Microsoft SC-200 Microsoft Security Operations Analyst Exam Exam Practice Test Questions

• Question 1

  You need to configure Microsoft Cloud App Security to generate alerts and trigger remediation actions in response to external sharing of confidential files.Which two actions should you perform in the Cloud App Security portal? Each correct answer presents part of the solution.NOTE: Each correct selection is worth one point.

  • From Settings, select Information Protection, select Azure Information Protection, and then select Only scan files for Azure Information Protection classification labels and content inspection warnings from this tenant
  • Select Investigate files, and then filter App to Office 365.
  • Select Investigate files, and then select New policy from search
  • From Settings, select Information Protection, select Azure Information Protection, and then select Automatically scan new files for Azure Information Protection classification labels and content inspection warnings
  • From Settings, select Information Protection, select Files, and then enable file monitoring.
  • Select Investigate files, and then filter File Type to Document.

  Show Answer Answer: D, E Next

• Question 2

  You have an Azure subscription.You need to stream the Microsoft Graph activity logs to a third-party security information and event management (SIEM) tool. The solution must minimize administrative effort.To where should you stream the logs?

  • an Azure Event Hubs namespace
  • an Azure Event Grid namespace
  • an Azure Storage account
  • a Log Analytics workspace

  Show Answer Answer: A Next

• Question 3

  Your company stores the data for every project in a different Azure subscription. All the subscriptions use the same Azure Active Directory (Azure AD) tenant.Every project consists of multiple Azure virtual machines that run Windows Server. The Windows events of the virtual machines are stored in a Log Analytics workspace in each machine's respective subscription.You deploy Azure Sentinel to a new Azure subscription.You need to perform hunting queries in Azure Sentinel to search across all the Log Analytics workspaces of all the subscriptions.Which two actions should you perform? Each correct answer presents part of the solution.NOTE: Each correct selection is worth one point.

  • Add the Security Events connector to the Azure Sentinel workspace.
  • Create a query that uses the workspace expression and the union operator.
  • Use the alias statement.
  • Create a query that uses the resource expression and the alias operator.
  • Add the Azure Sentinel solution to each workspace.

  Show Answer Answer: B, E Next

• Question 4

  You have a Microsoft 365 tenant that uses Microsoft Exchange Online and Microsoft Defender for Office 365.What should you use to identify whether zero-hour auto purge (ZAP) moved an email message from the mailbox of a user?

  • the Threat Protection Status report in Microsoft Defender for Office 365
  • the mailbox audit log in Exchange
  • the Safe Attachments file types report in Microsoft Defender for Office 365
  • the mail flow report in Exchange

  Show Answer Answer: A Next

• Question 5

  You need to recommend a solution to meet the technical requirements for the Azure virtual machines. What should you include in the recommendation?

  • just-in-time (JIT) access
  • Azure Defender
  • Azure Firewall
  • Azure Application Gateway

  Show Answer Answer: B Next