Free SC-200 Exam Braindumps

- (Exam Topic 3)
Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.
After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.
You are configuring Azure Sentinel.
You need to create an incident in Azure Sentinel when a sign-in to an Azure virtual machine from a malicious IP address is detected.
Solution: You create a Microsoft incident creation rule for a data connector.
Does this meet the goal?

1. A. Yes
2. B. No

Correct Answer: A
Reference:
https://docs.microsoft.com/en-us/azure/sentinel/connect-azure-security-center

- (Exam Topic 3)
You have a Microsoft 365 subscription that contains 1,000 Windows 10 devices. The devices have Microsoft Office 365 installed.
You need to mitigate the following device threats:
Microsoft Excel macros that download scripts from untrusted websites
Users that open executable attachments in Microsoft Outlook
Outlook rules and forms exploits What should you use?

1. A. Microsoft Defender Antivirus
2. B. attack surface reduction rules in Microsoft Defender for Endpoint
3. C. Windows Defender Firewall
4. D. adaptive application control in Azure Defender

Correct Answer: B
Reference:
https://docs.microsoft.com/en-us/microsoft-365/security/defender-endpoint/overview-attack-surface-reduction?v

- (Exam Topic 2)
You need to implement the Azure Information Protection requirements. What should you configure first?

1. A. Device health and compliance reports settings in Microsoft Defender Security Center
2. B. scanner clusters in Azure Information Protection from the Azure portal
3. C. content scan jobs in Azure Information Protection from the Azure portal
4. D. Advanced features from Settings in Microsoft Defender Security Center

Correct Answer: D
https://docs.microsoft.com/en-us/windows/security/threat-protection/microsoft-defender-atp/information- protection-in-windows-overview

- (Exam Topic 3)
You have an existing Azure logic app that is used to block Azure Active Directory (Azure AD) users. The
logic app is triggered manually. You deploy Azure Sentinel.
You need to use the existing logic app as a playbook in Azure Sentinel. What should you do first?

1. A. And a new scheduled query rule.
2. B. Add a data connector to Azure Sentinel.
3. C. Configure a custom Threat Intelligence connector in Azure Sentinel.
4. D. Modify the trigger in the logic app.

Correct Answer: D
https://docs.microsoft.com/en-us/azure/sentinel/playbook-triggers-actions https://docs.microsoft.com/en-us/azure/sentinel/tutorial-respond-threats-playbook

- (Exam Topic 3)
You have a Microsoft Sentinel workspace.
You receive multiple alerts for failed sign in attempts to an account. You identify that the alerts are false positives.
You need to prevent additional failed sign-in alerts from being generated for the account. The solution must meet the following requirements.
• Ensure that failed sign-in alerts are generated for other accounts.
• Minimize administrative effort What should do?

1. A. Create an automation rule.
2. B. Create a watchlist.
3. C. Modify the analytics rule.
4. D. Add an activity template to the entity behavior.

Correct Answer: A
An automation rule will allow you to specify which alerts should be suppressed, ensuring that failed sign-in alerts are generated for other accounts while minimizing administrative effort. To create an automation rule, navigate to the Automation Rules page in the Microsoft Sentinel workspace and configure the rule parameters to suppress the false positive alerts.