support@Free-Braindumps.com
Register Login
Cisco
CompTIA
ISC
EC-Council
EXIN
Fortinet
ITIL
Juniper
Microsoft
VMware
Avaya
SAP
Google
NVIDIA
Salesforce
Amazon
Palo Alto Networks
ISC2
CrowdStrike
Anthropic
All Vendors
  1. Home
  2. Exams
  3. Microsoft
  4. SC-200

Free SC-200 Exam Braindumps
Microsoft Security Operations Analyst Questions 137–144 (page: 19)

Updated On: 5-Aug-2026
Page 19 of 61
PDF with 499 Questions

You have a Microsoft 365 tenant.
You have a known threat file named File1.docx.
You need to prevent users from downloading File1.docx.
What should you do?

  1. From the Microsoft Defender portal, add an indicator.
  2. From the Microsoft Purview portal, create a data loss prevention (DLP) policy.
  3. From the Microsoft Purview portal, create a sensitivity label.
  4. From the Microsoft Defender portal configure an automated investigation.

Answer(s): A

Explanation:

Implement Endpoint Indicators If you have Microsoft Defender for Endpoint, you can create a custom indicator to block the file from being executed on managed devices.
Navigate to: Settings > Endpoints > Indicators > File hashes. Action: Add the SHA256 hash and set the response action to Block and Remediate. This will stop the file from running and attempt to remove it if found on a device.


Reference:

https://learn.microsoft.com/en-us/defender-endpoint/indicator-file



View Related Case Study

DRAG DROP (Drag and Drop is not supported)
You need to assign role-based access control (RBAC) roles to Group1 and Group2 to meet the Microsoft Sentinel requirements and the business requirements.
Which role should you assign to each group? To answer, drag the appropriate roles to the correct groups. Each role may be used once, more than once, or not at all. You may need to drag the split bar between panes or scroll to view content.
Note: Each correct selection is worth one point.
Select and Place:

  1. See Explanation section for answer.

Answer(s): A

Explanation:




Box 1: Microsoft Sentinel Playbook Operator Microsoft Sentinel Playbook Operator can list, view, and manually run playbooks.
Note: The fabrikam.com forest contains two global groups named Group1 and Group2. Fabrikam identifies the following Microsoft Sentinel requirements: Ensure that the members of Group1 can create and run playbooks.
Box 2: Microsoft Sentinel Contributor Ensure that the members of Group1 can manage analytics rules.
Microsoft Sentinel Contributor can, in addition to the below (Microsoft Sentinel Reader +Microsoft Sentinel Responder), create and edit workbooks, analytics rules, and other Microsoft Sentinel resources.
Box 3: Microsoft Sentinel Responder Ensure that the members of Group2 can manage incidents.
Microsoft Sentinel Reader can view data, incidents, workbooks, and other Microsoft Sentinel resources.
Microsoft Sentinel Responder can, in addition to the above, manage incidents (assign, dismiss, etc.).


Reference:

https://learn.microsoft.com/en-us/azure/sentinel/roles



View Related Case Study

You need to correlate data from the SecurityEvent Log Analytics table to meet the Microsoft Sentinel requirements for using UEBA.
Which Log Analytics table should you use?

  1. IdentityInfo
  2. AADRiskyUsers
  3. SentinelAudit
  4. IdentityDirectoryEvents

Answer(s): A

Explanation:

UEBA also synchronizes the user information from Azure Active Directory and on-premises Active Directory (currently in preview when using Microsoft Defender for Identity) into the IdentityInfo table, for you to use later on.
Note: Identify anomalous activities of Azure AD users by using User and Entity Behavior Analytics (UEBA). Evaluate the potential impact of compromised Azure AD user credentials by using UEBA.


Reference:

https://cloudbrothers.info/en/microsoft-sentinel-ueba/



View Related Case Study

You need to meet the Microsoft Sentinel requirements for App1.
What should you configure for App1?

  1. a trigger
  2. a data connector
  3. authorization
  4. an API connection

Answer(s): C



View Related Case Study

You need to ensure that you can run hunting queries to meet the Microsoft Sentinel requirements.
Which type of workspace should you create?

  1. Azure Synapse Analytics
  2. Azure Machine Learning
  3. Log Analytics
  4. Azure Databricks

Answer(s): B

Explanation:

Fabrikam identifies the following Microsoft Sentinel requirements: Run hunting queries on Pool1 by using Jupyter notebooks.
Get started with Jupyter notebooks and MSTICPy in Microsoft Sentinel
Run and initialize the Getting Started Guide notebook
This procedure describes how to launch your notebook and initialize MSTICpy.
1. In Microsoft Sentinel, select Notebooks from the left.
2. From the Templates tab, select A Getting Started Guide For Microsoft Sentinel ML Notebooks > Save notebook to save it to your Azure ML workspace.
3. Etc.


Reference:

https://learn.microsoft.com/en-us/azure/sentinel/notebook-get-started



View Related Case Study

You need to identify which mean time metrics to use to meet the Microsoft Sentinel requirements.
Which workbook should you use?

  1. Event Analyzer
  2. Investigation Insights
  3. Security Operations Efficiency
  4. Analytics Efficiency

Answer(s): C

Explanation:

Identify the mean time to close incidents generated during the last 30 days.
As a Security Operations Center (SOC) manager, you need to have overall efficiency metrics and measures at your fingertips to gauge the performance of your team. You'll want to see incident operations over time by many different criteria, like severity, MITRE tactics, mean time to triage, mean time to resolve, and more. Microsoft Sentinel now makes this data available to you with the new SecurityIncident table and schema in Log Analytics and the accompanying Security operations efficiency workbook. You'll be able to visualize your team's performance over time and use this insight to improve efficiency. You can also write and use your own KQL queries against the incident table to create customized workbooks that fit your specific auditing needs and KPIs.
Note: Security operations efficiency workbook To complement the SecurityIncidents table, we’ve provided you an out-of-the-box security operations efficiency workbook template that you can use to monitor your SOC operations. The workbook contains the following metrics:
Incident created over time Incidents created by closing classification, severity, owner, and status Mean time to triage *-> Mean time to closure Incidents created by severity, owner, status, product, and tactics over time Time to triage percentiles Time to closure percentiles Mean time to triage per owner Recent activities Recent closing classifications


Reference:

https://learn.microsoft.com/en-us/azure/sentinel/manage-soc-with-incident-metrics



View Related Case Study

HOTSPOT (Drag and Drop is not supported)
You need to create a query to investigate DNS-related activity. The solution must meet the Microsoft Sentinel requirements.
How should you complete the query? To answer, select the appropriate options in the answer area.
Note: Each correct selection is worth one point.
Hot Area:

  1. See Explanation section for answer.

Answer(s): A

Explanation:




Box 1: _Im_Dns Fabrikam identifies the following Microsoft Sentinel requirements: Query for NXDOMAIN DNS requests from the last seven days by using built-in Advanced Security Information Model (ASIM) unifying parsers.
Unifying parsers When using ASIM in your queries, use unifying parsers to combine all sources, normalized to the same schema, and query them using normalized fields. The unifying parser name is _Im_<schema> for built-in parsers and im<schema> for workspace deployed parsers, where <schema> stands for the specific schema it serves.
For example, the following query uses the built-in unifying DNS parser to query DNS events using the ResponseCodeName, SrcIpAddr, and TimeGenerated normalized fields:
_Im_Dns(starttime=ago(1d), responsecodename='NXDOMAIN')
| summarize count() by SrcIpAddr, bin(TimeGenerated,15m)
The example uses filtering parameters, which improve ASIM performance. The same example without filtering parameters would look like this:
_Im_Dns | where TimeGenerated > ago(1d) | where ResponseCodeName =~ "NXDOMAIN" | summarize count() by SrcIpAddr, bin(TimeGenerated,15m)
Box 2: (where TimeGenerated > ago(7d) |


Reference:

https://learn.microsoft.com/en-us/azure/sentinel/normalization-about-parsers



View Related Case Study

HOTSPOT (Drag and Drop is not supported)
You need to meet the Microsoft Sentinel requirements for collecting Windows Security event logs.
What should you do? To answer, select the appropriate options in the answer area.
Note: Each correct selection is worth one point.
Hot Area:

  1. See Explanation section for answer.

Answer(s): A

Explanation:




Box 1: Log Analytics agent Fabrikam identifies the following Microsoft Sentinel requirements: From AWS EC2 instances, collect Windows Security event log entries that include local group membership changes
Use the Log Analytics agent if you need to: * Collect logs and performance data from Azure virtual machines or hybrid machines hosted outside of Azure. * Send data to a Log Analytics workspace to take advantage of features supported by Azure Monitor Logs, such as log queries * Etc.
Box 2: KQL Log queries in Azure Monitor Azure Monitor Logs is based on Azure Data Explorer, and log queries are written by using the same Kusto Query Language (KQL). This rich language is designed to be easy to read and author, so you should be able to start writing queries with some basic guidance.


Reference:

https://learn.microsoft.com/en-us/azure/azure-monitor/agents/log-analytics-agent



  PDF
Viewing page 19 of 61
Viewing questions 145 - 152 out of 499 questions


Post your Comments and Discuss Microsoft SC-200 exam prep with other Community members:

AI Tutor AI Tutor 👋 I’m here to help!