SC-200 Practice Test 11 — 15 Questions

Question 1

A large enterprise uses Microsoft Defender for Cloud with all enhanced security plans enabled. They want to automatically enable the Defender for Cloud plans on new Azure subscriptions that are created under their management group. Which approach should they use?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Assign the built-in Azure Policy initiative 'Enable Microsoft Defender for Cloud on all subscriptions' at the management group level.. The built-in Azure Policy initiative 'Enable Microsoft Defender for Cloud on all subscriptions' is designed to be assigned at a management group scope, automatically enabling all Defender for Cloud plans on new subscriptions as they are created under that management group. This leverages Azure Policy's compliance evaluation and remediation tasks to enforce the security plans across the entire hierarchy without manual intervention.

Answer

Configure 'Continuous export' settings in Defender for Cloud to export policies to Log Analytics for each subscription.

Answer

Set the default security policies at the management group level in Defender for Cloud's environment settings.

Answer

Enable 'Auto provisioning' for the Log Analytics agent in Defender for Cloud.

Question 2

A security analyst receives an alert in Microsoft Defender XDR indicating a possible credential theft attempt from an external IP. The analyst wants to isolate the affected device immediately while preserving forensic data. What should the analyst do?

Accepted Answer

Initiate a live response session on the device and run the 'isolate device' command.. Initiating a live response session and running the 'isolate device' command in Microsoft Defender for Endpoint immediately disconnects the device from the network (both internal and external) while preserving forensic data on the endpoint. This action stops the ongoing credential theft attempt without destroying volatile evidence, which is critical for subsequent investigation.

Answer

Use Microsoft Defender for Endpoint to 'contain device' from the device inventory.

Answer

Disable the user account in Microsoft Entra ID.

Answer

Reset the user's password and enforce sign-out.

Question 3

Your organization uses Microsoft Defender for Office 365. You need to ensure that when a user reports a phishing email via the built-in Outlook add-in, an automated investigation is triggered in Microsoft 365 Defender. What should you configure?

Accepted Answer

Enable user-reported message settings in the Microsoft 365 Defender portal.. Enabling user-reported message settings in the Microsoft 365 Defender portal allows messages reported via the built-in Outlook add-in to automatically trigger an automated investigation (AIR) in Microsoft 365 Defender. This configuration ties the user reporting action directly to the incident response workflow, enabling the system to analyze the reported email and initiate remediation steps without manual intervention.

Answer

Define a safe links policy.

Answer

Configure an anti-phishing policy.

Answer

Set up a safe attachments policy.

Question 4

You are a SOC analyst using Microsoft Sentinel. You have a scheduled analytics rule that generates incidents from KQL queries. Recently, incidents are being created but automatically closed within minutes without any actions taken. You suspect a configuration issue. What should you check first?

Accepted Answer

Review the incident automation rules that might have a 'Close incident' action triggered by a condition.. Incident automation rules in Microsoft Sentinel can be configured to automatically close incidents when specific conditions are met, such as a related alert being resolved or a playbook completing. Since the incidents are being closed within minutes without manual intervention, an automation rule with a 'Close incident' action is the most likely cause, as it directly triggers closure based on conditions. Checking this first aligns with the SOC analyst's need to identify automated actions that could prematurely close incidents.

Answer

Verify the 'Alert grouping' settings in the analytics rule; they might be grouping alerts incorrectly.

Answer

Check if the analytics rule has a 'Suppression' setting enabled that causes the incident to close.

Answer

Examine the entity mapping configuration; it might be causing the incident to close automatically.

Question 5

Your organization uses Microsoft Defender for Cloud Apps and Microsoft Sentinel. You need to ensure that anomalous behavior alerts from Defender for Cloud Apps are automatically converted to incidents in Sentinel. What should you configure?

Accepted Answer

Enable the Microsoft Defender for Cloud Apps data connector in Microsoft Sentinel.. The Microsoft Defender for Cloud Apps data connector in Microsoft Sentinel is specifically designed to ingest alerts and anomalies from Defender for Cloud Apps and automatically create SecurityIncident records in Sentinel. Enabling this connector ensures that anomalous behavior alerts are converted to incidents without requiring custom playbooks or additional logic.

Answer

Enable the Microsoft Defender for Identity data connector in Microsoft Sentinel.

Answer

Enable the Microsoft 365 data connector in Microsoft Sentinel.

Answer

Create a playbook that triggers on Defender for Cloud Apps alerts and creates incidents in Sentinel.

Question 6

An organization uses Microsoft 365 Defender. A security analyst is reviewing an incident that involves a user who clicked a phishing link in an email. The analyst wants to see the email's full timeline, including delivery, click, and any follow-up actions. Which section of the email entity page provides this information?

Accepted Answer

Email timeline. The Email timeline section on the email entity page in Microsoft 365 Defender provides a chronological view of the email's lifecycle, including delivery, user clicks on the phishing link, and subsequent remediation actions such as soft delete or quarantine. This directly meets the analyst's need to see the full sequence of events for the incident.

Answer

Detection details

Answer

Threat types

Answer

Investigation graph

Question 7

You are designing a Microsoft Sentinel deployment for a multinational organization that must comply with GDPR and local data residency requirements. They have offices in the US, EU, and Asia. They want to use a single Microsoft Sentinel workspace for global visibility but need to ensure that data from EU sources remains within the EU. What is the best approach to meet these requirements?

Accepted Answer

Deploy separate Microsoft Sentinel workspaces in the US, EU, and Asia, and use cross-workspace queries and Azure Lighthouse to manage them centrally.. Deploying separate Microsoft Sentinel workspaces in each required region (US, EU, Asia) ensures that data from EU sources remains within the EU, satisfying GDPR and local data residency requirements. Cross-workspace queries and Azure Lighthouse allow centralized management and global visibility across these workspaces without moving data between regions.

Answer

Deploy a single Microsoft Sentinel workspace in the US and use Azure Policy to restrict data ingestion from EU sources.

Answer

Deploy a single workspace in the EU and enable UEBA to analyze all data.

Answer

Use Azure Lighthouse to project a single workspace into multiple regions, which automatically separates data storage.

Question 8

Refer to the exhibit. You are reviewing a Microsoft Sentinel scheduled analytics rule configured as above. An incident was created for multiple alerts triggering within a 5-hour window. The SOC team needs to investigate each alert separately because they involve different user accounts. What should the analyst do to ensure each alert generates a separate incident?

Accepted Answer

Set 'enabled' to false under groupingConfiguration.. Setting 'enabled' to false under groupingConfiguration disables alert grouping entirely. When grouping is disabled, each individual alert that triggers the scheduled rule will generate its own separate incident, allowing the SOC team to investigate alerts involving different user accounts independently.

Answer

Change the matchingMethod to 'AnyAlert'.

Answer

Set 'reopenClosedIncident' to true.

Answer

Change the lookbackDuration to PT0H.

Question 9

Your company uses Microsoft Sentinel and has enabled the Microsoft Defender XDR connector. You notice that incidents from Microsoft Defender for Cloud Apps are not appearing in Microsoft Sentinel. All other Defender XDR incidents appear correctly. What is the most likely cause?

Accepted Answer

The Microsoft Defender for Cloud Apps data connector is not enabled in Microsoft Sentinel.. The Microsoft Defender XDR connector ingests incidents from all Microsoft Defender products, including Defender for Cloud Apps, but only if the corresponding data connector is enabled in Microsoft Sentinel. Option D is correct because the Microsoft Defender for Cloud Apps data connector must be explicitly enabled to allow incident ingestion from that source; without it, incidents from Defender for Cloud Apps will not appear even though the XDR connector is active.

Answer

The security operations team does not have the appropriate permissions.

Answer

The Microsoft Defender XDR connector only ingests incidents from Microsoft Defender for Endpoint.

Answer

The Microsoft 365 E5 license is not assigned to the users.

Question 10

A SOC analyst receives a high-severity alert for a user who downloaded a malicious file from a phishing email. The analyst needs to quickly assess the scope of the incident across endpoints, email, and identities. Which Microsoft Defender XDR feature should the analyst use to get a unified view of the incident?

Accepted Answer

Microsoft Defender XDR incident queue. The Microsoft Defender XDR incident queue is the correct choice because it aggregates alerts from Microsoft Defender for Endpoint, Office 365, and Identity into a single incident view, enabling the analyst to correlate the malicious file download across endpoints, email, and user identities without switching consoles. This unified incident management is a core feature of Microsoft Defender XDR, designed specifically for rapid triage and scope assessment in multi-domain threats.

Answer

Microsoft Purview compliance portal

Answer

Microsoft Intune device compliance dashboard

Answer

Microsoft Sentinel incidents blade

Question 11

Your organization has Microsoft Defender for Cloud Apps and Microsoft Sentinel integrated. The security team wants to receive alerts when a user's activity from an anonymous IP address exceeds a certain risk score. What should you configure in Defender for Cloud Apps?

Accepted Answer

Activity policy. Activity policies in Microsoft Defender for Cloud Apps allow you to monitor and respond to specific user activities based on conditions such as IP address categories (e.g., anonymous proxy) and risk scores. This policy type can trigger alerts when a user's activity from an anonymous IP address exceeds a defined risk score threshold, meeting the security team's requirement.

Answer

Anomaly detection policy

Answer

File policy

Answer

App discovery policy

Question 12

A security analyst is investigating a complex incident in Microsoft 365 Defender that involves multiple stages: a phishing email, credential theft, and lateral movement. The analyst wants to view a visual representation of the attack chain, showing how alerts and entities are related. Which feature should the analyst use?

Accepted Answer

Incident graph. The incident graph in Microsoft 365 Defender provides a visual, interactive map of the entire attack chain, linking alerts, entities (such as users, devices, and IPs), and suspicious activities. This allows the analyst to see the progression from the phishing email to credential theft and lateral movement in a single view, making it the correct tool for understanding complex, multi-stage incidents.

Answer

Advanced hunting

Answer

Automated investigation

Answer

Alert timeline

Question 13

Your organization uses Microsoft Sentinel and Microsoft Defender for Cloud. A critical server in Azure was compromised by ransomware. The incident response team needs to ensure that no other resources in the same resource group are affected. What is the most immediate containment action?

Accepted Answer

Disable the public IP address and apply an NSG rule to block all inbound/outbound traffic to the server's subnet.. The most immediate containment action is to isolate the compromised server's subnet by disabling its public IP and applying an NSG rule that blocks all inbound and outbound traffic. This prevents lateral movement of ransomware to other resources in the same resource group while preserving the VM for forensic analysis. In Microsoft Defender for Cloud and Sentinel, network isolation at the subnet level is the fastest way to contain a breach without destroying evidence.

Answer

Delete the virtual machine immediately to stop the ransomware.

Answer

Change the local administrator password on the VM.

Answer

Move the VM to a different virtual network and subnet.

Question 14

A security team wants to enable advanced threat detection for all Azure SQL databases across multiple subscriptions. They want to receive alerts for SQL injection attempts and anomalous activities. Which action should they take in Microsoft Defender for Cloud?

Accepted Answer

Enable the Microsoft Defender for SQL plan at the subscription level.. Microsoft Defender for SQL provides advanced threat detection for Azure SQL databases, including alerts for SQL injection attempts and anomalous activities. Enabling the plan at the subscription level automatically protects all existing and future SQL databases within that subscription, ensuring centralized management and compliance.

Answer

Enable the Microsoft Defender for Servers plan on each subscription.

Answer

Configure SQL Auditing and Threat Detection on each SQL server individually.

Answer

Create an Azure Policy to deploy Azure SQL Firewall rules.

Question 15

Your organization uses Microsoft Sentinel and Microsoft Defender XDR. A security analyst reports that incidents related to ransomware are not being automatically triaged by the SOC automation playbook. You confirm that the playbook is enabled and connected to the analytics rule. What is the most likely cause of the issue?

Accepted Answer

The automation rule that triggers the playbook is set to run only when the incident is created by a specific provider (e.g., Microsoft Defender XDR), but the incident is created by Microsoft Sentinel.. The automation rule that triggers the playbook is configured with a condition that restricts it to incidents created by a specific provider, such as Microsoft Defender XDR. However, the ransomware incident is being created by Microsoft Sentinel (e.g., via an analytics rule), not by Microsoft Defender XDR. This provider mismatch prevents the automation rule from firing, so the playbook never runs, even though the playbook itself is enabled and connected to the analytics rule.

Answer

The Microsoft Sentinel workspace is in a different region than Microsoft Defender XDR.

Answer

The incident is not being created by the analytics rule.

Answer

The playbook is not associated with the correct analytics rule in the automation rule.