Online Access Free SC-200 Exam Questions

You have a Microsoft 365 tenant that uses Microsoft Exchange Online and Microsoft Defender for Office 365.
What should you use to identify whether zero-hour auto purge (ZAP) moved an email message from the mailbox of a user?

• A.the mail flow report in Exchange
• B.the Threat Protection Status report in Microsoft Defender for Office 365
• C.the mailbox audit log in Exchange
• D.the Safe Attachments file types report in Microsoft Defender for Office 365

You need to configure event monitoring for Server1. The solution must meet the Microsoft Sentinel requirements.
What should you create first?

• A.a Microsoft Sentinel automation rule
• B.a Microsoft Sentinel scheduled query rule
• C.an Azure Event Grid topic
• D.a Data Collection Rule (DCR)

You plan to review Microsoft Defender for Cloud alerts by using a third-party security information and event management (SIEM) solution.
You need to locate alerts that indicate the use of the Privilege Escalation MITRE ATT&CK tactic.
Which JSON key should you search?

• A.Entities
• B.Description
• C.Intent
• D.ExtendedProperies

You need to restrict cloud apps running on CUENT1 to meet the Microsoft Defender for Endpoint requirements. Which two configurations should you modify? Each correct answer presents part of the solution. NOTE: Each correct selection is worth one point.

• A.the Cloud Discovery settings in Microsoft Defender for Cloud Apps
• B.the Onboarding settings from Device management in Settings in Microsoft 365 Defender portal
• C.Advanced features from the Endpoints Settings in the Microsoft 365 Defender portal
• D.Microsoft Defender for Cloud Apps anomaly detection policies

You have a Microsoft 365 subscription that uses Microsoft Defender for Endpoint Plan 2 and contains 500 Windows devices. As part of an incident investigation, you identify the following suspected malware files:
* sys
* pdf
* docx
* xlsx
You need to create indicator hashes to block users from downloading the files to the devices. Which files can you block by using the indicator hashes?

• A.File1.sysonly
• B.File2.pdf. File3.docxr and File4.xlsx only
• C.File1.sys, File2.pdf, File3.dooc, and File4.xlsx
• D.File1.sys. File3.docx, and File4jclsx only
• E.File1.sysand File3.docxonly