SC-200 Practice Test

SC-200 Practice Test practice questions, page 5 of 20, with answer review and explanations.

Question 21

You are configuring Microsoft Cloud App Security. You have a custom threat detection policy based on the IP address ranges of your company's United States-based offices. You receive many alerts related to impossible travel and sign-ins from risky IP addresses. You determine that 99% of the alerts are legitimate sign-ins from your corporate offices. You need to prevent alerts for legitimate sign-ins from known locations. Which two actions should you perform? Each correct answer presents part of the solution. NOTE: Each correct selection is worth one point.

  1. Configure automatic data enrichment.
  2. Add the IP addresses to the corporate address range category.
  3. Increase the sensitivity level of the impossible travel anomaly detection policy.
  4. Add the IP addresses to the other address range category and add a tag.
  5. Create an activity policy that has an exclusion for the IP addresses.

Question 22

Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution. After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen. You are configuring Microsoft Defender for Identity integration with Active Directory. From the Microsoft Defender for identity portal, you need to configure several accounts for attackers to exploit. Solution: You add each account as a Sensitive account. Does this meet the goal?

  1. Yes
  2. No

Question 23

You have a Microsoft 365 tenant that uses Microsoft Exchange Online and Microsoft Defender for Office 365. What should you use to identify whether zero-hour auto purge (ZAP) moved an email message from the mailbox of a user?

  1. the Threat Protection Status report in Microsoft Defender for Office 365
  2. the mailbox audit log in Exchange
  3. the Safe Attachments file types report in Microsoft Defender for Office 365
  4. the mail flow report in Exchange

Question 24

You have a Microsoft 365 subscription that contains 1,000 Windows 10 devices. The devices have Microsoft Office 365 installed. You need to mitigate the following device threats: ✑ Microsoft Excel macros that download scripts from untrusted websites ✑ Users that open executable attachments in Microsoft Outlook ✑ Outlook rules and forms exploits What should you use?

  1. Microsoft Defender Antivirus
  2. attack surface reduction rules in Microsoft Defender for Endpoint
  3. Windows Defender Firewall
  4. adaptive application control in Azure Defender

Question 25

You have a third-party security information and event management (SIEM) solution. You need to ensure that the SIEM solution can generate alerts for Azure Active Directory (Azure AD) sign-events in near real time. What should you do to route events to the SIEM solution?

  1. Create an Azure Sentinel workspace that has a Security Events connector.
  2. Configure the Diagnostics settings in Azure AD to stream to an event hub.
  3. Create an Azure Sentinel workspace that has an Azure Active Directory connector.
  4. Configure the Diagnostics settings in Azure AD to archive to a storage account.