SC-200 Exam Question 86

You have a Microsoft Sentinel workspace.
You need to create a KQL query that will identify successful sign-ins from multiple countries during the last three hours.
How should you complete the query? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point

SC-200 Exam Question 87

You have 50 Microsoft Sentinel workspaces.
You need to view all the incidents from all the workspaces on a single page in the Azure portal. The solution must minimize administrative effort.
Which page should you use in the Azure portal?
  • SC-200 Exam Question 88

    You have a Microsoft 365 E5 subscription that uses Microsoft 365 Defender for Endpoint.
    You need to ensure that you can initiate remote shell connections to Windows servers by using the Microsoft 365 Defender portal.
    What should you configure? To answer, select the appropriate options in the answer area.
    NOTE: Each correct selection is worth one point.

    SC-200 Exam Question 89

    Your on-premises network contains 100 servers that run Windows Server.
    You have an Azure subscription that uses Microsoft Sentinel.
    You need to upload custom logs from the on-premises servers to Microsoft Sentinel.
    What should you do? To answer, select the appropriate options m the answer area.

    SC-200 Exam Question 90

    You have a Microsoft 365 subscription that uses Microsoft Purview.
    Your company has a project named Project1.
    You need to identify all the email messages that have the word Project1 in the subject line. The solution must search only the mailboxes of users that worked on Project1.
    What should you do?