SC-200 Exam Question 111
You have a Microsoft 365 subscription that uses Microsoft Defender XDR.
You need to implement deception rules.
The solution must ensure that you can limit the scope of the rules.
What should you create first?
You need to implement deception rules.
The solution must ensure that you can limit the scope of the rules.
What should you create first?
SC-200 Exam Question 112
You have a Microsoft 365 E5 subscription that contains 100 Linux devices. The devices are onboarded to Microsoft Defender 365. You need to initiate the collection of investigation packages from the devices by using the Microsoft 365 Defender portal. Which response action should you use?
SC-200 Exam Question 113
You have a Microsoft 365 subscription that uses Microsoft Defender XDR. Microsoft Purview, and Exchange Online.
You have a partner company named Contoso, Ltd.
You need to review all the emails that contain PDF attachments and were received from Contoso during the past month. The solution must minimize administrative effort.
What should you use?
You have a partner company named Contoso, Ltd.
You need to review all the emails that contain PDF attachments and were received from Contoso during the past month. The solution must minimize administrative effort.
What should you use?
SC-200 Exam Question 114
You plan to review Microsoft Defender for Cloud alerts by using a third-party security information and event management (SIEM) solution.
You need to locate alerts that indicate the use of the Privilege Escalation MITRE ATT&CK tactic.
Which JSON key should you search?
You need to locate alerts that indicate the use of the Privilege Escalation MITRE ATT&CK tactic.
Which JSON key should you search?
SC-200 Exam Question 115
You have a Microsoft Sentinel workspace named Workspaces
You need to exclude a built-in. source-specific Advanced Security Information Model (ASIM) parser from a built-in unified ASIM parser.
What should you create in Workspace1?
You need to exclude a built-in. source-specific Advanced Security Information Model (ASIM) parser from a built-in unified ASIM parser.
What should you create in Workspace1?