QUESTION: 6

HOTSPOT
-
You have the resources shown in the following table.

You have an Azure subscription that uses Microsoft Defender for Cloud.
You need to use Defender for Cloud to protect VM1 and Server1. The solution must meet the following requirements:
• Support Advanced Threat Protection and vulnerability assessment.
• Register each SQL Server 2022 instance as a SQL virtual machine.
• Minimize implementation and administrative effort.
What should you deploy to each server? To answer, select the appropriate options in the answer area.
Note: Each correct selection is worth one point.

See Explanation section for answer.

Answer(s): A

Explanation:

Reveal Solution Next Question

QUESTION: 6

You have a Microsoft 365 subscription that uses Microsoft Defender for Endpoint Plan 2 and contains a macOS device named Device1.
You need to investigate a Defender for Endpoint agent alert on Device1. The solution must meet the following requirements:
• Identify all the active network connections on Device1.
• Identify all the running processes on Device1.
• Retrieve the login history of Device1.
• Minimize administrative effort.
What should you do first from the Microsoft Defender portal?

From Devices, click Collect investigation package for Device1.
From Advanced features in Endpoints, enable Live Response unsigned script execution.
From Devices, initiate a live response session on Device1.
From Advanced features in Endpoints, disable Authenticated telemetry.

Answer(s): A

Reveal Solution Next Question

QUESTION: 6

You have 500 on-premises devices.
You have a Microsoft 365 E5 subscription that uses Microsoft Defender 365.
You onboard 100 devices to Microsoft Defender 365.
You need to identify any unmanaged on-premises devices. The solution must ensure that only specific onboarded devices perform the discovery.
What should you do first?

Create a device group.
Create an exclusion.
Set Discovery mode to Basic.
Create a tag.

Answer(s): C

Reveal Solution Next Question

QUESTION: 6

HOTSPOT
-
You have an Azure subscription that contains a Log Analytics workspace named Workspace1.
You configure Azure activity logs and Microsoft Entra ID logs to be forwarded to Workspace1.
You need to identify which Azure resources have been queried or modified by risky users.
How should you complete the KQL query? To answer, select the appropriate options in the answer area.
Note: Each correct selection is worth one point.

See Explanation section for answer.

Answer(s): A

Explanation:

Reveal Solution Next Question

Free SC-200 Exam Braindumps (page: 14)

QUESTION: 6

Explanation:

QUESTION: 6

QUESTION: 6

QUESTION: 6

Explanation: