SC-200 Practice Questions — Page 21

You have a Microsoft 365 subscription that contains three users named User1, User2 and User3 and the resources shown in the following table.

You have a Microsoft Defender XDR detection rule named Rule1 that has the following configurations:

• Scope:DevGroup1

• File hash: File1.exe

• Actions

o Devices: Collect investigation package

o User: Mark as compromised

o Files: Block

Each user attempts to run File1.exe on their device.

For each of the following statements, select Yes if the statement is true. Otherwise, select No.

NOTE: Each correct selection is worth one point.

You have a Microsoft 365 E5 subscription that contains Windows 11 and Linux CentOS devices.

In Microsoft Defender XDR, Deception is set to On.

You plan to create a deception rule that will use a custom lure.

You need to specify the type of file, and the planting path for the custom lure.

What should you specify? To answer, select the appropriate options in the answer area.

NOTE: Each correct selection is worth one point.

You have a Microsoft 365 E5 subscription that has a Conditional Access policy named Policy1.

You need to perform the following actions:

• Create a Conditional Access App Control custom policy named Custom1.

• Configure Policy1 to use Custom1.

What should you use co create Custom1, and in which settings of Policy1 should you enable Conditional Access App Control? To answer, select the appropriate options in the answer area.

NOTE: Each correct selection is worth one point.

You have an Azure subscription that uses Microsoft Defender for Cloud.

You need to configure Defender for Cloud to mitigate the following risks:

• Vulnerabilities within the application source code

• Exploitation toolkits in declarative templates

• Operations from malicious IP addresses

• Exposed secrets

Which two Defender for Cloud services should you use? Each correct answer presents part of the solution.

NOTE: Each correct answer is worth one point.

You have a Microsoft 365 E5 subscription that uses Microsoft Defender XDR.

You have a custom detection rule named Rule1 that generates an alert if more than five antivirus detections are identified on a device. Rule1 has a lookback period of 12 hours.

You need to change the lookback period to 48 hours.

What should you modify for Rule1?

You have a Microsoft 365 subscription. The subscription contains 500 Windows 11 devices that are onboarded to Microsoft Defender for Endpoint.

You need to perform the following actions in Microsoft Defender XDR:

• For your company’s finance department, populate random endpoints with fake cached credentials.

• Ensure that an incident is created in Microsoft Defender XDR if an attacker attempts to use the fake cached credentials.

The solution must ensure that the fake cached credentials are planted only on endpoints of the finance department.

Which three actions should you perform in sequence? To answer, move the appropriate actions from the list of actions to the answer area and arrange them in the correct order.

NOTE: More than one order of answer choices is correct. You will receive credit for any of the correct orders you select.