SC-200 Practice Test

Your company uses Azure Sentinel.
A new security analyst reports that she cannot assign and dismiss incidents in Azure
Sentinel. You need to resolve the issue for the analyst. The solution must use the principle
of least privilege. Which role should you assign to the analyst?

A.

Azure Sentinel Responder

B.

Logic App Contributor

C.

Azure Sentinel Contributor

D.

Azure Sentinel Reader

A security administrator receives email alerts from Azure Defender for activities such as
potential malware uploaded to a storage account and potential successful brute force
attacks.
The security administrator does NOT receive email alerts for activities such as antimalware
action failed and suspicious network activity. The alerts appear in Azure Security Center.
You need to ensure that the security administrator receives email alerts for all the activities.
What should you configure in the Security Center settings?

A.

the severity level of email notifications

B.

a cloud connector

C.

the Azure Defender plans

D.

the integration settings for Threat detection

You have five on-premises Linux servers.
You have an Azure subscription that uses Microsoft Defender for Cloud.
You need to use Defender for Cloud to protect the Linux servers.
What should you install on the servers first?

A.

the Dependency agent

B.

the Log Analytics agent

C.

the Azure Connected Machine agent

D.

the Guest Configuration extension

Your company uses Azure Sentinel to manage alerts from more than 10,000 IoT devices.
A security manager at the company reports that tracking security threats is increasingly
difficult due to the large number of incidents.
You need to recommend a solution to provide a custom visualization to simplify the
investigation of threats and to infer threats by using machine learning.
What should you include in the recommendation?

A.

built-in queries

B.

livestream

C.

notebooks

D.

bookmarks

Note: This question is part of a series of questions that present the same scenario. Each
question in the series contains a unique solution that might meet the stated goals. Some
question sets might have more than one correct solution, while others might not have a
correct solution.
After you answer a question in this section, you will NOT be able to return to it. As a result,
these questions will not appear in the review screen.
You use Azure Security Center.
You receive a security alert in Security Center.
You need to view recommendations to resolve the alert in Security Center.
Solution: From Regulatory compliance, you download the report.
Does this meet the goal?

A.

Yes

B.

No