sc-200 题目+答案 - 副本_在线真题试卷与模拟练习_sc-200 题目+答案 - 副本_考试宝

更新时间：试题数量：购买人数：提供作者：

有效期：个月

章节介绍：共有个章节

收藏

我的练习

我的错题
(0道)

我的收藏
(0道)

我的斩题
(0道)

我的笔记
(0道)

专项练习

顺序练习 0 / 0

随机练习 自定义设置练习量

题型乱序 按导入顺序练习

模拟考试 仿真模拟

题型练习 按题型分类练习

易错题 精选高频易错题

学习资料 考试学习相关信息

搜索

题库预览

You need to ensure that the processing of incidents generated by rulequery1 meets the Microsoft Sentinel requirements. What should you create first?

You need to monitor the password resets. The solution must meet the Microsoft Sentinel requirements. What should you do? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.【试题选项缺失，请补充】【仅支持A-H选项，选项超出支持范围】

You need to implement the ASIM query for DNS requests. The solution must meet the Microsoft Sentinel requirements. How should you configure the query? To answer, select the appropriate options in the answer area.

Adatum Corporation is a United States-based financial services company that has regional offices in New York, Chicago, and San Francisco. ### Existing Environment #### Identity Environment The on-premises network contains an Active Directory Domain Services (AD DS) forest named corp.adatum.com that syncs with an Azure AD tenant named adatum.com. All user and group management tasks are performed in corp.adatum.com. The corp.adatum.com domain contains a group named Group1 that syncs with adatum.com. #### Licensing Status All the users at Adatum are assigned a Microsoft 365 ES license and an Azure Active Directory Premium P2 license. #### Cloud Environment The cloud environment contains a Microsoft 365 subscription, an Azure subscription linked to the adatum.com tenant, and the resources shown in the following table. | Name | Type | Description | |------|------|-------------| | Sentinel1 | Microsoft Sentinel workspace | Includes a custom hunting query named HuntingQuery1 | | Server2 | Azure virtual machine | Runs Windows Server 2022 | #### On-premises Environment The on-premises network contains the resources shown in the following table. | Name | Type | Description | |------|------|-------------| | Server1 | Server | Runs Windows Server 2019<br>Has Azure Arc-enabled and the Azure Monitor agent installed | | Webapp1 | Web service | An on-premises, public-facing HTTP/HTTPS web service that generates JSON output in response to GET HTTP requests | | Infoblox1 | Infoblox DNS service | A third-party DNS service appliance linked to Sentinel1 by using a data connector | ### Requirements #### Planned changes Adatum plans to perform the following changes: - Implement a query named rulequery1 that will include the following KQL query.【缺少答案，请补充】

You need to implement the Microsoft Sentinel NRT rule for monitoring the designated break glass account. The solution must meet the Microsoft Sentinel requirements. How should you complete the query? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point. Answer Area SigninLogs | [第一空] kind=inner [第二空] ('breakglass_account') on $$left.UserPrincipalName == $$right.SearchKey 第一空选项: join, lookup, union 第二空选项: _GetWatchlist, external_table, materialized_view（含图）

You need to ensure that the Group1 members can meet the Microsoft Sentinel requirements. Which role should you assign to Group1?

You need to ensure that the configuration of HuntingQuery1 meets the Microsoft Sentinel requirements. What should you do?

You need to implement the query for Workbook1 and Webapp1. The solution must meet the Microsoft Sentinel requirements. How should you configure the query?【试题选项缺失，请补充】【仅支持A-H选项，选项超出支持范围】

You have an Azure subscription that contains a Microsoft Sentinel workspace named Workspace1. From Content Hub, you deploy the Microsoft Entra solution for Microsoft Sentinel and configure a connector. You need to analyze actions performed by users that have administrative privileges to the subscription. Which workbook should you use?

You have an Azure subscription that contains a Microsoft Sentinel workspace named Workspace1 and a user named User1. You need to ensure that User1 can investigate incidents by using Workspace1. The solution must follow the principle of least privilege. Which role should you assign to User1?

HOTSPOT - You have an Azure subscription that contains a Log Analytics workspace named Workspace1. You configure Azure activity logs and Microsoft Entra ID logs to be forwarded to Workspace1. You need to query Workspace1 to identify all the requests that failed due to insufficient authorization. How should you complete the KQL query? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.

You have a Microsoft 365 subscription that uses Microsoft Defender XDR. You are investigating an incident. You need to review the incident tasks that were performed. The solution must include a query that will display the incidents in a workbook, and then display the tasks of each incident in another grid. Which table should you target in the query?

You have an Azure subscription that contains a Microsoft Sentinel workspace named WS1 and 100 virtual machines that run Windows Server. You need to configure the collection of Windows Security event logs for ingestion to WS1. The solution must meet the following requirements: • Capture a full user audit trail including user sign-in and user sign-out events. • Minimize the volume of events. • Minimize administrative effort. Which event set should you select?

You have a Microsoft 365 subscription that uses Microsoft Defender for Cloud Apps and has Cloud Discovery enabled. You need to enrich the Cloud Discovery data. The solution must ensure that usernames in the Cloud Discovery traffic logs are associated with the user principal name (UPN) of the corresponding Microsoft Entra ID user accounts. What should you do first?

HOTSPOT - You have a Microsoft Sentinel workspace that has a default data retention period of 30 days. The workspace contains two custom tables as shown in the following table. Each table ingested two records per day during the past 365 days. You build KQL statements for use in analytic rules as shown in the following table. For each of the following statements, select Yes if the statement is true. Otherwise, select No. NOTE: Each correct selection is worth one point. Statements: 1. For Query1 to return a value of 30, you must change Table plan to Analytics. 2. For Query2 to return a value of 240, you must change Total retention period to 120 days. 3. For Query3 to return 90 rows, you must change Total retention period to 45 days.（含图）（含图）

HOTSPOT - You have a Microsoft 365 E5 subscription that uses Microsoft Defender for Endpoint You have the on-premises devices shown in the following table. You are preparing an incident response plan for devices infected by malware. You need to recommend response actions that meet the following requirements: • Block malware from communicating with and infecting managed devices. • Do NOT affect the ability to control managed devices. Which actions should you use for each device? 【试题选项缺失，请补充】【仅支持A-H选项，选项超出支持范围】（含图）

You have a Microsoft 365 E5 subscription that uses Microsoft Defender XDR and contains a user named User1. You need to ensure that User1 can manage Microsoft Defender XDR custom detection rules and Endpoint security policies. The solution must follow the principle of least privilege. Which role should you assign to User1?

You have the resources shown in the following table. |Name|Type|Description| |---|---|---| |Server1|On-premises server|On-boarded to Azure Arc<br>Runs Windows Server 2022<br>Has Microsoft SQL Server 2022 installed| |VM1|SQL Server on Azure Virtual Machines|Runs Windows Server 2022<br>Has Microsoft SQL Server 2022 installed| You have an Azure subscription that uses Microsoft Defender for Cloud. You need to use Defender for Cloud to protect VM1 and Server1. The solution must meet the following requirements: - Support Advanced Threat Protection and vulnerability assessment. - Register each SQL Server 2022 instance as a SQL virtual machine. - Minimize implementation and administrative effort. What should you deploy to each server? To answer, select the appropriate options in the answer area.（含图）

You have a Microsoft Sentinel workspace that contains a custom workbook named Workbook1. You need to create a visual based on the SecurityEvent table. The solution must meet the following requirements: - Identify the number of security events ingested during the past week. - Display the count of events by day in a timechart. What should you add to Workbook1?

You have an Azure subscription. You need to stream the Microsoft Graph activity logs to a third-party security information and event management (SIEM) tool. The solution must minimize administrative effort. To where should you stream the logs?

更多题库