SC-200 Practice Test 1 — 10 Questions

Question 1

Match each Microsoft Sentinel data connector on the left with the table name it populates on the right.

Accepted Answer

Microsoft Entra ID → SigninLogs; Windows Security Events via AMA → SecurityEvent; Cisco ASA via Syslog → CommonSecurityLog; Azure Activity → AzureActivity. It accurately maps each Microsoft Sentinel data connector to its corresponding log table. Microsoft Entra ID populates the SigninLogs table, Windows Security Events via AMA populates the SecurityEvent table, Cisco ASA via Syslog populates the CommonSecurityLog table (which is the standard schema for syslog-based security appliances), and Azure Activity populates the AzureActivity table. These mappings are defined by the data connectors themselves and are fundamental to querying the correct data in Sentinel.

Answer

The first and last mappings are swapped.

Answer

Every item maps to the same log table or feature category.

Answer

Only identity-related items are mapped; workload and network items are omitted.

Question 2

Which THREE steps are part of the incident response process when using Microsoft Sentinel?

Accepted Answer

Investigate the incident using hunting queries and entity timelines.. Investigating an incident using hunting queries and entity timelines is a core step in the Microsoft Sentinel incident response process. After an incident is created, analysts use KQL-based hunting queries to proactively search for related threats and leverage entity timelines to visualize the sequence of events and entity interactions, which is essential for understanding the scope and impact of the incident.

Answer

Identify the incident by creating an analytics rule.

Answer

Report the incident to the security team via email.

Question 3

A security analyst is investigating a suspicious process on an endpoint and needs to see all network connections initiated by that process. The analyst knows the ProcessId and DeviceName. Which advanced hunting table in Microsoft 365 Defender should the analyst query to retrieve network connection details associated with this process?

Accepted Answer

DeviceNetworkEvents. The DeviceNetworkEvents table in Microsoft 365 Defender is specifically designed to capture network connection events, including source and destination IP addresses, ports, protocols, and the initiating process ID (ProcessId). By querying this table with the known ProcessId and DeviceName, the analyst can retrieve all network connections initiated by that process, making it the correct choice for this investigation.

Answer

DeviceProcessEvents

Answer

DeviceEvents

Answer

IdentityLogonEvents

Question 4

A SOC analyst needs to investigate a potential data exfiltration incident involving a user uploading files to an external cloud storage service. Which Microsoft Sentinel data source would provide the MOST relevant information?

Accepted Answer

OfficeActivity. OfficeActivity (D) is the correct data source because it captures audit logs from Microsoft 365 services, including SharePoint Online, OneDrive for Business, and Exchange Online. These logs record file uploads, downloads, and sharing events, making them the most relevant for investigating data exfiltration to external cloud storage services like OneDrive or SharePoint.

Answer

SigninLogs

Answer

CommonSecurityLog

Answer

AzureActivity

Question 5

Refer to the exhibit. A Microsoft Sentinel scheduled rule is configured as shown. The rule generates an alert, but the incident created contains only the first alert, and subsequent alerts do not update the incident. What is the most likely cause?

Accepted Answer

The rule does not have incident grouping enabled.. The exhibit shows the rule is configured to create a single incident from alerts grouped by entities, but the 'Grouping' settings are not enabled. Without incident grouping enabled, each alert generates a separate incident, and subsequent alerts do not update the existing incident. Enabling incident grouping allows alerts matching the same grouping criteria to be merged into the same incident, ensuring updates occur.

Answer

The triggerOperator and triggerThreshold are misconfigured.

Answer

The KQL query is missing a join to include more data.

Answer

The severity is set to High, which prevents incident updates.

Question 6

Which TWO of the following are required to enable Microsoft Sentinel to receive alerts from Microsoft Defender for Cloud? (Choose two.)

Accepted Answer

Install the 'Microsoft Defender for Cloud' data connector in Microsoft Sentinel.. The 'Microsoft Defender for Cloud' data connector in Microsoft Sentinel is the specific integration point that ingests security alerts from Defender for Cloud into Sentinel. Without installing and configuring this connector, Sentinel cannot receive the alerts, even if Defender for Cloud is enabled on the subscription.

Answer

Deploy the Log Analytics agent on all VMs.

Answer

Connect a non-Azure machine using Azure Arc.

Answer

Assign an Azure Policy to enable Defender for Cloud.

Question 7

Which TWO actions are effective when threat hunting for lateral movement using remote desktop protocol (RDP) in Microsoft Defender XDR?

Accepted Answer

Query DeviceNetworkEvents for inbound connections on port 3389. Querying DeviceNetworkEvents for inbound RDP connections (port 3389) helps identify potential lateral movement. Correlating with LogonEvents for successful RDP logins confirms the movement. Option B (reviewing CloudAppEvents) is not directly RDP-related but could indicate lateral movement via cloud apps. Option D (checking for unusual email forwarding rules) is typically for exfiltration, not lateral movement. Option E (searching for SMB file share connections) is more related to file sharing and not specifically RDP lateral movement.

Answer

Review CloudAppEvents for access to cloud apps from multiple IPs

Answer

Check for unusual email forwarding rules

Answer

Search for SMB file share connections

Question 8

A SOC analyst in Microsoft Sentinel is creating a scheduled analytics rule to detect a possible password spray attack. The rule must trigger when a single source IP address has more than 10 failed logon attempts on different user accounts within a 30-minute window. The analyst writes a KQL query starting with 'SigninLogs | where ResultType == 50057' (failed logon). Which operator should the analyst use to group events by source IP and count distinct user accounts, then filter for counts above 10?

Accepted Answer

summarize. The `summarize` operator is required to group events by source IP address and count distinct user accounts using `dcount()` or `count()`. After summarizing, you apply a `where` clause to filter for counts above 10, which meets the rule's threshold. This is the standard pattern for aggregation in KQL.

Answer

where

Answer

extend

Answer

project

Question 9

Which THREE are valid incident classification options in Microsoft Sentinel?

Accepted Answer

Benign Positive. (Benign Positive) is correct because Microsoft Sentinel uses incident classification to categorize the outcome of an investigation. A Benign Positive indicates that an alert is triggered by legitimate activity that is expected or acceptable, such as a security tool scanning the network or a user performing an authorized administrative task. This classification helps analysts distinguish between true threats and harmless events without marking them as false positives.

Answer

Informational

Answer

Malicious

Question 10

Your organization uses Microsoft Sentinel. You receive an alert for a suspicious sign-in from an unusual location. You want to automatically create an incident and assign it to the security team for investigation. What should you configure?

Accepted Answer

Configure an automation rule that runs when the alert is generated, creates an incident, and sets the owner to the security team.. Automation rules in Microsoft Sentinel allow you to automatically create incidents from alerts and assign them to specific teams or owners. This is the native, efficient method to handle the scenario without manual intervention or custom playbooks.

Answer

Add the user to a watchlist and configure a fusion rule.

Answer

Create a playbook that triggers on the alert and creates an incident manually.

Answer

Modify the analytics rule to set the incident creation setting to 'Create incident from alert'.