QUESTION: 15

You receive a security bulletin about a potential attack that uses an image file.
You need to create an indicator of compromise (IoC) in Microsoft Defender for Endpoint to prevent the attack.
Which indicator type should you use?

a URL/domain indicator that has Action set to Alert only
a URL/domain indicator that has Action set to Alert and block
a file hash indicator that has Action set to Alert and block
a certificate indicator that has Action set to Alert and block

Answer(s): C

Reference:

https://docs.microsoft.com/en-us/microsoft-365/security/defender-endpoint/indicator-file?view=o365-worldwide

Reveal Solution Next Question

QUESTION: 15

HOTSPOT (Drag and Drop is not supported).
You use Azure Sentinel to monitor irregular Azure activity.
You create custom analytics rules to detect threats as shown in the following exhibit.
You do NOT define any incident settings as part of the rule definition.
Use the drop-down menus to select the answer choice that completes each statement based on the information presented in the graphic.
Note: Each correct selection is worth one point.
Hot Area:

See Explanation section for answer.

Answer(s): A

Explanation:

Reference:

https://docs.microsoft.com/en-us/azure/sentinel/tutorial-detect-threats-custom

Reveal Solution Next Question

QUESTION: 16

You have a Microsoft 365 E5 subscription.
Automated investigation and response (AIR) is enabled in Microsoft Defender for Office 365 and devices use full automation in Microsoft Defender for Endpoint.
You have an incident involving a user that received malware-infected email messages on a managed device.
Which action requires manual remediation of the incident?

soft deleting the email message
hard deleting the email message
isolating the device
containing the device

Answer(s): C

Reveal Solution Next Question

QUESTION: 16

You have a Microsoft 365 E5 subscription that uses Microsoft Defender XDR.
The security team at your company detects command and control (C2) agent traffic on the network. Agents communicate once every 50 hours.
You need to create a Microsoft Defender XDR custom detection rule that will identify compromised devices and establish a pattern of communication. The solution must meet the following requirements:
• Identify all the devices that have communicated during the past 14 days.
• Minimize how long it takes to identify the devices.
To what should you set the detection frequency for the rule?

Every 12 hours
Every 24 hours
Every three hours
Every hour

Answer(s): A

Reveal Solution Next Question

Free SC-200 Exam Braindumps (page: 30)

QUESTION: 15

Reference:

QUESTION: 15

Explanation:

Reference:

QUESTION: 16

QUESTION: 16