P.S. PDFExamDumps在Google Drive上分享了免費的、最新的SC-200考試題庫：https://drive.google.com/open?id=1XHLDYlCcRIuFmmpC3aqE51m8IuRtY5Ur
如果你擁有了PDFExamDumps Microsoft的SC-200考試培訓資料，我們將免費為你提供一年的更新，這意味著你總是得到最新的考試認證資料，只要考試目標有所變化，以及我們的學習材料有所變化，我們將在第一時間為你更新。我們知道你的需求，我們將幫助得到 Microsoft的SC-200考試認證的信心，讓你可以安然無憂的去參加考試，並順利通過獲得認證。
| Section | Weight | Objectives |
|---|---|---|
| Topic 1: Mitigate threats using Microsoft Sentinel | 40-45% | - Perform threat hunting and investigation
|
| Topic 2: Mitigate threats using Microsoft 365 Defender | 25-30% | - Investigate and respond to threats
|
| Topic 3: Mitigate threats using Microsoft Defender for Cloud | 25-30% | - Configure cloud security posture management
|
如果你參加Microsoft SC-200認證考試，你選擇PDFExamDumps就是選擇成功！祝你好運。
問題 #138
You have a Microsoft 365 subscription that uses Microsoft Defender XDR. You need to implement deception rules. The solution must ensure that you can limit the scope of the rules.
What should you create first? A. device groups
答案：D
解題說明：
In Microsoft Defender XDR, deception rules (part of the Defender for Endpoint Deception capability) allow security teams to deploy decoys and honeytokens to lure attackers. When configuring deception rules, scope management is essential to control which devices the rule applies to.
According to Microsoft's Defender XDR documentation:
"Deception rules can be targeted to specific devices or sets of devices by assigning them to device groups.
Device groups allow you to manage and scope rules, configurations, and alerts efficiently." Therefore, before creating a deception rule that must apply only to a specific subset of devices, you first create device groups - then assign the deception rule to those groups.
問題 #139
You have a Microsoft Sentinel workspace named workspace1 and an Azure virtual machine named VM1.
You receive an alert for suspicious use of PowerShell on VM1.
You need to investigate the incident, identify which event triggered the alert, and identify whether the following actions occurred on VM1 after the alert:
The modification of local group memberships
The purging of event logs
Which three actions should you perform in sequence in the Azure portal? To answer, move the appropriate actions from the list of actions to the answer area and arrange them in the correct order.
答案：
解題說明：
1 - From the Investigation blade, select Insights.
2 - From the Investigation blade, select the entity that represents VM1.
3 - From the details pane of the incident, select Investigate.
Reference:
https://github.com/Azure/Azure-Sentinel/wiki/Investigation-Insights---Overview
https://docs.microsoft.com/en-us/azure/sentinel/investigate-cases
問題 #140
You have a Microsoft 365 subscription that uses Microsoft 365 Defender and contains a user named User1.
You are notified that the account of User1 is compromised.
You need to review the alerts triggered on the devices to which User1 signed in.
How should you complete the query? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
答案：
解題說明：
Explanation:
Box 1: join
An inner join.
This query uses kind=inner to specify an inner-join, which prevents deduplication of left side values for DeviceId.
This query uses the DeviceInfo table to check if a potentially compromised user ( < account-name > ) has logged on to any devices and then lists the alerts that have been triggered on those devices.
DeviceInfo
//Query for devices that the potentially compromised account has logged onto
| where LoggedOnUsers contains ' < account-name > '
| distinct DeviceId
//Crosscheck devices against alert records in AlertEvidence and AlertInfo tables
| join kind=inner AlertEvidence on DeviceId
| project AlertId
//List all alerts on devices that user has logged on to
| join AlertInfo on AlertId
| project AlertId, Timestamp, Title, Severity, Category
DeviceInfo LoggedOnUsers AlertEvidence " project AlertID "
Box 2: project
Reference: https://docs.microsoft.com/en-us/microsoft-365/security/defender/advanced-hunting-query-emails- devices?view=o365-worldwide
問題 #141
You have a Microsoft 365 E5 subscription that uses Microsoft Defender 36S.
Your network contains an on-premises Active Directory Domain Services (AD DS) domain that syncs with Azure AD.
You need to identify the 100 most recent sign-in attempts recorded on devices and AD DS domain controllers.
How should you complete The KQL query? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
答案：
解題說明：
Explanation
問題 #142
Hotspot Question
You have a Microsoft Sentinel workspace named sws1.
You need to create a query that will detect when a user creates an unusually large numbers of Azure AD user accounts.
How should you complete the query? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
答案：
解題說明：
問題 #143
......
您是否感興趣想通過SC-200考試，然后開始您的高薪工作？PDFExamDumps擁有最新研發的題庫問題及答案，可以幫助數百萬的考生通過SC-200考試并獲得認證。我們提供給您最高品質的Microsoft SC-200題庫問題及答案，覆蓋面廣，可以幫助考生進行有效的考前學習。所有購買SC-200題庫的客戶都將得到一年的免費升級服務，這讓您擁有充裕的時間來完成考試。我們會100%為您提供方便以及保障，請記住能讓您100%通過考試的題庫就是我們的Microsoft SC-200考古題。
SC-200權威考題: https://www.pdfexamdumps.com/SC-200_valid-braindumps.html
2026 PDFExamDumps最新的SC-200 PDF版考試題庫和SC-200考試問題和答案免費分享：https://drive.google.com/open?id=1XHLDYlCcRIuFmmpC3aqE51m8IuRtY5Ur