QUESTION: 1

DRAG DROP (Drag and Drop is not supported).
You are investigating an incident by using Microsoft 365 Defender.
You need to create an advanced hunting query to count failed sign-in authentications on three devices named CFOLaptop, CEOLaptop, and COOLaptop.
How should you complete the query? To answer, select the appropriate options in the answer area.
Note: Each correct selection is worth one point.
Select and Place:

See Explanation section for answer.

Answer(s): A

Explanation:

Reveal Solution Next Question

QUESTION: 1

You have an Azure subscription that contains a Microsoft Sentinel workspace named WS1 and 100 virtual machines that run Windows Server.
You need to configure the collection of Windows Security event logs for ingestion to WS1. The solution must meet the following requirements:
• Capture a full user audit trail including user sign-in and user sign-out events.
• Minimize the volume of events.
• Minimize administrative effort.
Which event set should you select?

Minimal
Common
All events
Custom

Answer(s): B

Reveal Solution Next Question

QUESTION: 1

HOTSPOT
-
You have an Azure subscription that contains a user named User1 and a Microsoft Sentinel workspace named WS1.
You deploy Advanced Security Information Model (ASIM) authentication parsers to WS1.
You need to use the parsers to query the authentication events generated by User1 during the last 24 hours. The solution must maximize the performance of the query.
How should you complete the query? To answer, select the appropriate options in the answer area.
Note: Each correct selection is worth one point.

See Explanation section for answer.

Answer(s): A

Explanation:

Reveal Solution Next Question

QUESTION: 1

You need to restrict cloud apps running on CLIENT1 to meet the Microsoft Defender for Endpoint requirements.
Which two configurations should you modify? Each correct answer present part of the solution.
Note: Each correct selection is worth one point.

the Onboarding settings from Device management in Microsoft Defender Security Center
Cloud App Security anomaly detection policies
Advanced features from Settings in Microsoft Defender Security Center
the Cloud Discovery settings in Cloud App Security

Answer(s): C,D

Explanation:

All Cloud App Security unsanctioned apps must be blocked on the Windows 10 computers by using Microsoft Defender for Endpoint.

Reference:

https://docs.microsoft.com/en-us/cloud-app-security/mde-govern

Reveal Solution Next Question

Free SC-200 Exam Braindumps (page: 2)

Pass your Microsoft Security Operations Analyst exam with these free Actual Questions and Answers

QUESTION: 1

Explanation:

QUESTION: 1

QUESTION: 1

Explanation:

QUESTION: 1

Explanation:

Reference:

SC-200 Discussions & Posts