SC-200 Practice Test

Question 46

51 HOTSPOT You have a custom detection rule that includes the following KQL query. For each of the following statements, select Yes if True. Otherwise, select No. NOTE: Each correct selection is worth one point.

Question 47

You have an Azure subscription that uses Microsoft Defender for Servers Plan 1 and contains a server named Server1. You enable agentless scanning. You need to prevent Server1 from being scanned. The solution must minimize administrative effort. What should you do?

1. Create an exclusion tag.
2. Upgrade the subscription to Defender for Servers Plan 2.
3. Create a governance rule.
4. Create an exclusion group.

Question 48

You need to configure Microsoft Defender for Cloud Apps to generate alerts and trigger remediation actions in response to external sharing of confidential files. Which two actions should you perform in the Microsoft 365 Defender portal? Each correct answer presents part of the solution. NOTE: Each correct selection is worth one point.

1. From Settings, select Information Protection, select Azure Information Protection, and then select Only scan files for Azure Information Protection classification labels and content inspection warnings from this tenant.
2. From Cloud apps, select Files, and then filter File Type to Document. B. From Settings, select Information Protection, select Files, and then enable file monitoring.
3. From Cloud apps, select Files, and then filter App to Office 365.
4. From Cloud apps, select Files, and then select New policy from search.
5. From Settings, select Information Protection, select Azure Information Protection, and then select Automatically scan new files for Azure Information Protection classification labels and content inspection warnings.

Question 49

Your network contains an on-premises Active Directory Domain Services (AD DS) domain that syncs with Azure AD. You have a Microsoft 365 E5 subscription that uses Microsoft Defender 365. You need to identify all the interactive authentication attempts by the users in the finance department of your company. How should you complete the KQL query? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.

Question 50

You have a Microsoft 365 E5 subscription that uses Microsoft Defender for Endpoint. You need to identify any devices that triggered a malware alert and collect evidence related to the alert. The solution must ensure that you can use the results to initiate device isolation for the affected devices. What should you use in the Microsoft 365 Defender portal?

1. incidents
2. Remediation
3. Investigations
4. Advanced hunting