SC-200 Practice Test

SC-200 Practice Test practice questions, page 7 of 20, with answer review and explanations.

Question 31

You have a Microsoft 365 subscription that uses Microsoft 365 Defender. You need to identify all the entities affected by an incident. Which tab should you use in the Microsoft 365 Defender portal?

  1. Investigations
  2. Devices
  3. Evidence and Response
  4. Alerts

Question 32

You have a Microsoft 365 E5 subscription that is linked to a hybrid Azure AD tenant. You need to identify all the changes made to Domain Admins group during the past 30 days. What should you use?

  1. the Modifications of sensitive groups report in Microsoft Defender for Identity
  2. the identity security posture assessment in Microsoft Defender for Cloud Apps
  3. the Azure Active Directory Provisioning Analysis workbook
  4. the Overview settings of Insider risk management

Question 33

You have a Microsoft 365 subscription. The subscription uses Microsoft 365 Defender and has data loss prevention (DLP) policies that have aggregated alerts configured. You need to identify the impacted entities in an aggregated alert. What should you review in the DLP alert management dashboard of the Microsoft 365 compliance center?

  1. the Events tab of the alert
  2. the Sensitive Info Types tab of the alert
  3. Management log
  4. the Details tab of the alert

Question 34

You have a Microsoft 365 subscription that uses Microsoft 365 Defender. You plan to create a hunting query from Microsoft Defender. You need to create a custom tracked query that will be used to assess the threat status of the subscription. From the Microsoft 365 Defender portal, which page should you use to create the query?

  1. Threat analytics
  2. Advanced Hunting
  3. Explorer
  4. Policies & rules

Question 35

You have a Microsoft 365 subscription that uses Microsoft Defender for Endpoint. You need to add threat indicators for all the IP addresses in a range of 171.23.34.32-171.23.34.63. The solution must minimize administrative effort. What should you do in the Microsoft 365 Defender portal?

  1. Create an import file that contains the individual IP addresses in the range. Select Import and import the file.
  2. Create an import file that contains the IP address of 171.23.34.32/27. Select Import and import the file.
  3. Select Add indicator and set the IP address to 171.23.34.32-171.23.34.63.
  4. Select Add indicator and set the IP address to 171.23.34.32/27.