SC-200 Exam Question 86
Hotspot Question
You have a Microsoft Sentinel workspace named sws1.
You need to create a hunting query to identify users that list storage keys of multiple Azure Storage accounts. The solution must exclude users that list storage keys for a single storage account.
How should you complete the query? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.
You have a Microsoft Sentinel workspace named sws1.
You need to create a hunting query to identify users that list storage keys of multiple Azure Storage accounts. The solution must exclude users that list storage keys for a single storage account.
How should you complete the query? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.
SC-200 Exam Question 87
You have a Microsoft 365 subscription that has Microsoft 365 Defender enabled.
You need to identify all the changes made to sensitivity labels during the past seven days.
What should you use?
You need to identify all the changes made to sensitivity labels during the past seven days.
What should you use?
SC-200 Exam Question 88
You have a Microsoft 365 subscription that uses Microsoft Security Copilot.
You plan to configure a custom GPT plugin for Copilot.
Which GPT model should you use?
You plan to configure a custom GPT plugin for Copilot.
Which GPT model should you use?
SC-200 Exam Question 89
Hotspot Question
You have a Microsoft 365 E5 subscription that uses Microsoft Defender XDR.
You need to create a hunting query in KQL that meets the following requirements:
- Identifies any devices that received an email containing an
attachment named File1.pdf during the last 12 hours and opened the
attachment.
- Minimizes the resources required to run the query
How should you complete the query? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
You have a Microsoft 365 E5 subscription that uses Microsoft Defender XDR.
You need to create a hunting query in KQL that meets the following requirements:
- Identifies any devices that received an email containing an
attachment named File1.pdf during the last 12 hours and opened the
attachment.
- Minimizes the resources required to run the query
How should you complete the query? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
SC-200 Exam Question 90
Hotspot Question
You use Azure Sentinel to monitor irregular Azure activity.
You create custom analytics rules to detect threats as shown in the following exhibit.
You do NOT define any incident settings as part of the rule definition.
Use the drop-down menus to select the answer choice that completes each statement based on the information presented in the graphic.
NOTE: Each correct selection is worth one point.
You use Azure Sentinel to monitor irregular Azure activity.
You create custom analytics rules to detect threats as shown in the following exhibit.
You do NOT define any incident settings as part of the rule definition.
Use the drop-down menus to select the answer choice that completes each statement based on the information presented in the graphic.
NOTE: Each correct selection is worth one point.
