QUESTION: 27

You have a Microsoft Sentinel workspace.
You are investigating an incident that involves multiple alerts, events, and entities.
You need to create a bookmark for the investigation. The solution must minimize administrative effort.
Which settings should you use?

Incidents
Hunting
Content hub
Logs

Answer(s): A

Reveal Solution Next Question

QUESTION: 27

HOTSPOT (Drag and Drop is not supported).
You have a Microsoft 365 E5 subscription that contains 200 Windows 10 devices enrolled in Microsoft Defender for Endpoint.
You need to ensure that users can access the devices by using a remote shell connection directly from the Microsoft 365 Defender portal. The solution must use the principle of least privilege.
What should you do in the Microsoft 365 Defender portal? To answer, select the appropriate options in the answer area.
Note: Each correct selection is worth one point.
Hot Area:

See Explanation section for answer.

Answer(s): A

Explanation:

Box 1: Turn on Live Response -
Live response is a capability that gives you instantaneous access to a device by using a remote shell connection. This gives you the power to do in-depth investigative work and take immediate response actions.
Box: 2 -
Network assessment jobs allow you to choose network devices to be scanned regularly and added to the device inventory.

Reference:

https://docs.microsoft.com/en-us/microsoft-365/security/defender-endpoint/respond-machine-alerts?view=o365-worldwide https://docs.microsoft.com/en-us/microsoft-365/security/defender-endpoint/network-devices?view=o365-worldwide

Reveal Solution Next Question

QUESTION: 27

You are investigating an incident in Azure Sentinel that contains more than 127 alerts.
You discover eight alerts in the incident that require further investigation.
You need to escalate the alerts to another Azure Sentinel administrator.
What should you do to provide the alerts to the administrator?

Create a Microsoft incident creation rule
Share the incident URL
Create a scheduled query rule
Assign the incident

Answer(s): D

Reference:

https://docs.microsoft.com/en-us/azure/sentinel/investigate-cases

Reveal Solution Next Question

QUESTION: 27

You have an Azure subscription that contains a virtual machine named VM1 and uses Azure Defender. Azure Defender has automatic provisioning enabled.
You need to create a custom alert suppression rule that will supress false positive alerts for suspicious use of PowerShell on VM1.
What should you do first?

From Azure Security Center, add a workflow automation.
On VM1, run the Get-MPThreatCatalog cmdlet.
On VM1 trigger a PowerShell alert.
From Azure Security Center, export the alerts to a Log Analytics workspace.

Answer(s): C

Reference:

https://docs.microsoft.com/en-us/microsoft-365/security/defender-endpoint/manage-alerts?view=o365-worldwide

Reveal Solution Next Question

Free SC-200 Exam Braindumps (page: 41)

QUESTION: 27

QUESTION: 27

Explanation:

Reference:

QUESTION: 27

Reference:

QUESTION: 27

Reference: