Microsoft SC-200 Dumps & Mock Exam for Success, Microsoft Security Operations Analyst

Question #1

You have a custom analytics rule to detect threats in Azure Sentinel. You discover that the analytics rule stopped running. The rule was disabled, and the rule name has a prefix of AUTO DISABLED. What is a possible cause of the issue?

A. There are connectivity issues between the data sources and Log Analytics

B. The number of alerts exceeded 10,000 within two minutes

C. The rule query takes too long to run and times out

D. Permissions to one of the data sources of the rule query were modified

View answer

Correct Answer: A

Question #2

01.If you're hunting in Sentinel and come across results you want to use later, what would you use to save them for later?

A. otebook

B. ivestream

C. nalytics rule

D. ookmark

View answer

Correct Answer: d

Question #3

Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution. After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen. You are configuring Microsoft Defender for Identity integration with Active Di

A. Yes

B. No

View answer

Correct Answer: A

Question #4

You need to implement the Azure Information Protection requirements. What should you configure first?

A. Device health and compliance reports settings in Microsoft Defender Security Center

B. scanner clusters in Azure Information Protection from the Azure portal

C. content scan jobs in Azure Information Protection from the Azure portal

D. Advanced features from Settings in Microsoft Defender Security Center

View answer

Correct Answer: D

Question #5

You receive a security bulletin about a potential attack that uses an image filE. You need to create an indicator of compromise (IoC. in Microsoft Defender for Endpoint to prevent the attack. Which indicator type should you use?

A. a URL/domain indicator that has Action set to Alert only

B. a URL/domain indicator that has Action set to Alert and block

C. a file hash indicator that has Action set to Alert and block

D. a certificate indicator that has Action set to Alert and block

View answer

Correct Answer: c

Question #6

You need to assign a role-based access control (RBAC) role to admin1 to meet the Azure Sentinel requirements and the business requirements. Which role should you assign?

A. Automation Operator

B. Automation Runbook Operator

C. Azure Sentinel Contributor

D. Logic App Contributor

View answer

Correct Answer: C

Question #7

Which rule setting should you configure to meet the Azure Sentinel requirements?

A. From Set rule logic, turn off suppression

B. From Analytics rule details, configure the tactics

C. From Set rule logic, map the entities

D. From Analytics rule details, configure the severity

View answer

Correct Answer: c

Question #8

05.What type of policy would you create in MDA to monitor employee credentials being used in another country?

A. ccess policy

B. ession policy

C. ctivity policy

D. rivileged accounts

View answer

Correct Answer: c

Question #9

You create a new Azure subscription and start collecting logs for Azure Monitor. You need to configure Azure Security Center to detect possible threats related to sign-ins from suspicious IP addresses to Azure virtual machines. The solution must validate the configuration. Which three actions should you perform in a sequence? To answer, move the appropriate actions from the list of action to the answer area and arrange them in the correct order.

A. Mastered

B. Not Mastered

View answer

Correct Answer: D

Question #10

You implement Safe Attachments policies in Microsoft Defender for Office 365. Users report that email messages containing attachments take longer than expected to be receiveD.You need to reduce the amount of time it takes to deliver messages that contain attachments without compromising security. The attachments must be scanned for malware, and any messages that contain malware must be blockeD.What should you configure in the Safe Attachments policies?

A. Dynamic Delivery

B. Replace

C. Block and Enable redirect

D. Monitor and Enable redirect

View answer

Correct Answer: a

Question #11

You need to visualize Azure Sentinel data and enrich the data by using third-party data sources to identify indicators of compromise (IoC). What should you use?

A. notebooks in Azure Sentinel

B. Microsoft Cloud App Security

C. Azure Monitor

D. hunting queries in Azure Sentinel

View answer

Correct Answer: A

Question #12

Your company has a single office in Istanbul and a Microsoft 365 subscription. The company plans to use conditional access policies to enforce multi-factor authentication (MFA.. You need to enforce MFA for all users who work remotely.What should you include in the solution?

A. a fraud alert

B. a user risk policy

C. a sign-in user policy

D. a named location

View answer

Correct Answer: d

Question #13

You plan to create a custom Azure Sentinel query that will track anomalous Azure Active Directory (Azure AD) sign-in activity and present the activity as a time chart aggregated by day. You need to create a query that will be used to display the time chart. What should you include in the query?

A. extend

B. bin

C. makeset

D. workspace

View answer

Correct Answer: B

Question #14

A security administrator receives email alerts from Azure Defender for activities such as potential malware uploaded to a storage account and potential successful brute force attacks.The security administrator does NOT receive email alerts for activities such as antimalware action failed and suspicious network activity. The alerts appear in Azure Security Center. You need to ensure that the security administrator receives email alerts for all the activities.What should you configure in the Security Center s

A. the severity level of email notifications

B. a cloud connector

C. the Azure Defender plans

D. the integration settings for Threat detection

View answer

Correct Answer: a

Question #15

The issue for which team can be resolved by using Microsoft Defender for Endpoint?

A. executive

B. sales

C. marketing

D. security

View answer

Correct Answer: b

Question #16

Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution. After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen. You are configuring Microsoft Defender for Identity integration with Active Di

A. Yes

B. No

View answer

Correct Answer: D

Question #17

You receive an alert from Azure Defender for Key Vault. You discover that the alert is generated from multiple suspicious IP addresses. You need to reduce the potential of Key Vault secrets being leaked while you investigate the issuE. The solution must be implemented as soon as possible and must minimize the impact on legitimate users.What should you do first?

A. Modify the access control settings for the key vault

B. Enable the Key Vault firewall

C. Create an application security group

D. Modify the access policy for the key vault

View answer

Correct Answer: b

Question #18

Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution. After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen. You are configuring Microsoft Defender for Identity integration with Active Di

A. Yes

B. No

View answer

Correct Answer: B

Question #19

You have an Azure subscription that has Azure Defender enabled for all supported resource types. You create an Azure logic app named LA1. You plan to use LA1 to automatically remediate security risks detected in Azure Security Center. You need to test LA1 in Security Center. What should you do? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.

A. Mastered

B. Not Mastered

View answer

Correct Answer: A

DON'T WANT TO MISS A THING?

100% Pass Cisco, PMP, CISA, CISM, AWS Practice test on SALE!
Get Now

Microsoft SC-200 Dumps & Mock Exam for Success, Microsoft Security Operations Analyst | SPOTO

View Answers after Submission

DON'T WANT TO MISS A THING?

100% Pass Cisco, PMP, CISA, CISM, AWS Practice test on SALE! Get Now

Microsoft SC-200 Dumps & Mock Exam for Success, Microsoft Security Operations Analyst | SPOTO

View Answers after Submission

100% Pass Cisco, PMP, CISA, CISM, AWS Practice test on SALE!
Get Now