SC-200 무료 덤프문제 온라인 액세스

You have an Azure subscription that contains the users shown in the following table.

You need to delegate the following tasks:
* Enable Microsoft Defender for Servers on virtual machines.
* Review security recommendations and enable server vulnerability scans.
The solution must use the principle of least privilege.
Which user should perform each task? To answer, drag the appropriate users to the correct tasks. Each user may be used once, more than once, or not at all. You may need to drag the split bar between panes or scroll to view content.
NOTE: Each correct selection is worth one point.

정답:

Explanation:
Answer Area Task
User
Enable Microsoft Defender for Servers on virtual machines:
User1
Review security recommendations and enable server vulnerability scans:
User1
* Query successful
This is a role-based access control (RBAC) question using the principle of least privilege.
The table of users and roles is:
Name
Role
User1
Security administrator
User2
Security reader
User3
Contributor
Export to Sheets
* Action: This is a management/configuration task at the subscription level, often related to enabling Defender plans and installing extensions on VMs.
* Required Permissions: The ability to modify security policies and settings in Microsoft Defender for Cloud and the permission to install extensions on VMs.
* The Security Administrator role is explicitly designed for this, granting permissions to manage the security features, policies, and program enrollment (like enabling Defender plans).
* The Contributor role can also perform this by installing the necessary agents and extensions, but it grants broad access to manage all resources, violating the principle of least privilege for a purely security-focused task.
* Least Privilege User: User1 (Security administrator)
* Action: This task has two parts:
* Review security recommendations: This is a read-only action. The Security Reader role is sufficient.
* Enable server vulnerability scans: This means configuring a security feature (Vulnerability Assessment), which requires write access to the security configuration or the resource itself.
* The Security Reader role cannot perform the " enable " action.
* The Security Administrator role has the permissions required to modify security policy and configuration to enable scanning features.
* The Contributor role can also do this, but again, the Security Administrator role is the least privileged for a security-specific configuration change.
* Least Privilege User: Since the entire task includes an " enable " (write) action, we must use the role that can perform both read and write security actions. User1 (Security administrator) is the appropriate choice.
Task Analysis and Role Mapping 1. Enable Microsoft Defender for Servers on virtual machines. 2. Review security recommendations and enable server vulnerability scans.
Answer Area Task
User
Enable Microsoft Defender for Servers on virtual machines:
User1
Review security recommendations and enable server vulnerability scans:
User1

You have a Microsoft 365 E5 subscription that contains a device named Device1. From the Microsoft Defender portal, you discover that an alert was triggered for Device1. From the Device inventory page, you isolate Device1. You need to collect a list of installed programs on Device1. What should you do?

• A.Run an advanced hunting query against the DeviceTvmSoftwarelnventory table.
• B.Run an advanced hunting query against the DeviceProcessEvents table.
• C.Initiate a live response session and run the processes command.
• D.Run an advanced hunting query against the DeviceTvmlnfoGathering table.

You have a Microsoft 365 subscription that uses Microsoft 365 Defender.
You plan to create a hunting query from Microsoft Defender.
You need to create a custom tracked query that will be used to assess the threat status of the subscription.
From the Microsoft 365 Defender portal, which page should you use to create the query?

• A.Threat analytics
• B.Advanced Hunting
• C.Policies & rules
• D.Explorer

You have a Microsoft 365 B5 subscription that contains two groups named Group! and Group2 and uses Microsoft Copilot for Security. You need to configure Copilot for Security role assignments to meet the following requirements:
* Ensure that members of Group1 can run prompts and respond to Microsoft Defender XDR security incidents.
* Ensure that members of Group2 can run prompts.
* Follow the principle of least privilege.
You remove Everyone from the Copilot Contributor role.
Which two actions should you perform next? Each correct answer presents part of the solution. NOTE: Each correct selection is worth one point.

• A.Assign the Copilot Owner role to Group2.
• B.Assign the Copilot Contributor role to Group2.
• C.Assign the Security Operator role to Group1.
• D.Assign the Security Operator role to Group2.
• E.Assign the Copilot Owner role to Group1.

You have a Microsoft 365 subscription that uses Microsoft Defender for Endpoint and contains a user named user1 and a Microsoft 365 group named Group1. All users are assigned a Defender for Endpoint Plan 1 license.
You enable Microsoft Defender XDR Unified role-based access control (RBAC) for Endpoints & Vulnerability Management.
You need to ensure that User1 can configure alerts that will send email notifications to Group1. The solution must follow the principle of least privilege.
Which permissions should you assign to User1?

• A.Manage security settings
• B.Live response capabilities: Basic
• C.Alerts investigation
• D.Defender Vulnerability Management - Remediation handling