Microsoft Security Operations Analyst - SC-200 FREE EXAM DUMPS QUESTIONS & ANSWERS
You have a Microsoft subscription that has Microsoft Defender for Cloud enabled You configure the Azure logic apps shown in the following table.
You need to configure an automatic action that will run if a Suspicious process executed alert is triggered.
The solution must minimize administrative effort.
Which three actions should you perform in sequence? To answer, move the appropriate actions from the list of actions to the answer area and arrange them in the correct order.
You need to configure an automatic action that will run if a Suspicious process executed alert is triggered.
The solution must minimize administrative effort.
Which three actions should you perform in sequence? To answer, move the appropriate actions from the list of actions to the answer area and arrange them in the correct order.
Correct Answer:
Explanation:
Select Take action.
Configure the Trigger automated response settings.
Filter by alert title.
In Microsoft Defender for Cloud, automatic responses to alerts are implemented through Take action # Trigger automated response, which creates or binds a workflow automation to a Logic App. For an alert such as "Suspicious process executed", the least-effort approach is to start from the alert experience and attach the prebuilt Logic App that uses the "When a Defender for Cloud alert is created or triggered" trigger (your LogicApp2). The documented flow is: open the alert and choose Take action; within that blade, select Trigger automated response to connect a Logic App; then scope the automation by setting conditions/filters, including Alert title, so it only runs when the specific alert ("Suspicious process executed") is generated. This maps exactly to the three steps above.
Other panes under Take action-Mitigate the threat and Prevent future attacks-provide manual guidance or recommend hardening steps and are not used to bind a Logic App. Similarly, Suppress similar alerts is for tuning noise, not for launching automations. Because you already have LogicApp2 with the Defender for Cloud alert trigger, selecting Trigger automated response and filtering by alert title ensures the playbook runs every time that specific alert fires, with minimal administration and without creating additional custom logic.
You have an Azure subscription that uses Microsoft Defender for Cloud.
You need to create a workflow that will send a Microsoft Teams message to the IT department of your company when a new Microsoft Secure Score action is generated.
Which three actions should you perform in sequence? To answer, move the appropriate actions from the list of actions to the answer area and arrange them in the correct order.
You need to create a workflow that will send a Microsoft Teams message to the IT department of your company when a new Microsoft Secure Score action is generated.
Which three actions should you perform in sequence? To answer, move the appropriate actions from the list of actions to the answer area and arrange them in the correct order.
Correct Answer:
Explanation:
When you need to send a Microsoft Teams message (or perform any automated response) in Microsoft Defender for Cloud based on a new Microsoft Secure Score action, you must use workflow automation integrated with Azure Logic Apps.
Here's the correct sequence of actions, step by step:
The Secure Score is part of Defender for Cloud's Regulatory Compliance section.
To react to new Secure Score recommendations or actions, the Logic App must use the "When a Defender for Cloud regulatory compliance assessment is created or triggered" trigger.
This ensures that the automation is initiated whenever a new Secure Score change occurs.
According to Microsoft documentation:
"To automate Secure Score or compliance actions, select the 'Regulatory compliance assessment trigger' in Logic Apps. It triggers workflows when a new compliance or Secure Score recommendation is created or updated." Next, you configure the condition that specifies which Secure Score events should trigger the workflow.
For example, you can set conditions such as:
"If the assessment type = Secure Score," or
"If compliance status = Failed."
This filtering ensures that only relevant events (new Secure Score actions) will activate the workflow and prevent unnecessary Teams notifications.
Finally, in Defender for Cloud, you configure workflow automation to link the Logic App to the event stream.
From the Defender for Cloud portal, navigate to Workflow automation # Add automation # Choose trigger and Logic App.
Select the created Logic App as the target and define the scope (e.g., all subscriptions or resource groups).
This connects Defender for Cloud to the Logic App so that when a new Secure Score event occurs, the app automatically sends the Microsoft Teams message.
You have a Microsoft 365 subscription that has Microsoft 365 Defender enabled.
You need to identify all the changes made to sensitivity labels during the past seven days.
What should you use?
You need to identify all the changes made to sensitivity labels during the past seven days.
What should you use?
Correct Answer: D
Vote an answer
Explanation: Only visible for FreeCram members. You can sign-up / login (it's free).
You have a Microsoft 365 subscription that contains 1,000 Windows 10 devices. The devices have Microsoft Office 365 installed.
You need to mitigate the following device threats:
Microsoft Excel macros that download scripts from untrusted websites
Users that open executable attachments in Microsoft Outlook
Outlook rules and forms exploits
What should you use?
You need to mitigate the following device threats:
Microsoft Excel macros that download scripts from untrusted websites
Users that open executable attachments in Microsoft Outlook
Outlook rules and forms exploits
What should you use?
Correct Answer: D
Vote an answer
Explanation: Only visible for FreeCram members. You can sign-up / login (it's free).
You have a Microsoft 365 B5 subscription that uses Microsoft Defender XDR. You are investigating an incident You need to review the incident tasks that were performed. What can you use on the Incident page?
Correct Answer: C
Vote an answer
Explanation: Only visible for FreeCram members. You can sign-up / login (it's free).
You have a Microsoft 365 E5 subscription that uses Microsoft Defender XDR and contains a user named User1.
You need to ensure that User1 can manage Microsoft Defender XDR custom detection rules and Endpoint security policies. The solution must follow the principle of least privilege.
Which role should you assign to User1?
You need to ensure that User1 can manage Microsoft Defender XDR custom detection rules and Endpoint security policies. The solution must follow the principle of least privilege.
Which role should you assign to User1?
Correct Answer: D
Vote an answer
Explanation: Only visible for FreeCram members. You can sign-up / login (it's free).
You have an Azure Storage account that will be accessed by multiple Azure Function apps during the development of an application.
You need to hide Azure Defender alerts for the storage account.
Which entity type and field should you use in a suppression rule? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
You need to hide Azure Defender alerts for the storage account.
Which entity type and field should you use in a suppression rule? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Correct Answer:
Explanation:
When configuring suppression rules in Microsoft Defender for Cloud (previously Azure Security Center), you define the specific entity type and field values to suppress recurring or expected alerts. In this scenario, you want to hide Azure Defender alerts for a specific Azure Storage account that is being accessed during application development.
In Defender for Cloud, each protected asset (such as a virtual machine, SQL database, or storage account) is represented as an Azure Resource. Therefore, to suppress alerts for that storage account, you must target the Azure Resource entity type.
The unique identifier used to target an exact Azure resource in suppression conditions is its Resource Id, which follows the format:
/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/{resourceProvider}/{resourceName}
By specifying Entity type = Azure Resource and Field = Resource Id, the suppression rule ensures that only alerts generated from that specific storage account are hidden.
Other entity types such as IP address, Host, or User account do not apply to Azure Storage alerts. Likewise, fields like Address, Command line, or Name are not used for resource-based suppression.
# Final Answer:
Entity type: Azure Resource
Field: Resource Id
You have a Microsoft 365 subscription that uses Microsoft 365 Defender and contains a user named User1.
You are notified that the account of User1 is compromised.
You need to review the alerts triggered on the devices to which User1 signed in.
How should you complete the query? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
You are notified that the account of User1 is compromised.
You need to review the alerts triggered on the devices to which User1 signed in.
How should you complete the query? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Correct Answer:
Explanation:
Box 1: join
An inner join.
This query uses kind=inner to specify an inner-join, which prevents deduplication of left side values for DeviceId.
This query uses the DeviceInfo table to check if a potentially compromised user ( < account-name > ) has logged on to any devices and then lists the alerts that have been triggered on those devices.
DeviceInfo
//Query for devices that the potentially compromised account has logged onto
| where LoggedOnUsers contains ' < account-name > '
| distinct DeviceId
//Crosscheck devices against alert records in AlertEvidence and AlertInfo tables
| join kind=inner AlertEvidence on DeviceId
| project AlertId
//List all alerts on devices that user has logged on to
| join AlertInfo on AlertId
| project AlertId, Timestamp, Title, Severity, Category
DeviceInfo LoggedOnUsers AlertEvidence " project AlertID "
Box 2: project
Reference: https://docs.microsoft.com/en-us/microsoft-365/security/defender/advanced-hunting-query-emails- devices?view=o365-worldwide
You have a Microsoft 365 E5 subscription that contains the hosts shown in the following table.
You have indicators in Microsoft Defender for Endpoint as shown in the following table.
D1 and ID2 reference the same tile as ID3
For each of the following statements, select Yes if the statement is true Otherwise, select No.
NOTE: Each correction selection is worth one point.
You have indicators in Microsoft Defender for Endpoint as shown in the following table.
D1 and ID2 reference the same tile as ID3
For each of the following statements, select Yes if the statement is true Otherwise, select No.
NOTE: Each correction selection is worth one point.
Correct Answer:
You have an Azure subscription that contains a Microsoft Sentinel workspace named WS1.
You need to ensure that the incidents in WS1 include a list of actions that must be performed. The solution must meet the following requirements:
* Ensure that you can build a tailored list of actions for each type of incident.
* Minimize administrative effort.
What should you do? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
You need to ensure that the incidents in WS1 include a list of actions that must be performed. The solution must meet the following requirements:
* Ensure that you can build a tailored list of actions for each type of incident.
* Minimize administrative effort.
What should you do? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Correct Answer:
Your on-premises network contains a Hyper-V cluster. The cluster contains the virtual machines shown in the following table.
You have a Microsoft Sentinel workspace named SW1.
You have a data collection rule (OCR) that has the following configurations:
* Name: DCR1
* Destination: SW1
* Platform type: All
* Data collection endpoint: None
* Data source: Windows event logs, Linux syslog
For each of the following statements, select Yes if the statement is true. Otherwise, select No.
NOTE: Each correct selection is worth one point.
You have a Microsoft Sentinel workspace named SW1.
You have a data collection rule (OCR) that has the following configurations:
* Name: DCR1
* Destination: SW1
* Platform type: All
* Data collection endpoint: None
* Data source: Windows event logs, Linux syslog
For each of the following statements, select Yes if the statement is true. Otherwise, select No.
NOTE: Each correct selection is worth one point.
Correct Answer:
Explanation:
No
Yes
No
You have an Azure subscription that contains the users shown in the following table.
You need to delegate the following tasks:
* Enable Microsoft Defender for Servers on virtual machines.
* Review security recommendations and enable server vulnerability scans.
The solution must use the principle of least privilege.
Which user should perform each task? To answer, drag the appropriate users to the correct tasks. Each user may be used once, more than once, or not at all. You may need to drag the split bar between panes or scroll to view content.
NOTE: Each correct selection is worth one point.
You need to delegate the following tasks:
* Enable Microsoft Defender for Servers on virtual machines.
* Review security recommendations and enable server vulnerability scans.
The solution must use the principle of least privilege.
Which user should perform each task? To answer, drag the appropriate users to the correct tasks. Each user may be used once, more than once, or not at all. You may need to drag the split bar between panes or scroll to view content.
NOTE: Each correct selection is worth one point.
Correct Answer:
Explanation:
Task
User
Enable Microsoft Defender for Servers on virtual machines:
User1
Review security recommendations and enable server vulnerability scans:
User1
Query successful
This is a role-based access control (RBAC) question using the principle of least privilege.
The table of users and roles is:
Name
Role
User1
Security administrator
User2
Security reader
User3
Contributor
Export to Sheets
Action: This is a management/configuration task at the subscription level, often related to enabling Defender plans and installing extensions on VMs.
Required Permissions: The ability to modify security policies and settings in Microsoft Defender for Cloud and the permission to install extensions on VMs.
The Security Administrator role is explicitly designed for this, granting permissions to manage the security features, policies, and program enrollment (like enabling Defender plans).
The Contributor role can also perform this by installing the necessary agents and extensions, but it grants broad access to manage all resources, violating the principle of least privilege for a purely security-focused task.
Least Privilege User: User1 (Security administrator)
Action: This task has two parts:
Review security recommendations: This is a read-only action. The Security Reader role is sufficient.
Enable server vulnerability scans: This means configuring a security feature (Vulnerability Assessment), which requires write access to the security configuration or the resource itself.
The Security Reader role cannot perform the " enable " action.
The Security Administrator role has the permissions required to modify security policy and configuration to enable scanning features.
The Contributor role can also do this, but again, the Security Administrator role is the least privileged for a security-specific configuration change.
Least Privilege User: Since the entire task includes an " enable " (write) action, we must use the role that can perform both read and write security actions. User1 (Security administrator) is the appropriate choice.
Task
User
Enable Microsoft Defender for Servers on virtual machines:
User1
Review security recommendations and enable server vulnerability scans:
User1
You provision a Linux virtual machine in a new Azure subscription.
You enable Azure Defender and onboard the virtual machine to Azure Defender.
You need to verify that an attack on the virtual machine triggers an alert in Azure Defender.
Which two Bash commands should you run on the virtual machine? Each correct answer presents part of the solution.
NOTE: Each correct selection is worth one point.
You enable Azure Defender and onboard the virtual machine to Azure Defender.
You need to verify that an attack on the virtual machine triggers an alert in Azure Defender.
Which two Bash commands should you run on the virtual machine? Each correct answer presents part of the solution.
NOTE: Each correct selection is worth one point.
Correct Answer: C,D
Vote an answer
Explanation: Only visible for FreeCram members. You can sign-up / login (it's free).