Real IT Certification Exams Questions & Dumps | Get Certified with CertQuestionsBank.com

Latest SC-200 Exam Practice Questions

The practice questions for SC-200 exam was last updated on 2025-05-29 .

Viewing page 1 out of 21 pages.

Viewing questions 1 out of 108 questions.

Question#1

You are configuring Azure Sentinel.
You need to send a Microsoft Teams message to a channel whenever a sign-in from a suspicious IP address is detected.
Which two actions should you perform in Azure Sentinel? Each correct answer presents part of the
solution. NOTE: Each correct selection is worth one point.

A. Add a playbook.

B. Associate a playbook to an incident.

C. Enable Entity behavior analytics.

D. Create a workbook.

E. Enable the Fusion rule.

Explanation:
Reference: https://docs.microsoft.com/en-us/azure/sentinel/tutorial-respond-threats-playbook

Question#2

DRAG DROP
You have an Azure subscription that contains 100 Linux virtual machines.
You need to configure Microsoft Sentinel to collect event logs from the virtual machines.
Which three actions should you perform in sequence? To answer, move the appropriate actions from the list of actions to the answer area and arrange them in the correct order.

Question#3

You need to deploy the native cloud connector to Account! to meet the Microsoft Defender for Cloud requirements.
What should you do in Account! first?

A. Create an AWS user for Defender for Cloud.

B. Create an Access control (1AM) role for Defender for Cloud.

C. Configure AWS Security Hub.

D. Deploy the AWS Systems Manager (SSM) agent

Question#4

You have a Microsoft 365 subscription that uses Microsoft Purview and Microsoft Teams.
You have a team named Team1 that has a project named Project 1.
You need to identify any Project1 files that were stored on the team site of Team1 between February 1, 2023, and February 10, 2023.
Which KQL query should you run?
A)

B)

C)

D)

A. Option A

B. Option B

C. Option C

D. Option D

Question#5

You have a Microsoft 365 subscription.
You have 1,000 Windows devices that have a third-party antivirus product installed and Microsoft Defender Antivirus in passive mode. You need to ensure that the devices are protected from malicious artifacts that were undetected by the third-party antivirus product
Solution: You enable automated investigation and response (AIR)
Does this meet the goal?

A. Yes

B. No

Exam Code: SC-200Q & A: 306 Q&AsUpdated: 2025-05-29

Get All SC-200 Q&As

SC-200 Online Practice Questions

Question#1

Question#2

Question#3

Question#4

Question#5

Top 20 Exams

Important Links

Know Us

Follow Us