Free Preparation Discussions
MENU
Microsoft SC-200 Exam Questions
- Topic 1: Manage a security operations environment: This topic of the exam covers how to configure settings in Microsoft Defender XDR, Manage assets and environments, Design and configure a Microsoft Sentinel workspace, and Ingest data sources in Microsoft Sentinel.
- Topic 2: Configure protections and detections: This section deals with configuring protections in Microsoft Defender security technologies, configuring detection in Microsoft Defender XDR, and configuring detections in Microsoft Sentinel.
- Topic 3: Manage incident response: This section is about responding to alerts and incidents in Microsoft Defender XDR, it also covers responding to alerts and incidents identified by Microsoft Defender for Endpoint as well as configuring security orchestration, automation, and response (SOAR) in Microsoft Sentinel.
- Topic 4: Manage security threats: In this topic, students learn about hunting threats by using Microsoft Defender XDR and Microsoft Sentinel. Moreover, the topic focuses on creating and configuring Microsoft Sentinel workbooks.
Free Microsoft SC-200 Exam Actual Questions
Note: Premium Questions for SC-200 were last updated On Feb. 17, 2025 (see below)
You have 500 on-premises devices.
You have a Microsoft 365 E5 subscription that uses Microsoft Defender XDR.
You onboard 100 devices to Microsoft Defender XDR.
You need to identify any unmanaged on-premises devices. The solution must ensure that only specific onboarded devices perform the discovery.
What should you do first?
You have a Microsoft 365 subscription that uses Microsoft Defender for Endpoint and contains the devices shown in the following table.
You initiate a live response session on each device.
You need to collect a Defender for Endpoint investigation package from each device.
On which devices can you collect the package by running advanced live response commands from the command-line interface (CLI)?
You have a Microsoft 365 subscription that uses Microsoft Defender XDR.
You discover that when Microsoft Defender for Endpoint generates alerts for a commonly used executable file, it causes alert fatigue. You need to tune the alerts.
Which two actions can an alert tuning rule perform for the alerts?
Each correct answer presents a complete solution.
NOTE: Each correct selection is worth one point.
You have a Microsoft 365 subscription that uses Microsoft Defender XDR.
You are investigating an attacker that is known to use the Microsoft Graph API as an attack vector. The attacker performs the tactics shown the following table.
You need to search for malicious activities in your organization.
Which tactics can you analyze by using the MicrosoftGraphActivityLogs table?
You have a Microsoft 365 subscription that contains the following resources:
* 100 users that are assigned a Microsoft 365 E5 license
* 100 Windows 11 devices that are joined to the Microsoft Entra tenant
The users access their Microsoft Exchange Online mailbox by using Outlook on the web.
You need to ensure that if a user account is compromised, the Outlook on the web session token can be revoked.
What should you configure?
- Select Question Types you want
- Set your Desired Pass Percentage
- Allocate Time (Hours : Minutes)
- Create Multiple Practice tests with Limited Questions
- Customer Support
Patrick
13 days agoLettie
24 days agoHorace
1 months agoMacy
2 months agoAlishia
2 months agoAdell
3 months agoJennifer
3 months agoLucina
3 months agoAsha
4 months agoRyan
4 months agoMichal
4 months agoLeigha
5 months agoLinsey
5 months agoDell
5 months agoSantos
5 months agoSabra
5 months agoClaudio
6 months agoMila
6 months agoJoni
7 months agoDella
8 months agoMaryann
8 months agoGerald
8 months agoTenesha
8 months agodarrena
8 months agokalasan
8 months ago