Free Microsoft SC-200 Sample Questions

Question 1

You need to configure Microsoft Cloud App Security to generate alerts and triggerremediation actions in response to external sharing of confidential files.Which two actions should you perform in the Cloud App Security portal? Each correctanswer presents part of the solution.NOTE: Each correct selection is worth one point.

A. From Settings, select Information Protection, select Azure Information Protection, andthen select Only scan files for Azure Information Protection classification labels and contentinspection warnings from this tenant
B. Select Investigate files, and then filter App to Office 365.
C. Select Investigate files, and then select New policy from search
D. From Settings, select Information Protection, select Azure Information Protection, and then select Automatically scan new files for Azure Information Protection classificationlabels and content inspection warnings
E. From Settings, select Information Protection, select Files, and then enable filemonitoring.
F. Select Investigate files, and then filter File Type to Document.

Answer: D,E

Question 2

You have an Azure subscription that uses Microsoft Sentinel.You detect a new threat by using a hunting query.You need to ensure that Microsoft Sentinel automatically detects the threat. The solutionmust minimize administrative effort.What should you do?

A. Create a playbook.
B. Create a watchlist.
C. Create an analytics rule.
D. Add the query to a workbook.

Answer: A

Question 3

Note: This question is part of a series of questions that present the same scenario. Eachquestion in the series contains a unique solution that might meet the stated goals. Somequestion sets might have more than one correct solution, while others might not have acorrect solution.After you answer a question in this section, you will NOT be able to return to it. As a result,these questions will not appear in the review screen.You are configuring Microsoft Defender for Identity integration with Active Directory.From the Microsoft Defender for identity portal, you need to configure several accounts forattackers to exploit.Solution: From Azure Identity Protection, you configure the sign-in risk policy.Does this meet the goal?

A. Yes
B. No 

Answer: B

Question 4

You have 50 Microsoft Sentinel workspaces.You need to view all the incidents from all the workspaces on a single page in the Azure portal. The solution must minimize administrative effort. Which page should you use in the Azure portal?

A. Microsoft Sentinel - Incidents
B. Microsoft Sentinel - Workbooks
C. Microsoft Sentinel
D. Log Analytics workspaces

Answer: D

Question 5

You have a Microsoft 365 subscription that uses Microsoft 365 Defender A remediationaction for an automated investigation quarantines a file across multiple devices. You needto mark the file as safe and remove the file from quarantine on the devices. What shouldyou use m the Microsoft 365 Defender portal?

A. From Threat tracker, review the queries.
B. From the History tab in the Action center, revert the actions.
C. From the investigation page, review the AIR processes.
D. From Quarantine from the Review page, modify the rules.

Answer: B