You have an Azure subscription that uses Microsoft Defender for Cloud.You have an Amazon Web Services (AWS) subscription. The subscription contains multiple virtual machines that run Windows Server.You need to enable Microsoft Defender for Servers on the virtual machines.Which two actions should you perform? Each correct answer presents part of the solution.Note: Each correct answer is worth one point.
Answer(s): C,E
HOTSPOT (Drag and Drop is not supported)You have an Azure subscription named Sub1 and an Azure DevOps organization named AzDO1. AzDO1 uses Defender for Cloud and contains a project that has a YAML pipeline named Pipeline1.Pipeline1 outputs the details of discovered open source software vulnerabilities to Defender for Cloud.You need to configure Pipeline1 to output the results of secret scanning to Defender for Cloud.What should you add to Pipeline1? To answer, select the appropriate options in the answer area.Note: Each correct selection is worth one point.Hot Area:
Answer(s): A
Box 1: inputs: Setup secret scanning in Azure DevOps You can run secret scanning as part of the Azure DevOps build process by using the Microsoft Security DevOps (MSDO) Azure DevOps extension.To add secret scanning to Azure DevOps build process:1. Sign in to Azure DevOps2. Navigate to Pipeline.3. Locate the pipeline with MSDO Azure DevOps Extension is configured.4. Select Edit.5. Add the following lines to the YAML file inputs: categories: 'secrets'6. Select Save.By adding the additions to your yaml file, you'll ensure that secret scanning only runs when you execute a build to your Azure DevOps pipeline.Box 2: categories
https://learn.microsoft.com/en-us/azure/defender-for-cloud/detect-exposed-secrets
You create an Azure subscription named sub1.In sub1, you create a Log Analytics workspace named workspace1.You enable Microsoft Defender for Cloud and configure Defender for Cloud to use workspace1.You need to collect security event logs from the Azure virtual machines that report to workspace1.What should you do?
How do I stop the automatic agent installation and workspace creation? Deploying extensions with Defender for Cloud is highly recommended in order to get security alerts and recommendations about system updates, OS vulnerabilities, and endpoint protection. Turning off extensions limits these alerts and recommendations. However, you can disable automatic provisioning for a specific agent or extension:To disable automatic provisioning for a specific agent or extension:1. From the Azure portal, open Defender for Cloud and select Environment settings.2. Select the relevant subscription.3. In the Monitoring coverage column of the Defender for Server plan, select Settings.4. Turn off the extension you want to stop being automatically provisioned.5. Select Save.
https://learn.microsoft.com/en-us/azure/defender-for-cloud/faq-data-collection-agents
Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.You use Azure Security Center.You receive a security alert in Security Center.You need to view recommendations to resolve the alert in Security Center.Solution: From Security alerts, you select the alert, select Take Action, and then expand the Prevent future attacks section.Does this meet the goal?
Answer(s): B
You need to resolve the existing alert, not prevent future alerts. Therefore, you need to select the ‘Mitigate the threat’ option.
https://docs.microsoft.com/en-us/azure/security-center/security-center-managing-and-responding-alerts
You receive an alert from Microsoft Defender for Key Vault.You discover that the alert is generated from multiple suspicious IP addresses.You need to reduce the potential of Key Vault secrets being leaked while you investigate the issue. The solution must be implemented as soon as possible and must minimize the impact on legitimate users.What should you do first?
https://docs.microsoft.com/en-us/azure/security-center/defender-for-key-vault-usage
HOTSPOT (Drag and Drop is not supported)You have an on-premises datacenter that contains a custom web app named App1. App1 uses Active Directory Domain Services (AD DS) authentication and is accessible by using Microsoft Entra application proxy.You have a Microsoft 365 E5 subscription that uses Microsoft Defender XDR.You receive an alert that a user downloaded highly confidential documents.You need to remediate the risk associated with the alert by requiring multi-factor authentication (MFA) when users use App1 to initiate the download of documents that have a Highly Confidential sensitivity label applied.What should you do? To answer, select the appropriate options in the answer area.Note: Each correct selection is worth one point.Hot Area:
For App1 to require MFA, use: Conditional Access Conditional Access in Microsoft Entra (formerly Azure AD) is the correct mechanism for enforcing multi-factor authentication (MFA) based on specific conditions, such as accessing App1 when sensitive documents are involved. Conditional Access policies can enforce MFA based on user risk, location, or the sensitivity of the data being accessed.To implement a session policy, use: Microsoft Defender for Cloud Apps Microsoft Defender for Cloud Apps allows you to implement session control policies that monitor and control user sessions in real time. It can enforce policies such as blocking downloads of sensitive documents or enforcing additional authentication measures during specific activities within the session.
You have a Microsoft 365 subscription that uses Microsoft Defender XDR. The subscription contains 100 Windows 11 devices that use Microsoft Defender Antivirus. The devices are in a single Microsoft Defender for Endpoint device group.You need to ensure that you can block potentially malicious files on the devices by using the Allow or block file option.From the Microsoft Defender portal, you set Allow or block file to On.What should you do next?
After enabling the Allow or block file setting in the Microsoft Defender portal, the next step to block potentially malicious files is to create file indicators for the specific file hashes you want to block. You can add these indicators by following these steps in the Microsoft Defender portal: Navigate to Indicators: Go to Settings > Endpoints > Indicators (under the Rules section).Add File Hashes: Select the File hashes tab and click Add item.Define the Indicator: Enter the file's hash (MD5, SHA1, or SHA256) and set the Action to Block execution or Block and remediate.Set the Scope: Choose the organizational scope. Since you have a single device group including all devices, you can apply the indicator to that specific group or the entire organization. Requirements for Blocking to Work: Active Mode: Microsoft Defender Antivirus must be running in Active mode on the devices.Cloud Protection: Cloud-delivered protection must be enabled to allow the endpoint to communicate with the service for real-time blocking.
https://learn.microsoft.com/en-us/defender-endpoint/indicator-file
You have a Microsoft 365 subscription that contains a group named Group1. The subscription uses Microsoft Defender for Endpoint.You have 500 devices that run Windows 11. The devices are managed by using Microsoft Intune and are members of Group1.You implement security baselines for the devices.You discover that some devices fail to receive the security baselines.You need to identify which devices failed to receive the security baselines and which baselines were NOT received. The solution must minimize administrative effortWhich node should you use in the Microsoft Intune admin center?
To identify which devices failed to receive security baselines and which specific baselines were not received with minimal administrative effort, you should use the Endpoint security node in the Microsoft Intune admin center.Summary of Key Reporting Views * Identify which baselines failed Endpoint security > Security baselines > (Select Baseline Type) > Profiles pane.* Identify which devices failed Inside the profile: Monitor > Device status.Note: Steps to Identify Failed Devices and Baselines 1. Navigate to Security Baselines: Sign in to the Microsoft Intune admin center. *-> Go to Endpoint security > Security baselines. Select the Baseline Type: Select the specific baseline type you deployed (e.g., Security Baseline for Windows 10 and later or Microsoft Defender for Endpoint baseline).2. Identify the Failed Baseline (Profile): In the Profiles pane, you will see a list of your deployed baseline profiles. Review the Succeeded, Error, and Conflict columns to quickly identify which baseline profile has failures.3. Identify Failed Devices: Select the specific baseline profile that shows errors. Under the Monitor section, select Device status (or Device assignment status tile). This provides a list of all devices assigned the baseline, their names, and their specific deployment status (e.g., Error or Conflict).4. Identify Which Settings Failed: While in the profile view, under Monitor, select Per-setting status. This report displays each individual setting within that baseline and the count of devices reporting an error or conflict for that specific setting.
https://learn.microsoft.com/en-us/intune/intune-service/protect/security-baselines-monitor
Post your Comments and Discuss Microsoft SC-200 exam prep with other Community members:
Our website is free, but we have to fight against AI bots and content theft. We're sorry for the inconvenience caused by these security measures. You can access the rest of the SC-200 content, but please register or login to continue.