100% Authentic & Most Updated SC-200 Dumps

Question 1

Your company stores the data for every project in a different Azure subscription. All thesubscriptions use the same Azure Active Directory (Azure AD) tenant.Every project consists of multiple Azure virtual machines that run Windows Server. TheWindows events of the virtual machines are stored in a Log Analytics workspace in eachmachine’s respective subscription.You deploy Azure Sentinel to a new Azure subscription.You need to perform hunting queries in Azure Sentinel to search across all the LogAnalytics workspaces of all the subscriptions.Which two actions should you perform? Each correct answer presents part of the solution.NOTE: Each correct selection is worth one point.

A. Add the Security Events connector to the Azure Sentinel workspace.
B. Create a query that uses the workspace expression and the union operator.
C. Use the alias statement.
D. Create a query that uses the resource expression and the alias operator.
E. Add the Azure Sentinel solution to each workspace.

Answer: B,E

Question 2

You have a playbook in Azure Sentinel.When you trigger the playbook, it sends an email to a distribution group.You need to modify the playbook to send the email to the owner of the resource instead ofthe distribution group.What should you do?

A. Add a parameter and modify the trigger.
B. Add a custom data connector and modify the trigger.
C. Add a condition and modify the action.
D. Add a parameter and modify the action.

Answer: D

Question 3

Note: This question is part of a series of questions that present the same scenario. Eachquestion in the series contains a unique solution that might meet the stated goals. Somequestion sets might have more than one correct solution, while others might not have acorrect solution.After you answer a question in this section, you will NOT be able to return to it. As a result,these questions will not appear in the review screen.You use Azure Security Center.You receive a security alert in Security Center.You need to view recommendations to resolve the alert in Security Center.Solution: From Security alerts, you select the alert, select Take Action, and then expandthe Prevent future attacks section.Does this meet the goal?

A. Yes
B. No

Answer: B

Question 4

Your company uses Azure Sentinel.A new security analyst reports that she cannot assign and dismiss incidents in AzureSentinel. You need to resolve the issue for the analyst. The solution must use the principleof least privilege. Which role should you assign to the analyst?

A. Azure Sentinel Responder
B. Logic App Contributor
C. Azure Sentinel Contributo
D. Azure Sentinel Reader

Answer: A

Question 5

You have an Azure Sentinel workspace.You need to test a playbook manually in the Azure portal. From where can you run the testin Azure Sentinel?

A. Playbooks
B. Analytics
C. Threat intelligence
D. Incidents

Answer: D

Question 6

Your company uses Azure Sentinel to manage alerts from more than 10,000 IoT devices.A security manager at the company reports that tracking security threats is increasinglydifficult due to the large number of incidents.You need to recommend a solution to provide a custom visualization to simplify theinvestigation of threats and to infer threats by using machine learning.What should you include in the recommendation?

A. built-in queries
B. livestream
C. notebooks
D. bookmarks

Answer: C

Question 7

Note: This question is part of a series of questions that present the same scenario. Eachquestion in the series contains a unique solution that might meet the stated goals. Somequestion sets might have more than one correct solution, while others might not have acorrect solution.After you answer a question in this section, you will NOT be able to return to it. As a result,these questions will not appear in the review screen.You use Azure Security Center.You receive a security alert in Security Center.You need to view recommendations to resolve the alert in Security Center.Solution: From Regulatory compliance, you download the report.Does this meet the goal?

A. Yes
B. No

Answer: B

Question 8

You are configuring Azure Sentinel.You need to send a Microsoft Teams message to a channel whenever a sign-in from asuspicious IP address is detected.Which two actions should you perform in Azure Sentinel? Each correct answer presentspart of the solution.NOTE: Each correct selection is worth one point.

A. Add a playbook.
B. Associate a playbook to an incident.
C. Enable Entity behavior analytics.
D. Create a workbook.
E. Enable the Fusion rule.

Answer: A,B

Question 9

Your company uses Microsoft Defender for Endpoint.The company has Microsoft Word documents that contain macros. The documents areused frequently on the devices of the company’s accounting team.You need to hide false positive in the Alerts queue, while maintaining the existing securityposture. Which three actions should you perform? Each correct answer presents part of thesolution.NOTE: Each correct selection is worth one point.

A. Resolve the alert automatically.
B. Hide the alert.
C. Create a suppression rule scoped to any device.
D. Create a suppression rule scoped to a device group.
E. Generate the alert.

Answer: B,C,E

Question 10

You have a Microsoft 365 subscription that uses Microsoft Defender for Office 365.You have Microsoft SharePoint Online sites that contain sensitive documents. Thedocuments contain customer account numbers that each consists of 32 alphanumericcharacters.You need to create a data loss prevention (DLP) policy to protect the sensitive documents.What should you use to detect which documents are sensitive?

A. SharePoint search
B. a hunting query in Microsoft 365 Defender
C. Azure Information Protection
D. RegEx pattern matching

Answer: C