Microsoft SC-200 Exam Dumps

Your company uses Azure Security Center and Azure Defender.The security operations team at the company informs you that it does NOT receive emailnotifications for security alerts.What should you configure in Security Center to enable the email notifications?

A. Security solutions
B. Security policy
C. Pricing & settings
D. Security alerts
E. Azure Defender

Answer: C

Note: This question is part of a series of questions that present the same scenario. Eachquestion in the series contains a unique solution that might meet the stated goals. Somequestion sets might have more than one correct solution, while others might not have acorrect solution.After you answer a question in this section, you will NOT be able to return to it. As a result,these questions will not appear in the review screen.You are configuring Microsoft Defender for Identity integration with Active Directory.From the Microsoft Defender for identity portal, you need to configure several accounts forattackers to exploit.Solution: You add the accounts to an Active Directory group and add the group as aSensitive group.Does this meet the goal?

A. Yes
B. No

Answer: B

Note: This question is part of a series of questions that present the same scenario. Eachquestion in the series contains a unique solution that might meet the stated goals. Somequestion sets might have more than one correct solution, while others might not have acorrect solution.After you answer a question in this section, you will NOT be able to return to it. As a result,these questions will not appear in the review screen.You use Azure Security Center.You receive a security alert in Security Center.You need to view recommendations to resolve the alert in Security Center.Solution: From Security alerts, you select the alert, select Take Action, and then expandthe Mitigate the threat section.Does this meet the goal?

A. Yes
B. No

Answer: A

You have an existing Azure logic app that is used to block Azure Active Directory (AzureAD) users. The logic app is triggered manually.You deploy Azure Sentinel.You need to use the existing logic app as a playbook in Azure Sentinel. What should youdo first?

A. And a new scheduled query rule.
B. Add a data connector to Azure Sentinel.
C. Configure a custom Threat Intelligence connector in Azure Sentinel.
D. Modify the trigger in the logic app.

Answer: B

Note: This question is part of a series of questions that present the same scenario. Eachquestion in the series contains a unique solution that might meet the stated goals. Somequestion sets might have more than one correct solution, while others might not have acorrect solution.After you answer a question in this section, you will NOT be able to return to it. As a result,these questions will not appear in the review screen.You are configuring Microsoft Defender for Identity integration with Active Directory.From the Microsoft Defender for identity portal, you need to configure several accounts forattackers to exploit.Solution: From Entity tags, you add the accounts as Honeytoken accounts.Does this meet the goal?

A. Yes
B. No

Answer: A

You have a custom analytics rule to detect threats in Azure Sentinel.You discover that the analytics rule stopped running. The rule was disabled, and the rulename has a prefix of AUTO DISABLED.What is a possible cause of the issue?

A. There are connectivity issues between the data sources and Log Analytics
B. The number of alerts exceeded 10,000 within two minutes.
C. The rule query takes too long to run and times out.
D. Permissions to one of the data sources of the rule query were modified.

Answer: D

You need to receive a security alert when a user attempts to sign in from a location thatwas never used by the other users in your organization to sign in.Which anomaly detection policy should you use?

A. Impossible travel
B. Activity from anonymous IP addresses
C. Activity from infrequent country
D. Malware detection

Answer: C

You use Azure Sentinel.You need to receive an immediate alert whenever Azure Storage account keys areenumerated. Which two actions should you perform? Each correct answer presents part ofthe solution.NOTE: Each correct selection is worth one point.

A. Create a livestream
B. Add a data connector
C. Create an analytics rule
D. Create a hunting query.
E. Create a bookmark.

Answer: B,D

You are investigating a potential attack that deploys a new ransomware strain.You plan to perform automated actions on a group of highly valuable machines that containsensitive information.You have three custom device groups.You need to be able to temporarily group the machines to perform actions on the devices.Which three actions should you perform? Each correct answer presents part of thesolution. NOTE: Each correct selection is worth one point.

A. Add a tag to the device group.
B. Add the device users to the admin role.
C. Add a tag to the machines.
D. Create a new device group that has a rank of 1.
E. Create a new admin role.
F. Create a new device group that has a rank of 4.

Answer: B,D,E

Note: This question is part of a series of questions that present the same scenario. Eachquestion in the series contains a unique solution that might meet the stated goals. Somequestion sets might have more than one correct solution, while others might not have acorrect solution.After you answer a question in this section, you will NOT be able to return to it. As a result,these questions will not appear in the review screen.You are configuring Microsoft Defender for Identity integration with Active Directory.From the Microsoft Defender for identity portal, you need to configure several accounts forattackers to exploit.Solution: From Azure Identity Protection, you configure the sign-in risk policy.Does this meet the goal?

A. Yes
B. No

Answer: B

You receive an alert from Azure Defender for Key Vault.You discover that the alert is generated from multiple suspicious IP addresses.You need to reduce the potential of Key Vault secrets being leaked while you investigatethe issue. The solution must be implemented as soon as possible and must minimize theimpact on legitimate users.What should you do first?

A. Modify the access control settings for the key vault.
B. Enable the Key Vault firewall.
C. Create an application security group.
D. Modify the access policy for the key vault.

Answer: B

You create an Azure subscription named sub1.In sub1, you create a Log Analytics workspace named workspace1.You enable Azure Security Center and configure Security Center to use workspace1.You need to ensure that Security Center processes events from the Azure virtual machinesthat report to workspace1.What should you do?

A. In workspace1, install a solution.
B. In sub1, register a provider.
C. From Security Center, create a Workflow automation.
D. In workspace1, create a workbook.

Answer: A

You plan to create a custom Azure Sentinel query that will provide a visual representationof the security alerts generated by Azure Security Center.You need to create a query that will be used to display a bar graph. What should youinclude in the query?

A. extend
B. bin
C. count
D. workspace

Answer: C

You need to visualize Azure Sentinel data and enrich the data by using third-party datasources to identify indicators of compromise (IoC).What should you use?

A. notebooks in Azure Sentinel
B. Microsoft Cloud App Security
C. Azure Monitor
D. hunting queries in Azure Sentinel

Answer: A