SC-200 Practice Test 4 — 10 Questions

Question 1

A SOC analyst is creating a new analytics rule in Microsoft Sentinel to detect when a user account is disabled. The analyst needs to select a rule template that uses Microsoft Entra ID audit logs. Which rule type should the analyst choose?

Accepted Answer

Scheduled. A scheduled query rule is the correct choice because it allows the analyst to define a KQL query that runs on a fixed interval (e.g., every 5 minutes) against Microsoft Entra ID audit logs, which are stored in the AuditLogs table. This is the standard approach for detecting patterns like account disable events, as it provides full control over the query logic and scheduling frequency.

Answer

NRT (Near-Real-Time)

Answer

Anomaly

Answer

Fusion

Question 2

A SOC analyst wants to create a Microsoft Sentinel scheduled analytics rule that alerts when a user from a critical department (e.g., Finance) logs on from an IP address that is not in the company's approved IP address ranges. The analyst has an Azure Sentinel watchlist named 'FinanceApprovedIPs' containing the allowed IP ranges. Which KQL operator should be used in the rule's query to efficiently check if the IP address from SigninLogs falls within any of the watchlist ranges?

Accepted Answer

join kind=inner (watchlist) on $left.IPAddress $right.IPRange with condition using ipv4_is_in_range() or ipv4_lookup(). Option A is correct because the `ipv4_lookup()` function (or `ipv4_is_in_range()` used with a join) is specifically designed to efficiently check whether an IP address falls within a range defined in a watchlist. In Microsoft Sentinel, watchlists store data as tables, and `ipv4_lookup()` performs a range-based lookup using CIDR notation, which is far more efficient than string-based or exact-match operators. This allows the query to match the `IPAddress` from `SigninLogs` against the `IPRange` column in the `FinanceApprovedIPs` watchlist without iterating over every possible address.

Answer

where IPAddress has any (watchlist)

Answer

where IPAddress in (watchlist)

Answer

where IPAddress startswith (watchlist)

Question 3

A SOC team ingests Microsoft 365 Defender advanced hunting data into Microsoft Sentinel. They want to create a scheduled analytics rule that detects when a user receives more than 5 emails from an external sender containing a specific attachment name within 1 hour. Which KQL tables and approach should the analyst use?

Accepted Answer

EmailEvents and EmailAttachmentInfo; summarize count() by AccountUpn, AttachmentFileName, bin(Timestamp,1h). Option A is correct because the detection requires joining EmailEvents (which contains sender/recipient metadata) with EmailAttachmentInfo (which contains attachment file names) to filter by external senders and a specific attachment name, then using summarize count() with bin(Timestamp,1h) to group events into 1-hour windows and identify users receiving more than 5 such emails. This approach directly maps to the requirement: external sender, attachment name, user identity (AccountUpn), and time-based aggregation.

Answer

EmailEvents and EmailUrlInfo; summarize count() by SenderObjectId

Answer

EmailEvents only; filter by AttachmentFileName

Answer

EmailPostDeliveryEvents; summarize count() by RecipientEmailAddress

Question 4

An analyst is investigating a data exfiltration incident. They suspect that a user downloaded sensitive files from a SharePoint site and then uploaded them to a non-corporate cloud storage service (e.g., Dropbox) using the same device. Which combination of Advanced Hunting tables should the analyst query to correlate the SharePoint download activity with network connections to external IPs?

Accepted Answer

CloudAppEvents and DeviceNetworkEvents. CloudAppEvents logs user activities in cloud apps like SharePoint, including file downloads. DeviceNetworkEvents logs network connections from devices, including connections to external IPs. Combining these tables allows the analyst to correlate the SharePoint download event (from CloudAppEvents) with subsequent network connections to non-corporate cloud storage IPs (from DeviceNetworkEvents) on the same device, directly mapping the exfiltration path.

Answer

EmailEvents and DeviceNetworkEvents

Answer

DeviceFileEvents and DeviceNetworkEvents

Answer

CloudAppEvents and IdentityLogonEvents

Question 5

A SOC analyst is creating an automation rule in Microsoft Sentinel to trigger a playbook when a new incident is created. The analyst wants the rule to apply only to incidents that have a severity of 'High' and where the 'User' entity is present. Which condition configuration should the analyst use?

Accepted Answer

Set 'Incident severity equals High' and 'Entity type contains User'. Option B is correct because Microsoft Sentinel automation rules evaluate conditions at the incident level, not the alert level. The 'Incident severity equals High' condition filters by incident severity, and 'Entity type contains User' checks that the incident's entities include a User entity, which is required for the playbook to receive entity context.

Answer

Set 'Incident severity equals High' and 'Incident tag contains User'

Answer

Set 'Alert severity equals High' and 'Alert entity type contains User'

Answer

Set 'Incident provider equals Microsoft Sentinel' and 'Entity type contains User'

Question 6

An organization has enabled Microsoft Defender for Cloud's enhanced security features. They want to ensure that newly provisioned Azure virtual machines automatically have the built-in vulnerability assessment solution installed. Which configuration should they enable in Defender for Cloud?

Accepted Answer

Auto-provisioning of the vulnerability assessment solution. Option B is correct because Microsoft Defender for Cloud's enhanced security features include a dedicated auto-provisioning setting specifically for the built-in vulnerability assessment solution (powered by Qualys). When enabled, this setting automatically deploys the vulnerability assessment extension to all new and existing Azure VMs, ensuring continuous vulnerability scanning without manual intervention.

Answer

Auto-provisioning of the Log Analytics agent

Answer

Automatic provisioning of all security agents

Answer

Azure Policy assignment for Update Management

Question 7

A security analyst is investigating an advanced persistent threat (APT) campaign that involves lateral movement using RDP. The analyst wants to create a custom detection rule in Microsoft 365 Defender that triggers when a device remotely connects to another device via RDP (process: mstsc.exe) and, within 10 minutes, the remote device executes a suspicious script (e.g., PowerShell.exe with encoded command). Which KQL query pattern in advanced hunting should be used to correlate these events across devices?

Accepted Answer

DeviceProcessEvents | where FileName == 'mstsc.exe' | project SourceDevice = DeviceName, TimeGenerated, RemoteDevice = extract(remote device from command line) | join kind=inner (DeviceProcessEvents | where FileName == 'powershell.exe') on $left.RemoteDevice == $right.DeviceName and $left.TimeGenerated between ($right.TimeGenerated-10m .. $right.TimeGenerated). Option B is correct because it uses the `extract()` function to parse the remote device name from the `mstsc.exe` command line (e.g., `mstsc.exe /v:REMOTE_PC`), then performs an inner join with `DeviceProcessEvents` for `powershell.exe` on the condition that the remote device name matches and the `mstsc.exe` timestamp falls within a 10-minute window before the PowerShell execution. This precisely correlates the lateral movement (RDP connection) with the subsequent suspicious script execution on the target device, which is the required detection pattern.

Answer

DeviceProcessEvents | where FileName == 'mstsc.exe' | join DeviceProcessEvents on DeviceName | where (Timestamp2 - Timestamp1) between (0m..10m) and FileName == 'powershell.exe'

Answer

DeviceProcessEvents | where FileName in~ ('mstsc.exe', 'powershell.exe') and TimeGenerated > ago(1h) | summarize makelist(DeviceName) by bin(TimeGenerated, 10m)

Answer

DeviceProcessEvents | where FileName == 'mstsc.exe' | extend RemoteDevice = extract(...,1, ProcessCommandLine) | join kind=inner (DeviceProcessEvents | where FileName == 'powershell.exe') on $left.RemoteDevice == $right.DeviceName and $left.TimeGenerated between ($right.TimeGenerated - 10m .. $right.TimeGenerated)

Question 8

A SOC analyst wants to detect when a user signs in from a device that has never been used by that user before. The analyst plans to use Microsoft Sentinel with the SigninLogs table. Which KQL approach correctly identifies sign-ins from devices not previously associated with the user within the last 30 days?

Accepted Answer

Join the SigninLogs table with itself to find the earliest sign-in per user and device, then filter for those that match the earliest timestamp. Option A is correct because it uses a self-join on the SigninLogs table to identify the earliest sign-in per user-device pair within the last 30 days. By filtering for rows where the sign-in timestamp matches the earliest timestamp, the query isolates sign-ins from devices that have never been used by that user before, effectively detecting first-time device usage.

Answer

Use the _GetWatchlist function with a custom watchlist of known user-device pairs

Answer

Use the BehaviorAnalytics table which already identifies new devices

Answer

Apply the 'where DeviceId != '' and DeviceId startswith "device-"' filter to ensure the device is new

Question 9

A SOC analyst needs to create a scheduled analytics rule in Microsoft Sentinel that detects when a user logs in from an IP address that is not in a predefined list of known corporate IP ranges. The list is maintained as a custom Sentinel watchlist and frequently updated. Which KQL function should the analyst use to reference the watchlist within the rule's query?

Accepted Answer

_GetWatchlist(). The _GetWatchlist() function is the correct KQL function to reference a custom Sentinel watchlist within an analytics rule query. It retrieves the watchlist content as a table, allowing the analyst to join or filter login events against the known corporate IP ranges. This function is specifically designed for Sentinel watchlists and supports frequent updates without modifying the rule query.

Answer

externaldata()

Answer

lookup()

Answer

invoke()

Question 10

A threat hunter in Microsoft Sentinel writes a KQL query in the Logs blade to find possible data exfiltration. The query uses the CommonSecurityLog table to look for large outbound file transfers from a specific IP address. The analyst wants to include only events where the total bytes sent in a 5-minute window exceed 100 MB. Which KQL operator combination would best achieve this?

Accepted Answer

CommonSecurityLog | where SourceIp == '10.0.0.1' | summarize totalBytes = sum(BytesSent) by bin(TimeGenerated, 5m) | where totalBytes > 100000000. Option A is correct because it first filters the CommonSecurityLog table for the specific source IP, then uses `summarize` with `bin(TimeGenerated, 5m)` to aggregate total bytes sent in 5-minute windows, and finally filters for windows where the sum exceeds 100 MB (100,000,000 bytes). This correctly implements a time-windowed aggregation to detect large outbound transfers, which is the standard pattern for identifying data exfiltration over a period.

Answer

CommonSecurityLog | where SourceIp == '10.0.0.1' | extend bin = bin(TimeGenerated, 5m) | where BytesSent > 100000000

Answer

CommonSecurityLog | where SourceIp == '10.0.0.1' | summarize make_list(BytesSent) by TimeGenerated | where array_length(make_list) > 100000000

Answer

CommonSecurityLog | where SourceIp == '10.0.0.1' | project BytesSent, TimeGenerated | summarize sum(BytesSent) by bin(TimeGenerated, 5m) | where sum_BytesSent > 100000000