SC-200 Practice Test

SC-200 Practice Test practice questions, page 12 of 20, with answer review and explanations.

Question 56

You have a Microsoft 365 E5 subscription that uses Microsoft Defender for Endpoint. You need to create a detection rule that meets the following requirements: • Is triggered when a device that has critical software vulnerabilities was active during the last hour • Limits the number of duplicate results How should you complete the KQL query? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.

Question 57

You have a Microsoft 365 E5 subscription that uses Microsoft Teams. You need to perform a content search of Teams chats for a user by using the Microsoft Purview compliance portal. The solution must minimize the scope of the search. How should you configure the content search? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.

Question 58

You have a Microsoft 365 E5 subscription that contains 100 Linux devices. The devices are onboarded to Microsoft Defender 365. You need to initiate the collection of investigation packages from the devices by using the Microsoft 365 Defender portal. Which response action should you use?

  1. Run antivirus scan
  2. Initiate Automated Investigation
  3. Collect investigation package
  4. Initiate Live Response Session

Question 59

You need to configure Microsoft Defender for Cloud Apps to generate alerts and trigger remediation actions in response to external sharing of confidential files. Which two actions should you perform in the Microsoft 365 Defender portal? Each correct answer presents part of the solution. NOTE: Each correct selection is worth one point.

  1. From Settings, select Cloud App, select Microsoft Information Protection, and then select Only scan files for Microsoft Information Protection sensitivity labels and content inspection warnings from this tenant.
  2. From Cloud apps, select Files, and then filter File Type to Document.
  3. From Settings, select Cloud App, select Microsoft Information Protection, select Files, and then enable file monitoring.
  4. From Cloud apps, select Files, and then filter App to Office 365.
  5. From Cloud apps, select Files, and then select New policy from search.
  6. From Settings, select Cloud App, select Microsoft Information Protection, and then select Automatically scan new files for Microsoft Information Protection sensitivity labels and content inspection warnings.

Question 60

You have a Microsoft 365 subscription that uses Microsoft Purview. Your company has a project named Project1. You need to identify all the email messages that have the word Project1 in the subject line. The solution must search only the mailboxes of users that worked on Project1. What should you do?

  1. Perform a user data search.
  2. Create a records management disposition.
  3. Perform an audit search.
  4. Perform a content search.