DRAG DROP (Drag and Drop is not supported)You have an Azure subscription. The subscription contains 10 virtual machines that are onboarded to Microsoft Defender for Cloud.You need to ensure that when Defender for Cloud detects digital currency mining behavior on a virtual machine, you receive an email notification. The solution must generate a test email.Which three actions should you perform in sequence? To answer, move the appropriate actions from the list of actions to the answer area and arrange them in the correct order.Select and Place:
Answer(s): A
Step 1: From Logic App Designer, create a logic app. Create a logic app and define when it should automatically run1. From Defender for Cloud's sidebar, select Workflow automation.2. To define a new workflow, click Add workflow automation. The options pane for your new automation opens.Here you can enter:A name and description for the automation.The triggers that will initiate this automatic workflow. For example, you might want your Logic App to run when a security alert that contains "SQL" is generated.The Logic App that will run when your trigger conditions are met.3. From the Actions section, select visit the Logic Apps page to begin the Logic App creation process. 4. Etc. Step 2: From Logic App Designer, run a trigger. Manually trigger a Logic App You can also run Logic Apps manually when viewing any security alert or recommendation.Step 3: From Workflow automation in Defender for cloud, add a workflow automation. Configure workflow automation at scale using the supplied policies Automating your organization's monitoring and incident response processes can greatly improve the time it takes to investigate and mitigate security incidents.
https://docs.microsoft.com/en-us/azure/defender-for-cloud/workflow-automation
DRAG DROP (Drag and Drop is not supported)You have a Microsoft 365 E5 subscription that has Microsoft Defender for Cloud enabled. You configure the Azure logic apps shown in the following table. You need to configure an automatic action that will run if a Suspicious process executed alert is triggered. The solution must minimize administrative effort. Which three actions should you perform in sequence? To answer, move the appropriate actions from the list of actions to the answer area and arrange them in the correct order.Select and Place:
Step 1: Select Take action Respond to a security alert After you've investigated a security alert and understood its scope, you can respond to the alert from within Microsoft Defender for Cloud:1. Open the Take action tab to see the recommended responses.2. Review the Mitigate the threat section for the manual investigation steps necessary to mitigate the issue.Step 2: Configure the Prevent future attacks settings. 3. To harden your resources and prevent future attacks of this kind, remediate the security recommendations in the Prevent future attacks section.Step 3: Configure the Trigger automated response settings. 4. To trigger a logic app with automated response steps, use the Trigger automated response section.5. If the detected activity isn’t malicious, you can suppress future alerts of this kind using the Suppress similar alerts section.6.Etc.
https://docs.microsoft.com/en-us/azure/defender-for-cloud/tutorial-security-incident
You have an Azure subscription that has Microsoft Defender for Cloud enabled.You have a virtual machine named Server1 that runs Windows Server 2022 and is hosted in Amazon Web Services (AWS).You need to collect logs and resolve vulnerabilities for Server1 by using Defender for Cloud.What should you install first on Server1?
Answer(s): C
You have an Azure subscription that uses Microsoft Defender for Cloud and contains a storage account named storage1.You receive an alert that there was an unusually high volume of delete operations on the blobs in storage1.You need to identify which blobs were deleted.What should you review?
Answer(s): B
Configure Microsoft Defender for Storage Security alerts are triggered when anomalies in activity occur. These security alerts are integrated with Microsoft Defender for Cloud, and are also sent via email to subscription administrators, with details of suspicious activity and recommendations on how to investigate and remediate threats.The service ingests resource logs of read, write, and delete requests to Blob storage and to Azure Files for threat detection. To investigate alerts from Microsoft Defender for Cloud, you can view related storage activity using Storage Analytics Logging.
https://learn.microsoft.com/en-us/azure/storage/common/azure-defender-storage-configure
You have an Azure subscription that uses Microsoft Defender for Cloud.You need to filter the security alerts view to show the following alerts:-Unusual user accessed a key vault-Log on from an unusual location-Impossible travel activityWhich severity should you use?
Medium This is probably a suspicious activity might indicate that a resource is compromised. Defender for Cloud's confidence in the analytic or finding is medium and the confidence of the malicious intent is medium to high. These would usually be machine learning or anomaly-based detections, for example a sign-in attempt from an unusual location.Incorrect: * High There is a high probability that your resource is compromised. You should look into it right away. Defender for Cloud has high confidence in both the malicious intent and in the findings used to issue the alert. For example, an alert that detects the execution of a known malicious tool such as Mimikatz, a common tool used for credential theft.* Low This might be a benign positive or a blocked attack. Defender for Cloud isn't confident enough that the intent is malicious and the activity might be innocent. For example, log clear is an action that might happen when an attacker tries to hide their tracks, but in many cases is a routine operation performed by admins. Defender for Cloud doesn't usually tell you when attacks were blocked, unless it's an interesting case that we suggest you look into.* Low This might be a benign positive or a blocked attack. Defender for Cloud isn't confident enough that the intent is malicious and the activity might be innocent. For example, log clear is an action that might happen when an attacker tries to hide their tracks, but in many cases is a routine operation performed by admins. Defender for Cloud doesn't usually tell you when attacks were blocked, unless it's an interesting case that we suggest you look into.
https://learn.microsoft.com/en-us/azure/defender-for-cloud/alerts-overview
You plan to review Microsoft Defender for Cloud alerts by using a third-party security information and event management (SIEM) solution.You need to locate alerts that indicate the use of the Privilege Escalation MITRE ATT&CK tactic.Which JSON key should you search?
DRAG DROP (Drag and Drop is not supported)You have 50 on-premises servers.You have an Azure subscription that uses Microsoft Defender for Cloud. The Defender for Cloud deployment has Microsoft Defender for Servers and automatic provisioning enabled.You need to configure Defender for Cloud to support the on-premises servers. The solution must meet the following requirements:-Provide threat and vulnerability management.-Support data collection rules.Which three actions should you perform in sequence? To answer, move the appropriate actions from the list of actions to the answer area and arrange them in the correct order.Select and Place:
Step 1: From the Add servers with Azure Arc settings in the Azure portal, generate an installation script Connect hybrid machines to Azure using a deployment scriptYou can enable Azure Arc-enabled servers for one or a small number of Windows or Linux machines in your environment by performing a set of steps manually. Or you can use an automated method by running a template script that we provide. This script automates the download and installation of both agents.Generate the installation script from the Azure portal The script to automate the download and installation, and to establish the connection with Azure Arc, is available from the Azure portal. To complete the process, perform the following steps:1. From your browser, go to the Azure portal.2. On the Servers - Azure Arc page, select Add at the upper left.3. On the Select a method page, select the Add a single server tile, and then select Generate script.4. Etc.Step 2: On the on-premises servers, install the Azure Connected Machine agent. Onboard machines as Azure Arc connected machines by installing the Hybrid Connected Machine agent on the target machine(s); this can be done by using a script or manually. Once a machine is onboarded, you will see it as Azure resource.Install and validate the agent on Windows Install manually You can install the Connected Machine agent manually by running the Windows Installer package AzureConnectedMachineAgent.msi.Step 3: On the on-premises servers, install the Log Analytics agent. Onboarding non-Azure machines into Azure Arc provide you the ability to: Deploy virtual machine extension (such as Log Analytics agent, vulnerability assessment scanner, custom script extension and more)Incorrect: * On the on-premises servers, install the Azure Monitor agent.* From the Data controller settings in the Azure portal, create an Azure Arc data controller. Microsoft Defender for Cloud allows you to protect non-Azure resources located on-premises or on other cloud providers, from virtual machines, Kubernetes services and SQL resources.To do so, those resources need to be connected to Azure by leveraging Azure Arc service – meaning that you can now manage and operate all your existing IT resources consistently and at-scale, wherever they reside, from Azure.
https://learn.microsoft.com/en-us/azure/azure-arc/servers/onboard-portal https://techcommunity.microsoft.com/t5/microsoft-defender-for-cloud/protect-non-azure-resources-using-azure-arc-and-microsoft/ba-p/2277215
HOTSPOT (Drag and Drop is not supported)You have an Azure subscription that uses Microsoft Defender for Cloud and contains an Azure logic app named app1.You need to ensure that app1 launches when a specific Defender for Cloud security alert is generated.How should you complete the Azure Resource Manager (ARM) template? To answer, select the appropriate options in the answer area.Note: Each correct selection is worth one point.Hot Area:
Box 1: “Microsoft.Security/automations"Box 2: triggers Quickstart: Create an automatic response to a specific security alert using an ARM template or BicepPartial template: "resources": [ { "type": "Microsoft.Security/automations", "apiVersion": "2019-01-01-preview", "name": "[parameters('automationName')]", "location": "[parameters('location')]", "properties": { "description": "[format(variables('automationDescription'), parameters('subscriptionId'))]", "isEnabled": true, "actions": [ { "actionType": "LogicApp", "logicAppResourceId": "[resourceId('Microsoft.Logic/workflows', parameters('logicAppName'))]", "uri": "[listCallbackURL(resourceId(parameters('subscriptionId'), parameters ('logicAppResourceGroupName'), 'Microsoft.Logic/workflows/triggers', parameters('logicAppName'), 'manual'),'2019-05-01').value]" }
https://learn.microsoft.com/en-us/azure/defender-for-cloud/quickstart-automation-alert?tabs=CLI
Post your Comments and Discuss Microsoft SC-200 exam prep with other Community members:
Our website is free, but we have to fight against AI bots and content theft. We're sorry for the inconvenience caused by these security measures. You can access the rest of the SC-200 content, but please register or login to continue.