Question 37:

  You plan to review Microsoft Defender for Cloud alerts by using a third-party security information and event management (SIEM) solution.

  You need to locate alerts that indicate the use of the Privilege Escalation MITRE ATTandCK tactic.

  Which JSON key should you search?

  A. Description

  B. Intent

  C. ExtendedProperies

  D. Entities

  Correct Answer: A

  Example, misp-galaxy/clusters/mitre-enterprise-attack-attack-pattern.json

  { "authors": [

  "MITRE"

  ],

  "category": "attack-pattern",

  "description": "ATTandCK tactic",

  "name": "Enterprise Attack - Attack Pattern",

  "source": "https://github.com/mitre/cti",

  "type": "mitre-enterprise-attack-attack-pattern",

  "uuid": "fb2242d8-1707-11e8-ab20-6fa7448c3640"

  Reference: https://github.com/MISP/misp-galaxy/blob/main/clusters/mitre-enterprise-attack-attack-pattern.json

• Question 38:

  You have an Azure subscription that uses Microsoft Defender for Cloud. You need to filter the security alerts view to show the following alerts:

  1.

  Unusual user accessed a key vault

  2.

  Log on from an unusual location

  3.

  Impossible travel activity Which severity should you use?

  A. Informational

  B. Low

  C. Medium

  D. High

  Correct Answer: C

  Medium This is probably a suspicious activity might indicate that a resource is compromised. Defender for Cloud's confidence in the analytic or finding is medium and the confidence of the malicious intent is medium to high. These would usually be machine learning or anomaly-based detections, for example a sign-in attempt from an unusual location.

  Incorrect:

  *

  High There is a high probability that your resource is compromised. You should look into it right away. Defender for Cloud has high confidence in both the malicious intent and in the findings used to issue the alert. For example, an alert that detects the execution of a known malicious tool such as Mimikatz, a common tool used for credential theft.

  *

  Low This might be a benign positive or a blocked attack. Defender for Cloud isn't confident enough that the intent is malicious and the activity might be innocent. For example, log clear is an action that might happen when an attacker tries to hide their tracks, but in many cases is a routine operation performed by admins. Defender for Cloud doesn't usually tell you when attacks were blocked, unless it's an interesting case that we suggest you look into.

  *

  Low This might be a benign positive or a blocked attack. Defender for Cloud isn't confident enough that the intent is malicious and the activity might be innocent. For example, log clear is an action that might happen when an attacker tries to hide their tracks, but in many cases is a routine operation performed by admins. Defender for Cloud doesn't usually tell you when attacks were blocked, unless it's an interesting case that we suggest you look into.

  Reference: https://learn.microsoft.com/en-us/azure/defender-for-cloud/alerts-overview

• Question 39:

  You have a Microsoft Sentinel workspace named Workspace1 and 200 custom Advanced Security Information Model (ASIM) parsers based on the DNS schema.

  You need to make the 200 parses available in Workspace1. The solution must minimize administrative effort.

  What should you do first?

  A. Copy the parsers to the Azure Monitor Logs page.

  B. Create a JSON file based on the DNS template.

  C. Create an XML file based on the DNS template.

  D. Create a YAML file based on the DNS template.

  Correct Answer: D

  Deploy parsers

  Deploy parsers manually by copying them to the Azure Monitor Log page and saving the query as a function. This method is useful for testing.

  To deploy a large number of parsers, we recommend using parser ARM templates, as follows:

  Create a YAML file based on the relevant template for each schema and include your query in it. Start with the YAML template relevant for your schema and parser type, filtering or parameter-less.

  Use the ASIM Yaml to ARM template converter to convert your YAML file to an ARM template.

  If deploying an update, delete older versions of the functions using the portal or the function delete PowerShell tool.

  Deploy your template using the Azure portal or PowerShell.

  Reference:

  https://learn.microsoft.com/en-us/azure/sentinel/normalization-develop-parsers

• Question 40:

  You have an Azure subscription that contains a Microsoft Sentinel workspace.

  You need to create a playbook that will run automatically in response to a Microsoft Sentinel alert.

  What should you create first?

  A. a hunting query in Microsoft Sentinel

  B. an Azure logic app

  C. an automation rule in Microsoft Sentinel

  D. a trigger in Azure Functions

  Correct Answer: C

  You can use playbooks together with automation rules to automate your incident response and remediate security threats detected by Microsoft Sentinel.

  Automation rules help you triage incidents in Microsoft Sentinel. You can use them to automatically assign incidents to the right personnel, close noisy incidents or known false positives, change their severity, and add tags. They are also the mechanism by which you can run playbooks in response to incidents.

  Reference: https://learn.microsoft.com/en-us/azure/sentinel/tutorial-respond-threats-playbook