QUESTION: 12

Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.
After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.
You are configuring Microsoft Defender for Identity integration with Active Directory.
From the Microsoft Defender for identity portal, you need to configure several accounts for attackers to exploit.
Solution: You add the accounts to an Active Directory group and add the group as a Sensitive group.
Does this meet the goal?

Answer(s): B

Reference:

https://docs.microsoft.com/en-us/defender-for-identity/manage-sensitive-honeytoken-accounts

Reveal Solution Next Question

QUESTION: 12

You recently deployed Azure Sentinel.
You discover that the default Fusion rule does not generate any alerts. You verify that the rule is enabled.
You need to ensure that the Fusion rule can generate alerts.
What should you do?

Disable, and then enable the rule.
Add data connectors
Create a new machine learning analytics rule.
Add a hunting bookmark.

Answer(s): B

Reference:

https://docs.microsoft.com/en-us/azure/sentinel/connect-data-sources

Reveal Solution Next Question

QUESTION: 13

HOTSPOT
-
You have an Azure subscription that uses Microsoft Defender for Cloud.
You need to use an Azure Resource Manager (ARM) template to create a workflow automation that will trigger a logic app when specific alerts are received by Microsoft Defender for Cloud.
How should you complete the template? To answer, select the appropriate options in the answer area.
Note: Each correct selection is worth one point.

See Explanation section for answer.

Answer(s): A

Explanation:

Reveal Solution Next Question

QUESTION: 13

You have an Azure subscription named Sub1 that uses Microsoft Defender for Cloud.
You need to assign the PCI DSS 4.0 initiative to Sub1 and have the initiative displayed in the Defender for Cloud Regulatory compliance dashboard.
From Security policies in the Environment settings, you discover that the option to add more industry and regulatory standards is unavailable.
What should you do first?

Configure the Continuous export settings for Log Analytics.
Enable the Cloud Security Posture Management (CSPM) plan for the subscription.
Configure the Continuous export settings for Azure Event Hubs.
Disable the Microsoft Cloud Security Benchmark (MCSB) assignment.

Answer(s): B

Reveal Solution Next Question

Free SC-200 Exam Braindumps (page: 26)

QUESTION: 12

Reference:

QUESTION: 12

Reference:

QUESTION: 13

Explanation:

QUESTION: 13