SC-200 Practice Test 11 — 15 Questions

Question 1

A security analyst uses Microsoft Defender for Cloud to monitor Azure SQL Databases. The analyst wants to generate alerts for SQL injection attempts but only for databases that contain sensitive data (e.g., credit card numbers). What is the most efficient way to configure alerting to focus on these databases?

Accepted Answer

Use Data Discovery & Classification in Azure SQL to label sensitive columns, then configure Advanced Threat Protection to alert only when a SQL injection event is detected against a database with those labels.. Option B is correct because it uses Azure SQL's Data Discovery & Classification to label sensitive columns (e.g., credit card numbers) and then configures Advanced Threat Protection (ATP) to alert only when a SQL injection event is detected against databases with those labels. This approach directly ties the alert trigger to the presence of sensitive data, ensuring alerts are generated only for relevant databases without manual per-database management. It is the most efficient method as it leverages built-in classification and ATP integration, avoiding unnecessary overhead or external dependencies.

Answer

Enable a custom alert rule in Microsoft Sentinel that queries Azure SQL audit logs and filters based on database classification tags.

Answer

Disable Advanced Threat Protection for all databases except those that contain sensitive data by manually enabling ATP per database.

Answer

Create a workflow automation in Defender for Cloud that filters SQL injection alerts based on database name.

Question 2

A security engineer is configuring Microsoft Defender for Cloud in a hybrid environment with on-premises servers connected via Azure Arc. The engineer wants to enable the Defender for Cloud plans for servers (including vulnerability assessment) on all Azure Arc-enabled machines. What is the correct method to deploy the Log Analytics agent (or Azure Monitor Agent) and the Microsoft Defender for Endpoint (MDE) integration?

Accepted Answer

Use the Defender for Cloud auto-provisioning feature with the Azure Policy 'Deploy Log Analytics agent' and enable MDE integration. Option B is correct because Defender for Cloud's auto-provisioning feature uses built-in Azure Policy initiatives to automatically deploy the Log Analytics agent (or Azure Monitor Agent) to Azure Arc-enabled machines, and it also enables the Microsoft Defender for Endpoint (MDE) integration via the 'Configure machines to receive a vulnerability assessment provider' policy. This ensures consistent, scalable deployment without manual intervention, aligning with the hybrid environment's requirements.

Answer

Manually install the Log Analytics agent on each machine and then enable MDE integration

Answer

Use Azure Arc extensions to install the agents and then configure Defender for Cloud plans

Answer

Deploy the agents via Configuration Manager

Question 3

A security operations analyst is creating a scheduled analytics rule in Microsoft Sentinel to detect brute force attempts on Microsoft Entra ID authentication. Which data source is most appropriate for this rule?

Accepted Answer

SigninLogs. SigninLogs captures user authentication attempts to Microsoft Entra ID, including failed sign-ins, which are essential for detecting brute force attacks. This data source provides detailed properties such as IP address, application, and status codes (e.g., 50076 for invalid password), enabling accurate detection of repeated failed attempts. Azure Activity Logs, Office Activity Logs, and SecurityEvent do not contain Entra ID authentication events.

Answer

Azure Activity Logs

Answer

Office Activity Logs

Answer

SecurityEvent

Question 4

A security team wants to automatically block an IP address in Azure Firewall when Microsoft Sentinel detects a high number of failed logins from that IP. Which automation approach should they use?

Accepted Answer

Create an automation rule that triggers on incident creation and runs a playbook that uses the Azure Firewall connector to add a rule.. Option C is correct because it uses an automation rule triggered on incident creation to run a playbook, which can leverage the Azure Firewall connector to add a blocking rule. This approach directly integrates Sentinel's detection of a high number of failed logins with automated remediation in Azure Firewall, ensuring a real-time response without manual intervention.

Answer

Create an automation rule that triggers a playbook directly.

Answer

Create a scheduled analytics rule that runs a playbook.

Answer

Configure a Logic App to poll Sentinel alerts and block IPs.

Question 5

A SOC analyst is creating a scheduled analytics rule in Microsoft Sentinel to detect when a user account is added to a privileged role in Microsoft Entra ID. The analyst wants to correlate with the user's previous role assignments to identify potential privilege escalation. Which table should the analyst query?

Accepted Answer

AuditLogs. The AuditLogs table in Microsoft Sentinel captures directory activity, including changes to privileged role assignments in Microsoft Entra ID (formerly Azure AD). By querying AuditLogs, the analyst can correlate the current role addition with historical role assignment events to detect potential privilege escalation. SigninLogs, AzureActivity, and SecurityEvent do not contain the specific role assignment audit data needed for this correlation.

Answer

SigninLogs

Answer

AzureActivity

Answer

SecurityEvent

Question 6

A SOC analyst is configuring a scheduled analytics rule in Microsoft Sentinel. The rule runs every hour and queries the SigninLogs table for failed sign-ins. The analyst wants to avoid generating multiple incidents for the same user and IP address within a 1-hour window. Which configuration should the analyst use in the 'Incident creation' section of the rule?

Accepted Answer

Set 'Alert per rule run' to 'Single alert per run' and enable 'Grouping' with 'Group all alerts into a single incident' and time window of 1 hour.. Option A is correct because setting 'Alert per rule run' to 'Single alert per run' ensures that all matching query results from a single run are bundled into one alert. Enabling 'Grouping' with 'Group all alerts into a single incident' and a 1-hour time window then merges alerts across multiple runs for the same user and IP into one incident, preventing duplicate incidents within that window. This directly meets the requirement to avoid multiple incidents for the same user and IP within an hour.

Answer

Set 'Alert per rule run' to 'Every event' and disable grouping.

Answer

Set 'Alert per rule run' to 'Single alert per run' and disable grouping.

Answer

Configure the rule to use 'Supply chain' analytics rule type.

Question 7

A SOC analyst needs to create a custom alert in Microsoft Sentinel that triggers when a specific user logs in from an unusual geographic location, compared to a learned baseline of normal locations. Which type of analytics rule is best suited for this scenario?

Accepted Answer

Anomaly detection rule (machine learning). Option C is correct because anomaly detection rules in Microsoft Sentinel use machine learning to establish a baseline of normal user behavior, such as typical geographic login locations. When a login event deviates significantly from this learned baseline, the rule triggers an alert. This is the only rule type specifically designed for detecting behavioral anomalies without requiring static thresholds or predefined patterns.

Answer

Scheduled query

Answer

Near-real-time (NRT) rule

Answer

Fusion rule

Question 8

A SOC analyst needs to create an automated response in Microsoft Sentinel that, when a specific type of incident is created, automatically creates a ticket in ServiceNow and blocks the source IP address in Azure Firewall. The analyst already has a playbook that performs these actions. What is the correct configuration to trigger this playbook?

Accepted Answer

Attach the playbook to an automation rule that includes the condition for the target incident type.. Automation rules in Microsoft Sentinel are the correct mechanism to trigger a playbook automatically when an incident is created. By attaching the playbook to an automation rule with a condition that matches the specific incident type (e.g., based on incident title or tag), the rule executes the playbook immediately upon incident creation, fulfilling the requirement without manual intervention.

Answer

Configure the playbook to run on a scheduled recurrence every 5 minutes.

Answer

Add the playbook to the incident's comments as a quick link.

Answer

Use a separate Power Automate flow with a trigger that watches for new Sentinel incidents.

Question 9

A SOC analyst needs to ingest firewall logs from an on-premises Cisco ASA into Microsoft Sentinel. The logs are sent via syslog to a Linux server. Which data connector should the analyst use to properly parse and collect these logs?

Accepted Answer

Common Event Format (CEF). The Common Event Format (CEF) connector is the correct choice because Cisco ASA firewalls send syslog messages that can be forwarded to a Linux log collector (rsyslog or syslog-ng), which then formats them into CEF (a normalized syslog format) before forwarding to the Sentinel Log Analytics workspace. This connector parses the CEF headers and maps the fields into the CommonSecurityLog table, enabling proper parsing and correlation of firewall events.

Answer

Syslog

Answer

Windows Firewall

Answer

Cisco ASA via API

Question 10

A SOC analyst wants to create a scheduled analytics rule in Microsoft Sentinel that runs every hour and detects multiple failed user login attempts from a single IP address within a 5-minute window. Which KQL function should be used in the query to group the failed events by 5-minute time intervals?

Accepted Answer

summarize count() by IPAddress, bin(TimeGenerated, 5m). Option A is correct because the `bin()` function in KQL is specifically designed to group data into fixed-size time buckets, such as 5-minute intervals. By using `summarize count() by IPAddress, bin(TimeGenerated, 5m)`, the query counts failed login attempts per IP address within each 5-minute window, which directly meets the requirement for a scheduled rule that detects multiple failures from a single IP in a 5-minute period.

Answer

summarize count() by IPAddress, TimeGenerated

Answer

extend interval = datetime_diff('minute', TimeGenerated, ago(5m))

Answer

scan with (match all events within 5m by IPAddress)

Question 11

An organization uses Microsoft Defender for Office 365. A security analyst is investigating a phishing email that was delivered to a user. The user clicked the link, but it was blocked by Defender for Office 365 at the time of click. The analyst needs to view the full click verdict, including the specific block action (e.g., blocked by custom block list). Where can the analyst find this information?

Accepted Answer

The email entity page in Microsoft 365 Defender. The email entity page in Microsoft 365 Defender provides the full click verdict for a specific email, including the exact block action (e.g., blocked by custom block list, blocked by URL reputation). This page aggregates all detection and verdict details for a single email, making it the correct location for the analyst to view the specific block action at time of click.

Answer

Threat Explorer in Microsoft 365 Defender

Answer

The advanced hunting table EmailEvents

Answer

The Attack simulation training dashboard

Question 12

An organization uses Microsoft Defender for Cloud and needs to track compliance with internal security policies that are not covered by any built-in regulatory standard. They want to see the compliance status for these internal controls in the Regulatory Compliance dashboard alongside other standards. What should they configure?

Accepted Answer

Create a custom Azure Policy initiative with the required controls and assign it to the relevant scopes.. To track compliance with internal security policies not covered by built-in regulatory standards, you must create a custom Azure Policy initiative that defines the required controls and assign it to the relevant scopes. Defender for Cloud automatically evaluates resources against assigned initiatives and surfaces the compliance status in the Regulatory Compliance dashboard alongside built-in standards, allowing unified visibility.

Answer

Create a custom assessment in the Microsoft Defender for Cloud recommendations dashboard.

Answer

Use the Secure Score API to develop a custom dashboard outside Defender for Cloud.

Answer

Enable the "Custom compliance" feature in Defender for Cloud's pricing tier.

Question 13

An organization uses Microsoft Sentinel with the Microsoft Defender for Cloud connector enabled. A security analyst receives an alert from Defender for Cloud about a potential brute-force attack on an Azure VM. The analyst wants to automatically create an incident in Sentinel and trigger a playbook that blocks the attacker's IP using a firewall. Which type of Sentinel automation rule should the analyst configure?

Accepted Answer

Incident automation rule. Incident automation rules in Microsoft Sentinel allow you to automatically trigger a playbook when an incident is created or updated. Since the Defender for Cloud alert generates an incident in Sentinel, an incident automation rule can be configured to run a playbook that blocks the attacker's IP via a firewall, meeting the requirement without needing to modify the analytics rule itself.

Answer

Analytics rule automation

Answer

Playbook trigger

Answer

Custom log ingestion

Question 14

In Microsoft 365 Defender, an incident is created automatically. An analyst wants to see all related alerts for that incident. Which tab on the incident details page should the analyst select?

Accepted Answer

Alerts tab. The Alerts tab on the incident details page in Microsoft 365 Defender displays all alerts that have been automatically correlated into the incident. Since an incident is a collection of related alerts, selecting the Alerts tab is the correct way for an analyst to view every individual alert that contributed to the incident.

Answer

Devices tab

Answer

Users tab

Answer

Evidence tab

Question 15

A global organization has Azure subscriptions organized under a single management group. The security team wants to ensure that the Azure Security Benchmark initiative is assigned once to cover all current and future subscriptions within that management group, without needing to assign it individually. They also want to see compliance results aggregated at the management group level. In Microsoft Defender for Cloud, what is the correct approach to achieve this?

Accepted Answer

Assign the Azure Security Benchmark initiative directly to the management group via Azure Policy, and use the Defender for Cloud's Regulatory Compliance dashboard.. Assigning the Azure Security Benchmark initiative directly to the management group via Azure Policy ensures that the policy initiative is inherited by all current and future subscriptions under that management group. Defender for Cloud's Regulatory Compliance dashboard then aggregates compliance results at the management group level, providing a single view of compliance across the entire hierarchy without requiring individual assignments.

Answer

Enable Defender for Cloud's enhanced security features on each subscription, and the benchmark will be automatically applied.

Answer

Create a custom assessment in Defender for Cloud that queries the management group scope.

Answer

Assign the initiative to the root management group using Azure Policy, then configure Defender for Cloud to ignore individual subscription assignments.