참고: ITDumpsKR에서 Google Drive로 공유하는 무료 2026 Microsoft SC-200 시험 문제집이 있습니다: https://drive.google.com/open?id=1n-rfISzrLANxm2QmQrnUghTyBXse-IkK
우리ITDumpsKR에서는 각종IT시험에 관심있는분들을 위하여, 여러 가지 인증시험자료를 제공하는 사이트입니다. 우리ITDumpsKR는 많은 분들이 IT인증시험을 응시하여 성공할수록 도와주는 사이트입니다. 우리의 파워는 아주 대단하답니다. 여러분은 우리ITDumpsKR 사이트에서 제공하는Microsoft SC-200관련자료의 일부분문제와답등 샘플을 무료로 다운받아 체험해봄으로 우리에 믿음이 생기게 될 것입니다.
Microsoft SC-200 (Microsoft Security Operations Analyst) 시험은 Microsoft 환경에서 보안 사건을 식별, 조사 및 대응하는 데 필요한 기술과 지식을 시험하는 자격증 시험입니다. 이 시험은 보안 작업에 경험이 있는 보안 전문가를 대상으로 하며, 인정받는 자격증으로 자신의 기술을 검증하고자 하는 사람들을 위해 제공됩니다. 이 시험은 위협 탐지, 사건 대응, 클라우드 보안 및 규정 준수와 관련된 다양한 주제를 다룹니다.
ITDumpsKR는Microsoft SC-200시험에 필요한 모든 문제유형을 커버함으로서 Microsoft SC-200시험을 합격하기 위한 최고의 선택이라 할수 있습니다. Microsoft SC-200시험 Braindump를 공부하면 학원다니지 않으셔도 자격증을 취득할수 있습니다. Microsoft SC-200 덤프정보 상세보기는 이 글의 링크를 클릭하시면 ITDumpsKR사이트에 들어오실수 있습니다.
마이크로소프트 SC-200은 또한 마이크로소프트 보안 운영 분석가 자격증 시험으로 알려져 있으며, 마이크로소프트 기술에서 보안 제어, 위협 및 취약점 관리, 사고 대응 및 컴플라이언스 프레임워크를 구현 및 관리하는 보안 전문가의 기술과 지식을 검증하고자 하는 사람들을 위해 설계되었습니다. 이 자격증 시험은 Azure, Microsoft 365 및 Windows 10과 같은 마이크로소프트 환경에서 보안 사건을 모니터링, 감지 및 대응하는 책임이 있는 개인들에게 이상적입니다.
질문 # 98
You have an Azure subscription that contains two users named User1 and User2 and a Microsoft Sentinel workspace named workspace1. You need to ensure that the users can perform the following tasks in workspace1:
* User1 must be able to dismiss incidents and assign incidents to users.
* User2 must be able to modify analytics rules.
The solution must use the principle of least privilege.
Which role should you assign to each user? To answer, drag the appropriate roles to the correct users. Each role may be used once, more than once, or not at all. You may need to drag the split bar between panes or scroll to view content.
NOTE: Each correct selection is worth one point.
정답：
설명：
Explanation:
In Microsoft Sentinel, different built-in roles provide access at varying levels of capability, following the principle of least privilege.
* Microsoft Sentinel Responder
* Purpose: Designed for SOC analysts responsible for handling and responding to incidents.
* Capabilities:
* View and investigate incidents.
* Assign incidents, dismiss incidents, and change incident statuses.
* Respond to alerts but cannot modify Sentinel configuration or analytics rules.
* # This matches the requirements for User1, who needs to dismiss and assign incidents.
* Microsoft Sentinel Contributor
* Purpose: Intended for security engineers or Sentinel administrators.
* Capabilities:
* Create, edit, and delete analytics rules, workbooks, hunting queries, and automation rules.
* Manage data connectors and configuration.
* Cannot assign permissions but can change Sentinel resources.
* # This matches the requirements for User2, who must be able to modify analytics rules.
Other roles for reference:
* Microsoft Sentinel Reader: View-only permissions.
* Microsoft Sentinel Automation Contributor: Allows playbook and automation editing.
* Contributor/Reader: General Azure roles, not Sentinel-specific.
질문 # 99
You have a Microsoft 365 subscription that uses Microsoft Defender for Endpoint Plan 2 and contains a Windows device named Device1.
Twenty files on Device1 are quarantined by custom indicators as part of an investigation.
You need to release the 20 files from quarantine.
How should you complete the command? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
정답：
설명：
Explanation:
질문 # 100
You have a Microsoft Sentinel workspace that contains a custom workbook named Workbook1.
You need to create a visual based on the SecuntyEvent table. The solution must meet the following requirements:
* Identify the number of security events ingested during the past week.
* Display the count of events by day in a timechart
What should you add to Workbook1?
정답：C
설명：
In Microsoft Sentinel workbooks, a query visualization is used to retrieve and display data from tables (like SecurityEvent) using Kusto Query Language (KQL).
To meet the requirements:
* Identify the number of security events ingested in the past week.
* Display the count of events by day in a timechart.
You would add a KQL query control to the workbook, for example:
SecurityEvent
| where TimeGenerated > ago(7d)
| summarize Count = count() by bin(TimeGenerated, 1d)
| render timechart
* Metric is used for a single numeric value, not a chart.
* Group and Links or tabs are for workbook organization, not visualization.
# Correct answer: A. a query
질문 # 101
You need to implement the query for Workbook1 and Webapp1. The solution must meet the Microsoft Sentinel requirements. How should you configure the query? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.
정답：
설명：
Explanation:
질문 # 102
You have a Microsoft 365 E5 subscription that uses Microsoft Defender for Endpoint.
You have the on-premises devices shown in the following table.
You are preparing an incident response plan for devices infected by malware. You need to recommend response actions that meet the following requirements:
* Block malware from communicating with and infecting managed devices.
* Do NOT affect the ability to control managed devices.
Which actions should you use for each device? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
정답：
설명：
Explanation:
In Microsoft Defender for Endpoint (MDE), the actions available for a device depend on its onboarding and management state. These actions are part of the incident response toolkit used by SecOps analysts to contain, isolate, or investigate devices during malware incidents.
Device1 is onboarded and managed through Microsoft Defender for Endpoint, meaning it supports the full range of response actions, including:
* Isolate device - disconnects the device from the network while maintaining Defender for Endpoint connectivity for command and control.
* Contain device - blocks communication between this device and other devices, reducing lateral movement.
* Initiate Automated Investigation (AIR) - triggers Defender's automated threat investigation and remediation process.
According to Microsoft's official Defender for Endpoint documentation:
"For devices onboarded and managed by Microsoft Defender for Endpoint, SecOps can initiate automated investigations, isolate or contain devices, and perform live response actions." Thus, Device1 supports all three response actions.
# Answer for Device1: Isolate device, Initiate Automated Investigation, and Contain device Device2 is discovered but unmanaged, meaning it has not been onboarded to Defender for Endpoint. For unmanaged or discovered-only devices, the available actions are limited. Microsoft documentation clearly states:
"For unmanaged devices discovered by Defender for Endpoint, response actions such as containment or investigation are unavailable. Only isolation recommendations can be made if supported." Because Device2 is a Linux device and not onboarded, the platform cannot perform full remediation or containment. The only applicable action that aligns with incident containment (but not management interference) is isolating the device from the network to prevent malware spread.
# Answer for Device2: Isolate device only
# Final Answers Summary:
* Device1: Isolate device, Initiate Automated Investigation, and Contain device
* Device2: Isolate device only
질문 # 103
......
SC-200유효한 공부자료: https://www.itdumpskr.com/SC-200-exam.html
참고: ITDumpsKR에서 Google Drive로 공유하는 무료, 최신 SC-200 시험 문제집이 있습니다: https://drive.google.com/open?id=1n-rfISzrLANxm2QmQrnUghTyBXse-IkK