Cisco®
CompTIA
Checkpoint
ISC
EC-Council
EXIN
Fortinet
ITIL®
Juniper
PMI
Microsoft
VMware
Avaya
Google
Salesforce
Amazon
Palo Alto Networks
ISC2
Splunk®
All Vendors
  2. Home
  3. Exams
  4. Microsoft
  5. SC-200

Free SC-200 Exam Braindumps (page: 2)

Page 2 of 79
PDF with 389 Questions

DRAG DROP (Drag and Drop is not supported).
You are investigating an incident by using Microsoft 365 Defender.
You need to create an advanced hunting query to count failed sign-in authentications on three devices named CFOLaptop, CEOLaptop, and COOLaptop.
How should you complete the query? To answer, select the appropriate options in the answer area.
Note: Each correct selection is worth one point.
Select and Place:

  1. See Explanation section for answer.

Answer(s): A

Explanation:



You have an Azure subscription that contains a Microsoft Sentinel workspace named WS1 and 100 virtual machines that run Windows Server.
You need to configure the collection of Windows Security event logs for ingestion to WS1. The solution must meet the following requirements:
• Capture a full user audit trail including user sign-in and user sign-out events.
• Minimize the volume of events.
• Minimize administrative effort.
Which event set should you select?

  1. Minimal
  2. Common
  3. All events
  4. Custom

Answer(s): B



HOTSPOT
-
You have an Azure subscription that contains a user named User1 and a Microsoft Sentinel workspace named WS1.
You deploy Advanced Security Information Model (ASIM) authentication parsers to WS1.
You need to use the parsers to query the authentication events generated by User1 during the last 24 hours. The solution must maximize the performance of the query.
How should you complete the query? To answer, select the appropriate options in the answer area.
Note: Each correct selection is worth one point.

  1. See Explanation section for answer.

Answer(s): A

Explanation:



You need to restrict cloud apps running on CLIENT1 to meet the Microsoft Defender for Endpoint requirements.
Which two configurations should you modify? Each correct answer present part of the solution.
Note: Each correct selection is worth one point.

  1. the Onboarding settings from Device management in Microsoft Defender Security Center
  2. Cloud App Security anomaly detection policies
  3. Advanced features from Settings in Microsoft Defender Security Center
  4. the Cloud Discovery settings in Cloud App Security

Answer(s): C,D

Explanation:

All Cloud App Security unsanctioned apps must be blocked on the Windows 10 computers by using Microsoft Defender for Endpoint.


Reference:

https://docs.microsoft.com/en-us/cloud-app-security/mde-govern






Post your Comments and Discuss Microsoft SC-200 exam with other Community members:

SC-200 Exam Discussions & Posts