Exam: SC-200
|
|||||||||||||||||||||||||||
Updates to the exam
Our exams are updated periodically to reflect skills that are required to
perform a role. We have included two versions of the Skills Measured objectives
depending on when you are taking the exam.
We always update the English language version of the exam first. Some exams are
localized into other languages, and those are updated approximately eight weeks
after the English version is updated. While Microsoft makes every effort to
update localized versions as noted, there may be times when the localized
versions of an exam are not updated on this schedule. Other available languages
are listed in the Schedule Exam section of the Exam Details webpage. If the exam
isn't available in your preferred language, you can request an additional 30
minutes to complete the exam.
Note
The bullets that follow each of the skills measured are intended to
illustrate how we are assessing that skill. Related topics may be covered in the
exam.
Note
Most questions cover features that are general availability (GA). The exam
may contain questions on Preview features if those features are commonly used.
Audience profile
As a Microsoft security operations analyst, you reduce organizational risk
by:
Rapidly remediating active attacks in the environment.
Advising on improvements to threat protection practices.
Referring violations of organizational policies to appropriate stakeholders.
You perform:
Triage.
Incident response.
Vulnerability management.
Threat hunting.
Cyber threat intelligence analysis.
As a Microsoft security operations analyst, you monitor, identify, investigate,
and respond to threats in multicloud environments by using:
Microsoft Sentinel
Microsoft Defender for Cloud
Microsoft 365 Defender
Third-party security solutions
In this role, you collaborate with business stakeholders, architects, identity
administrators, Azure administrators, and endpoint administrators to secure IT
systems for the organization.
As a candidate, you should be familiar with:
Microsoft 365
Azure cloud services
Windows and Linux operating systems
Skills at a glance
Mitigate threats by using Microsoft 365 Defender (25–30%)
Mitigate threats by using Defender for Cloud (15–20%)
Mitigate threats by using Microsoft Sentinel (50–55%)
Mitigate threats by using Microsoft 365 Defender (25–30%)
Mitigate threats to the Microsoft 365 environment by using Microsoft 365
Defender
Investigate, respond, and remediate threats to Microsoft Teams, SharePoint
Online, and OneDrive
Investigate, respond, and remediate threats to email by using Microsoft Defender
for Office 365
Investigate and respond to alerts generated by data loss prevention (DLP)
policies
Investigate and respond to alerts generated by insider risk policies
Discover and manage apps by using Microsoft Defender for Cloud Apps
Identify, investigate, and remediate security risks by using Defender for Cloud
Apps
Mitigate endpoint threats by using Microsoft Defender for Endpoint
Manage data retention, alert notification, and advanced features
Recommend attack surface reduction (ASR) for devices
Respond to incidents and alerts
Configure and manage device groups
Identify devices at risk by using the Microsoft Defender Vulnerability
Management
Manage endpoint threat indicators
Identify unmanaged devices by using device discovery
Mitigate identity threats
Mitigate security risks related to events for Microsoft Entra ID
Mitigate security risks related to Microsoft Entra ID Protection events
Mitigate security risks related to Active Directory Domain Services (AD DS) by
using Microsoft Defender for Identity
Manage extended detection and response (XDR) in Microsoft 365 Defender
Manage incidents and automated investigations in the Microsoft 365 Defender
portal
Manage actions and submissions in the Microsoft 365 Defender portal
Identify threats by using Kusto Query Language (KQL)
Identify and remediate security risks by using Microsoft Secure Score
Analyze threat analytics in the Microsoft 365 Defender portal
Configure and manage custom detections and alerts
Investigate threats by using audit features in Microsoft 365 Defender and
Microsoft Purview
Perform threat hunting by using unified audit log
Perform threat hunting by using Content Search
Mitigate threats by using Defender for Cloud (15–20%)
Implement and maintain cloud security posture management
Assign and manage regulatory compliance policies, including Microsoft cloud
security benchmark (MCSB)
Improve the Microsoft Defender for Cloud secure score by applying recommended
remediations
Configure plans and agents for Microsoft Defender for Servers
Configure and manage Microsoft Defender for DevOps
Configure and manage Microsoft Defender External Attack Surface Management (EASM)
Configure environment settings in Microsoft Defender for Cloud
Plan and configure Microsoft Defender for Cloud settings, including selecting
target subscriptions and workspaces
Configure Microsoft Defender for Cloud roles
Assess and recommend cloud workload protection
Enable plans for Microsoft Defender for Cloud
Configure automated onboarding of Azure resources
Connect compute resources by using Azure Arc
Connect multi-cloud resources by using Environment settings
Respond to alerts and incidents in Microsoft Defender for Cloud
Set up email notifications
Create and manage alert suppression rules
Design and configure workflow automation in Microsoft Defender for Cloud
Remediate alerts and incidents by using Microsoft Defender for Cloud
recommendations
Manage security alerts and incidents
Analyze Microsoft Defender for Cloud threat intelligence reports
Mitigate threats by using Microsoft Sentinel (50–55%)
Design and configure a Microsoft Sentinel workspace
Plan a Microsoft Sentinel workspace
Configure Microsoft Sentinel roles
Design and configure Microsoft Sentinel data storage, including log types and
log retention
Plan and implement the use of data connectors for ingestion of data sources in
Microsoft Sentinel
Identify data sources to be ingested for Microsoft Sentinel
Configure and use Microsoft Sentinel connectors for Azure resources, including
Azure Policy and diagnostic settings
Configure Microsoft Sentinel connectors for Microsoft 365 Defender and Defender
for Cloud
Design and configure Syslog and Common Event Format (CEF) event collections
Design and configure Windows security event collections
Configure threat intelligence connectors
Create custom log tables in the workspace to store ingested data
Manage Microsoft Sentinel analytics rules
Configure the Fusion rule
Configure Microsoft security analytics rules
Configure built-in scheduled query rules
Configure custom scheduled query rules
Configure near-real-time (NRT) analytics rules
Manage analytics rules from Content hub
Manage and use watchlists
Manage and use threat indicators
Perform data classification and normalization
Classify and analyze data by using entities
Query Microsoft Sentinel data by using Advanced Security Information Model (ASIM)
parsers
Develop and manage ASIM parsers
Configure security orchestration automated response (SOAR) in Microsoft Sentinel
Create and configure automation rules
Create and configure Microsoft Sentinel playbooks
Configure analytic rules to trigger automation rules
Trigger playbooks from alerts and incidents
Manage Microsoft Sentinel incidents
Configure an incident generation
Triage incidents in Microsoft Sentinel
Investigate incidents in Microsoft Sentinel
Respond to incidents in Microsoft Sentinel
Investigate multi-workspace incidents
Use Microsoft Sentinel workbooks to analyze and interpret data
Activate and customize Microsoft Sentinel workbook templates
Create custom workbooks
Configure advanced visualizations
Hunt for threats by using Microsoft Sentinel
Analyze attack vector coverage by using MITRE ATT&CK in Microsoft Sentinel
Customize content gallery hunting queries
Create custom hunting queries
Use hunting bookmarks for data investigations
Monitor hunting queries by using Livestream
Retrieve and manage archived log data
Create and manage search jobs
Manage threats by using User and Entity Behavior Analytics
Configure User and Entity Behavior Analytics settings
Investigate threats by using entity pages
Configure anomaly detection analytics rules
Change log
Key to understanding the table: The topic groups (also known as functional
groups) are in bold typeface followed by the objectives within each group. The
table is a comparison between the two versions of the exam skills measured and
the third column describes the extent of the changes.
SC-200 Brain Dumps Exam + Online / Offline and Android Testing Engine & 4500+ other exams included
$50 - $25 (you save $25)
Buy Now
Sample Question:
Sample Question and Answers
QUESTION 1
The issue for which team can be resolved by using Microsoft Defender for
Endpoint?
A. executive
B. sales
C. marketing
Answer: B
QUESTION 2
The issue for which team can be resolved by using Microsoft Defender for
Office 365?
A. executive
B. marketing
C. security
D. sales
Answer: B
QUESTION 4
You need to recommend a solution to meet the technical requirements for the
Azure virtual machines. What should you include in the recommendation?
A. just-in-time (JIT) access
B. Azure Defender
C. Azure Firewall
D. Azure Application Gateway
Answer: B
QUESTION 6
You need to remediate active attacks to meet the technical requirements.
What should you include in the solution?
A. Azure Automation runbooks
B. Azure Logic Apps
C. Azure Functions
D Azure Sentinel livestreams
Answer: B
QUESTION 8
You need to complete the query for failed sign-ins to meet the technical
requirements.
Where can you find the column name to complete the where clause?
A. Security alerts in Azure Security Center
B. Activity log in Azure
C. Azure Advisor
D. the query windows of the Log Analytics workspace
Answer: D
QUESTION 9
You need to implement the Azure Information Protection requirements. What
should you configure first?
A. Device health and compliance reports settings in Microsoft Defender Security
Center
B. scanner clusters in Azure Information Protection from the Azure portal
C. content scan jobs in Azure Information Protection from the Azure portal
D. Advanced features from Settings in Microsoft Defender Security Center
Answer: D
QUESTION 10
You need to modify the anomaly detection policy settings to meet the Cloud
App Security requirements. Which policy should you modify?
A. Activity from suspicious IP addresses
B. Activity from anonymous IP addresses
C. Impossible travel
D. Risky sign-in
Answer: C
Buy Complete
Students Feedback / Reviews/ Discussion
Jose Lindo Meza 7 months, 3 weeks ago - Peru
Took my exam today and passed with score 866.
My exam had 48 questions, of which about 15 were not here (most of them were from the case study, which was totally different). I have contributor access
upvoted 5 times
Hari P 8 months, 1 week ago - India
Exam score 788. Only 4 new question
upvoted 3 times
manissin 8 months, 2 weeks ago - japan
TRUST ME..I have passed my 2 certification by this website. Great work TEAM...
upvoted 5 times
ABDULLAH BAHKALI 1 months, 2 weeks ago - Saudi Arabia
I took my exam with 788. Case study was exactly the same. 2-3 new questions
upvoted 5 times
ROSE IBEMBU 3 months, 3 weeks ago - Angola
I passed exam yesterday with 922 points. All questions were from here perhaps 1-2 question were different. I have contributor access.
upvoted 7 times
Michael D 4 months, 3 weeks ago - Germany
Cleared my exam yesterday with 800
out of total 49 questions , almost 15 were new but examtopics questions are great help. Thank you
upvoted 3 times
Patrick Brazier 5 months, 3 weeks ago - Australia
Passed 800 there were 48 questions and 15 new questions.
upvoted 2 times
Richard Bain 9 months, 4 weeks ago - United States
dump still valid, I passed exam on yesterday.
upvoted 2 times
logged members Can Post comments / review and take part in Discussion
Certkingdom Offline Testing Engine Simulator Download
Prepare with yourself how CertKingdom Offline Exam Simulator it is designed specifically for any exam preparation. It allows you to create, edit, and take practice tests in an environment very similar to an actual exam.
Supported Platforms: Windows-7 64bit or later - EULA | How to Install?
FAQ's: Windows-8 / Windows 10 if you face any issue kinldy uninstall and reinstall the Simulator again.
Download Offline Simulator-Beta
Certkingdom Testing Engine Features
- Certkingdom Testing Engine simulates the real exam environment.
- Interactive Testing Engine Included
- Live Web App Testing Engine
- Offline Downloadable Desktop App Testing Engine
- Testing Engine App for Android
- Testing Engine App for iPhone
- Testing Engine App for iPad
- Working with the Certkingdom Testing Engine is just like taking the real tests, except we also give you the correct answers.
- More importantly, we also give you detailed explanations to ensure you fully understand how and why the answers are correct.
Certkingdom Android Testing Engine Simulator Download
Take your learning mobile android device with all the features as desktop offline testing engine. All android devices are supported.
Supported Platforms: All Android OS EULA
Install the Android Testing Engine from google play store and download the app.ck from certkingdom website android testing engine download
Certkingdom Android Testing Engine Features
- CertKingdom Offline Android Testing Engine
- Make sure to enable Root check in Playstore
- Live Realistic practice tests
- Live Virtual test environment
- Live Practice test environment
- Mark unanswered Q&A
- Free Updates
- Save your tests results
- Re-examine the unanswered Q & A
- Make your own test scenario (settings)
- Just like the real tests: multiple choice questions
- Updated regularly, always current
