QUESTION: 24

DRAG DROP (Drag and Drop is not supported).
You have an Azure Functions app that generates thousands of alerts in Azure Security Center each day for normal activity.
You need to hide the alerts automatically in Security Center.
Which three actions should you perform in sequence in Security Center? Each correct answer presents part of the solution.
Note: Each correct selection is worth one point.
Select and Place:

See Explanation section for answer.

Answer(s): A

Explanation:

Reference:

https://techcommunity.microsoft.com/t5/azure-security-center/suppression-rules-for-azure-security-center-alerts-are-now/ba-p/1404920

Reveal Solution Next Question

QUESTION: 25

You have a Microsoft 365 subscription that uses Microsoft Defender for Endpoint and contains the devices shown in the following table.

You initiate a live response session on each device.
You need to collect a Defender for Endpoint investigation package from each device.
On which devices can you collect the package by running advanced live response commands from the command-line interface (CLI)?

Device1 and Device2 only
Device1, Device2, and Device3 only
Device3 and Device4 only
Device1, Device2, Device3, and Device4

Answer(s): B

Reveal Solution Next Question

QUESTION: 25

You have a third-party security information and event management (SIEM) solution.
You need to ensure that the SIEM solution can generate alerts for Azure Active Directory (Azure AD) sign-events in near real time.
What should you do to route events to the SIEM solution?

Create an Azure Sentinel workspace that has a Security Events connector.
Configure the Diagnostics settings in Azure AD to stream to an event hub.
Create an Azure Sentinel workspace that has an Azure Active Directory connector.
Configure the Diagnostics settings in Azure AD to archive to a storage account.

Answer(s): B

Reference:

https://docs.microsoft.com/en-us/azure/active-directory/reports-monitoring/overview-monitoring

Reveal Solution Next Question

QUESTION: 25

You use Azure Sentinel.
You need to receive an alert in near real-time whenever Azure Storage account keys are enumerated.
Which two actions should you perform? Each correct answer presents part of the solution.
Note: Each correct selection is worth one point.

Create a livestream
Add a data connector
Create an analytics rule
Create a hunting query.
Create a bookmark.

Answer(s): A,D

Reference:

https://docs.microsoft.com/en-us/azure/sentinel/livestream

Reveal Solution Next Question

Free SC-200 Exam Braindumps (page: 40)

QUESTION: 24

Explanation:

Reference:

QUESTION: 25

QUESTION: 25

Reference:

QUESTION: 25

Reference:

SC-200 Discussions & Posts