SC-200 Free Practice Test

- (Topic 4)
You have a suppression rule in Azure Security Center for 10 virtual machines that are used for testing. The virtual machines run Windows Server.
You are troubleshooting an issue on the virtual machines.
In Security Center, you need to view the alerts generated by the virtual machines during the last five days.
What should you do?

1. A. Change the rule expiration date of the suppression rule.
2. B. Change the state of the suppression rule to Disabled.
3. C. Modify the filter for the Security alerts page.
4. D. View the Windows event logs on the virtual machines.

Correct Answer: B
Reference:
https://docs.microsoft.com/en-us/azure/security-center/alerts-suppression-rules

- (Topic 4)
You have two Azure subscriptions that use Microsoft Defender for Cloud.
You need to ensure that specific Defender for Cloud security alerts are suppressed at the root management group level. The solution must minimize administrative effort.
What should you do in the Azure portal?

1. A. Create an Azure Policy assignment.
2. B. Modify the Workload protections settings in Defender for Cloud.
3. C. Create an alert rule in Azure Monitor.
4. D. Modify the alert settings in Defender for Cloud.

Correct Answer: D
You can use alerts suppression rules to suppress false positives or other unwanted
security alerts from Defender for Cloud.
Note: To create a rule directly in the Azure portal:
* 1. From Defender for Cloud's security alerts page:
Select the specific alert you don't want to see anymore, and from the details pane, select Take action.
Or, select the suppression rules link at the top of the page, and from the suppression rules page select Create new suppression rule:
* 2. In the new suppression rule pane, enter the details of your new rule.
Your rule can dismiss the alert on all resources so you don't get any alerts like this one in the future.
Your rule can dismiss the alert on specific criteria - when it relates to a specific IP address, process name, user account, Azure resource, or location.
* 3. Enter details of the rule.
* 4. Save the rule.
Reference: https://docs.microsoft.com/en-us/azure/defender-for-cloud/alerts-suppression- rules

HOTSPOT - (Topic 4)
You have an Azure subscription that has Azure Defender enabled for all supported resource types.
You create an Azure logic app named LA1.
You plan to use LA1 to automatically remediate security risks detected in Defenders for Cloud.
You need to test LA1 in Defender for Cloud.
What should you do? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.

Solution:


Does this meet the goal?

1. A. Yes
2. B. No

Correct Answer: A

- (Topic 4)
You have an Azure subscription that contains a Microsoft Sentinel workspace. The workspace contains a Microsoft Defender for Cloud data connector. You need to customize which details will be included when an alert is created for a specific event. What should you do?

1. A. Modify the properties of the connector.
2. B. Create a Data Collection Rule (DCR).
3. C. Create a scheduled query rule.
4. D. Enable User and Entity Behavior Analytics (UEBA)

Correct Answer: D

- (Topic 4)
You are configuring Microsoft Cloud App Security.
You have a custom threat detection policy based on the IP address ranges of your company’s United States-based offices.
You receive many alerts related to impossible travel and sign-ins from risky IP addresses. You determine that 99% of the alerts are legitimate sign-ins from your corporate offices. You need to prevent alerts for legitimate sign-ins from known locations.
Which two actions should you perform? Each correct answer presents part of the solution.
NOTE: Each correct selection is worth one point.

1. A. Override automatic data enrichment.
2. B. Add the IP addresses to the corporate address range category.
3. C. Increase the sensitivity level of the impossible travel anomaly detection policy.
4. D. Add the IP addresses to the other address range category and add a tag.
5. E. Create an activity policy that has an exclusion for the IP addresses.

Correct Answer: AD