Online Access Free SC-200 Practice Test

You have a Microsoft 365 subscription that uses Microsoft Copilot for Security.
You create a promptbook named Book1.
For Book1, you need to create a prompt that contains an input named IncidentID.
How should you format IncidentID?

• A.< IncidentID >
• B.##IncidentID##
• C.[IncidentID]
• D.SIncidentlD$

Your on-premises network contains two Active Directory Domain Services (AD DS) domains named contoso.
com and fabrikam.com. Contoso.com contains a group named Group1. Fabrikam.com contains a group named Group2.
You have a Microsoft Sentinel workspace named WS1 that contains a scheduled query rule named Rule1.
Rule1 generates alerts in response to anomalous AD DS security events. Each alert creates an incident.
You need to implement an incident triage solution that meets the following requirements:
Security incidents from contoso.com must be assigned to Group1.
Security incidents from fabrikam.com must be assigned to Group2.
Administrative effort must be minimized.
What should you include in the solution?

• A.a playbook that is triggered by the creation of an incident
• B.one automation rule assigned to Rule1
• C.a playbook that is triggered by the creation of an alert
• D.two automation rules assigned to Rule1

You need to implement the ASIM query for DNS requests. The solution must meet the Microsoft Sentinel requirements. How should you configure the query? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.

Correct Answer:

Explanation:

In Microsoft Sentinel's Advanced Security Information Model (ASIM), DNS queries are normalized through the Im_Dns parser, which unifies DNS telemetry from multiple sources (Infoblox, Windows DNS, Azure Firewall DNS proxy, etc.). Microsoft guidance states that when you need broad compatibility and want to
"use built-in ASIM parsers whenever possible," you should call the generic Im_Dns() parser. To minimize overhead, ASIM provides a pack parameter that restricts the parser to a specific content pack (vendor/source) so it won't iterate through all available source parsers under the hood. For Infoblox NIOS, you pass the Infoblox pack via the pack parameter, which limits parsing to the Infoblox implementation and reduces query cost/latency while keeping the query portable across environments.
Putting it together, the recommended pattern is:
Im_Dns(pack= " InfobloxNIOS " )
| where DnsResponseCodeName == " NXDOMAIN "
| summarize count()
This approach satisfies all requirements:
Uses built-in ASIM (Im_Dns).
Minimizes query overhead (uses pack to limit parsing to Infoblox).
Targets NXDOMAIN responses for counting DNS request failures from Infoblox1.

You have an Azure subscription that contains the following resources:
* A virtual machine named VM1 that runs Windows Server
* A Microsoft Sentinel workspace named Sentinel1 that has User and Entity Behavior Analytics (UEBA) enabled You have a scheduled query rule named Rule1 that tracks sign-in attempts to VM1.
You need to update Rule 1 to detect when a user from outside the IT department of your company signs in to VM1. The solution must meet the following requirements:
* Utilize UEBA results.
* Maximize query performance.
* Minimize the number of false positives.
How should you complete the rule definition? To answer select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.

Correct Answer:

Explanation:

To detect sign-ins to VM1 by users outside the IT department while leveraging UEBA, you should enrich Windows security events with identity attributes from UEBA's enrichment tables. In Microsoft Sentinel, UEBA writes organizational attributes (e.g., Department, Title, AAD object IDs/SIDs) to the IdentityInfo table. Joining SecurityEvent (Event IDs 4624/4625) with IdentityInfo on the user SID lets you filter with where Department != " IT " -meeting the requirement to utilize UEBA results.
For performance and fewer false positives, use join kind=inner. An inner join only returns rows where the user in SecurityEvent has a corresponding identity record in IdentityInfo, avoiding unmatched and potentially noisy events. Options like fullouter would introduce non-matching rows (increasing noise), and anti would return only unmatched rows (the opposite of what's needed).
BehaviorAnalytics contains anomaly scores/events rather than static attributes like department, and SigninLogs is raw AAD sign-in telemetry (not the UEBA-enriched identity inventory needed for department filtering). Therefore, IdentityInfo is the correct enrichment source.
Thus, to satisfy use UEBA, maximize performance, and minimize false positives: join kind=inner with IdentityInfo and then filter Department != " IT " .

You are investigating a potential attack that deploys a new ransomware strain.
You plan to perform automated actions on a group of highly valuable machines that contain sensitive information.
You have three custom device groups.
You need to be able to temporarily group the machines to perform actions on the devices. Which three actions should you perform? Each correct answer presents part of the solution. NOTE: Each correct selection is worth one point.

• A.Add a tag to the machines.
• B.Create a new device group that has a rank of 1.
• C.Add a tag to the device group.
• D.Add the device users to the admin role.
• E.Create a new device group that has a rank of 4.
• F.Create a new admin role.