SC-200

You need to receive a security alert when a user attempts to sign in from a location that was never used by the other users in your organization to sign in.Which anomaly detection policy should you use?

• Activity from infrequent country

• Impossible travel

• Activity from anonymous IP addresses

• Malware detection

This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.You are configuring Microsoft Defender for Identity integration with Active Directory.From the Microsoft Defender for identity portal, you need to configure several accounts for attackers to exploit.Solution: From Entity tags, you add the accounts as Honeytoken accounts.Does this meet the goal?

• Yes

• No

What does the search operator do?

• Searches across tables and isn't column-specific.

• Searches only data in the last hour.

• Searches in columns specified.

What are project operators?

• Project operators filter a table to the subset of rows that satisfy a predicate.

• Project operators create summarized columns and append them to the result set.

• Project operators add, remove, or rename columns in a result set.

You can classify an Incident as which of the following?

• True alert

• High alert

• Test alert

What describes Safe Attachments from Microsoft Defender for Office 365?

• Messages and attachments are routed to a special environment where Microsoft Defender for Office 365 uses a variety of machine learning and analysis techniques to detect malicious intent.

• Protects your users from malicious URLs in a message or in an Office document.

• A powerful report that enables your Security Operations team to investigate and respond to threats effectively and efficiently.

How can you ensure that a file is sent into quarantine for review by an administrator?

• When creating a file policy, select Quarantine for admin

• When creating a file policy, select Put in admin quarantine

• When creating a file policy, select Put in review for admin

Your company has a single office in Istanbul and a Microsoft 365 subscription.The company plans to use conditional access policies to enforce multi-factor authentication (MFA).You need to enforce MFA for all users who work remotely.What should you include in the solution?

• a fraud alert

• a user risk policy

• a named location

• a sign-in user policy

You create an Azure subscription named sub1.In sub1, you create a Log Analytics workspace named workspace1.You enable Azure Security Center and configure Security Center to use workspace1.You need to collect security event logs from the Azure virtual machines that report to workspace1.What should you do?

• From Security Center, enable data collection

• In sub1, register a provider.

• From Security Center, create a Workflow automation.

• In workspace1, create a workbook.

You create an Azure subscription. You enable Azure Defender for the subscription. You need to use Azure Defender to protect on-premises computers. What should you do on the on-premises computers?

• A Install the Log Analytics agent.

• nstall the Dependency agent.

• Configure the Hybrid Runbook Worker role.

• Install the Connected Machine agent.