Free Microsoft SC-200 Exam Dumps Questions & Answers

You have a Microsoft 365 subscription.
You have 1,000 Windows devices that have a third-party antivirus product installed and Microsoft Defender Antivirus in passive mode. You need to ensure that the devices are protected from malicious artifacts that were undetected by the third-party antivirus product. Solution: You configure Controlled folder access.
Does this meet the goal?

• A.  Yes
• B.  No

You have a Microsoft 365 E5 subscription that uses Microsoft Defender XDR and contains a user named User1.
You need to ensure that User1 can manage Microsoft Defender XDR custom detection rules and Endpoint security policies. The solution must follow the principle of least privilege.
Which role should you assign to User1?

• A.  Security Operator
• B.  Desktop Analytics Administrator
• C.  Cloud Device Administrator
• D.  Security Administrator

Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.
After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.
You are configuring Microsoft Defender for Identity integration with Active Directory.
From the Microsoft Defender for identity portal, you need to configure several accounts for attackers to exploit.
Solution: From Entity tags, you add the accounts as Honeytoken accounts.
Does this meet the goal?

• A.  Yes
• B.  No

You need to create an advanced hunting query to investigate the executive team issue.
How should you complete the query? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.

Correct Answer:

Explanation:
Table: DeviceFileEvents
Aggregation function: count()
In Microsoft Defender XDR advanced hunting, data tables such as DeviceFileEvents, DeviceProcessEvents, and CloudAppEvents are used to investigate various types of activities. Since this query aims to investigate an issue related to file activity-specifically identifying when files have been accessed, modified, or created repeatedly-the correct data source table is DeviceFileEvents. This table contains information about file-level activities recorded by Defender for Endpoint sensors, including file path, file name, action type, and user account involved.
The KQL structure shown in the image follows standard hunting query syntax:
DeviceFileEvents
| where Timestamp > ago(2d)
| summarize activityCount = count() by FolderPath, FileName, ActionType, AccountDisplayName
| where activityCount > 5
Here's why:
The where Timestamp > ago(2d) clause filters results from the last 2 days, a typical timeframe for immediate investigations.
The summarize operator groups events by FolderPath, FileName, ActionType, and AccountDisplayName, then uses count() to determine how many times each file was acted upon.
Finally, where activityCount > 5 filters to show only unusually high-frequency activity, which might indicate suspicious or automated file manipulation.
Microsoft Defender XDR documentation highlights that DeviceFileEvents is the correct schema for file activity investigations, while DeviceProcessEvents focuses on process creation and execution, and CloudAppEvents targets cloud application usage.
Thus, the verified and documented correct completions are:
Table: DeviceFileEvents
Aggregation function: count()

You need to implement Microsoft Sentinel queries for Contoso and Fabrikam to meet the technical requirements.
What should you include in the solution? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.

Correct Answer:

Explanation:

In Microsoft Sentinel, each workspace acts as a logical container for security data and analytics. When integrating Sentinel across organizations or environments-such as between Contoso and Fabrikam-each Azure subscription needs at least one Log Analytics workspace that Sentinel can attach to. This workspace becomes the data repository for logs and analytics rules.
Therefore, Fabrikam requires a minimum of one Log Analytics workspace to onboard Microsoft Sentinel and begin collecting and analyzing data. Multiple workspaces may be used for isolation or region-specific requirements, but one is sufficient for a functional deployment.
To query and correlate data between multiple workspaces or tenants, Sentinel uses the workspace() KQL function. This function allows cross-workspace queries, letting you pull data from different Sentinel instances for investigation or threat correlation. For example:
union workspace( " FabrikamWorkspace " ).SecurityEvent, workspace( " ContosoWorkspace " ).
SecurityEvent
| summarize count() by Account
This KQL syntax enables cross-tenant or cross-subscription correlation when Defender or Sentinel workspaces are connected through proper permissions (e.g., Azure Lighthouse or cross-tenant data access).
# Final Answers:
Minimum number of Log Analytics workspaces: 1
Query element required to correlate data between tenants: workspace