HOTSPOT (Drag and Drop is not supported)You have an Azure subscription that uses Microsoft Defender for Cloud.You create a Google Cloud Platform (GCP) organization named GCP1.You need to onboard GCP1 to Defender for Cloud by using the native cloud connector. The solution must ensure that all future GCP projects are onboarded automatically.What should you include in the solution? To answer, select the appropriate options in the answer area.Note: Each correct selection is worth one point.Hot Area:
Answer(s): A
Box 1: A management project and a custom role (See 5. Below) (Optional) If you select Organization, a management project and an organization custom role will be created on your GCP project for the onboarding process. Auto-provisioning will be enabled for the onboarding of new projects.Box 2: Steps below: 10. Select the GCP Cloud Shell >. 11. The GCP Cloud Shell will open. 12. Paste the script into the Cloud Shell terminal and run it.Note: To protect your GCP-based resources, you can connect a GCP project with either:* Native cloud connector (recommended) - Provides an agentless connection to your GCP account that you can extend with Defender for Cloud's Defender plans to secure your GCP resources* Classic cloud connectorTo connect your GCP project to Defender for Cloud with a native connector:1. Sign in to the Azure portal. 2. Navigate to Defender for Cloud > Environment settings. 3. Select + Add environment. 4. Select the Google Cloud Platform. 5. Enter all relevant information.(Optional) If you select Organization, a management project and an organization custom role will be created on your GCP project for the onboarding process. Auto-provisioning will be enabled for the onboarding of new projects.6. Select the Next: Select Plans. 7. Toggle the plans you want to connect to On. 8. Select the Next: Configure access. 9. Select Copy. 10. Select the GCP Cloud Shell >. 11. The GCP Cloud Shell will open. 12. Paste the script into the Cloud Shell terminal and run it.
https://learn.microsoft.com/en-us/azure/defender-for-cloud/quickstart-onboard-gcp
HOTSPOT (Drag and Drop is not supported)You need to use an Azure Resource Manager template to create a workflow automation that will trigger an automatic remediation when specific security alerts are received by Microsoft Defender for Cloud.How should you complete the portion of the template that will provision the required Azure resources? To answer, select the appropriate options in the answer area.Note: Each correct selection is worth one point.Hot Area:
Box 1: Microsoft.Security Example: create an automatic response to a specific security alert using an ARM template You can use an Azure Resource Manager template (ARM template) to create a workflow automation. The workflow automation will trigger a logic app when specific security alerts are received by Microsoft Defender for Cloud.Example: "resources": [ { "type": "Microsoft.Security/automations", "apiVersion": "2019-01-01-preview", "name": "[parameters('automationName')]", "location": "[parameters('location')]",Etc. Box 2: 'Microsoft.Logic Example continued: "actions": [ { "actionType": "LogicApp", "logicAppResourceId": "[resourceId('Microsoft.Logic/workflows', parameters('logicAppName'))]", "uri": "[listCallbackURL(resourceId(parameters('subscriptionId'), parameters ('logicAppResourceGroupName'), 'Microsoft.Logic/workflows/triggers', parameters('logicAppName'), 'manual'),'2019-05-01').value]" } ],
https://learn.microsoft.com/en-us/azure/defender-for-cloud/quickstart-automation-alert
You have an Azure subscription that contains a virtual machine named VM1 and uses Microsoft Defender for Cloud.Microsoft Defender for Cloud has automatic provisioning configured to use Azure Monitor Agent.You need to create a custom alert suppression rule that will suppress false positive alerts for suspicious use of PowerShell on VM1.What should you do first?
Answer(s): C
Create a suppression ruleTo create a rule for a specific alert in the Azure portal:1. From Defender for Cloud's security alerts page, select the alert you want to suppress. 2. From the details pane, select Take action. 3. In the Suppress similar alerts section of the Take action tab, select Create suppression rule. 4. In the New suppression rule pane, enter the details of your new rule. * Entities - The resources that the rule applies to. You can specify a single resource, multiple resources, or resources that contain a partial resource ID. If you don't specify any resources, the rule applies to all resources in the subscription. * Etc.Incorrect: Not D: The Get-MpThreatCatalog cmdlet gets known threats from the Windows Defender definitions catalog. The definitions catalog contains references to all known threats that Windows Defender can identify.Example: Get a known threat from the definitions catalogPS C:\> Get-MpThreatCatalog -ThreatID 1994This command gets the known threat that has the ID 1994.
https://learn.microsoft.com/en-us/azure/defender-for-cloud/alerts-suppression-rules https://learn.microsoft.com/en-us/powershell/module/defender/get-mpthreatcatalog
You have the resources shown in the following table.You have an Azure subscription that uses Microsoft Defender for Cloud.You need to enable Microsoft Defender for Servers on each resource.Which resources will require the installation of the Azure Arc agent?
* Server1 & Server4: Connect your non-Azure machines to Microsoft Defender for Cloud Microsoft Defender for Cloud can monitor the security posture of your non-Azure machines, but first you need to connect them to Azure.Connect on-premises machines by using Azure Arc A machine that has Azure Arc-enabled servers becomes an Azure resource. When you install the Log Analytics agent on it, it appears in Defender for Cloud with recommendations, like your other Azure resources.Azure Arc-enabled servers provide enhanced capabilities, such as enabling guest configuration policies on the machine and simplifying deployment with other Azure services.* Server2 Connect your AWS account to Microsoft Defender for Cloud Workloads commonly span multiple cloud platforms. Cloud security services must do the same. Microsoft Defender for Cloud helps protect workloads in Amazon Web Services (AWS), but you need to set up the connection between them and Defender for Cloud.Defender for Servers If you choose the Microsoft Defender for Servers plan, you need:Microsoft Defender for Servers enabled on your subscription. Learn how to enable plans in Enable enhanced security features.An active AWS account, with EC2 instances. *-> Azure Arc for servers installed on your EC2 instances.
https://learn.microsoft.com/en-us/azure/defender-for-cloud/quickstart-onboard-machines https://learn.microsoft.com/en-us/azure/defender-for-cloud/quickstart-onboard-aws
You have an Azure subscription that uses Microsoft Defender for Cloud.You have a GitHub account named Account1 that contains 10 repositories.You need to ensure that Defender for Cloud can assess the repositories in Account1.What should you do first in the Microsoft Defender for Cloud portal?
Connect your GitHub repositories to Microsoft Defender for CloudConnect your GitHub account To connect your GitHub account to Microsoft Defender for Cloud:1. Sign in to the Azure portal. 2. Go to Microsoft Defender for Cloud > Environment settings. 3. Select Add environment. 4. Select GitHub.5. Enter a name (limit of 20 characters), and then select your subscription, resource group, and region. 6. Etc.
https://learn.microsoft.com/en-us/azure/defender-for-cloud/quickstart-onboard-github
HOTSPOT (Drag and Drop is not supported)You have an Azure subscription named Sub1 that uses Microsoft Defender for Cloud.You have an Azure DevOps organization named AzDO1.You need to integrate Sub1 and AzDO1. The solution must meet the following requirements:-Detect secrets exposed in pipelines by using Defender for Cloud.-Minimize administrative effort.What should you do? To answer, select the appropriate options in the answer area.Note: Each correct selection is worth one point.Hot Area:
Box 1: Add an environment Connect your Azure DevOps repositories to Microsoft Defender for CloudConnect your Azure DevOps organization To connect your Azure DevOps organization to Defender for Cloud by using a native connector:1. Sign in to the Azure portal.2. Go to Microsoft Defender for Cloud > Environment settings.3. Select Add environment.4. Select Azure DevOps.5. Etc. Box 2: Install an extension Prerequisites To complete this quickstart, you need:An Azure account with Defender for Cloud onboarded. The Microsoft Security DevOps Azure DevOps extension configured.
https://learn.microsoft.com/en-us/azure/defender-for-cloud/quickstart-onboard-devops
DRAG DROP (Drag and Drop is not supported)You have an Azure subscription that uses Microsoft Defender for Cloud.You need to create a workflow that will send a Microsoft Teams message to the IT department of your company when a new Microsoft Secure Score action is generated.Which three actions should you perform in sequence? To answer, move the appropriate actions from the list of actions to the answer area and arrange them in the correct order.Select and Place:
Step 1: Configure a workflow automationCreate a logic app and define when it should automatically run 1. From Defender for Cloud's sidebar, select Workflow automation.From this page you can create new automation rules, enable, disable, or delete existing ones.2. To define a new workflow, select Add workflow automation. The options pane for your new automation opens.* Details omitted* Step 2: Create an Azure logic app that includes the Defender for Cloud regulatory compliance assessments trigger3. From the Actions section, select visit the Logic Apps page to begin the logic app creation process.You'll be taken to Azure Logic Apps.4. Select (+) Add.* Details omitted* 5. After you've defined your logic app, return to the workflow automation definition pane ("Add workflow automation"). Select Refresh to ensure your new logic app is available for selection.Type of trigger: Run workflow automations when there are changes to your complianceDefender for Cloud's workflow automation feature can trigger Logic Apps whenever one of your regulatory compliance assessments changes state.For example, you might want Defender for Cloud to email a specific user when a compliance assessment fails. You'll need to first create the logic app (using Azure Logic Apps) and then set up the trigger in a new workflow automation as explained in Automate responses to Defender for Cloud triggers.Step 3: Configure a trigger condition
https://learn.microsoft.com/en-us/azure/defender-for-cloud/workflow-automation https://learn.microsoft.com/en-us/azure/defender-for-cloud/regulatory-compliance-dashboard
You have an Azure subscription that uses Microsoft Defender for Cloud and contains 100 virtual machines that run Windows Server.You need to configure Defender for Cloud to collect event data from the virtual machines. The solution must minimize administrative effort and costs.Which two actions should you perform? Each correct answer presents part of the solution.Note: Each correct selection is worth one point.
Answer(s): A,E
E: Plan your Defender for Servers deployment Microsoft Defender for Servers extends protection to your Windows and Linux machines that run in Azure, Amazon Web Services (AWS), Google Cloud Platform (GCP), and on-premises. Defender for Servers integrates with Microsoft Defender for Endpoint to provide endpoint detection and response (EDR) and other threat protection features.A (not D): What event types are stored for "Common" and "Minimal"? The Common and Minimal event sets were designed to address typical scenarios based on customer and industry standards for the unfiltered frequency of each event and their usage.* Common - A set of events that satisfies most customers and provides a full audit trail. This set is intended to provide a full user audit trail, including events with low volume. For example, this set contains both user logon events (event ID 4624) and user logoff events (event ID 4634). We include auditing actions like security group changes, key domain controller Kerberos operations, and other events that are recommended by industry organizations.* Minimal* All events – For customers who want to make sure all events are stored.Configure the Log Analytics agent and workspaces When the Log Analytics agent is on, Defender for Cloud deploys the agent on all supported Azure VMs and any new ones created.Incorrect: Not B: Automatic enrollment Microsoft Endpoint Manager automatic enrollment does not support Windows Server. Microsoft Defender for Servers is needed.
https://www.scappman.com/post/how-to-guide-getting-started-with-microsoft-intune-part-4 https://learn.microsoft.com/en-us/azure/defender-for-cloud/plan-defender-for-servers
Post your Comments and Discuss Microsoft SC-200 exam prep with other Community members:
Our website is free, but we have to fight against AI bots and content theft. We're sorry for the inconvenience caused by these security measures. You can access the rest of the SC-200 content, but please register or login to continue.