Question 1

You need to correlate data from the SecurityEvent Log Anarytks table to meet the Microsoft Sentinel requirements for using UEB

Options :

A : IdentityInfo

B : SentwlAuoNt

C : AADRiskyUsers

D : IdentityOirectoryEvents

Answer: D

Question 2

You create an Azure subscription.
You enable Azure Defender for the subscription.
You need to use Azure Defender to protect on-premises computers.
What should you do on the on-premises computers?

Options :

A : Install the Log Analytics agent.

B : Install the Dependency agent.

C : Configure the Hybrid Runbook Worker role.

D : Install the Connected Machine agent.

Answer: A

Question 3

You have two Azure subscriptions that use Microsoft Defender for Cloud.

You need to ensure that specific Defender for Cloud security alerts are suppressed at the root management group level. The solution must minimize administrative effort.

What should you do in the Azure portal?

Options :

A : Create an Azure Policy assignment.

B : Modify the Workload protections settings in Defender for Cloud.

C : Create an alert rule in Azure Monitor.

D : Modify the alert settings in Defender for Cloud.

Answer: D

Question 4

You plan to review Microsoft Defender for Cloud alerts by using a third-party security information and event management (SIEM) solution.

You need to locate alerts that indicate the use of the Privilege Escalation MITRE ATT&CK tactic.

Which JSON key should you search?

Options :

A : Description

B : Intent

C : ExtendedProperies

D : Entities

Answer: A

Question 5

You have a Microsoft Sentinel workspace named SW1.

In SW1, you investigate an incident that is associated with the following entities:

• Host

• IP address

• User account

• Malware name

Which entity can be labeled as an indicator of compromise (IoC) directly from the incident's page?

Options :

A : malware name

B : host

C : user account

D : IP address

Answer: D

Smartly Prepare Exam with Free Online SC-200 Practice Test

Buying Options: