Important Microsoft SC-200 Exam Questions

Answer: A

Explanation:

In Microsoft Defender XDR, the attack surface map visually prioritizes assets that are tagged as critical to your organization's operations. According to Microsoft's documentation:

''Critical asset rules help ensure high-value or sensitive resources are highlighted on the attack surface map for monitoring and correlation in incidents.''

To have DB1 (a database server) appear on the attack surface map, it must be designated as a critical asset. When you configure a critical asset rule, Defender XDR automatically classifies and surfaces that system on the map, enabling enhanced monitoring, prioritization, and contextual correlation in security incidents.

Other options do not achieve this:

Asset rule: general classification, not used for attack surface prioritization.

Honeytoken entity tag: marks decoy assets for threat detection.

Sensitive entity tag: used for sensitivity context in data or user-based scenarios.

Correct answer: A. a critical asset rule

Answer: B

Explanation:

In Microsoft Defender for Cloud's role-based access model, specific Azure built-in roles define what users can view and configure:

Security Reader: View-only access to Defender for Cloud recommendations and alerts.

Security Operator: Can view and dismiss alerts but cannot modify security policies.

Security Admin: Can view everything a reader can and additionally edit security policies, manage recommendations, and configure settings across Defender for Cloud.

Owner/Contributor: Have broader Azure resource management rights, exceeding what's required to manage Defender for Cloud policies---violating the principle of least privilege.

The principle of least privilege dictates assigning the narrowest role that allows performing the required tasks. In this case, the Security Admin role is explicitly documented by Microsoft as granting permission to modify security policies and settings in Defender for Cloud, without granting full subscription ownership rights.

Therefore, to allow User1 to modify Defender for Cloud security policies while maintaining least privilege: Assign the Security Admin role.

Answer: A

Explanation:

XDR Custom Detection Rules Documentation):

In Microsoft Defender XDR, custom detection rules are scheduled KQL queries that evaluate telemetry on a recurring schedule, using a lookback (loopback) period to determine how much historical data to analyze during each run.

The loopback period determines the time window over which data is evaluated (e.g., 12 hours, 48 hours). To change this period, administrators modify the rule's schedule configuration --- specifically the frequency or recurrence settings in the custom detection rule editor. The KQL query (including summarize or where operators) defines the logic but not the temporal scope of data evaluation.

Therefore, extending the loopback from 12 hours to 48 hours requires adjusting the frequency (schedule) configuration of the rule, not the query itself.

Correct Answe r: A. the frequency

Answer: C

Answer: B

Explanation:

Azure Identity Protection is used to detect and remediate risky sign-ins based on user behavior and risk levels, but it does not configure decoy or Honeytoken accounts. Honeytoken accounts are a Defender for Identity feature, not an Identity Protection feature.

The solution described (configuring sign-in risk policies in Azure Identity Protection) relates to conditional access and risk-based sign-in responses, not to creating monitored decoy accounts.

Hence, the goal of configuring several accounts for attacker exploitation (Honeytoken monitoring) is not met by this solution.