QUESTION: 16

You use Azure Defender.
You have an Azure Storage account that contains sensitive information.
You need to run a PowerShell script if someone accesses the storage account from a suspicious IP address.
Which two actions should you perform? Each correct answer presents part of the solution.
Note: Each correct selection is worth one point.

From Azure Security Center, enable workflow automation.
Create an Azure logic app that has a manual trigger.
Create an Azure logic app that has an Azure Security Center alert trigger.
Create an Azure logic app that has an HTTP trigger.
From Azure Active Directory (Azure AD), add an app registration.

Answer(s): A,C

Reference:

https://docs.microsoft.com/en-us/azure/storage/common/azure-defender-storage-configure?tabs=azure-security-center https://docs.microsoft.com/en-us/azure/security-center/workflow-automation

Reveal Solution Next Question

QUESTION: 16

Your company deploys the following services:
✑ Microsoft Defender for Identity
✑ Microsoft Defender for Endpoint
✑ Microsoft Defender for Office 365
You need to provide a security analyst with the ability to use the Microsoft 365 security center. The analyst must be able to approve and reject pending actions generated by Microsoft Defender for Endpoint. The solution must use the principle of least privilege.
Which two roles should assign to the analyst? Each correct answer presents part of the solution.
Note: Each correct selection is worth one point.

the Compliance Data Administrator in Azure Active Directory (Azure AD)
the Active remediation actions role in Microsoft Defender for Endpoint
the Security Administrator role in Azure Active Directory (Azure AD)
the Security Reader role in Azure Active Directory (Azure AD)

Answer(s): B,D

Reference:

https://docs.microsoft.com/en-us/microsoft-365/security/defender-endpoint/rbac?view=o365-worldwide

Reveal Solution Next Question

QUESTION: 16

You have an Azure Sentinel deployment in the East US Azure region.
You create a Log Analytics workspace named LogsWest in the West US Azure region.
You need to ensure that you can use scheduled analytics rules in the existing Azure Sentinel deployment to generate alerts based on queries to LogsWest.
What should you do first?

Deploy Azure Data Catalog to the West US Azure region.
Modify the workspace settings of the existing Azure Sentinel deployment.
Add Azure Sentinel to a workspace.
Create a data connector in Azure Sentinel.

Answer(s): C

Reference:

https://docs.microsoft.com/en-us/azure/sentinel/extend-sentinel-across-workspaces-tenants

Reveal Solution Next Question

QUESTION: 17

You have a Microsoft 365 subscription that uses Microsoft Defender XDR and contains a Windows device named Device1.
The timeline of Device1 includes three files named File1.ps1, File2.exe, and File3.dll.
You need to submit files for deep analysis in Microsoft Defender XDR.
Which files can you submit?

File1.ps1 only
File2.exe only
File3.dll only
File2.exe and File3.dll only
File1.ps1 and File2.exe only
File1.ps1, File2.exe, and File3.dll

Answer(s): D

Reveal Solution Next Question

Free SC-200 Exam Braindumps (page: 32)

QUESTION: 16

Reference:

QUESTION: 16

Reference:

QUESTION: 16

Reference:

QUESTION: 17

SC-200 Discussions & Posts