SC-200 Online Practice Questions and Answers

Correct Answer: D

Correct Answer: C

Connect your GitHub repositories to Microsoft Defender for Cloud

Connect your GitHub account

To connect your GitHub account to Microsoft Defender for Cloud:

1.

Sign in to the Azure portal.

2.

Go to Microsoft Defender for Cloud > Environment settings.

3.

Select Add environment.

4.

Select GitHub.

5.

Enter a name (limit of 20 characters), and then select your subscription, resource group, and region.

6.

Etc.

Reference: https://learn.microsoft.com/en-us/azure/defender-for-cloud/quickstart-onboard-github

Correct Answer: D

Reference: https://docs.microsoft.com/en-us/azure/sentinel/tutorial-detect-threats-custom

Correct Answer: A

Import a list of IoCs

You can choose to upload a CSV file that defines the attributes of indicators, the action to be taken, and other details.

1.

Download the sample CSV to know the supported column attributes.

2.

In the navigation pane, select Settings > Endpoints > Indicators (under Rules).

3.

Select the tab of the entity type you'd like to import indicators for.

4.

Select Import > Choose file.

5.

Select Import. Do this for all the files you'd like to import.

6.

Select Done.

Note: You can create an indicator for:

Files

IP addresses

URLs/domains

Certificates

Incorrect:

Not B: Classless Inter-Domain Routing (CIDR) notation for IP addresses is not supported.

Not C: Only single IP addresses are supported (no CIDR blocks or IP ranges) in custom indicators.

Not D: Classless Inter-Domain Routing (CIDR) notation for IP addresses is not supported.

Note 2: Create an indicator for IPs, URLs, or domains from the settings page

1.

In the navigation pane, select Settings > Endpoints > Indicators (under Rules).

2.

Select the IP addresses or URLs/Domains tab.

Only single IP addresses are supported (no CIDR blocks or IP ranges) in custom indicators

3.

Select Add item.

4.

Specify the following details:

Indicator - Specify the entity details and define the expiration of the indicator.

Action - Specify the action to be taken and provide a description.

Scope - Define the scope of the machine group.

5.

Review the details in the Summary tab, then select Save.

Reference:

https://learn.microsoft.com/en-us/microsoft-365/security/defender-endpoint/indicator-manage

https://learn.microsoft.com/en-us/microsoft-365/security/defender-endpoint/manage-indicators

https://learn.microsoft.com/en-us/microsoft-365/security/defender-endpoint/indicator-ip-domain

Correct Answer: D

Correct Answer: C

Correct Answer: D

Correct Answer:

Correct Answer:

Correct Answer:

Box 1: Hunting blade Create a bookmark

Add a bookmark

1.

In the Azure portal, navigate to Microsoft Sentinel > Threat management > Hunting to run queries for suspicious and anomalous behavior.

2.

Select one of the hunting queries and on the right, in the hunting query details, select Run Query.

3.

Select View query results. For example:

This action opens the query results in the Logs pane.

4.

From the log query results list, use the checkboxes to select one or more rows that contain the information you find interesting.

5.

Select Add bookmark:

6.

On the right, in the Add bookmark pane, optionally, update the bookmark name, add tags, and notes to help you identify what was interesting about the item.

7.

Etc.

Box 2: Hunting blade Associate a bookmark with incident You can also create an incident from one or more bookmarks, or add one or more bookmarks to an existing incident. Select a checkbox to the left of any bookmarks you want to use, and then select Incident actions > Create new incident or

Add to existing incident. Triage and investigate the incident like any other. Note: Add bookmarks to a new or existing incident

1.

In the Azure portal, navigate to Microsoft Sentinel > Threat management > Hunting > Bookmarks tab, and select the bookmark or bookmarks you want to add to an incident.

2.

Select Incident actions from the command bar:

3.

Select either Create new incident or Add to existing incident, as appropriate. Then:

For a new incident: Optionally update the details for the incident, and then select Create. For adding a bookmark to an existing incident: Select one incident, and then select Add.

To view the bookmark within the incident: Navigate to Microsoft Sentinel > Threat management > Incidents and select the incident with your bookmark. Select View full details, and then select the Bookmarks tab.

Reference: https://learn.microsoft.com/en-us/azure/sentinel/bookmarks https://learn.microsoft.com/en-us/azure/sentinel/hunting