SC-200 英文 Microsoft Security Operations Analyst（微软安全运营分析师）_在线真题试卷与模拟练习_SC-200 英文 Microsoft Security Operations Analyst（微软安全运营分析师）_考试宝

更新时间：试题数量：购买人数：提供作者：

有效期：个月

章节介绍：共有个章节

收藏

我的练习

我的错题
(0道)

我的收藏
(0道)

我的斩题
(0道)

我的笔记
(0道)

专项练习

顺序练习 0 / 0

随机练习 自定义设置练习量

题型乱序 按导入顺序练习

模拟考试 仿真模拟

题型练习 按题型分类练习

易错题 精选高频易错题

学习资料 考试学习相关信息

搜索

题库预览

You have a Microsoft Sentinel playbook that is triggered by using the Azure Activity connector. You need to create a new near-real-time (NRT) analytics rule that will use the playbook. What should you configure for the rule?

You plan to create a custom Azure Sentinel query that will provide a visual Representation of the security alerts generated by Azure Security Center. You need to create a query that will be used to display a bar graph. What should you include in the query?

You have a Microsoft Sentinel workspace that has User and Entity Behavior Analytics (UEBA) enabled for Signin Logs. You need to ensure that failed interactive sign-ins are detected. The solution must minimize administrative effort. What should you use?

You have an Azure subscription that has the enhanced security features in Microsoft Defender for Cloud enabled and contains a user named

User1.

You need to ensure that User1 can export alert data from Defender for Cloud. The solution must use the principle of least privilege.

Which role should you assign to User1?

You have an Azure subscription that has Microsoft Defender for Cloud enabled. You have a virtual machine named Server1 that runs Windows Server 2022 and is hosted in Amazon Web Services (AWS). You need to collect logs and resolve vulnerabilities for Server1 by using Defender for Cloud. What should you install first on Server1?

You are investigating an incident in Azure Sentinel that contains more than 127 alerts. You discover eight alerts in the incident that require further investigation. You need to escalate the alerts to another Azure Sentinel administrator. What should you do to provide the alerts to the administrator?

Fabrikam identifies the following Microsoft Sentinel requirements: • Query for NXDOMAIN DNS requests from the last seven days by using built-in Advanced Security Information Model (ASIM) unifying parsers. • From AWS EC2 instances, collect Windows Security event log entries that include local group membership changes. • Identify anomalous activities of Azure AD users by using User and Entity Behavior Analytics (UEBA). • Evaluate the potential impact of compromised Azure AD user credentials by using UEBA. • Ensure that App1 is available for use in Microsoft Sentinel automation rules. • Identify the mean time to triage for incidents generated during the last 30 days. • Identify the mean time to close incidents generated during the last 30 days. • Ensure that the members of Group1 can create and run playbooks. • Ensure that the members of Group1 can manage analytics rules. • Run hunting queries on Pool1 by using Jupyter notebooks. • Ensure that the members of Group2 can manage incidents. • Maximize the performance of data queries. • Minimize the amount of collected data. You need to deploy the native cloud connector to Account 1 to meet the Microsoft Defender for Cloud requirements. What should you do in Account1 first?

You create an Azure subscription named sub1. In sub1, you create a Log Analytics workspace named workspace1. You enable Microsoft Defender for Cloud and configure Defender for Cloud to use workspace1. You need to collect security event logs from the Azure virtual machines that report to workspace1. What should you do?

You have a Microsoft 365 subscription that uses Microsoft Defender for O ce 365. You have Microsoft SharePoint Online sites that contain sensitive documents. The documents contain customer account numbers that each consists of 32 alphanumeric characters. You need to create a data loss prevention (DLP) policy to protect the sensitive documents. What should you use to detect which documents are sensitive?

You have an Azure subscription that uses Microsoft Defender for Cloud and contains a storage account named storage1. You receive an alert that there was an unusually high volume of delete operations on the blobs in storage1. You need to identify which blobs were deleted. What should you review?

You have an Azure subscription that uses Microsoft Sentinel and contains 100 Linux virtual machines. You need to monitor the virtual machines by using Microsoft Sentinel. The solution must meet the following requirements: ✑ Minimize administrative effort. ✑ Minimize the parsing required to read fog data. What should you configure?

A company uses Azure Sentinel. You need to create an automated threat response. What should you use?

Overview - Litware Inc. is a renewable energy company. Litware has offices in Boston and Seattle. Litware also has remote users located across the United States. To access Litware resources, including cloud resources, the remote users establish a VPN Connection to either office. Existing Environment - Identity Environment - The network contains an Active Directory forest named litware.com that syncs to an Azure Active Directory (Azure AD) tenant named litware.com. Microsoft 365 Environment - Litware has a Microsoft 365 E5 subscription linked to the litware.com Azure AD tenant. Microsoft Defender for Endpoint is deployed to all computers that run Windows 10. All Microsoft Cloud App Security built-in anomaly detection policies are enabled. Azure Environment - Litware has an Azure subscription linked to the litware.com Azure AD tenant. The subscription contains resources in the East US Azure region as shown in the following table. Network Environment - Each Litware office connects directly to the internet and has a site-to-site VPN connection to the virtual networks in the Azure subscription. On-premises Environment - The on-premises network contains the computers shown in the following table. Current problems - Cloud App Security frequently generates false positive alerts when users connect to both offices simultaneously. Planned Changes and Requirements Planned Changes - Litware plans to implement the following changes: Create and configure Azure Sentinel in the Azure subscription. Validate Azure Sentinel functionality by using Azure AD test user accounts. Business Requirements - Litware identifies the following business requirements: The principle of least privilege must be used whenever possible. Costs must be minimized, as long as all other requirements are met. Logs collected by Log Analytics must provide a full audit trail of user activities. All domain controllers must be protected by using Microsoft Defender for Identity. Azure Information Protection Requirements All files that have security labels and are stored on the Windows 10 computers must be available from the Azure Information Protection ג€" Data Discovery dashboard. Microsoft Defender for Endpoint requirements All Cloud App Security unsanctioned apps must be blocked on the Windows 10 computers by using Microsoft Defender for Endpoint. Microsoft Cloud App Security requirements Cloud App Security must identify whether a user connection is anomalous based on tenant-level data. Azure Defender Requirements - All servers must send logs to the same Log Analytics workspace. Azure Sentinel Requirements - Litware must meet the following Azure Sentinel requirements: Integrate Azure Sentinel and Cloud App Security. Ensure that a user named admin1 can configure Azure Sentinel playbooks. Create an Azure Sentinel analytics rule based on a custom query. The rule must automatically initiate the execution of a playbook. Add notes to events that represent data access from a specific IP address to provide the ability to reference the IP address when navigating Through an investigation graph while hunting. Create a test rule that generates alerts when inbound access to Microsoft Office 365 by the Azure AD test user accounts is detected. Alerts Generated by the rule must be grouped into individual incidents, with one incident per test user account. You need to implement the Azure Information Protection requirements. What should you configure first?

A security administrator receives email alerts from Azure Defender for activities such as potential malware uploaded to a storage account and Potential successful brute force attacks. The security administrator does NOT receive email alerts for activities such as antimalware action failed and suspicious network activity. The Alerts appear in Azure Security Center. You need to ensure that the security administrator receives email alerts for all the activities. What should you configure in the Security Center settings?

You have a playbook in Azure Sentinel. When you trigger the playbook, it sends an email to a distribution group. You need to modify the playbook to send the email to the owner of the resource instead Of the distribution group. What should you do?

You have an Azure subscription that contains a user named User1. User1 is assigned an Azure Active Directory Premium Plan 2 license. You need to identify whether the identity of User1 was compromised during the last 90 days. What should you use?

Case study - This is a case study. Case studies are not timed separately. You can use as much exam time as you would like to complete each case. However, there may be additional case studies and sections on This exam. You must manage your time to ensure that you are able to complete all questions included on this exam in the time provided. To answer the questions included in a case study, you will need to reference information that is provided in the case study. Case studies might contain exhibits and other resources that provide more Information about the scenario that is described in the case study. Each question is independent of the other questions in this case study. At the end of this case study, a review screen will appear. This screen allows you to review your answers and to make changes before you move to the next section of the exam. After you begin a new Section, you cannot return to this section. To start the case study - To display the first question in this case study, click the Next button. Use the buttons in the left pane to explore the content of the case study before you answer the questions. Clicking these buttons Displays information such as business requirements, existing environment, and problem statements. If the case study has an All Information tab, note that the information displayed is identical to The information displayed on the subsequent tabs. When you are ready to answer a question, click the Question button to return to the question. Overview - ∗A company named Contoso Ltd. has a main office and five branch offices located throughout North America. The main office is in Seattle. The branch offices are in Toronto, Miami, Houston, Los Angeles, and Vancouver. Contoso has a subsidiary named Fabrikam, Ltd. that has offices in New York and San Francisco. Existing Environment - End-User Environment - All users at Contoso use Windows 10 devices. Each user is licensed for Microsoft 365. In addition, iOS devices are distributed to the members of the sales team at Contoso. Cloud and Hybrid Infrastructure - All Contoso applications are deployed to Azure. You enable Microsoft Cloud App Security. Contoso and Fabrikam have different Azure Active Directory (Azure AD) tenants. Fabrikam recently purchased an Azure subscription and enabled Azure Defender for all supported resource types. Current Problems - The security team at Contoso receives a large number of cybersecurity alerts. The security team spends too much time identifying which cybersecurity alerts are legitimate threats, and which are not. The Contoso sales team uses only iOS devices. The sales team members exchange files with customers by using a variety of third-party tools. In the past, the sales team experienced phishing attacks On their devices. The marketing team at Contoso has several Microsoft SharePoint Online sites for collaborating with external vendors. The marketing team has had several incidents in which vendors uploaded files That contain malware. The executive team at Contoso suspects a security breach. The executive team requests that you identify which files had more than five activities during the past 48 hours, including data access, download, or deletion for Microsoft Cloud App Security-protected applications. Requirements - Planned Changes - Contoso plans to integrate the security operations of both companies and manage all security operations centrally. Technical Requirements - Contoso identifies the following technical requirements: Receive alerts if an Azure virtual machine is under brute force attack. Use Azure Sentinel to reduce organizational risk by rapidly remediating active attacks on the environment. Implement Azure Sentinel queries that correlate data across the Azure AD tenants of Contoso and Fabrikam. Develop a procedure to remediate Azure Defender for Key Vault alerts for Contoso in case of external and internal threats. The solution must minimize the impact on legitimate attempts to access the Key vault content. Identify all cases of users who failed to sign in to an Azure resource for the first time from a given country. A junior security administrator provides you with the following incomplete query. BehaviorAnalytics - | where ActivityType == "FailedLogOn" | where ________ == True You need to recommend a solution to meet the technical requirements for the Azure virtual machines. What should you include in the recommendation? 概览 -家名为Contos0有限公司的公司在北美有一个总办事处和五个分办事处。主要办公室在西雅图。分公司位于多伦多、迈阿密、休斯顿、洛杉矶和温哥华。 Contoso在纽约和旧金山设有办事处的子公司Fabrikam,Ltd。现有环境晏终用户环境一 Contoso的所有用户都使用Windows10设备。每个用户都有微软365的授权。此外，i0s的设备被分配给康多索的销售团队的成员。云和混合基础设施-所有Contoso应用程序都部署到Azure。您启用微软云应用程序安全性。 Contoso和Fabrikam拥有不同的AzureActive Directory,(AzeAD)租户。Fabrikam最近购买了Azure订T阅，并为所有受支持的资源类型启用了Azure Defender. 目前存在的问题一Contoso的安全团队收到大量网络安全警报。安全团队花费了太多的时间来确定哪些网络安全警报是合法的威胁，哪些不是。康多索的销售团队只使用i0S的设备。销售团队成员通过使用各种第三方工具与客户交换文件。在过去，销售团队经历过网络钓鱼攻击在他们的设备上。 Contoso的营销团队有几个微软SharePoint Online网站，用于与外部供应商合作。营销团队曾发生过几次供应商上传文件含有恶意软件。Contoso的管理团队怀疑有安全漏洞。执行团队要求您确定哪些文件在过去48小时内有超过5个活动，包括Microsoft cloudApp安全保护应用程序的数据访问、下载或刑除所需资源计划中的变化-- Contoso计划整合两家公司的安全运营，并集中管理所有的安全运营。技术要求一- Contoso确定了以下技术要求: 如果Azure虚拟机受到暴力攻击，则接收警报。使用Azure Sentinel快速修复对环境的主动攻击，从而降低组织风险。实现Azure Sentinel查询，将Contoso和Fabrikam的Azure AD租户之间的数据关联起来。针对Contoso的KeyVault警报制定补救Azure Defender的程序，以防出现外部和内部威胁。解决方案必须最大限度地减少对合法尝试访问密钥库内容。识别从给定国家/地区首次登录Azure资源失败的用户的所有情况。初级安全管理员为您提供了以下不完整的查询。行为分析-其中ActivityType--"失败的登录" 其中 -=为真您需要推荐一个解决方案以满足Azure虚拟机的技术要求。推荐信中应该包括哪些内容?

Your company uses Azure Sentinel to manage alerts from more than 10,000 IoT Devices. ∗A security manager at the company reports that tracking security threats is increasingly Difficult due to the large number of incidents. You need to recommend a solution to provide a custom visualization to simplify the Investigation of threats and to infer threats by using machine learning. What should you include in the recommendation?

Case study - This is a case study. Case studies are not timed separately. You can use as much exam time as you would like to complete each case. However, there may be additional case studies and sections on This exam. You must manage your time to ensure that you are able to complete all questions included on this exam in the time provided. To answer the questions included in a case study, you will need to reference information that is provided in the case study. Case studies might contain exhibits and other resources that provide more Information about the scenario that is described in the case study. Each question is independent of the other questions in this case study. At the end of this case study, a review screen will appear. This screen allows you to review your answers and to make changes before you move to the next section of the exam. After you begin a new Section, you cannot return to this section. To start the case study - To display the first question in this case study, click the Next button. Use the buttons in the left pane to explore the content of the case study before you answer the questions. Clicking these buttons Displays information such as business requirements, existing environment, and problem statements. If the case study has an All Information tab, note that the information displayed is identical to The information displayed on the subsequent tabs. When you are ready to answer a question, click the Question button to return to the question. Overview - Litware Inc. is a renewable energy company. Litware has offices in Boston and Seattle. Litware also has remote users located across the United States. To access Litware resources, including cloud resources, the remote users establish a VPN Connection to either office. Existing Environment - Identity Environment - The network contains an Active Directory forest named litware.com that syncs to an Azure Active Directory (Azure AD) tenant named litware.com. Microsoft 365 Environment - Litware has a Microsoft 365 E5 subscription linked to the litware.com Azure AD tenant. Microsoft Defender for Endpoint is deployed to all computers that run Windows 10. All Microsoft Cloud App Security built-in anomaly detection policies are enabled. Azure Environment - Litware has an Azure subscription linked to the litware.com Azure AD tenant. The subscription contains resources in the East US Azure region as shown in the following table. Network Environment - Each Litware office connects directly to the internet and has a site-to-site VPN connection to the virtual networks in the Azure subscription. On-premises Environment - The on-premises network contains the computers shown in the following table. Current problems - Cloud App Security frequently generates false positive alerts when users connect to both offices simultaneously. Planned Changes and Requirements Planned Changes - Litware plans to implement the following changes: Create and configure Azure Sentinel in the Azure subscription. Validate Azure Sentinel functionality by using Azure AD test user accounts. Business Requirements - Litware identifies the following business requirements: The principle of least privilege must be used whenever possible. Costs must be minimized, as long as all other requirements are met. Logs collected by Log Analytics must provide a full audit trail of user activities. All domain controllers must be protected by using Microsoft Defender for Identity. Azure Information Protection Requirements All files that have security labels and are stored on the Windows 10 computers must be available from the Azure Information Protection ג€" Data Discovery dashboard. Microsoft Defender for Endpoint requirements All Cloud App Security unsanctioned apps must be blocked on the Windows 10 computers by using Microsoft Defender for Endpoint. Microsoft Cloud App Security requirements Cloud App Security must identify whether a user connection is anomalous based on tenant-level data. Azure Defender Requirements - All servers must send logs to the same Log Analytics workspace. Azure Sentinel Requirements - Litware must meet the following Azure Sentinel requirements: Integrate Azure Sentinel and Cloud App Security. Ensure that a user named admin1 can configure Azure Sentinel playbooks. Create an Azure Sentinel analytics rule based on a custom query. The rule must automatically initiate the execution of a playbook. Add notes to events that represent data access from a specific IP address to provide the ability to reference the IP address when navigating Through an investigation graph while hunting. Create a test rule that generates alerts when inbound access to Microsoft Office 365 by the Azure AD test user accounts is detected. Alerts Generated by the rule must be grouped into individual incidents, with one incident per test user account. You need to assign a role-based access control (RBAC) role to admin1 to meet the Azure Sentinel requirements and the business requirements. Which role should you assign? 您需要为admin分配一个基于角色的访问控制(RBAC)角色，以满足Azure Sentinel需求和业务需求。你应该分配哪个角色?

You have an Azure subscription that uses Microsoft Defender for Cloud and contains a resource group named RG1. RG1 contains 20 virtual Machines that run Windows Server 2019. You need to configure just-in-time (JIT) access for the virtual machines in RG1. The solution must meet the following requirements: • Limit the maximum request time to two hours. • Limit protocols access to Remote Desktop Protocol (RDP) only. • Minimize administrative effort. What should you use?

更多题库