HOTSPOT (Drag and Drop is not supported)You have an Azure subscription that has Microsoft Defender for Cloud enabled for all supported resource types.You create an Azure logic app named LA1.You plan to use LA1 to automatically remediate security risks detected in Defender for Cloud.You need to test LA1 in Defender for Cloud.What should you do? To answer, select the appropriate options in the answer area.Note: Each correct selection is worth one point.Hot Area:
Answer(s): A
Box 1: When a Microsoft Defender for Cloud Recommendation is created or triggered When a Microsoft Defender for Cloud Recommendation is created or triggered - If your logic app relies on a recommendation that gets deprecated or replaced, your automation will stop working and you'll need to update the trigger. (also see step 6 below)Incorrect: * When a Defender for Cloud Alert is created or triggered You can customize the trigger so that it relates only to alerts with the severity levels that interest you.* When a response to a Defender for Cloud alert is triggered. Note: If you are using the legacy trigger "When a response to a Microsoft Defender for Cloud alert is triggered", your logic apps will not be launched by the Workflow Automation feature. Instead, use either of the triggers mentioned above [rather in step 6 below].Box 2: Regulatory compliance standards Configure workflow automation at scale using the supplied policies Automating your organization's monitoring and incident response processes can greatly improve the time it takes to investigate and mitigate security incidents.To implement these policies:1. From the table below, select the policy you want to apply:* Workflow automation for security alerts Deploy Workflow Automation for Microsoft Defender for Cloud alerts* Workflow automation for security recommendations Deploy Workflow Automation for Microsoft Defender for Cloud recommendations* [This one!] Workflow automation for regulatory compliance changes Deploy Workflow Automation for Microsoft Defender for Cloud regulatory compliance2. From the relevant Azure Policy page, select Assign.3. Etc.Note 1: There is similar question where Workflow automation is the correct answer. This option is not available here.Note 2: Create a logic app and define when it should automatically run 1. From Defender for Cloud's sidebar, select Workflow automation.From this page you can create new automation rules, enable, disable, or delete existing ones.2. To define a new workflow, select Add workflow automation. The options pane for your new automation opens.Here you can enter: A name and description for the automation. The triggers that will initiate this automatic workflow. For example, you might want your Logic App to run when a security alert that contains "SQL" is generated. The Logic App that will run when your trigger conditions are met.3. From the Actions section, select visit the Logic Apps page to begin the Logic App creation process.4. Select (+) Add.5. Fill out all required fields and select Review + Create.The message Deployment is in progress appears. Wait for the deployment complete notification to appear and select Go to resource from the notification.6. Review the information you entered and select Create.The logic app designer supports the following Defender for Cloud triggers:* When a Microsoft Defender for Cloud Recommendation is created or triggered - If your logic app relies on a recommendation that gets deprecated or replaced, your automation will stop working and you'll need to update the trigger. To track changes to recommendations, use the release notes.* When a Defender for Cloud Alert is created or triggered - You can customize the trigger so that it relates only to alerts with the severity levels that interest you.* When a Defender for Cloud regulatory compliance assessment is created or triggered - Trigger automations based on updates to regulatory compliance assessments.7. Etc.
https://learn.microsoft.com/en-us/azure/defender-for-cloud/workflow-automation
You have an Azure subscription that has Microsoft Defender for Cloud enabled.You have a virtual machine that runs Windows 10 and has the Log Analytics agent installed.You need to simulate an attack on the virtual machine that will generate an alert.What should you do first?
Answer(s): B
Simulate alerts on your Azure VMs (Windows) After the Log Analytics agent is installed on your machine, follow these steps from the computer where you want to be the attacked resource of the alert:1. Copy an executable (for example calc.exe) to the computer's desktop, or other directory of your convenience, and rename it as ASC_AlertTest_662jfi039N.exe. 2. Open the command prompt and execute this file with an argument (just a fake argument name), such as: ASC_AlertTest_662jfi039N.exe -foo 3. Wait 5 to 10 minutes and open Defender for Cloud Alerts. An alert should appear.
https://learn.microsoft.com/en-us/azure/defender-for-cloud/alert-validation
DRAG DROP (Drag and Drop is not supported)You create a new Azure subscription and start collecting logs for Azure Monitor.You need to validate that Microsoft Defender for Cloud will trigger an alert when a malicious file is present on an Azure virtual machine running Windows Server.Which three actions should you perform in a sequence? To answer, move the appropriate actions from the list of action to the answer area and arrange them in the correct order.Note: More than one order of answer choices is correct. You will receive credit for any of the correct orders you select.Select and Place:
Step 1: Change the alert severity threshold for emails to Low Security alerts need to reach the right people in your organization. By default, Microsoft Defender for Cloud emails subscription owners whenever a high-severity alert is triggered for their subscription.Note: How are alerts classified? Defender for Cloud assigns a severity to alerts to help you prioritize how you attend to each alert. Severity is based on how confident Defender for Cloud is in the:Finding/analytic used to issue the alert Confidence level that there was malicious intent behind the activity that led to the alert Severity, Recommended response * High There is a high probability that your resource is compromised. You should look into it right away. Defender for Cloud has high confidence in both the malicious intent and in the findings used to issue the alert. For example, an alert that detects the execution of a known malicious tool such as Mimikatz, a common tool used for credential theft.* Medium This is probably a suspicious activity might indicate that a resource is compromised. Defender for Cloud's confidence in the analytic or finding is medium and the confidence of the malicious intent is medium to high. These would usually be machine learning or anomaly-based detections, for example a sign-in attempt from an unusual location.* Low This might be a benign positive or a blocked attack. Defender for Cloud isn't confident enough that the intent is malicious and the activity might be innocent. For example, log clear is an action that might happen when an attacker tries to hide their tracks, but in many cases is a routine operation performed by admins. Defender for Cloud doesn't usually tell you when attacks were blocked, unless it's an interesting case that we suggest you look into.Step 2: Copy and executable and rename the file as ASC_AlertTest_662jfi039N.exe.Alert validation in Microsoft Defender for Cloud.Simulate alerts on your Azure VMs (Windows) After the Log Analytics agent is installed on your machine, follow these steps from the computer where you want to be the attacked resource of the alert:1. Copy an executable (for example calc.exe) to the computer's desktop, or other directory of your convenience, and rename it as ASC_AlertTest_662jfi039N.exe. 2. Open the command prompt and execute this file with an argument (just a fake argument name), such as: ASC_AlertTest_662jfi039N.exe -foo 3. Wait 5 to 10 minutes and open Defender for Cloud Alerts. An alert should appear.Step 3: Run the executable file and specify the appropriate arguments.Incorrect: * Enable Microsoft Defender for Cloud's enhanced security features for the subscription. Basic features are enough in this scenario.Basic features When you open Defender for Cloud in the Azure portal for the first time or if you enable it through the API, Defender for Cloud is enabled for free on all your Azure subscriptions. Defender for Cloud provides foundational cloud security and posture management (CSPM) features by default. The foundational CSPM includes, secure score, security policy and basic recommendations, and network security assessment to help you protect your Azure resources.Enhanced features When you enable the enhanced security features (paid), Defender for Cloud can provide unified security management and threat protection across your hybrid cloud workloads.
https://learn.microsoft.com/en-us/azure/defender-for-cloud/alert-validation https://learn.microsoft.com/en-us/azure/defender-for-cloud/configure-email-notifications
You have an Azure subscription that uses Microsoft Defender for Cloud and contains 100 virtual machines that run Windows Server.You need to configure Defender for Cloud to collect event data from the virtual machines. The solution must minimize administrative effort and costs.Which two actions should you perform? Each correct answer presents part of the solution.Note: Each correct selection is worth one point.
Answer(s): A,E
A (not D): What event types are stored for "Common" and "Minimal"? The Common and Minimal event sets were designed to address typical scenarios based on customer and industry standards for the unfiltered frequency of each event and their usage.* Common - A set of events that satisfies most customers and provides a full audit trail. This set is intended to provide a full user audit trail, including events with low volume. For example, this set contains both user logon events (event ID 4624) and user logoff events (event ID 4634). We include auditing actions like security group changes, key domain controller Kerberos operations, and other events that are recommended by industry organizations.* Minimal* All events – For customers who want to make sure all events are stored.Configure the Log Analytics agent and workspaces When the Log Analytics agent is on, Defender for Cloud deploys the agent on all supported Azure VMs and any new ones created.E: See 4c below. Deploy the Azure Monitor Agent to protect your servers with Microsoft Defender for CloudTo make sure that your server resources are secure, Microsoft Defender for Cloud uses agents installed on your servers to send information about your servers to Microsoft Defender for Cloud for analysis. You can quietly deploy the Azure Monitor Agent on your servers when you enable Defender for Servers.Deploy the Azure Monitor Agent with Defender for Cloud To deploy the Azure Monitor Agent with Defender for Cloud:1. From Defender for Cloud's menu, open Environment settings.2. Select the relevant subscription.3. In the Monitoring coverage column of the Defender for Server plan, select Settings.4. Enable deployment of the Azure Monitor Agent4a. For the Log Analytics agent/Azure Monitor Agent, select the On status.4b. For the Log Analytics agent/Azure Monitor Agent, select Edit configuration.4c. For the Auto-provisioning configuration agent type, select Azure Monitor Agent.
https://learn.microsoft.com/en-us/azure/defender-for-cloud/working-with-log-analytics-agent https://learn.microsoft.com/en-us/azure/defender-for-cloud/auto-deploy-azure-monitoring-agent
You have an Azure subscription that uses Microsoft Defender for Cloud and contains a user named User1.You need to ensure that User1 can modify Microsoft Defender for Cloud security policies. The solution must use the principle of least privilege.Which role should you assign to User1?
Security Admin View and update permissions for Microsoft Defender for Cloud. Same permissions as the Security Reader role and can also update the security policy and dismiss alerts and recommendations.Incorrect: * Security Reader View permissions for Microsoft Defender for Cloud. Can view recommendations, alerts, a security policy, and security states, but cannot make changes.* owner - too much permissions* Contributor (too much permissions) Grants full access to manage all resources, but does not allow you to assign roles in Azure RBAC, manage assignments in Azure Blueprints, or share image galleries.
https://learn.microsoft.com/en-us/azure/role-based-access-control/built-in-roles
You have an Azure subscription that contains a user named User1.User1 is assigned a Microsoft Entra ID P2 license.You need to identify whether the identity of User1 was compromised during the last 90 days.What should you use?
Scenario: User compromised (True positive) ‘Risky users’ report shows an at-risk user [Risk state = At risk] with low risk [Risk level = Low] and that user was indeed compromised.What happens under the hood? Azure AD will move the user risk to High [Risk state = Confirmed compromised; Risk level = High] and will add a new detection ‘Admin confirmed user compromised’.Notes: Currently, the ‘Confirm user compromised’ option is only available in ‘Risky users’ report. The detection ‘Admin confirmed user compromised’ is shown in the tab ‘Risk detections not linked to a sign-in’ in the ‘Risky users’ report.
https://learn.microsoft.com/en-us/azure/active-directory/identity-protection/howto-identity-protection-risk-feedback
You have an Azure subscription that uses Microsoft Defender for Cloud.You have an Amazon Web Services (AWS) account that contains an Amazon Elastic Compute Cloud (EC2) instance named EC2-1.You need to onboard EC2-1 to Defender for Cloud.What should you install on EC2-1?
You have an Azure subscription that uses Microsoft Defender for Cloud and contains a resource group named RG1. RG1 contains 20 virtual machines that run Windows Server 2019.You need to configure just-in-time (JIT) access for the virtual machines in RG1. The solution must meet the following requirements:-Limit the maximum request time to two hours.-Limit protocol access to Remote Desktop Protocol (RDP) only.-Minimize administrative effort.What should you use?
Post your Comments and Discuss Microsoft SC-200 exam prep with other Community members:
Our website is free, but we have to fight against AI bots and content theft. We're sorry for the inconvenience caused by these security measures. You can access the rest of the SC-200 content, but please register or login to continue.