QUESTION: 29

DRAG DROP (Drag and Drop is not supported).
You need to use an Azure Sentinel analytics rule to search for specific criteria in Amazon Web Services (AWS) logs and to generate incidents.
Which three actions should you perform in sequence? To answer, move the appropriate actions from the list of actions to the answer area and arrange them in the correct order.
Select and Place:

See Explanation section for answer.

Answer(s): A

Explanation:

Reference:

https://docs.microsoft.com/en-us/azure/sentinel/detect-threats-custom

Reveal Solution Next Question

QUESTION: 29

Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.
After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.
You have Linux virtual machines on Amazon Web Services (AWS).
You deploy Azure Defender and enable auto-provisioning.
You need to monitor the virtual machines by using Azure Defender.
Solution: You manually install the Log Analytics agent on the virtual machines.
Does this meet the goal?

Answer(s): B

Reference:

https://docs.microsoft.com/en-us/azure/defender-for-cloud/quickstart-onboard-machines?pivots=azure-arc

Reveal Solution Next Question

QUESTION: 30

You have a Microsoft 365 subscription that has Microsoft 365 Defender enabled.
You need to identify all the changes made to sensitivity labels during the past seven days.
What should you use?

the Incidents blade of the Microsoft 365 Defender portal
the Alerts settings on the Data Loss Prevention blade of the Microsoft 365 compliance center
Activity explorer in the Microsoft 365 compliance center
the Explorer settings on the Email & collaboration blade of the Microsoft 365 Defender portal

Answer(s): C

Explanation:

Labeling activities are available in Activity explorer.
For example:
Sensitivity label applied -
This event is generated each time an unlabeled document is labeled or an email is sent with a sensitivity label.
It is captured at the time of save in Office native applications and web applications.
It is captured at the time of occurrence in Azure Information protection add-ins.
Upgrade and downgrade labels actions can also be monitored via the Label event type field and filter.

Reference:

https://docs.microsoft.com/en-us/microsoft-365/compliance/data-classification-activity-explorer-available-events?view=o365-worldwide

Reveal Solution Next Question

QUESTION: 30

You have the following environment:
Azure Sentinel -
✑ A Microsoft 365 subscription
✑ Microsoft Defender for Identity
✑ An Azure Active Directory (Azure AD) tenant
You configure Azure Sentinel to collect security logs from all the Active Directory member servers and domain controllers.
You deploy Microsoft Defender for Identity by using standalone sensors.
You need to ensure that you can detect when sensitive groups are modified in Active Directory.
Which two actions should you perform? Each correct answer presents part of the solution.
Note: Each correct selection is worth one point.

Configure the Advanced Audit Policy Configuration settings for the domain controllers.
Modify the permissions of the Domain Controllers organizational unit (OU).
Configure auditing in the Microsoft 365 compliance center.
Configure Windows Event Forwarding on the domain controllers.

Answer(s): A,D

Reference:

https://docs.microsoft.com/en-us/defender-for-identity/configure-windows-event-collection https://docs.microsoft.com/en-us/defender-for-identity/configure-event-collection

Reveal Solution Next Question

Free SC-200 Exam Braindumps (page: 43)

QUESTION: 29

Explanation:

Reference:

QUESTION: 29

Reference:

QUESTION: 30

Explanation:

Reference:

QUESTION: 30

Reference: