Summer Special Sale Limited Time 60% Discount Offer - Ends in 0d 00h 00m 00s - Coupon code: 713PS592

SC-200 Microsoft Security Operations Analyst Questions and Answers

Questions 4

You have a Microsoft 365 tenant that uses Microsoft Exchange Online and Microsoft Defender for Office 365.

What should you use to identify whether zero-hour auto purge (ZAP) moved an email message from the mailbox of a user?

Options:

A.

the Threat Protection Status report in Microsoft Defender for Office 365

B.

the mailbox audit log in Exchange

C.

the Safe Attachments file types report in Microsoft Defender for Office 365

D.

the mail flow report in Exchange

Buy Now
Questions 5

You have a Microsoft 365 E5 subscription that contains a device named Device 1. Device 1 is enrolled in Microsoft Defender for End point.

Device1 reports an incident that includes a file named File1 exe as evidence.

You initiate the Collect Investigation Package action and download the ZIP file.

You need to identify the first and last time File1.exe was executed.

What should you review in the investigation package?

Options:

A.

Processes

B.

Scheduled tasks

C.

Autoruns

D.

Security event log

E.

Prefetch files

Buy Now
Questions 6

You have an Azure subscription that uses Microsoft Defender for Cloud and contains 100 virtual machines that run Windows Server.

You need to configure Defender for Cloud to collect event data from the virtual machines. The solution must minimize administrative effort and costs.

Which two actions should you perform? Each correct answer presents part of the solution.

NOTE: Each correct selection is worth one point.

Options:

A.

From the workspace created by Defender for Cloud, set the data collection level to Common

B.

From the Microsoft Endpoint Manager admin center, enable automatic enrollment.

C.

From the Azure portal, create an Azure Event Grid subscription.

D.

From the workspace created by Defender for Cloud, set the data collection level to All Events

E.

From Defender for Cloud in the Azure portal, enable automatic provisioning for the virtual machines.

Buy Now
Questions 7

You need to ensure that the Group1 members can meet the Microsoft Sentinel requirements.

Which role should you assign to Group1?

Options:

A.

Microsoft Sentinel Automation Contributor

B.

Logic App Contributor

C.

Automation Operator

D.

Microsoft Sentinel Playbook Operator

Buy Now
Questions 8

You need to ensure that the configuration of HuntingQuery1 meets the Microsoft Sentinel requirements.

What should you do?

Options:

A.

Add HuntingQuery1 to a livestream.

B.

Create a watch list.

C.

Create an Azure Automation rule.

D.

Add HuntingQuery1 to favorites.

Buy Now
Questions 9

You have a Microsoft Sentinel workbook that contains the following KQL query.

SC-200 Question 9

You need to create a visual that will change the color of the errCount column based on the value returned. How should you configure the visual? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.

SC-200 Question 9

Options:

Buy Now
Questions 10

You recently deployed Azure Sentinel.

You discover that the default Fusion rule does not generate any alerts. You verify that the rule is enabled.

You need to ensure that the Fusion rule can generate alerts.

What should you do?

Options:

A.

Disable, and then enable the rule.

B.

Add data connectors

C.

Create a new machine learning analytics rule.

D.

Add a hunting bookmark.

Buy Now
Questions 11

The issue for which team can be resolved by using Microsoft Defender for Office 365?

Options:

A.

executive

B.

marketing

C.

security

D.

sales

Buy Now
Questions 12

You need to implement the Microsoft Sentinel NRT rule for monitoring the designated break glass account. The solution must meet the Microsoft Sentinel requirements.

How should you complete the query? To answer, select the appropriate options in the answer area.

NOTE: Each correct selection is worth one point.

SC-200 Question 12

Options:

Buy Now
Questions 13

You need to remediate active attacks to meet the technical requirements.

What should you include in the solution?

Options:

A.

Azure Automation runbooks

B.

Azure Logic Apps

C.

Azure Functions

D Azure Sentinel livestreams

Buy Now
Questions 14

You need to create an advanced hunting query to investigate the executive team issue.

How should you complete the query? To answer, select the appropriate options in the answer area.

NOTE: Each correct selection is worth one point.

SC-200 Question 14

Options:

Buy Now
Questions 15

You need to recommend remediation actions for the Azure Defender alerts for Fabrikam.

What should you recommend for each threat? To answer, select the appropriate options in the answer area.

NOTE: Each correct selection is worth one point.

SC-200 Question 15

Options:

Buy Now
Questions 16

You need to complete the query for failed sign-ins to meet the technical requirements.

Where can you find the column name to complete the where clause?

Options:

A.

Security alerts in Azure Security Center

B.

Activity log in Azure

C.

Azure Advisor

D.

the query windows of the Log Analytics workspace

Buy Now
Questions 17

You need to recommend a solution to meet the technical requirements for the Azure virtual machines. What should you include in the recommendation?

Options:

A.

just-in-time (JIT) access

B.

Azure Defender

C.

Azure Firewall

D.

Azure Application Gateway

Buy Now
Questions 18

You need to implement Azure Sentinel queries for Contoso and Fabrikam to meet the technical requirements.

What should you include in the solution? To answer, select the appropriate options in the answer area.

NOTE: Each correct selection is worth one point.

SC-200 Question 18

Options:

Buy Now
Questions 19

You need to configure the Azure Sentinel integration to meet the Azure Sentinel requirements.

What should you do? To answer, select the appropriate options in the answer area.

NOTE: Each correct selection is worth one point.

SC-200 Question 19

Options:

Buy Now
Questions 20

Which rule setting should you configure to meet the Microsoft Sentinel requirements?

Options:

A.

From Set rule logic, turn off suppression.

B.

From Analytic rule details, configure the tactics.

C.

From Set rule logic, map the entities.

D.

From Analytic rule details, configure the severity.

Buy Now
Questions 21

The issue for which team can be resolved by using Microsoft Defender for Endpoint?

Options:

A.

executive

B.

sales

C.

marketing

Buy Now
Questions 22

You need to implement Microsoft Defender for Cloud to meet the Microsoft Defender for Cloud requirements and the business requirements. What should you include in the solution? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.

SC-200 Question 22

Options:

Buy Now
Questions 23

You need to create the test rule to meet the Azure Sentinel requirements. What should you do when you create the rule?

Options:

A.

From Set rule logic, turn off suppression.

B.

From Analytics rule details, configure the tactics.

C.

From Set rule logic, map the entities.

D.

From Analytics rule details, configure the severity.

Buy Now
Questions 24

You need to add notes to the events to meet the Azure Sentinel requirements.

Which three actions should you perform in sequence? To answer, move the appropriate actions from the list of action to the answer area and arrange them in the correct order.

SC-200 Question 24

Options:

Buy Now
Questions 25

You need to implement Azure Defender to meet the Azure Defender requirements and the business requirements.

What should you include in the solution? To answer, select the appropriate options in the answer area.

NOTE: Each correct selection is worth one point.

SC-200 Question 25

Options:

Buy Now
Questions 26

You need to modify the anomaly detection policy settings to meet the Microsoft Defender for Cloud Apps requirements and resolve the reported problem.

Which policy should you modify?

Options:

A.

Activity from suspicious IP addresses

B.

Risky sign-in

C.

Activity from anonymous IP addresses

D.

Impossible travel

Buy Now
Questions 27

You need to assign a role-based access control (RBAC) role to admin1 to meet the Azure Sentinel requirements and the business requirements.

Which role should you assign?

Options:

A.

Automation Operator

B.

Automation Runbook Operator

C.

Azure Sentinel Contributor

D.

Logic App Contributor

Buy Now
Questions 28

You need to create the analytics rule to meet the Azure Sentinel requirements.

What should you do? To answer, select the appropriate options in the answer area.

NOTE: Each correct selection is worth one point.

SC-200 Question 28

Options:

Buy Now
Questions 29

You need to modify the anomaly detection policy settings to meet the Cloud App Security requirements. Which policy should you modify?

Options:

A.

Activity from suspicious IP addresses

B.

Activity from anonymous IP addresses

C.

Impossible travel

D.

Risky sign-in

Buy Now
Questions 30

You need to configure the Microsoft Sentinel integration to meet the Microsoft Sentinel requirements. What should you do? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.

SC-200 Question 30

Options:

Buy Now
Questions 31

You need to restrict cloud apps running on CUENT1 to meet the Microsoft Defender for Endpoint requirements. Which two configurations should you modify? Each correct answer presents part of the solution. NOTE: Each correct selection is worth one point.

Options:

A.

the Cloud Discovery settings in Microsoft Defender for Cloud Apps

B.

the Onboarding settings from Device management in Settings in Microsoft 365 Defender portal

C.

Microsoft Defender for Cloud Apps anomaly detection policies

D.

Advanced features from the Endpoints Settings in the Microsoft 365 Defender portal

Buy Now
Questions 32

You need to configure DC1 to meet the business requirements.

Which four actions should you perform in sequence? To answer, move the appropriate actions from the list of actions to the answer area and arrange them in the correct order.

SC-200 Question 32

Options:

Buy Now
Questions 33

You need to restrict cloud apps running on CLIENT1 to meet the Microsoft Defender for Endpoint requirements.

Which two configurations should you modify? Each correct answer present part of the solution.

NOTE: Each correct selection is worth one point.

Options:

A.

the Onboarding settings from Device management in Microsoft Defender Security Center

B.

Cloud App Security anomaly detection policies

C.

Advanced features from Settings in Microsoft Defender Security Center

D.

the Cloud Discovery settings in Cloud App Security

Buy Now
Questions 34

You need to implement the Azure Information Protection requirements. What should you configure first?

Options:

A.

Device health and compliance reports settings in Microsoft Defender Security Center

B.

scanner clusters in Azure Information Protection from the Azure portal

C.

content scan jobs in Azure Information Protection from the Azure portal

D.

Advanced features from Settings in Microsoft Defender Security Center

Buy Now
Questions 35

You have an Azure subscription that uses resource type for Cloud. You need to filter the security alerts view to show the following alerts:

• Unusual user accessed a key vault

• Log on from an unusual location

• Impossible travel activity

Which severity should you use?

Options:

A.

Informational

B.

Low

C.

Medium

D.

High

Buy Now
Questions 36

You have a Microsoft 365 subscription.

You have 1,000 Windows devices that have a third-party antivirus product installed and Microsoft Defender Antivirus in passive mode. You need to ensure that the devices are protected from malicious artifacts that were undetected by the third-party antivirus product Solution: You enable automated investigation and response (AIR).

Does this meet the goal?

Options:

A.

Yes

B.

No

Buy Now
Questions 37

You have two Azure subscriptions that use Microsoft Defender for Cloud.

You need to ensure that specific Defender for Cloud security alerts are suppressed at the root management group level. The solution must minimize administrative effort.

What should you do in the Azure portal?

Options:

A.

Create an Azure Policy assignment.

B.

Modify the Workload protections settings in Defender for Cloud.

C.

Create an alert rule in Azure Monitor.

D.

Modify the alert settings in Defender for Cloud.

Buy Now
Questions 38

You have a Microsoft 365 E5 subscription that uses Microsoft Defender XDR.

You are implementing a deception rule.

You need to provide a custom lure file.

For the custom lure, you set Planting path to HOME.

Which types of files can you use for the custom lure, and in which home directory should the file be located on a device? To answer, select the appropriate options in the answer area.

NOTE: Each correct selection is worth one point.

SC-200 Question 38

Options:

Buy Now
Questions 39

You have a Microsoft 365 subscription.

You have 1,000 Windows devices that have a third-party antivirus product installed and Microsoft Defender Antivirus in passive mode.

You need to ensure that the devices are protected from malicious artifacts that were undetected by the third -party antivirus product.

Solution: You configure endpoint detection and response (EDR) in block mode.

Does this meet the goal?

Options:

A.

Yes

B.

No

Buy Now
Questions 40

You have an Azure subscription that contains a Log Analytics workspace named Workspace1.

You configure Azure activity logs and Microsoft Entra ID logs to be forwarded to Workspace1.

You need to query Workspace1 to identify all the requests that failed due to insufficient authorization.

How should you complete the KQL query? To answer, select the appropriate options in the answer area.

NOTE: Each correct selection is worth one point.

Options:

Buy Now
Questions 41

NO: 7

You provision a Linux virtual machine in a new Azure subscription.

You enable Azure Defender and onboard the virtual machine to Azure Defender.

You need to verify that an attack on the virtual machine triggers an alert in Azure Defender.

Which two Bash commands should you run on the virtual machine? Each correct answer presents part of the solution.

NOTE: Each correct selection is worth one point.

Options:

A.

cp /bin/echo ./asc_alerttest_662jfi039n

B.

./alerttest testing eicar pipe

C.

cp /bin/echo ./alerttest

D.

./asc_alerttest_662jfi039n testing eicar pipe

Buy Now
Questions 42

You have a Microsoft 365 subscription that uses Microsoft Purview and contains a Microsoft SharePoint Online site named Site1. Site1 contains the files shown in the following table.

SC-200 Question 42

From Microsoft Purview, you create the content search queries shown in the following table.

SC-200 Question 42

For each of the following statements, select Yes if the statement is true. Otherwise, select No.

NOTE; Each correct selection is worth one point.

SC-200 Question 42

Options:

Buy Now
Questions 43

You have a Microsoft 365 E5 subscription and a Microsoft Sentinel workspace. You need to create a KQL query that will combine data from the following sources:

• Microsoft Graph

• Risky users detected by using Microsoft Entra ID Protection

The solution must minimize the volume of data returned. How should the query start?

Options:

A.

MicrosoftGraphActivityLogs

lookup kind=leftouter AADRiskyUsers on $left.Userld == $right.Id

B.

MicrosoftGraphActivityLogs

join AADRiskyUsers on $left.Userld == $right.Id

C.

MicrosoftGraphActivityLogs

join AADUserRiskEvents on $left.Userld == $right.Id

D.

find in (MicrosoftGraphActivityLogs, AADUserRiskEvents) where

Buy Now
Questions 44

You have an Azure subscription that contains an Azure logic app named app1 and a Microsoft Sentinel workspace that has an Azure AD connector. You need to ensure that app1 launches when Microsoft Sentinel detects an Azure AD-generated alert. What should you create first?

Options:

A.

a repository connection

B.

awatchlist

C.

an analytics rule

D.

an automation rule

Buy Now
Questions 45

You have a Microsoft 365 subscription that uses Microsoft Defender XOR and contains a Windows device named Oevice1. You investigate a suspicious process named Prod on Device! by using a live response session. You need to perform the following actions:

• Stop Prod.

• Send Prod for further review.

Which live response command should you run for each action? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.

SC-200 Question 45

Options:

Buy Now
Questions 46

You have an Azure subscription.

You need to delegate permissions to meet the following requirements:

• Enable and disable advanced features of Microsoft Defender for Cloud.

• Apply security recommendations to a resource.

The solution must use the principle of least privilege.

Which Microsoft Defender for Cloud role should you use for each requirement? To answer, drag the appropriate roles to the correct requirements. Each role may be used once, mote than once, or not at all. You may need to drag the split bar between panes or scroll to view content.

NOTE: Each correct selection is worth one point.

SC-200 Question 46

Options:

Buy Now
Questions 47

You have an Azure subscription named Sub1 that contains the resources shown in the following table.

SC-200 Question 47

You plan to configure Rule1 to trigger Lapp1 when an incident is generated.

You need to recommend the role-based access control (RBAC) role that you should assign to WS1, and the scope at which should you assign the role. The solution must follow the principle of least privilege.

What should you recommend? To answer, select the appropriate options in the answer area.

NOTE: Each correct selection is worth one point.

SC-200 Question 47

Options:

Buy Now
Questions 48

You have four Azure subscriptions. One of the subscriptions contains a Microsoft Sentinel workspace.

You need to deploy Microsoft Sentinel data connectors to collect data from the subscriptions by using Azure Policy. The solution must ensure that the policy will apply to new and existing resources in the subscriptions.

Which type of connectors should you provision, and what should you use to ensure that all the resources are monitored? To answer, select the appropriate options in the answer area.

NOTE: Each correct selection is worth one point.

SC-200 Question 48

Options:

Buy Now
Questions 49

You have a Microsoft Sentinel workspace that contains a custom workbook.

You need to query the number of daily security alerts. The solution must meet the following requirements:

• Identify alerts that occurred during the last 30 days.

• Display the results in a timechart.

How should you complete the query? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.

SC-200 Question 49

Options:

Buy Now
Questions 50

You have a Microsoft 365 E5 subscription that uses Microsoft Defender XDR and contains a Windows device named Device1.

You detect malicious activity on Device1.

You initiate a live response session on Device1.

You need to perform the following actions:

• Download a file from the live response library.

• Stop a process that is running on Device1.

Which live response command should you run for each action? To answer, select the appropriate options in the answer area.

NOTE: Each correct selection is worth one point.

SC-200 Question 50

Options:

Buy Now
Questions 51

You have a Microsoft 365 E5 subscription that uses Microsoft Defender and an Azure subscription that uses Azure Sentinel.

You need to identify all the devices that contain files in emails sent by a known malicious email sender. The query will be based on the match of the SHA256 hash.

How should you complete the query? To answer, select the appropriate options in the answer area.

NOTE: Each correct selection is worth one point.

SC-200 Question 51

Options:

Buy Now
Questions 52

You have a Microsoft Sentinel workspace.

You need to prevent a built-in Advance Security information Model (ASIM) parse from being updated automatically.

What are two ways to achieve this goal? Each correct answer presents a complete solution.

NOTE: Each correct selection is worth one point.

Options:

A.

Redeploy the built-in parse and specify a CallerContext parameter of any and a SourceSpecificParse parameter of any.

B.

Create a hunting query that references the built-in parse.

C.

Redeploy the built-in parse and specify a CallerContext parameter of built-in.

D.

Build a custom unify parse and include the build- parse version

E.

Create an analytics rule that includes the built-in parse

Buy Now
Exam Code: SC-200
Exam Name: Microsoft Security Operations Analyst
Last Update: Jun 27, 2025
Questions: 347

PDF + Testing Engine

$74.6  $186.49

Testing Engine

$59.8  $149.49
buy now SC-200 testing engine

PDF (Q&A)

$55  $137.49
buy now SC-200 pdf