Microsoft SC-200 Exam - Topic 7 Question 42 Discussion

Actual exam question for Microsoft's SC-200 exam

Question #: 42
Topic #: 7

[All SC-200 Questions]

You have an Azure subscription that has Microsoft Defender for Cloud enabled.

You have a virtual machine that runs Windows 10 and has the Log Analytics agent installed.

You need to simulate an attack on the virtual machine that will generate an alert.

What should you do first?

ARun the Log Analytics Troubleshooting Tool.

BCopy a executable and rename the file as ASC_AlerTest_662jf10N,exe

CModify the settings of the Microsoft Monitoring Agent.

DRun the MMASetup executable and specify the -foo argument

Show Suggested Answer

Suggested Answer: A

by Amber at Sep 19, 2022, 01:24 PM

Limited Time Offer

25%

Off

Get Premium SC-200 Questions as Interactive Web-Based Practice Test or PDF

Contribute your Thoughts:

Submit Cancel

Glory

4 months ago

I heard modifying settings can trigger alerts too!

upvoted 0 times

...

Carlee

4 months ago

Wait, can you really simulate an attack like that?

upvoted 0 times

...

Tyisha

5 months ago

Not sure about that, seems risky.

upvoted 0 times

...

Devorah

5 months ago

Yeah, that makes sense!

upvoted 0 times

...

Skye

5 months ago

I think option B is the way to go.

upvoted 0 times

...

Galen

5 months ago

Running the Log Analytics Troubleshooting Tool seems like a good first step, but I’m not confident it would simulate an attack effectively.

upvoted 0 times

...

Ashanti

5 months ago

I feel like modifying the settings of the Microsoft Monitoring Agent could be a step, but I can't recall if it directly leads to generating an alert.

upvoted 0 times

...

Estrella

5 months ago

I think copying an executable and renaming it sounds familiar. Didn’t we practice something like that in a lab session?

upvoted 0 times

...

Annamae

5 months ago

I remember we talked about simulating attacks in our last study group, but I’m not sure which option would actually trigger an alert.

upvoted 0 times

...

Kristofer

5 months ago

This looks like a tricky question. I'll need to carefully review the options to determine the best approach.

upvoted 0 times

...

Lashunda

5 months ago

Hmm, I'm a bit unsure about this one. The question is asking about a denormalized object, so I'll need to think carefully about which of these options fits that description.

upvoted 0 times

...

Marci

5 months ago

IP address and TCP port seems like the most straightforward approach to me. That should give a clear way to identify the video streaming traffic.

upvoted 0 times

...