microsoft SC-200 Exam Questions

Questions for the SC-200 were updated on : Jun 17 ,2024

Page 1 out of 8. Viewing questions 1-15 out of 110

Question 1 Topic 1, Case Study 1Case Study Question View Case

The issue for which team can be resolved by using Microsoft Defender for Endpoint?

  • A. executive
  • B. sales
  • C. marketing
Answer:

B

User Votes:
A
50%
B
50%
C
50%

Explanation:
Reference: https://docs.microsoft.com/en-us/windows/security/threat-protection/microsoft-defender-atp/microsoft-defender-
atp-ios

Discussions
vote your answer:
A
B
C
0 / 1000

Question 2 Topic 1, Case Study 1Case Study Question View Case

The issue for which team can be resolved by using Microsoft Defender for Office 365?

  • A. executive
  • B. marketing
  • C. security
  • D. sales
Answer:

B

User Votes:
A
50%
B
50%
C
50%
D
50%

Explanation:
Reference: https://docs.microsoft.com/en-us/microsoft-365/security/office-365-security/atp-for-spo-odb-and-
teams?view=o365-worldwide

Discussions
vote your answer:
A
B
C
D
0 / 1000

Question 3 Topic 2, Case Study 2Case Study Question View Case

You need to implement the Azure Information Protection requirements.
What should you configure first?

  • A. Device health and compliance reports settings in Microsoft Defender Security Center
  • B. scanner clusters in Azure Information Protection from the Azure portal
  • C. content scan jobs in Azure Information Protection from the Azure portal
  • D. Advanced features from Settings in Microsoft Defender Security Center
Answer:

D

User Votes:
A
50%
B
50%
C
50%
D
50%

Explanation:
Reference: https://docs.microsoft.com/en-us/windows/security/threat-protection/microsoft-defender-atp/information-
protection-in-windows-overview

Discussions
vote your answer:
A
B
C
D
0 / 1000

Question 4 Topic 2, Case Study 2Case Study Question View Case

You need to modify the anomaly detection policy settings to meet the Cloud App Security requirements and resolve the
reported problem.
Which policy should you modify?

  • A. Activity from suspicious IP addresses
  • B. Activity from anonymous IP addresses
  • C. Impossible travel
  • D. Risky sign-in
Answer:

C

User Votes:
A
50%
B
50%
C
50%
D
50%

Explanation:
Reference: https://docs.microsoft.com/en-us/cloud-app-security/anomaly-detection-policy

Discussions
vote your answer:
A
B
C
D
0 / 1000

Question 5 Topic 2, Case Study 2Case Study Question View Case

DRAG DROP
You need to configure DC1 to meet the business requirements.
Which four actions should you perform in sequence? To answer, move the appropriate actions from the list of actions to the
answer area and arrange them in the correct order.
Select and Place:

Answer:


Explanation:
Step 1: log in to https://portal.atp.azure.com as a global admin
Step 2: Create the instance Step 3. Connect the instance to Active Directory Step 4. Download and install the sensor.
Reference: https://docs.microsoft.com/en-us/defender-for-identity/install-step1 https://docs.microsoft.com/en-us/defender-for-
identity/install-step4

Discussions
0 / 1000

Question 6 Topic 3, Case Study 3Case Study Question View Case

HOTSPOT
You need to recommend remediation actions for the Azure Defender alerts for Fabrikam.
What should you recommend for each threat? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Hot Area:

Answer:


Explanation:
Reference: https://docs.microsoft.com/en-us/azure/key-vault/general/security-features https://docs.microsoft.com/en-
us/azure/key-vault/general/secure-your-key-vault

Discussions
0 / 1000

Question 7 Topic 3, Case Study 3Case Study Question View Case

You need to recommend a solution to meet the technical requirements for the Azure virtual machines.
What should you include in the recommendation?

  • A. just-in-time (JIT) access
  • B. Azure Defender
  • C. Azure Firewall
  • D. Azure Application Gateway
Answer:

B

User Votes:
A
50%
B
50%
C
50%
D
50%

Explanation:
Reference:
https://docs.microsoft.com/en-us/azure/security-center/azure-defender

Discussions
vote your answer:
A
B
C
D
0 / 1000

Question 8 Topic 4, Case Study 4Case Study Question View Case

You need to complete the query for failed sign-ins to meet the technical requirements.
Where can you find the column name to complete the where clause?

  • A. Security alerts in Azure Security Center
  • B. Activity log in Azure
  • C. Azure Advisor
  • D. the query windows of the Log Analytics workspace
Answer:

D

User Votes:
A
50%
B
50%
C
50%
D
50%
Discussions
vote your answer:
A
B
C
D
0 / 1000

Question 9 Topic 4, Case Study 4Case Study Question View Case

You need to remediate active attacks to meet the technical requirements.
What should you include in the solution?

  • A. Azure Automation runbooks
  • B. Azure Logic Apps
  • C. Azure Functions
  • D. Azure Sentinel livestreams
Answer:

B

User Votes:
A
50%
B
50%
C
50%
D
50%

Explanation:
Reference: https://docs.microsoft.com/en-us/azure/sentinel/automate-responses-with-playbooks

Discussions
vote your answer:
A
B
C
D
0 / 1000

Question 10 Topic 4, Case Study 4Case Study Question View Case

HOTSPOT
You need to create an advanced hunting query to investigate the executive team issue.
How should you complete the query? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Hot Area:

Answer:


Explanation:
Mitigate threats using Azure Sentinel

Discussions
0 / 1000

Question 11 Topic 4, Case Study 4Case Study Question View Case

HOTSPOT
You need to implement Azure Sentinel queries for Contoso and Fabrikam to meet the technical requirements.
What should you include in the solution? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Hot Area:

Answer:


Explanation:
Reference: https://docs.microsoft.com/en-us/azure/sentinel/extend-sentinel-across-workspaces-tenants

Discussions
0 / 1000

Question 12 Topic 5, Case Study 5Case Study Question View Case

You need to restrict cloud apps running on CLIENT1 to meet the Microsoft Defender for Endpoint requirements.
Which two configurations should you modify? Each correct answer present part of the solution.
NOTE: Each correct selection is worth one point.

  • A. the Onboarding settings from Device management in Microsoft Defender Security Center
  • B. Cloud App Security anomaly detection policies
  • C. Advanced features from Settings in Microsoft Defender Security Center
  • D. the Cloud Discovery settings in Cloud App Security
Answer:

C D

User Votes:
A
50%
B
50%
C
50%
D
50%

Explanation:
All Cloud App Security unsanctioned apps must be blocked on the Windows 10 computers by using Microsoft Defender for
Endpoint.
Reference: https://docs.microsoft.com/en-us/cloud-app-security/mde-govern

Discussions
vote your answer:
A
B
C
D
0 / 1000

Question 13 Topic 5, Case Study 5Case Study Question View Case

DRAG DROP
You need to add notes to the events to meet the Azure Sentinel requirements.
Which three actions should you perform in sequence? To answer, move the appropriate actions from the list of action to the
answer area and arrange them in the correct order.
Select and Place:

Answer:


Explanation:
Reference: https://docs.microsoft.com/en-us/azure/sentinel/bookmarks

Discussions
0 / 1000

Question 14 Topic 5, Case Study 5Case Study Question View Case

HOTSPOT
You need to configure the Azure Sentinel integration to meet the Azure Sentinel requirements.
What should you do? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Hot Area:

Answer:


Explanation:
Reference: https://docs.microsoft.com/en-us/cloud-app-security/siem-sentinel

Discussions
0 / 1000

Question 15 Topic 5, Case Study 5Case Study Question View Case

You need to assign a role-based access control (RBAC) role to admin1 to meet the Azure Sentinel requirements and the
business requirements.
Which role should you assign?

  • A. Automation Operator
  • B. Automation Runbook Operator
  • C. Azure Sentinel Contributor
  • D. Azure Sentinel Responder
Answer:

C

User Votes:
A
50%
B
50%
C
50%
D
50%

Explanation:
Litware must meet the following requirements:
Ensure that a user named admin1 can configure Azure Sentinel playbooks. The principle of least privilege must be used


whenever possible.
Azure Sentinel Contributor can view data, incidents, workbooks, and other Azure Sentinel resources, manage incidents
(assign, dismiss, etc.), create and edit workbooks, analytics rules, and other Azure Sentinel resources.
Reference: https://docs.microsoft.com/en-us/azure/sentinel/roles

Discussions
vote your answer:
A
B
C
D
0 / 1000
To page 2