SC-200 Practice Test 12 — 15 Questions

Question 1

A threat hunter wants to correlate alerts from multiple Microsoft security products in Microsoft Sentinel. Which feature should be used to create a unified incident?

Accepted Answer

Analytics Rules. Analytics Rules in Microsoft Sentinel can be configured to create incidents from alerts across multiple security products, enabling unified incident creation for threat hunting. Option A (Threat Intelligence) is used to import and use threat intelligence feeds, not to create incidents. Option B (Jupyter Notebooks) provides a platform for security analysis and automation using Python, not for incident creation. Option D (Investigation Graph) is a visual tool for exploring connections between entities in an investigation, not for creating incidents.

Answer

Threat Intelligence

Answer

Jupyter Notebooks

Answer

Investigation Graph

Question 2

Which THREE techniques would you use in Microsoft Sentinel to hunt for data exfiltration over DNS?

Accepted Answer

Analyze DNS query logs for high volume or long subdomains. Correct options: A, C, E. DNS query analysis (A) helps identify unusual domain patterns like long subdomains indicative of exfiltration. Correlating DNS with process creation (C) pinpoints the source process, aiding attribution. ASIM DNS parsers (E) normalize logs for advanced anomaly detection. Option B is incorrect because large data transfers to known cloud storage IPs are not specific to DNS exfiltration—DNS exfiltration typically uses small payloads in DNS queries. Option D is unrelated as email forwarding rules are about email, not DNS.

Answer

Examine network traffic logs for large data transfers to known cloud storage IPs

Answer

Review email forwarding rules for external domains

Question 3

Your threat hunt aims to detect possible Kerberoasting attacks. Which KQL query in Microsoft Sentinel would best identify service principal name (SPN) requests from unusual accounts?

Accepted Answer

let knownAccounts = dynamic(['svc_sql', 'svc_adfs']); SecurityEvent | where EventID == 4768 | where Account !in (knownAccounts) | summarize cnt=count() by Account, IpAddress | where cnt > 5. The best query for detecting Kerberoasting is Option C. Kerberoasting involves requesting Kerberos service tickets (TGS) for service principal names (SPNs) to crack the service account password. Event ID 4769 corresponds to a Kerberos service ticket request. Option C filters out known service accounts (like svc_sql, svc_adfs) and looks for accounts with more than 5 requests, which may indicate an attacker brute-forcing service tickets. Option A uses Event ID 4768 (TGT requests), which is not directly related to service ticket requests. Option B does not filter known accounts and includes all accounts. Option D uses Event ID 4773 (Kerberos service ticket renewal), which is not the typical event for Kerberoasting.

Answer

SecurityEvent | where EventID == 4768 | summarize count() by Account | where count_ > 10

Answer

SecurityEvent | where EventID == 4769 | summarize count() by Account

Answer

SecurityEvent | where EventID == 4773 | summarize count() by Account

Question 4

During a threat hunt in Microsoft Sentinel, you identify a series of successful logins from an unusual IP address to multiple Azure VM instances. The logins occur outside business hours. Which hunting technique would be most effective to correlate these events with potential lateral movement?

Accepted Answer

Use Microsoft Defender for Cloud Apps to perform session replay of the user's activities during that time.. Session replay in Microsoft Defender for Cloud Apps allows you to reconstruct the user's activities, showing the sequence of events across multiple VMs and identifying lateral movement patterns. Option A is wrong because correlating sign-in logs with Azure activity logs may identify concurrent events but doesn't reveal the step-by-step lateral movement. Option B is wrong because creating an alert rule is a detection mechanism, not a proactive hunting technique for correlating events. Option D is wrong because UEBA detects anomalies based on baselines but does not directly link the logins to lateral movement.

Answer

Run a KQL query that correlates sign-in logs with Azure activity logs using a common timestamp window.

Answer

Create a custom analytics rule in Microsoft Sentinel to alert on repeated logins from the same IP.

Answer

Enable User and Entity Behavior Analytics (UEBA) in Microsoft Sentinel to detect anomalies.

Question 5

Which Microsoft Sentinel feature allows you to query data across multiple workspaces in a single KQL query?

Accepted Answer

The workspace() function in KQL. The `workspace()` function in KQL allows you to include data from multiple Log Analytics workspaces in a single query. Option A is incorrect because the `union` operator with workspace names is not a valid cross-workspace query method; `union` combines tables within the same workspace. Option B is incorrect because the `externaldata` operator is used to query data from external storage, not other workspaces. Option D is incorrect because the `join` operator merges rows from tables within the same workspace, not across workspaces.

Answer

The union operator with workspace names

Answer

The externaldata operator with workspace URLs

Answer

The join operator with workspace identifiers

Question 6

You are threat hunting in Microsoft Sentinel and have enabled UEBA. You want to detect a possible privilege escalation where a user creates a new user account and adds it to a privileged role within minutes. Which UEBA anomaly type should you investigate?

Accepted Answer

Mass role assignment changes. UEBA detects 'Mass role assignment changes' as an anomaly that could indicate privilege escalation. Option A (Unusual file access) is for data exfiltration. Option B (Impossible travel) is for geographic anomalies. Option D (Anomalous sign-in) focuses on authentication.

Answer

Unusual file access

Answer

Impossible travel

Answer

Anomalous sign-in

Question 7

An analyst is investigating a phishing campaign that targeted multiple users. The analyst needs to identify if any users clicked a malicious link in the email. Which Microsoft Defender for Office 365 feature should be used?

Accepted Answer

Threat Explorer. Threat Explorer (also known as Explorer) in Microsoft Defender for Office 365 provides a real-time, interactive view of threat data, including email delivery status and user actions such as clicks on malicious links. It allows analysts to filter by 'Click action' to identify users who clicked a URL that was determined to be malicious, making it the correct tool for this investigation.

Answer

Safe Attachments

Answer

Attack Simulator

Answer

Safe Links

Question 8

Your organization has Microsoft Defender for Cloud Apps (MDA) connected to Microsoft Sentinel. The SOC team wants to receive alerts when a user accesses a sanctioned cloud app from an anonymous IP address. What should you configure?

Accepted Answer

Create an activity policy in Defender for Cloud Apps and connect it to Sentinel.. An activity policy in Defender for Cloud Apps can be configured to trigger alerts on specific user activities, such as accessing a sanctioned app from an anonymous IP address. This policy can then be connected to Microsoft Sentinel via the Defender for Cloud Apps data connector, which ingests alerts as incidents for SOC review. File policies (A) focus on file-level actions like sharing or malware detection, not user access events, while session policies (D) control real-time access but do not generate alerts for historical or post-access monitoring.

Answer

Create a file policy in Defender for Cloud Apps.

Answer

Enable the Defender for Cloud Apps connector in Sentinel without additional configuration.

Answer

Create a session policy in Defender for Cloud Apps.

Question 9

Your organization is migrating to Microsoft Sentinel. You need to ensure that the workspace retains data for 2 years for compliance, but you want to reduce costs by using cheaper storage for data older than 90 days. What should you configure?

Accepted Answer

Set workspace retention to 90 days and configure long-term retention in Azure Data Explorer (ADX).. Microsoft Sentinel allows you to set the workspace retention to 90 days for interactive, hot-tier access, and then configure long-term retention in Azure Data Explorer (ADX) for data older than 90 days. This approach meets the 2-year compliance requirement while reducing costs, as ADX provides cheaper storage for older data that is queried less frequently.

Answer

Set the workspace retention to 730 days and enable a data cap.

Answer

Export data older than 90 days to a storage account and delete from workspace.

Answer

Configure the workspace retention to 90 days and use Azure Storage archiving.

Question 10

Your organization uses Microsoft Sentinel and has multiple workspaces for different regions. The security team wants to use a single workbook to display data from all workspaces. What is the correct approach?

Accepted Answer

Create a workbook with cross-workspace queries using the workspace() expression. Microsoft Sentinel workbooks support cross-workspace queries using the `workspace()` expression in Kusto Query Language (KQL). This allows a single workbook to aggregate and display data from multiple Sentinel workspaces without moving or duplicating the data, meeting the security team's requirement efficiently.

Answer

Export data from all workspaces to a single Azure Data Lake

Answer

Create a workbook in one workspace and configure it to use Azure Lighthouse

Answer

Create a workbook in each workspace and merge them manually

Question 11

Refer to the exhibit. You are reviewing an alert in Microsoft Defender for Endpoint. The alert details are shown. Which of the following actions should you take first?

Accepted Answer

Investigate the device and the alert details. The first step in incident response is to investigate the alert details and the affected device to understand the scope and severity of the threat. Without investigation, you cannot determine whether the alert is a true positive, whether isolation is appropriate, or which remediation steps are needed. Microsoft Defender for Endpoint provides a rich investigation experience, including the alert story, device timeline, and related events, which must be reviewed before taking any containment or remediation actions.

Answer

Mark the alert as a false positive

Answer

Initiate device isolation to contain the threat

Answer

Run a full antivirus scan on the device

Question 12

Your team is using Microsoft 365 Defender advanced hunting to investigate a possible data exfiltration incident. The security team suspects that an internal attacker used a compromised SharePoint Online account to download sensitive files from multiple sites. You need to build a hunting query that identifies all file download activities from SharePoint Online for a specific user account over the past 7 days, and then calculates the total size of downloaded files. Which KQL query should you use?

Accepted Answer

CloudAppEvents | where Application == 'SharePoint Online' and ActionType == 'FileDownloaded' and AccountDisplayName == 'targetuser@contoso.com' and Timestamp > ago(7d) | summarize TotalSize = sum(FileSize). Ly filters SharePoint file download events (FileDownloaded) and sums the FileSize. Option A uses wrong action; Option C uses wrong table; Option D is for email.

Answer

CloudAppEvents | where Application == 'SharePoint Online' and ActionType == 'FileDownload' and AccountDisplayName == 'targetuser@contoso.com' and Timestamp > ago(7d) | summarize TotalSize = sum(FileSize)

Answer

EmailEvents | where Application == 'SharePoint Online' and ActionType == 'FileDownloaded' and AccountDisplayName == 'targetuser@contoso.com' and Timestamp > ago(7d) | summarize TotalSize = sum(FileSize)

Answer

FileEvents | where Application == 'SharePoint Online' and ActionType == 'FileDownloaded' and AccountDisplayName == 'targetuser@contoso.com' and Timestamp > ago(7d) | summarize TotalSize = sum(FileSize)

Question 13

Your company uses Microsoft Defender for Cloud Apps. You discover that a user's account is compromised and used to access a sensitive SharePoint site from an unfamiliar IP. You need to immediately revoke the user's session and force them to re-authenticate. Which action should you take?

Accepted Answer

Apply a policy with the 'Revoke session' action.. The 'Revoke session' policy action in Defender for Cloud Apps terminates the user's current session and forces re-authentication. Option A (Suspend user) is too drastic and may disrupt legitimate access. Option C (Block IP) would block all users from that IP, which may not be desired. Option D (Notify user) is not immediate and does not stop the session.

Answer

Add the IP to the blocked IP addresses list.

Answer

Create a governance action to suspend the user.

Answer

Send a notification to the user to change their password.

Question 14

Your organization uses Microsoft Sentinel and Microsoft Defender XDR. The security team wants to automatically create an incident in Microsoft Sentinel when a Microsoft Defender for Endpoint alert is triggered. What should you configure?

Accepted Answer

Enable the Microsoft Defender XDR connector in Microsoft Sentinel and select the incident creation settings.. The Microsoft Defender XDR connector in Microsoft Sentinel is specifically designed to ingest alerts and incidents from Microsoft Defender for Endpoint and other Defender products. By enabling this connector and configuring its incident creation settings, Sentinel automatically creates incidents when Defender for Endpoint alerts are triggered, without requiring custom logic or manual polling.

Answer

Set up a Logic App custom connector to poll Defender alerts.

Answer

Configure the Security Events connector to forward Defender alerts.

Answer

Create analytics rules in Microsoft Sentinel for each Defender alert type.

Question 15

Which TWO tasks can you perform using Microsoft Sentinel automation rules?

Accepted Answer

Assign an incident to an analyst.. Automation rules in Microsoft Sentinel can directly assign incidents to specific analysts or groups without requiring a playbook. This is a native action within the automation rule configuration, enabling immediate ownership and accountability for incident response.

Answer

Send an email notification without a playbook.

Answer

Delete an incident.

Answer

Create a new analytics rule.