SC-200 Practice Test 12 — 15 Questions

Question 1

Your organization uses Microsoft Defender XDR. You notice that automated investigations are being blocked for certain devices due to high-severity alerts. You need to ensure that automated actions can proceed for devices with a risk score below 30. What should you configure?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Configure a device group with an automated investigation and response rule that excludes devices with a risk score above 30.. Device groups in Microsoft Defender XDR allow you to scope automated investigation and response (AIR) rules based on device risk scores. By creating a device group that excludes devices with a risk score above 30, you ensure that automated actions proceed only for devices meeting your threshold, directly addressing the requirement.

Answer

Disable automated investigation for all devices and rely on manual investigation.

Answer

Adjust the Microsoft Defender for Cloud Apps policy to allow automated actions for low-risk devices.

Answer

Modify the attack surface reduction rules to allow automated actions on low-risk devices.

Question 2

Your organization uses Microsoft Sentinel and Microsoft Defender XDR. You need to ensure that a new SOC analyst can triage incidents without being able to delete or modify analytics rules. Which role should you assign?

Accepted Answer

Microsoft Sentinel Reader. Microsoft Sentinel Reader provides read-only access to Sentinel data, including incidents, workbooks, and analytics rules, but explicitly prevents any modifications or deletions. This role is ideal for SOC analysts who need to triage incidents without altering detection configurations. Security Reader and Global Reader lack Sentinel-specific incident triage permissions, while Security Operator allows modification of incidents, which exceeds the required scope.

Answer

Security Reader

Answer

Global Reader

Answer

Security Operator

Question 3

Your security team is investigating an incident in Microsoft Defender XDR where a user received multiple phishing emails. The team needs to create an automated response that blocks the sender's email address across all mailboxes in the organization. Which action should you configure in an automated investigation and response (AIR) playbook?

Accepted Answer

Add a 'Block sender' action in Microsoft Defender for Office 365.. Blocking a sender's email address across all mailboxes is a native capability of Microsoft Defender for Office 365. The 'Block sender' action in an AIR playbook directly adds the sender to the tenant's block list, which is enforced at the transport layer for all inbound email, effectively preventing any further delivery from that address.

Answer

Add a 'Block IP address' action in Microsoft Defender for Cloud Apps.

Answer

Create a custom detection rule in Microsoft Sentinel.

Answer

Deploy a configuration profile in Microsoft Intune.

Question 4

As a security operations analyst, you receive an alert from Microsoft Defender for Identity about a suspicious Kerberos activity. You need to investigate the alert and determine if it is a true positive. What should you use to pivot from the alert to the related user and device timeline?

Accepted Answer

From the Microsoft 365 Defender portal, open the alert and click on the user or device name to view their timeline.. In the Microsoft 365 Defender portal, when you open a Microsoft Defender for Identity alert, you can directly click on the user or device name to pivot to their timeline. This timeline provides a consolidated view of activities, including Kerberos events, authentication attempts, and other related signals, enabling you to quickly assess whether the suspicious Kerberos activity is a true positive without leaving the portal.

Answer

Search for the user in Azure AD audit logs.

Answer

Open the alert in Microsoft Sentinel and use the investigation graph.

Answer

Use the Microsoft 365 compliance portal to run an eDiscovery search.

Question 5

You are analyzing the query above in Microsoft 365 Defender advanced hunting. The goal is to identify potentially compromised accounts used only once. The query returns thousands of results including many normal single logons. How can you refine the query to reduce false positives?

Accepted Answer

Add a filter to exclude IP addresses from the corporate VPN range and common applications like Outlook Web Access.. Adding a filter to exclude IP addresses from the corporate VPN range and common applications (like Outlook Web Access) helps reduce false positives by removing legitimate single logons that are expected. Option A (LogonCount > 1) would exclude the very accounts we are trying to find (single logons). Option B (removing the domain filter) would expand results but not necessarily reduce false positives. Option C (accounts never logged on before) is too restrictive and may miss compromised accounts used only once.

Answer

Change the where clause to LogonCount > 1.

Answer

Remove the filter on AccountUpn endswith "@contoso.com".

Answer

Add a filter to only include accounts that have never logged on before.

Question 6

Your company is deploying Microsoft Defender for Endpoint. You need to ensure that all devices report their security baseline compliance to Microsoft Intune. Which configuration should you use?

Accepted Answer

Assign a Security Baseline policy in Microsoft Intune to the device groups. Security Baseline policies in Microsoft Intune define a set of pre-configured security settings recommended by Microsoft to harden devices. When assigned to device groups, these policies automatically evaluate and report compliance status for each device, ensuring all devices meet the required security baseline. This directly fulfills the requirement to report security baseline compliance to Intune.

Answer

Configure a device configuration profile in Microsoft Intune

Answer

Deploy Windows Update for Business reports

Answer

Enable Microsoft Defender for Cloud Apps session controls

Question 7

A security analyst is investigating a sophisticated attack chain that started with a user clicking a link in a phishing email, which led to a drive-by download from a malicious website. The analyst wants to see the full list of URLs visited from the user's browser on the device. Which Advanced Hunting table contains this information?

Accepted Answer

DeviceEvents. DeviceEvents in Microsoft Defender XDR captures browser-based activities, including URL visits, via the 'ActionType' field (e.g., 'BrowserUrlClicked' or 'BrowserUrlNavigation'). This table is specifically designed to log web navigation events from browsers like Microsoft Edge or Chrome, making it the correct source for the full list of URLs visited during the phishing attack chain.

Answer

DeviceNetworkEvents

Answer

DeviceProcessEvents

Answer

DeviceFileEvents

Question 8

A company has multiple Azure subscriptions managed by Microsoft Defender for Cloud with enhanced security features enabled. The security team wants to ensure that all Azure SQL Servers have Advanced Data Security (ADS) enabled, including Vulnerability Assessment. They decide to use Azure Policy to enforce this at scale. Which built-in policy initiative should they assign to achieve this?

Accepted Answer

Azure Security Benchmark. The Azure Security Benchmark initiative includes built-in policies to enforce Advanced Data Security (ADS) and Vulnerability Assessment on Azure SQL Servers. Assigning this initiative at scale ensures compliance with security best practices across all subscriptions, as it contains the specific policy effect to enable ADS and VA automatically.

Answer

Enable Azure Monitor for VMs

Answer

Deploy Diagnostics Settings for SQL Databases

Answer

Enable Advanced Threat Protection for SQL servers

Question 9

A security analyst in Microsoft 365 Defender is investigating an incident that involves a malicious email attachment. Which advanced hunting table should the analyst use to find information about the email including sender, recipient, and subject?

Accepted Answer

EmailEvents. The EmailEvents table in Microsoft 365 Defender advanced hunting contains the core email metadata, including sender (SenderFromAddress), recipient (RecipientEmailAddress), and subject (Subject). This table records events such as email delivery, blocking, and filtering actions, making it the primary source for investigating email-related incidents. The other tables focus on specific components like attachments or URLs, not the full email envelope details.

Answer

EmailAttachmentInfo

Answer

EmailUrlInfo

Answer

IdentityLogonEvents

Question 10

Your organization has deployed Microsoft Sentinel and configured a workspace with data connectors for Microsoft 365 Defender, Azure Activity, and Office 365. You need to ensure that security incidents are automatically assigned to the appropriate analyst based on the incident type. What should you configure?

Accepted Answer

Create an automation rule that runs when an incident is created, with conditions on the incident title, and an action to assign the incident to a specific owner.. Automation rules in Microsoft Sentinel allow you to define conditions (e.g., incident title containing specific keywords) and actions (e.g., assign incident to a specific owner) that run automatically when an incident is created. This directly meets the requirement to assign incidents to the appropriate analyst based on incident type without manual intervention.

Answer

Create a playbook triggered by incident creation that assigns the incident to a user based on the incident title.

Answer

Add a watchlist that maps incident types to analyst email addresses and configure a scheduled analytics rule.

Answer

Configure a Microsoft 365 Defender incident assignment rule in the Microsoft 365 Defender portal.

Question 11

You manage a Microsoft Sentinel workspace with multiple analytics rules. You notice that an analytics rule has not generated any alerts in the past month despite relevant data being ingested. The rule uses a custom KQL query that joins two tables. What is the most likely cause?

Accepted Answer

The join condition in the KQL query is incorrect, resulting in no matching records. The most likely cause is an incorrect join condition in the KQL query. When a custom analytics rule uses a JOIN operation between two tables, if the join keys or conditions do not match any records in the ingested data, the query returns zero results, and no alerts are generated. Since the question states that relevant data is being ingested, the issue is not with data availability but with the query logic itself.

Answer

The rule is using an unsupported KQL function

Answer

The data connector for the tables is disabled

Answer

The rule is running on a schedule of 5 minutes but the data arrives every hour

Question 12

You are configuring Microsoft Sentinel automation rules to handle incidents from multiple analytics rules. You need to ensure that incidents from a specific rule are automatically assigned to the 'SOC Tier 2' group and have a severity of 'High' regardless of the original severity. What should you do?

Accepted Answer

Configure an automation rule with 'Add tag' and 'Set severity' actions, plus 'Assign owner'. Automation rules in Microsoft Sentinel can directly modify incident properties such as severity and owner without requiring external logic apps or playbooks. Option D correctly uses the 'Set severity' action to override the original severity to 'High' and the 'Assign owner' action to assign the incident to the 'SOC Tier 2' group, fulfilling both requirements in a single, efficient rule.

Answer

Use a logic app trigger to change severity

Answer

Create a playbook to modify the incident properties

Answer

Create a separate analytics rule to override the incident

Question 13

Your security operations team uses Microsoft Sentinel workbooks to monitor security posture. You notice that a workbook query is timing out when run against a large workspace. What is the best way to optimize the query without changing its results?

Accepted Answer

Use the workspace() function to query specific workspaces only.. The `workspace()` function in KQL allows you to explicitly scope a query to specific workspaces, reducing the data scanned and improving performance. By targeting only the necessary workspaces, you avoid the overhead of querying the entire large workspace, which is the root cause of the timeout. This optimization does not alter the query logic or results, as it simply restricts the data source.

Answer

Remove some filter conditions to simplify the query.

Answer

Add a summarize operator at the end of the query.

Answer

Reduce the time range of the query.

Question 14

A security analyst is investigating a ransomware attack in Microsoft 365 Defender and needs to understand how the attacker moved laterally from an initial compromised workstation to a domain controller. Which feature should the analyst use to see a visual timeline of device-to-device connections and process executions?

Accepted Answer

Incident graph (attack story). The Incident graph (attack story) in Microsoft 365 Defender provides a visual, interactive timeline that correlates alerts, device-to-device connections, and process executions across the entire attack chain. This allows the analyst to trace lateral movement from the initial compromised workstation to the domain controller in a single, consolidated view, which is exactly what the question requires.

Answer

Device timeline view for each affected device

Answer

Advanced hunting with DeviceNetworkEvents and DeviceProcessEvents

Answer

Automated investigation report

Question 15

You are hunting for signs of Kerberoasting in Microsoft Sentinel. Which hunting query using KQL would you use to identify service principal names (SPNs) being queried via Kerberos TGS requests?

Accepted Answer

SecurityEvent | where EventID == 4769 and TicketEncryptionType == 0x17. Kerberoasting involves requesting TGS tickets for Service Principal Names (SPNs). In Microsoft Sentinel, the SecurityEvent table with EventID 4769 logs TGS requests. TicketEncryptionType 0x17 indicates RC4 encryption, which is commonly used in Kerberoasting attacks. Option A correctly identifies this query. Option D is incorrect because EventID 4768 is for TGT requests, not TGS. Option B (DeviceEvents) may not capture this specific event, and Option C (DeviceLogonEvents) does not focus on SPN details.

Answer

DeviceEvents | where ActionType == 'KerberosTicketRequest'

Answer

DeviceLogonEvents | where LogonType == 'Kerberos' and AccountDomain == 'Service'

Answer

SecurityEvent | where EventID == 4768 and TicketEncryptionType == 0x17