support@Free-Braindumps.com
Register Login
Cisco
CompTIA
ISC
EC-Council
EXIN
Fortinet
ITIL
Juniper
Microsoft
VMware
Avaya
SAP
Google
NVIDIA
Salesforce
Amazon
Palo Alto Networks
ISC2
CrowdStrike
Anthropic
All Vendors
  1. Home
  2. Exams
  3. Microsoft
  4. SC-200

Free SC-200 Exam Braindumps
Microsoft Security Operations Analyst Questions 161–168 (page: 22)

Updated On: 5-Aug-2026
Page 22 of 61
PDF with 499 Questions
View Related Case Study

You need to meet the Microsoft Sentinel requirements for Group1.
Which role should you assign to Group1?

  1. Microsoft Sentinel Playbook Operator
  2. Logic App Contributor
  3. Automation Operator
  4. Microsoft Sentinel Automation Contributor

Answer(s): B

Explanation:

Scenario: Ensure that the Group1 members can create and edit playbooks.
Microsoft Sentinel roles, permissions, and allowed actions This table summarizes the Microsoft Sentinel roles and their allowed actions in Microsoft Sentinel.

Incorrect: * Microsoft Sentinel Playbook Operator Microsoft Sentinel Playbook Operator can list, view, and manually run playbooks.
* Microsoft Sentinel Automation Contributor Microsoft Sentinel Automation Contributor allows Microsoft Sentinel to add playbooks to automation rules. It isn't meant for user accounts.


Reference:

https://learn.microsoft.com/en-us/azure/sentinel/roles



View Related Case Study

You need to ensure that the configuration of HuntingQuery1 meets the Microsoft Sentinel requirements.
What should you do?

  1. Add HuntingQuery1 to a livestream.
  2. Create a watchlist.
  3. Create an Azure Automation rule.
  4. Add HuntingQuery1 to favorites.

Answer(s): D



View Related Case Study

HOTSPOT (Drag and Drop is not supported)
You need to implement the query for Workbook1 and Webapp1. The solution must meet the Microsoft Sentinel requirements.
How should you configure the query? To answer, select the appropriate options in the answer area.
Note: Each correct selection is worth one point.
Hot Area:

  1. See Explanation section for answer.

Answer(s): A

Explanation:





Scenario: Implement a custom Microsoft Sentinel workbook named Workbook1 that will include a query to dynamically retrieve data from Webapp1. WebApp1 is a web service. An on-premises, public-facing HTTP/HTTPS web service that generates JSON output in response to GET HTTP requests.
Box 1: Custom endpoint Data source to query
Custom endpoint Workbooks support getting data from any external source. If your data lives outside Azure, you can bring it to workbooks by using this data source type.
To make a query control that uses this data source, use the Data source dropdown and select Custom Endpoint. Provide the appropriate parameters, such as Http method, url, headers, url parameters, and body. Make sure your data source supports CORS. Otherwise, the request will fail.
Note: Workbooks can extract data from these data sources:
Logs Metrics Azure Resource Graph Azure Resource Manager Azure Data Explorer *-> JSON Merge *-> Custom endpoint Workload health Azure resource health Azure RBAC Change Analysis (preview) Prometheus (preview)
Incorrect: * JSON The JSON provider allows you to create a query result from *static* (in this scenario we have dynamic data)
JSON content. It's most commonly used in parameters to create dropdown parameters of static values. Simple JSON arrays or objects will automatically be converted into grid rows and columns. For more specific behaviors, you can use the Results tab and JSONPath settings to configure columns.
Box 2: Enable Cross-Origin Resource Sharing (CORS) On Webapp1
Make sure your data source supports CORS. Otherwise, the request will fail.


Reference:

https://learn.microsoft.com/en-us/azure/azure-monitor/visualize/workbooks-data-sources



DRAG DROP (Drag and Drop is not supported)
Your company deploys Microsoft Sentinel.
You plan to delegate the administration of Microsoft Sentinel to various groups.
You need to delegate the following tasks:
-Create and run playbooks
-Create workbooks and analytic rules.
The solution must use the principle of least privilege.
Which role should you assign for each task? To answer, drag the appropriate roles to the correct tasks. Each role may be used once, more than once, or not at all. You may need to drag the split bar between panes or scroll to view content.
Note: Each correct selection is worth one point.
Select and Place:

  1. See Explanation section for answer.

Answer(s): A

Explanation:


Reference:

https://docs.microsoft.com/en-us/azure/sentinel/roles



A company uses Microsoft Sentinel.
You need to create an automated threat response.
What should you use?

  1. a data connector
  2. a playbook
  3. a workbook
  4. a Microsoft incident creation rule

Answer(s): B


Reference:

https://docs.microsoft.com/en-us/azure/sentinel/tutorial-respond-threats-playbook



HOTSPOT (Drag and Drop is not supported)
You use Microsoft Sentinel to monitor irregular Azure activity.
You create custom analytics rules to detect threats as shown in the following exhibit.

You do NOT define any incident settings as part of the rule definition.
Use the drop-down menus to select the answer choice that completes each statement based on the information presented in the graphic.
Note: Each correct selection is worth one point.
Hot Area:

  1. See Explanation section for answer.

Answer(s): A

Explanation:


Reference:

https://docs.microsoft.com/en-us/azure/sentinel/tutorial-detect-threats-custom



You have an Microsoft Sentinel deployment in the East US Azure region.
You create a Log Analytics workspace named LogsWest in the West US Azure region.
You need to ensure that you can use scheduled analytics rules in the existing Microsoft Sentinel deployment to generate alerts based on queries to LogsWest.
What should you do first?

  1. Deploy Azure Data Catalog to the West US Azure region.
  2. Modify the workspace settings of the existing Microsoft Sentinel deployment.
  3. Add Microsoft Sentinel to a workspace.
  4. Create a data connector in Microsoft Sentinel.

Answer(s): C


Reference:

https://docs.microsoft.com/en-us/azure/sentinel/extend-sentinel-across-workspaces-tenants



You create a custom analytics rule to detect threats in Microsoft Sentinel.
You discover that the rule fails intermittently.
What are two possible causes of the failures? Each correct answer presents a complete solution.
Note: Each correct selection is worth one point.

  1. The rule query takes too long to run and times out.
  2. The target workspace was deleted.
  3. Permissions to the data sources of the rule query were modified.
  4. There are connectivity issues between the data sources and Log Analytics.

Answer(s): A,D

Explanation:

Incorrect Answers: B: This would cause it to fail every time, not just intermittently. C: This would cause it to fail every time, not just intermittently.



  PDF
Viewing page 22 of 61
Viewing questions 169 - 176 out of 499 questions


Post your Comments and Discuss Microsoft SC-200 exam prep with other Community members:

AI Tutor AI Tutor 👋 I’m here to help!