SC-200 Practice Test 10 — 10 Questions

Question 1

A security analyst is configuring a Microsoft Sentinel workspace. The analyst needs to connect a third-party firewall that sends logs via Syslog and supports a common event format (CEF). Which data connector should the analyst use to ingest these logs?

Accepted Answer

Common Event Format (CEF) via AMA. The Common Event Format (CEF) via AMA data connector is specifically designed to ingest logs from security appliances that send Syslog messages in CEF format. CEF is an industry-standard format that allows firewalls and other devices to send structured event data, and the Azure Monitor Agent (AMA) replaces the older Log Analytics Agent for this purpose. This connector parses the CEF headers and maps the fields to the appropriate Microsoft Sentinel tables, enabling efficient threat detection and analysis.

Answer

Windows Security Events via AMA

Answer

Azure Activity Log

Answer

Office 365 connector

Question 2

A security analyst is investigating a potential data exfiltration incident in Microsoft 365 Defender. They have identified a suspicious email sent to an external recipient containing an attachment. They want to know if the attachment has been opened and if any sensitive data was accessed. Which advanced hunting table should the analyst query to find email attachment activities, such as file download or view?

Accepted Answer

EmailEvents. B is correct because EmailEvents is the advanced hunting table in Microsoft 365 Defender that captures email-level activities, including whether an attachment was opened or viewed by the recipient. This table contains actions such as 'Email open' and 'Attachment open', which directly answer the analyst's question about attachment access and potential data exfiltration.

Answer

DeviceFileEvents

Answer

EmailAttachmentInfo

Answer

UrlClickEvents

Question 3

A security analyst is investigating a phishing incident in Microsoft 365 Defender. They need to view the original email's sender, delivery action, and any automated remediation steps taken. Which entity page should the analyst open?

Accepted Answer

Email entity page. The Email entity page in Microsoft 365 Defender (part of Microsoft Defender XDR) is specifically designed to provide a comprehensive view of an email message, including the original sender, delivery action (e.g., delivered, quarantined, blocked), and any automated remediation steps (e.g., zero-hour auto purge, soft delete). This page aggregates data from Exchange Online Protection (EOP) and Microsoft Defender for Office 365, making it the correct choice for investigating phishing incidents.

Answer

User entity page

Answer

Device entity page

Answer

IP entity page

Question 4

A security analyst is investigating a ransomware attack in Microsoft 365 Defender and needs to understand how the attacker moved laterally from an initial compromised workstation to a domain controller. Which feature should the analyst use to see a visual timeline of device-to-device connections and process executions?

Accepted Answer

Incident graph (attack story). The Incident graph (attack story) in Microsoft 365 Defender provides a visual, interactive timeline that correlates alerts, device-to-device connections, and process executions across the entire attack chain. This allows the analyst to trace lateral movement from the initial compromised workstation to the domain controller in a single, consolidated view, which is exactly what the question requires.

Answer

Device timeline view for each affected device

Answer

Advanced hunting with DeviceNetworkEvents and DeviceProcessEvents

Answer

Automated investigation report

Question 5

A security analyst is investigating a suspicious process on an endpoint and needs to see all network connections initiated by that process. The analyst knows the ProcessId and DeviceName. Which advanced hunting table in Microsoft 365 Defender should the analyst query to retrieve network connection details associated with this process?

Accepted Answer

DeviceNetworkEvents. The DeviceNetworkEvents table in Microsoft 365 Defender is specifically designed to capture network connection events, including source and destination IP addresses, ports, protocols, and the initiating process ID (ProcessId). By querying this table with the known ProcessId and DeviceName, the analyst can retrieve all network connections initiated by that process, making it the correct choice for this investigation.

Answer

DeviceProcessEvents

Answer

DeviceEvents

Answer

IdentityLogonEvents

Question 6

A security analyst wants to quickly check the number of incidents created in Microsoft Sentinel in the last 7 days, grouped by severity. Which KQL query should the analyst use?

Accepted Answer

SecurityIncident | where TimeGenerated > ago(7d) | summarize count() by Severity. Option A is correct because the SecurityIncident table in Microsoft Sentinel stores incident records, and the query filters for incidents created in the last 7 days using `where TimeGenerated > ago(7d)`, then groups them by severity with `summarize count() by Severity`. This directly answers the analyst's need to check the number of incidents grouped by severity.

Answer

SecurityAlert | where TimeGenerated > ago(7d) | summarize count() by Severity

Answer

SigninLogs | where TimeGenerated > ago(7d) | summarize count() by Status

Answer

DeviceEvents | where TimeGenerated > ago(7d) | summarize count() by ActionType

Question 7

A security analyst is reviewing a phishing incident in Microsoft 365 Defender. They need to find all users who received a specific email message by searching for the email's Internet Message ID. Which advanced hunting table should the analyst query?

Accepted Answer

EmailEvents. The EmailEvents table in Advanced Hunting stores metadata about email transactions, including the Internet Message ID (a unique identifier defined in RFC 5322). By querying this table with the specific Internet Message ID, the analyst can retrieve all recipients who received that exact email, making it the correct choice for this scenario.

Answer

EmailAttachmentInfo

Answer

EmailUrlInfo

Answer

AADSignInEventsBeta

Question 8

A security analyst is triaging security alerts in Microsoft Defender for Cloud. Which of the following are valid ways to suppress a specific alert type to reduce noise? (Choose all that apply.)

Accepted Answer

Create an alert suppression rule based on alert entity. Option A is correct because Microsoft Defender for Cloud allows you to create suppression rules that automatically dismiss alerts based on specific alert entities (such as alert ID, title, or severity) to reduce noise. These rules are configured in the security alerts settings and can be scoped to a subscription or management group, ensuring that alerts matching the defined criteria are silently dismissed without generating incidents.

Answer

Modify the alert's severity

Answer

Set an automatic response action

Question 9

A security analyst is using Microsoft 365 Defender advanced hunting to investigate a ransomware incident. The analyst wants to find all processes that were created with a specific parent process ID. Which column in the DeviceProcessEvents table should the analyst use to filter the parent process?

Accepted Answer

ParentProcessId. The ParentProcessId column in the DeviceProcessEvents table stores the process ID (PID) of the parent process that created a given process. By filtering on this column, the analyst can identify all child processes spawned by a specific parent, which is critical for tracing ransomware execution chains in advanced hunting queries.

Answer

ProcessId

Answer

InitiatingProcessId

Answer

LogonId

Question 10

A security analyst reviews Microsoft Defender for Cloud recommendations for an Azure virtual machine. The VM has a recommendation titled 'Install endpoint protection solution on virtual machines'. The analyst clicks on the recommendation and sees affected resources. Which of the following best describes the purpose of this recommendation in the context of Defender for Cloud?

Accepted Answer

It advises deploying a supported endpoint protection solution, such as Microsoft Defender Antivirus, to protect the VM from malware and other threats.. Option D is correct because the recommendation 'Install endpoint protection solution on virtual machines' in Microsoft Defender for Cloud specifically identifies VMs that lack a supported endpoint protection solution (e.g., Microsoft Defender Antivirus, Trend Micro, Symantec). Its purpose is to ensure that VMs are protected against malware, viruses, and other threats by deploying an endpoint protection solution, which is a core security control in the cloud security posture management (CSPM) framework.

Answer

It identifies VMs that have an open network security group inbound rule that should be closed.

Answer

It suggests enabling Azure Firewall on the virtual network to protect the VM from external threats.

Answer

It recommends enabling disk encryption for the VM's OS and data disks.