Free Microsoft SC-200 Practice Exam with Questions & Answers | Set: 3

Name: How to Pass SC-200 Exams
Brand: Examstrack
SKU: sc-200
Price: 40.25 USD
Availability: InStock

Questions 21

You are informed of an increase in malicious email being received by users.

You need to create an advanced hunting query in Microsoft 365 Defender to identify whether the accounts of the email recipients were compromised. The query must return the most recent 20 sign-ins performed by the recipients within an hour of receiving the known malicious email.

How should you complete the query? To answer, select the appropriate options in the answer area.

NOTE: Each correct selection is worth one point.

SC-200 Question 21

Options:

Microsoft SC-200 Premium Access

Benjamin

10-Aug-2025

With Examstrack, guaranteed success in SC-200 is within reach. Their comprehensive resources cover all the necessary topics.

Questions 22

You plan to connect an external solution that will send Common Event Format (CEF) messages to Azure Sentinel.

You need to deploy the log forwarder.

Which three actions should you perform in sequence? To answer, move the appropriate actions form the list of actions to the answer area and arrange them in the correct order.

SC-200 Question 22

Options:

Questions 23

You have two Azure subscriptions that use Microsoft Defender for Cloud.

You need to ensure that specific Defender for Cloud security alerts are suppressed at the root management group level. The solution must minimize administrative effort.

What should you do in the Azure portal?

Options:

Create an Azure Policy assignment.

Modify the Workload protections settings in Defender for Cloud.

Create an alert rule in Azure Monitor.

Modify the alert settings in Defender for Cloud.

Questions 24

You have a Microsoft Sentinel workspace named sws1.

You need to create a hunting query to identify users that list storage keys of multiple Azure Storage accounts. The solution must exclude users that list storage keys for a single storage account.

How should you complete the query? To answer, select the appropriate options in the answer area.

NOTE: Each correct selection is worth one point.

SC-200 Question 24

Options:

Questions 25

You need to use an Azure Sentinel analytics rule to search for specific criteria in Amazon Web Services (AWS) logs and to generate incidents.

Which three actions should you perform in sequence? To answer, move the appropriate actions from the list of actions to the answer area and arrange them in the correct order.

a Microsoft 365 E5

SC-200 Question 25

Options:

Questions 26

You need to restrict cloud apps running on CLIENT1 to meet the Microsoft Defender for Endpoint requirements.

Which two configurations should you modify? Each correct answer present part of the solution.

NOTE: Each correct selection is worth one point.

Options:

the Onboarding settings from Device management in Microsoft Defender Security Center

Cloud App Security anomaly detection policies

Advanced features from Settings in Microsoft Defender Security Center

the Cloud Discovery settings in Cloud App Security

Questions 27

Which rule setting should you configure to meet the Microsoft Sentinel requirements?

Options:

From Set rule logic, turn off suppression.

From Analytic rule details, configure the tactics.

From Set rule logic, map the entities.

From Analytic rule details, configure the severity.

Questions 28

You need to configure DC1 to meet the business requirements.

Which four actions should you perform in sequence? To answer, move the appropriate actions from the list of actions to the answer area and arrange them in the correct order.

SC-200 Question 28