SC-200 Practice Test 13 — 15 Questions

Question 1

During an incident response, a SOC analyst needs to automatically collect relevant evidence from multiple Microsoft 365 services. Which Microsoft Sentinel playbook trigger should the analyst configure?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Microsoft Sentinel Incident trigger with action 'Collect evidence'.. The Microsoft Sentinel Incident trigger with the 'Collect evidence' action is specifically designed to automate evidence collection across Microsoft 365 services during incident response. This trigger fires when an incident is created or updated, allowing the playbook to gather relevant data from sources like Microsoft Defender for Endpoint, Microsoft 365 Defender, and Microsoft Entra ID without manual intervention.

Answer

Microsoft Sentinel Playbook trigger 'When a response action is executed'.

Answer

Microsoft Sentinel Scheduled Analytics rule trigger.

Answer

Microsoft Sentinel Alert trigger.

Question 2

Your organization has a Microsoft Sentinel workspace that ingests logs from Azure resources, Microsoft 365, and third-party firewalls. You need to ensure that data retention for Azure Activity logs complies with a regulatory requirement of 3 years, while keeping costs low for other data types. What should you do?

Accepted Answer

Configure a data retention policy on the AzureActivity table to 3 years.. Azure Sentinel allows you to configure a custom retention policy on a specific table (e.g., AzureActivity) to retain data for up to 2 years (or longer with Archive tier) independently of the workspace's default retention. This meets the 3-year regulatory requirement for Azure Activity logs without increasing retention costs for other data types, as the workspace default can remain shorter.

Answer

Use the Archive tier for Azure Activity logs and set the total retention period to 3 years.

Answer

Set the workspace retention to 3 years.

Answer

Enable Basic Logs plan on the AzureActivity table.

Question 3

Your company has a hybrid environment with Microsoft Sentinel and Microsoft Defender for Cloud. You notice that the 'Priority' field in Sentinel incidents is not being populated correctly. You need to ensure that Sentinel incidents inherit the priority from Microsoft Defender for Cloud alerts. What should you configure?

Accepted Answer

Configure the Microsoft Defender for Cloud data connector to map severity and use an automation rule to set priority based on severity.. Microsoft Defender for Cloud alerts include a severity field, and the Microsoft Defender for Cloud data connector in Sentinel can ingest this severity. By mapping the severity in the connector configuration, you can then use an automation rule to set the Sentinel incident's 'Priority' field based on the mapped severity, ensuring inheritance from Defender for Cloud alerts.

Answer

Enable the 'Sync incidents and alerts' setting in Microsoft Defender XDR.

Answer

Use a workbook to display priority and manually update incidents.

Answer

Create an analytics rule that queries Microsoft Defender for Cloud alerts and sets the priority in the incident creation.

Question 4

Refer to the exhibit. An automation rule in Microsoft Sentinel is configured as shown. When a high-severity incident is created, what is the expected behavior?

Accepted Answer

The task is created, then the playbook runs, but the incident modification fails because the owner is incorrectly formatted.. The automation rule in Microsoft Sentinel executes actions sequentially. The task creation and playbook run succeed, but the incident modification fails because the owner field is incorrectly formatted. Sentinel expects the incident owner to be specified as a user principal name (UPN) or object ID, not a plain text string like 'SOC-Tier1'.

Answer

All actions execute successfully: task created, playbook runs, incident owner set to SOC-Tier1.

Answer

The rule fails to run because the actions are not in valid JSON format.

Answer

The playbook runs first, then the task is created, then the incident is modified.

Question 5

Your security team uses Microsoft Sentinel UEBA to detect anomalous user behavior. You need to configure UEBA to baseline user activities and generate alerts for deviations. What must you do first?

Accepted Answer

Enable UEBA in the Sentinel Settings blade and select relevant data sources.. Microsoft Sentinel UEBA requires explicit enablement in the Sentinel Settings blade under the 'Entity behavior analytics' section. Once enabled, you must select the relevant data sources (e.g., Microsoft Entra ID sign-in logs, Office 365 audit logs, Windows Security Events) so that Sentinel can baseline normal user behavior patterns and generate alerts for anomalous deviations. Without this initial configuration, UEBA cannot process any data or produce behavioral analytics.

Answer

Create an Azure Machine Learning workspace for anomaly detection.

Answer

Assign Microsoft 365 E5 licenses to all users.

Answer

Deploy a custom data connector for HR systems.

Question 6

Your organization uses Microsoft Sentinel for security information and event management (SIEM). You need to ensure that all incidents from a specific analytics rule are automatically assigned to the 'SOC Tier 1' team. What should you configure in Microsoft Sentinel?

Accepted Answer

Create an automation rule that triggers when the incident is created and sets the owner.. Automation rules in Microsoft Sentinel allow you to define conditions (such as incident creation) and actions (such as setting the owner) without requiring a playbook or custom code. This provides a lightweight, native way to automatically assign incidents from a specific analytics rule to the 'SOC Tier 1' team by filtering on the rule's name or ID in the automation rule's condition.

Answer

Configure alert enrichment in the analytics rule to add the owner.

Answer

Modify the analytics rule to write the incident to a custom table accessible by the SOC team.

Answer

Create a playbook that assigns the incident and attach it to the analytics rule.

Question 7

Match each Microsoft Defender for Cloud feature on the left with its primary purpose on the right.

Accepted Answer

Just-In-Time VM Access → Provides time-limited access to management ports via NSG rules; Adaptive Application Controls → Allowlists known safe applications to run on VMs; File Integrity Monitoring → Detects changes to sensitive registry keys and files; Regulatory Compliance Dashboard → Assesses Azure resources against industry standards. It accurately matches each Microsoft Defender for Cloud feature to its primary purpose. Just-In-Time (JIT) VM Access reduces the attack surface by locking down management ports (e.g., RDP 3389, SSH 22) and granting time-limited access via NSG rules only when requested. Adaptive Application Controls uses machine learning to create an allowlist of known safe applications, blocking unknown executables on VMs. File Integrity Monitoring (FIM) tracks changes to sensitive registry keys, files, and certificates, alerting on unauthorized modifications. The Regulatory Compliance Dashboard continuously assesses Azure resources against built-in standards like CIS, NIST, and Azure Security Benchmark, providing a compliance score and recommendations.

Answer

The first and second mappings are reversed; the remaining mappings are unchanged.

Answer

All features map to the same monitoring purpose.

Answer

The compliance and access-control mappings are swapped.

Question 8

A SOC analyst creates a scheduled analytics rule in Microsoft Sentinel to detect anomalous Microsoft Entra ID sign-ins. The rule uses the SigninLogs table and runs every 15 minutes. The analyst wants to alert when a user signs in from a country that is not in the allowed list (['US', 'CA']). Which KQL query pattern should be used in the rule?

Accepted Answer

SigninLogs | where Location.countryOrRegion !in (dynamic(['US','CA'])). The SigninLogs table stores the sign-in location in the `Location.countryOrRegion` field, which is a nested property of the `Location` dynamic object. The KQL operator `!in` with `dynamic(['US','CA'])` correctly performs a case-sensitive comparison against a list of string values, ensuring that only sign-ins from countries outside the allowed list trigger the alert.

Answer

SigninLogs | where Country !in ('US','CA')

Answer

SigninLogs | where location != 'US' and location != 'CA'

Answer

SigninLogs | where geoLocation !in (dynamic(['US','CA']))

Question 9

You are managing a Microsoft Defender XDR environment. The security team wants to receive email notifications when a new incident is created with severity 'High' or 'Medium'. They also want to ensure that notifications are sent only for incidents that are not automatically resolved by AIR. What should you configure?

Accepted Answer

Create an email notification rule in Microsoft Defender XDR with conditions for severity and status set to 'Active'.. Microsoft Defender XDR allows you to create email notification rules specifically for incidents, with conditions to filter by severity (e.g., High, Medium) and status (e.g., Active). This ensures notifications are sent only for new incidents that are not automatically resolved by AIR, as AIR-resolved incidents would have a status of 'Resolved' or 'Redirected', not 'Active'.

Answer

Create a playbook in Microsoft Sentinel that sends an email when an incident is created.

Answer

Configure an automation rule in Microsoft Sentinel to send email notifications.

Answer

Configure alert service settings in the Microsoft 365 Defender portal to send emails for high and medium severity alerts.

Question 10

Refer to the exhibit. You are investigating a user entity in Microsoft Sentinel. The entity details show a riskLevel of 'high' and riskState 'atRisk'. What does this indicate?

Accepted Answer

The user account has been flagged by Microsoft Entra ID Protection as at risk. The riskLevel of 'high' and riskState of 'atRisk' are specific properties populated by Microsoft Entra ID Protection (formerly Azure AD Identity Protection). These values indicate that the user account has been flagged as risky based on real-time risk detections (e.g., leaked credentials, anonymous IP address, atypical travel). This is not a direct result of a Sentinel analytics rule, nor does it mean the account is disabled or confirmed compromised—it means the identity protection service has detected suspicious activity and assigned a risk level.

Answer

The user account has been disabled

Answer

The user account triggered a Sentinel analytics rule

Answer

The user account has been confirmed compromised

Question 11

A phishing email was delivered to several users. The analyst wants to find all messages in the campaign, see delivery actions, and perform remediation from the Microsoft 365 Defender portal. Which tool should they use?

Accepted Answer

Threat Explorer.. Threat Explorer (also known as Explorer) in Microsoft 365 Defender is the correct tool because it provides a comprehensive view of email threats, including phishing campaigns. It allows analysts to search for all messages in a campaign, review delivery actions (e.g., blocked, delivered to junk, or delivered), and perform remediation actions such as soft delete, hard delete, or move to quarantine directly from the portal.

Answer

Microsoft Secure Score.

Answer

Azure Activity log.

Answer

Microsoft Defender Vulnerability Management software inventory.

Question 12

A security analyst is investigating a user who may have been compromised. The analyst sees a sign-in from an unusual location and then a series of suspicious actions performed by that user, including deleting files and sending emails. The analyst wants to find all emails sent by the user after the anomalous sign-in. Which advanced hunting tables should be used?

Accepted Answer

EmailEvents and IdentityLogonEvents. The investigation requires correlating a specific sign-in event (from IdentityLogonEvents) with subsequent email activity (from EmailEvents). IdentityLogonEvents captures authentication details including location, while EmailEvents records email send/receive metadata. Joining these tables on the user principal name (UPN) and timestamp allows the analyst to filter all emails sent after the anomalous sign-in.

Answer

EmailEvents and DeviceFileEvents

Answer

IdentityLogonEvents and DeviceEvents

Answer

EmailAttachmentInfo and EmailUrlInfo alone

Question 13

Your Microsoft Sentinel workspace has multiple analytics rules generating incidents. You need to ensure that when an incident is created from a specific rule, a Teams message is sent to the security team. What should you configure?

Accepted Answer

Create an automation rule that runs a playbook when the incident is created. Automation rules in Microsoft Sentinel can trigger on incident creation and execute a playbook, which can be configured to send a Teams message via a connector. This provides a native, low-code way to automate notifications without custom code or external tools.

Answer

Configure a workbook to send an email when an incident appears

Answer

Modify the incident creation rule in Microsoft 365 Defender

Answer

Add a custom analytics rule that triggers on incident creation

Question 14

You are managing a Microsoft Sentinel workspace that ingests data from Microsoft 365 Defender. You notice that some incident creation rules are not generating incidents as expected. What should you check first?

Accepted Answer

The Microsoft 365 Defender data connector. The Microsoft 365 Defender data connector is the correct first check because it is the ingestion pipeline for security alerts from Microsoft 365 Defender into Microsoft Sentinel. If this connector is misconfigured, disconnected, or has stopped syncing, incident creation rules that depend on these alerts will not trigger, even if the analytics rules themselves are enabled and correctly configured.

Answer

The workspace daily usage cap

Answer

The SecurityIncident table schema

Answer

The analytics rule status

Question 15

You are configuring Microsoft Defender for Cloud Apps to enhance visibility into your organization's SaaS app usage. You need to ensure that risky user activities are automatically suspended. What should you configure?

Accepted Answer

Create a session policy to block or limit activities based on risk.. Session policies in Microsoft Defender for Cloud Apps allow you to monitor and control user activities in real time based on risk level. By configuring a session policy with the 'block' or 'limit' action triggered by risk factors (e.g., anomalous location, impossible travel), you can automatically suspend risky user activities without disrupting legitimate usage.

Answer

Set up IP address range policies.

Answer

Configure app discovery policies.

Answer

Define file policies to protect sensitive data.