Free Preparation Discussions
MENU
Microsoft SC-200 Exam Questions
Free Microsoft SC-200 Exam Actual Questions
Note: Premium Questions for SC-200 were last updated On Jul. 20, 2026 (see below)
You have a Microsoft 365 E5 subscription that uses Microsoft Copilot for Security. You plan to run the following code to create a custom Copilot for Security plugin.
You need to specify a format and complete the code segment. Which format should you use for the
When authoring a custom plugin for Copilot for Security that queries security telemetry and returns structured results, the expected query/target format is Kusto Query Language (KQL). Copilot for Security integrates with Microsoft security data platforms (Microsoft Sentinel/Log Analytics and Defender tables) where investigative and hunting queries are expressed in KQL. Official plugin examples and guidance show the plugin invoking a KQL query against a workspace or a Defender table and returning the results in the plugin response payload. KQL is the language used to interrogate event, alert, and entity tables (for example, DeviceProcessEvents, SecurityAlert, MicrosoftGraphActivityLogs) and is the supported format when a plugin's purpose is to retrieve and return telemetry to Copilot for Security. Other formats listed (API, GPT, SQL) are not the standard query language for Defender/Sentinel data: APIs are endpoints for programmatic access, GPT is a model format, and SQL is not used for Azure Monitor / Sentinel tables. Therefore when the plugin's <target> must specify the query format against security telemetry, KQL is the correct choice.
You receive an alert from Azure Defender for Key Vault.
You discover that the alert is generated from multiple suspicious IP addresses.
You need to reduce the potential of Key Vault secrets being leaked while you investigate the issue. The solution must be implemented as soon as possible and must minimize the impact on legitimate users.
What should you do first?
When Azure Defender for Key Vault (now part of Microsoft Defender for Cloud) raises an alert about suspicious access attempts from multiple unknown IP addresses, the immediate mitigation step---before deeper investigation---is to restrict network access to the Key Vault to reduce exposure.
The Azure Key Vault firewall allows you to restrict access by:
Allowing access only from trusted IP addresses, VNets, or private endpoints.
Blocking all other traffic by enabling the firewall and disabling ''Allow access from all networks.''
Microsoft's official recommendation states:
''To reduce the likelihood of secrets being compromised while you investigate an alert, enable the Key Vault firewall and restrict access to trusted networks or specific virtual networks.'' ''Firewall and virtual network configuration can be applied immediately without affecting existing permissions or access policies.''
This step:
Minimizes exposure to malicious IP addresses.
Is quick to implement (through the Azure Portal or CLI).
Has minimal impact on legitimate users if you properly whitelist trusted networks or VNets.
Other options:
A (Modify access control settings) or D (Modify access policy) would affect permissions and could disrupt legitimate users or service principals.
C (Create an application security group) applies to network interfaces, not directly to Key Vault.
Answe r: B. Enable the Key Vault firewall
You have a Microsoft Sentinel workspace.
You enable User and Entity Behavior Analytics (UFBA) by using Audit logs and Signin logs. The following entities are detected in the Azure AD tenant:
* App name: App1
* IP address: 192.168.1.2
* Computer name: Device1
* Used client app: Microsoft Edge
* Email address: user1@company.com
* Sign-in URL: https://www.company.com
Which entities can be investigated by using UEBA?
Microsoft Sentinel UEBA (User and Entity Behavior Analytics) focuses on users and hosts (devices) and enriches data with contextual information. When enabling UEBA with Audit logs and Signin logs, the only entities supported for investigation are:
User accounts (email addresses)
Hosts or devices (including IP addresses)
Other values like App name, Used client app, and Sign-in URL are attributes in log data but not tracked entities in UEBA investigations.
Answe r: B. IP address and email address only
You have an existing Azure logic app that is used to block Azure Active Directory (Azure AD) users. The logic app is triggered manually.
You deploy Azure Sentinel.
You need to use the existing logic app as a playbook in Azure Sentinel. What should you do first?
In Microsoft Sentinel, playbooks are Azure Logic Apps that automate responses to alerts or incidents. To use an existing Logic App as a playbook in Sentinel, it must start with the ''Microsoft Sentinel alert'' trigger. This trigger allows Sentinel to call and pass alert details to the Logic App automatically.
When an existing Logic App has a manual trigger, it cannot be invoked directly by Sentinel. Therefore, the first step is to modify the trigger to replace the manual trigger with the ''When a response to an Azure Sentinel alert is triggered'' trigger. After that, you can link it within Sentinel incidents or automation rules.
This process is detailed in Microsoft Defender XDR and Sentinel documentation under ''Connect a Logic App to Sentinel as a playbook.''
Hence, the correct answer is D. Modify the trigger in the logic app.
You have a Microsoft 365 subscription that uses Microsoft Defender XDR. You need to implement deception rules. The solution must ensure that you can limit the scope of the rules.
What should you create first?
- Select Question Types you want
- Set your Desired Pass Percentage
- Allocate Time (Hours : Minutes)
- Create Multiple Practice tests with Limited Questions
- Customer Support
Andrew Miller
16 days agoJennifer Taylor
30 days agoEmily Harris
2 months agoRichard Wright
2 months agoCarol Evans
3 months agoMelissa Torres
3 months agoDaniel Taylor
3 months agoAmanda Nelson
3 months agoKenneth Martinez
3 months agoKaren Green
3 months agoStephen Hill
2 months agoKattie
4 months agoPansy
4 months agoEun
4 months agoKayleigh
4 months agoAhmed
5 months agoErnest
5 months agoKristofer
5 months agoOretha
5 months agoArleen
6 months agoVincenza
6 months agoWade
6 months agoBlondell
6 months agoPaola
7 months agoAlba
7 months agoLeota
7 months agoLorrie
7 months agoBok
8 months agoJeannetta
8 months agoLuis
8 months agoAndra
8 months agoLing
9 months agoPenney
9 months agoHerminia
9 months agoJoye
9 months agoNadine
10 months agoFreeman
10 months agoGlennis
10 months agoAhmed
10 months agoRuthann
11 months agoRhea
11 months agoLynda
1 year agoNina
1 year agoGayla
1 year agoAnnabelle
1 year agoRoxane
1 year agoPatrick
1 year agoLettie
2 years agoHorace
2 years agoMacy
2 years agoAlishia
2 years agoAdell
2 years agoJennifer
2 years agoLucina
2 years agoAsha
2 years agoRyan
2 years agoMichal
2 years agoLeigha
2 years agoLinsey
2 years agoDell
2 years agoSantos
2 years agoSabra
2 years agoClaudio
2 years agoMila
2 years agoJoni
2 years agoDella
2 years agoMaryann
2 years agoGerald
2 years agoTenesha
2 years agodarrena
2 years agokalasan
2 years ago