You need to configure Microsoft Defender for Cloud Apps to generate alerts and trigger remediation actions in response to external sharing of confidential files.Which two actions should you perform in the Microsoft Defender for Cloud Apps portal? Each correct answer presents part of the solution.Note: Each correct selection is worth one point.
Answer(s): D,E
Discover and protect sensitive information in your organizationPhase 1: Discover your data Details omitted.(D) Phase 2: Classify sensitive information 1. Define which information is sensitive. Details omitted.2. Enable Microsoft Information Protection integration a. In the Microsoft 365 Defender portal, select Settings. Then choose Cloud Apps. b. Under Information Protection, go to Microsoft Information Protection. Select Automatically scan new files for Microsoft Information Protection sensitivity labels and content inspection warnings.3. Etc. Phase 3: Protect your data Phase 4: Monitor and report on your dataE: File filters in Microsoft Defender for Cloud Apps File monitoring should be enabled in Settings. In the Microsoft 365 Defender portal, select Settings. Then choose Cloud Apps. Under Information Protection, select Files. Select Enable file monitoring and then select Save.Note: To provide data protection, Microsoft Defender for Cloud Apps gives you visibility into all the files from your connected apps. After you connect Microsoft Defender for Cloud Apps to an app using the App connector, Microsoft Defender for Cloud Apps scans all the files, for example all the files stored in OneDrive and Salesforce. Then, Defender for Cloud Apps rescans each file every time it's modified – the modification can be to content, metadata, or sharing permissions. Scanning times depend on the number of files stored in your app. You can also use the Files page to filter files to investigate what kind of data is saved in your cloud apps.
https://docs.microsoft.com/en-us/cloud-app-security/tutorial-dlp https://docs.microsoft.com/en-us/cloud-app-security/azip-integration https://learn.microsoft.com/en-us/defender-cloud-apps/file-filters
HOTSPOT (Drag and Drop is not supported)You purchase a Microsoft 365 subscription.You plan to configure Microsoft Defender for Cloud Apps.You need to create a custom template-based policy that detects connections to Microsoft 365 apps that originate from a botnet network.What should you use? To answer, select the appropriate options in the answer area.Note: Each correct selection is worth one point.Hot Area:
Answer(s): A
https://docs.microsoft.com/en-us/cloud-app-security/anomaly-detection-policy
Your company has a single office in Istanbul and a Microsoft 365 subscription.The company plans to use conditional access policies to enforce multi-factor authentication (MFA).You need to enforce MFA for all users who work remotely.What should you include in the solution?
Answer(s): C
https://docs.microsoft.com/en-us/azure/active-directory/conditional-access/location-condition
You are configuring Microsoft Defender for Cloud Apps.You have a custom threat detection policy based on the IP address ranges of your company’s United States-based offices.You receive many alerts related to impossible travel and sign-ins from risky IP addresses.You determine that 99% of the alerts are legitimate sign-ins from your corporate offices.You need to prevent alerts for legitimate sign-ins from known locations.Which two actions should you perform? Each correct answer presents part of the solution.Note: Each correct selection is worth one point.
Answer(s): A,B
Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.You are configuring Microsoft Defender for Identity integration with Active Directory.From the Microsoft Defender portal, you need to configure several accounts for attackers to exploit.Solution: You add each account as a Sensitive account.Does this meet the goal?
Answer(s): B
https://docs.microsoft.com/en-us/defender-for-identity/manage-sensitive-honeytoken-accounts
You have a Microsoft 365 tenant that uses Microsoft Exchange Online and Microsoft Defender for Office 365.What should you use to identify whether zero-hour auto purge (ZAP) moved an email message from the mailbox of a user?
To determine if ZAP moved your message, you can use either the Threat Protection Status report or Threat Explorer (and real-time detections).
https://docs.microsoft.com/en-us/microsoft-365/security/office-365-security/zero-hour-auto-purge?view=o365-worldwide
You have a Microsoft 365 subscription that contains 1,000 Windows 11 devices.The devices have Microsoft 365 Apps installed and are onboarded to Microsoft Defender for Endpoint.You need to mitigate the following device threats:-Microsoft Excel macros that download scripts from untrusted websites-Users that open executable attachments in Microsoft Outlook-Outlook rules and forms exploitsWhat should you use?
Attack surfaces are all the places where your organization is vulnerable to cyberthreats and attacks. Defender for Endpoint includes several capabilities to help reduce your attack surfaces.Incorrect: * antivirus exclusions of Microsoft Defender for Endpoint Exclusions would reduce the protection.
https://docs.microsoft.com/en-us/microsoft-365/security/defender-endpoint/overview-attack-surface-reduction? view=o365-worldwide
You have a third-party security information and event management (SIEM) solution.You need to ensure that the SIEM solution can generate alerts for Azure Active Directory (Azure AD) sign-events in near real time.What should you do to route events to the SIEM solution?
https://docs.microsoft.com/en-us/azure/active-directory/reports-monitoring/overview-monitoring
Share your comments for Microsoft SC-200 exam with other users:
awesome contents