QUESTION: 21

You are configuring Microsoft Cloud App Security.
You have a custom threat detection policy based on the IP address ranges of your company's United States-based offices.
You receive many alerts related to impossible travel and sign-ins from risky IP addresses.
You determine that 99% of the alerts are legitimate sign-ins from your corporate offices.
You need to prevent alerts for legitimate sign-ins from known locations.
Which two actions should you perform? Each correct answer presents part of the solution.
Note: Each correct selection is worth one point.

Configure automatic data enrichment.
Add the IP addresses to the corporate address range category.
Increase the sensitivity level of the impossible travel anomaly detection policy.
Add the IP addresses to the other address range category and add a tag.
Create an activity policy that has an exclusion for the IP addresses.

Answer(s): A,B

Reveal Solution Next Question

QUESTION: 21

You plan to create a custom Azure Sentinel query that will track anomalous Azure Active Directory (Azure AD) sign-in activity and present the activity as a time chart aggregated by day.
You need to create a query that will be used to display the time chart.
What should you include in the query?

extend
bin
makeset
workspace

Answer(s): B

Reference:

https://docs.microsoft.com/en-us/azure/azure-monitor/logs/get-started-queries

Reveal Solution Next Question

QUESTION: 21

HOTSPOT (Drag and Drop is not supported).
You have an Azure Storage account that will be accessed by multiple Azure Function apps during the development of an application.
You need to hide Azure Defender alerts for the storage account.
Which entity type and field should you use in a suppression rule? To answer, select the appropriate options in the answer area.
Note: Each correct selection is worth one point.
Hot Area:

See Explanation section for answer.

Answer(s): A

Explanation:

Reference:

https://techcommunity.microsoft.com/t5/azure-security-center/suppression-rules-for-azure-security-center-alerts-are-now/ba-p/1404920

Reveal Solution Next Question

QUESTION: 22

You have a Microsoft Sentinel workspace named SW1.
In SW1, you investigate an incident that is associated with the following entities:
• Host
• IP address
• User account
• Malware name
Which entity can be labeled as an indicator of compromise (IoC) directly from the incident's page?

malware name
host
user account
IP address

Answer(s): D

Reveal Solution Next Question

Free SC-200 Exam Braindumps (page: 37)

QUESTION: 21

QUESTION: 21

Reference:

QUESTION: 21

Explanation:

Reference:

QUESTION: 22

SC-200 Discussions & Posts