Question 1

You have a Microsoft Sentinel workspace.

You receive multiple alerts for failed sign in attempts to an account.

You identify that the alerts are false positives.

You need to prevent additional failed sign-in alerts from being generated for the account. The solution must meet the following requirements.

* Ensure that failed sign-in alerts are generated for other accounts.

* Minimize administrative effort

What should do?

Options :

A : Create an automation rule.

B : Create a watchlist.

C : Modify the analytics rule.

D : Add an activity template to the entity behavior.

Answer: A

Question 2

You create an Azure subscription.

You enable Microsoft Defender for Cloud for the subscription.

You need to use Defender for Cloud to protect on-premises computers.

What should you do on the on-premises computers?

Options :

A : Configure the Hybrid Runbook Worker role.

B : Install the Connected Machine agent.

C : Install the Log Analytics agent

D : Install the Dependency agent.

Answer: C

Question 3

You need to deploy the native cloud connector to Account! to meet the Microsoft Defender for Cloud requirements. What should you do in Account! first?

Options :

A : Create an AWS user for Defender for Cloud.

B : Create an Access control (1AM) role for Defender for Cloud.

C : Configure AWS Security Hub.

D : Deploy the AWS Systems Manager (SSM) agent

Answer: D

Question 4

You have an Azure subscription that uses Microsoft Defender for Cloud and contains a resource group named RG1. RG1 contains 20 virtual machines that run Windows Server 2019.

You need to configure just-in-time (JIT) access for the virtual machines in RG1. The solution must meet the following requirements:

• Limit the maximum request time to two hours.

• Limit protocols access to Remote Desktop Protocol (RDP) only.

• Minimize administrative effort.

What should you use?

Options :

A : Azure AD Privileged Identity Management (PIM)

B : Azure Policy

C : Azure Bastion

D : Azure Front Door

Answer: B

Question 5

You have a Microsoft 365 E5 subscription that uses Microsoft Defender for Endpoint.

You need to create a query that will link the AlertInfo, AlertEvidence, and DeviceLogonEvents tables. The solution must return all the rows in the tables.

Which operator should you use?

Options :

A : search *

B : union kind = inner

C : join kind = inner

D : evaluate hint.remote =

Answer: C

Higher Test Marks with Free Online SC-200 Exam Practice

Buying Options: