CompTIA
Checkpoint
ISC
HP
Dell
EC-Council
EXIN
Fortinet
ITIL®
Juniper
PMI
Microsoft
VMware
Avaya
Google
Salesforce
Amazon
Palo Alto Networks
Certiport
ISC2
All Vendors
  2. Home
  3. Exams
  4. Microsoft
  5. SC-200

Free SC-200 Exam Braindumps (page: 17)

Page 16 of 79
PDF with 355 Questions

You have a Microsoft Sentinel workspace that contains a custom workbook named Workbook1.
You need to create a visual based on the SecurityEvent table. The solution must meet the following requirements:
• Identify the number of security events ingested during the past week.
• Display the count of events by day in a timechart.
What should you add to Workbook1?

  1. a query
  2. a metric
  3. a group
  4. links or tabs

Answer(s): A



HOTSPOT
-
You have a Microsoft Sentinel workspace.
You plan to visualize data from Microsoft SharePoint Online and OneDrive sites.
You need to create a KQL query for the visual. The solution must meet the following requirements:
• Select all workloads as a single operation.
• Include two parameters named Operations and Users.
• In the results, exclude empty values for the site URLs.
How should you complete the query? To answer, select the appropriate options in the answer area.
Note: Each correct selection is worth one point.

  1. See Explanation section for answer.

Answer(s): A

Explanation:



You have a Microsoft 365 E5 subscription that contains a device named Device1. Device1 is enrolled in Microsoft Defender for Endpoint.
Device1 reports an incident that includes a file named File1.exe as evidence.
You initiate the Collect Investigation Package action and download the ZIP file.
You need to identify the first and last time File1.exe was executed.
What should you review in the investigation package?

  1. Processes
  2. Autoruns
  3. Security event log
  4. Scheduled tasks
  5. Prefetch files

Answer(s): E



HOTSPOT
-
You have a Microsoft 365 subscription that uses Microsoft Defender XDR and contains a Windows device named Device1.
You investigate a suspicious process named Prod on Device1 by using a live response session.
You need to perform the following actions:
• Stop Prod.
• Send Prod for further review.
Which live response command should you run for each action? To answer, select the appropriate options in the answer area.
Note: Each correct selection is worth one point.

  1. See Explanation section for answer.

Answer(s): A

Explanation:






Post your Comments and Discuss Microsoft SC-200 exam with other Community members:

SC-200 Discussions & Posts