Free SC-200 Exam Braindumps
Microsoft Security Operations Analyst Questions 193–200 (page: 26)

You have two Azure subscriptions that use Microsoft Defender for Cloud.
You need to ensure that specific Defender for Cloud security alerts are suppressed at the root management group level. The solution must minimize administrative effort.
What should you do in the Azure portal?

You have an Azure subscription that has the enhanced security features in Microsoft Defender for Cloud enabled and contains a user named User1.
You need to ensure that User1 can export alert data from Defender for Cloud. The solution must use the principle of least privilege.
Which role should you assign to User1?

You have an Azure subscription that contains an Azure logic app named app1 and a Microsoft Sentinel workspace that has an Azure AD connector.
You need to ensure that app1 launches when Microsoft Sentinel detects an Azure AD-generated alert.
What should you create first?

You have a Microsoft Sentinel workspace.
You need to identify which rules are used to detect advanced multistage attacks that comprise two or more alerts or activities. The solution must minimize administrative effort.
Which rule type should you query?

You have an Azure subscription that uses Microsoft Sentinel and contains 100 Linux virtual machines.
You need to monitor the virtual machines by using Microsoft Sentinel. The solution must meet the following requirements:
-Minimize administrative effort.
-Minimize the parsing required to read log data.
What should you configure?

HOTSPOT (Drag and Drop is not supported)
You have 100 Azure subscriptions that have enhanced security features in Microsoft Defender for Cloud enabled. All the subscriptions are linked to a single Microsoft Entra tenant.
You need to stream the Defender for Cloud logs to a syslog server. The solution must minimize administrative effort.
What should you do? To answer, select the appropriate options in the answer area.
Note: Each correct selection is worth one point.
Hot Area:

DRAG DROP (Drag and Drop is not supported)
You have an Azure subscription that contains 100 Linux virtual machines.
You need to configure Microsoft Sentinel to collect event logs from the virtual machines.
Which three actions should you perform in sequence? To answer, move the appropriate actions from the list of actions to the answer area and arrange them in the correct order.
Select and Place:

DRAG DROP (Drag and Drop is not supported)
You plan to connect an external solution that will send Common Event Format (CEF) messages to Microsoft Sentinel.
You need to deploy the log forwarder.
Which three actions should you perform in sequence? To answer, move the appropriate actions form the list of actions to the answer area and arrange them in the correct order.
Select and Place: