Free Preparation Discussions
MENU
Microsoft SC-200 Exam Questions
Free Microsoft SC-200 Exam Actual Questions
Note: Premium Questions for SC-200 were last updated On Sep. 06, 2026 (see below)
You have a Microsoft 365 E5 subscription that contains 500 Windows 11 devices.
You have a Microsoft Defender for Endpoint deployment that has the following settings:
Discovery mode: Basic
Live Response: Disabled
Enable EDR in block mode: Off
Tamper Protection: Off
You need to implement automatic attack disruption in Microsoft Defender XDR.
What should you do?
Microsoft Defender XDR's Automatic attack disruption requires EDR in block mode to be enabled. This feature allows Defender for Endpoint to block or contain malicious activities, even when the primary antivirus engine fails to detect or block them initially.
According to Microsoft Defender documentation, attack disruption relies on real-time EDR response capabilities and EDR in block mode to isolate compromised users or devices automatically. Without EDR in block mode, Defender can only alert --- not stop --- ongoing attacks.
Enabling EDR in block mode integrates the EDR layer with Microsoft Defender Antivirus to automatically contain lateral movement and credential theft activities. While Tamper Protection, Live Response, and Standard Discovery are valuable, they do not directly enable automatic attack disruption.
Correct Answe r: A. Set Enable EDR in block mode to On
You have a Microsoft 365 E5 subscription that uses Microsoft Copilot for Security. You plan to run the following code to create a custom Copilot for Security plugin.
You need to specify a format and complete the code segment. Which format should you use for the
When authoring a custom plugin for Copilot for Security that queries security telemetry and returns structured results, the expected query/target format is Kusto Query Language (KQL). Copilot for Security integrates with Microsoft security data platforms (Microsoft Sentinel/Log Analytics and Defender tables) where investigative and hunting queries are expressed in KQL. Official plugin examples and guidance show the plugin invoking a KQL query against a workspace or a Defender table and returning the results in the plugin response payload. KQL is the language used to interrogate event, alert, and entity tables (for example, DeviceProcessEvents, SecurityAlert, MicrosoftGraphActivityLogs) and is the supported format when a plugin's purpose is to retrieve and return telemetry to Copilot for Security. Other formats listed (API, GPT, SQL) are not the standard query language for Defender/Sentinel data: APIs are endpoints for programmatic access, GPT is a model format, and SQL is not used for Azure Monitor / Sentinel tables. Therefore when the plugin's <target> must specify the query format against security telemetry, KQL is the correct choice.
You receive an alert from Azure Defender for Key Vault.
You discover that the alert is generated from multiple suspicious IP addresses.
You need to reduce the potential of Key Vault secrets being leaked while you investigate the issue. The solution must be implemented as soon as possible and must minimize the impact on legitimate users.
What should you do first?
When Azure Defender for Key Vault (now part of Microsoft Defender for Cloud) raises an alert about suspicious access attempts from multiple unknown IP addresses, the immediate mitigation step---before deeper investigation---is to restrict network access to the Key Vault to reduce exposure.
The Azure Key Vault firewall allows you to restrict access by:
Allowing access only from trusted IP addresses, VNets, or private endpoints.
Blocking all other traffic by enabling the firewall and disabling ''Allow access from all networks.''
Microsoft's official recommendation states:
''To reduce the likelihood of secrets being compromised while you investigate an alert, enable the Key Vault firewall and restrict access to trusted networks or specific virtual networks.'' ''Firewall and virtual network configuration can be applied immediately without affecting existing permissions or access policies.''
This step:
Minimizes exposure to malicious IP addresses.
Is quick to implement (through the Azure Portal or CLI).
Has minimal impact on legitimate users if you properly whitelist trusted networks or VNets.
Other options:
A (Modify access control settings) or D (Modify access policy) would affect permissions and could disrupt legitimate users or service principals.
C (Create an application security group) applies to network interfaces, not directly to Key Vault.
Answe r: B. Enable the Key Vault firewall
You have a Microsoft Sentinel workspace.
You enable User and Entity Behavior Analytics (UFBA) by using Audit logs and Signin logs. The following entities are detected in the Azure AD tenant:
* App name: App1
* IP address: 192.168.1.2
* Computer name: Device1
* Used client app: Microsoft Edge
* Email address: user1@company.com
* Sign-in URL: https://www.company.com
Which entities can be investigated by using UEBA?
Microsoft Sentinel UEBA (User and Entity Behavior Analytics) focuses on users and hosts (devices) and enriches data with contextual information. When enabling UEBA with Audit logs and Signin logs, the only entities supported for investigation are:
User accounts (email addresses)
Hosts or devices (including IP addresses)
Other values like App name, Used client app, and Sign-in URL are attributes in log data but not tracked entities in UEBA investigations.
Answe r: B. IP address and email address only
You have an existing Azure logic app that is used to block Azure Active Directory (Azure AD) users. The logic app is triggered manually.
You deploy Azure Sentinel.
You need to use the existing logic app as a playbook in Azure Sentinel. What should you do first?
In Microsoft Sentinel, playbooks are Azure Logic Apps that automate responses to alerts or incidents. To use an existing Logic App as a playbook in Sentinel, it must start with the ''Microsoft Sentinel alert'' trigger. This trigger allows Sentinel to call and pass alert details to the Logic App automatically.
When an existing Logic App has a manual trigger, it cannot be invoked directly by Sentinel. Therefore, the first step is to modify the trigger to replace the manual trigger with the ''When a response to an Azure Sentinel alert is triggered'' trigger. After that, you can link it within Sentinel incidents or automation rules.
This process is detailed in Microsoft Defender XDR and Sentinel documentation under ''Connect a Logic App to Sentinel as a playbook.''
Hence, the correct answer is D. Modify the trigger in the logic app.
- Select Question Types you want
- Set your Desired Pass Percentage
- Allocate Time (Hours : Minutes)
- Create Multiple Practice tests with Limited Questions
- Customer Support
Rachel Martinez
2 days agoRobert Hall
15 days agoDavid Robinson
1 month agoAshley Lewis
2 months agoAndrew Miller
2 months agoJennifer Taylor
3 months agoEmily Harris
3 months agoRichard Wright
4 months agoCarol Evans
4 months agoMelissa Torres
5 months agoDaniel Taylor
4 months agoAmanda Nelson
5 months agoKenneth Martinez
5 months agoKaren Green
4 months agoStephen Hill
4 months agoKattie
5 months agoPansy
6 months agoEun
6 months agoKayleigh
6 months agoAhmed
6 months agoErnest
6 months agoKristofer
7 months agoOretha
7 months agoArleen
7 months agoVincenza
8 months agoWade
8 months agoBlondell
8 months agoPaola
8 months agoAlba
8 months agoLeota
9 months agoLorrie
9 months agoBok
9 months agoJeannetta
9 months agoLuis
10 months agoAndra
10 months agoLing
10 months agoPenney
11 months agoHerminia
11 months agoJoye
11 months agoNadine
11 months agoFreeman
11 months agoGlennis
12 months agoAhmed
12 months agoRuthann
1 year agoRhea
1 year agoLynda
1 year agoNina
1 year agoGayla
1 year agoAnnabelle
1 year agoRoxane
2 years agoPatrick
2 years agoLettie
2 years agoHorace
2 years agoMacy
2 years agoAlishia
2 years agoAdell
2 years agoJennifer
2 years agoLucina
2 years agoAsha
2 years agoRyan
2 years agoMichal
2 years agoLeigha
2 years agoLinsey
2 years agoDell
2 years agoSantos
2 years agoSabra
2 years agoClaudio
2 years agoMila
2 years agoJoni
2 years agoDella
2 years agoMaryann
2 years agoGerald
2 years agoTenesha
2 years agodarrena
2 years agokalasan
2 years ago