Free Microsoft SC-200 Exam Questions

Question 1

You have a Microsoft 365 subscription that uses Microsoft Defender for Endpoint and contains the devices shown in the following table.You initiate a live response session on each device. You need to collect a Defender for Endpoint investigation package from each device.On which devices can you collect the package by running advanced live response commands from the command-line interface (CLI)?

A : Device1 and Device2 only

B : Device1, Device2, and Device3 only

C : Device3 and Device4 only

D : Device1, Devke2, Device3, and Device4

Answer: B

Question 2

You have an Azure subscription that uses Microsoft Sentinel.

You need to minimize the administrative effort required to respond to the incidents and remediate the security threats detected by Microsoft Sentinel.

Which two features should you use? Each correct answer presents part of the solution.

NOTE: Each correct selection is worth one point.

A : crosoft Sentinel bookmarks

B : ure Automation runbooks

C : crosoft Sentinel automation rules

D : crosoft Sentinel playbooks

E : ure Functions apps

Answer: C,D

Question 3

You have a Microsoft 365 subscription.You have 1,000 Windows devices that have a third-party antivirus product installed and MicrosoftDefender Antivirus in passive mode. You need to ensure that the devices are protected frommalicious artifacts that were undetected by the third-party antivirus product. Solution: You configureControlled folder access. Does this meet the goal?

A : Yes

B : No

Answer: B

Question 4

You have an Azure subscription.

You need to stream the Microsoft Graph activity logs to a third-party security information and event management (SIEM) tool. The solution must minimize administrative effort.

To where should you stream the logs?

A : an Azure Event Hubs namespace

B : an Azure Storage account

C : an Azure Event Grid namespace

D : a Log Analytics workspace

Answer: A

Question 5

You have a Microsoft 365 subscription.You have 1,000 Windows devices that have a third-party antivirus product installed and MicrosoftDefender Antivirus in passive mode. You need to ensure that the devices are protected frommalicious artifacts that were undetected by the third-party antivirus product. Solution: You configureControlled folder access. Does this meet the goal?

A : Yes

B : No

Answer: B