SC-200 Practice Test 13 — 15 Questions

Question 1

A company has multiple Azure subscriptions under a management group. They want to ensure that all VMs across all subscriptions have Microsoft Defender for Cloud's vulnerability assessment solution (using the Microsoft Defender Vulnerability Management engine) enabled. They also want to automatically remediate any non-compliant VMs by enabling the VA solution when a VM is missing it. Which combination of policy initiatives and automation should they use?

Accepted Answer

Assign the 'Configure machines to receive a vulnerability assessment provider' policy with 'DeployIfNotExists' effect and set it to auto-remediate at the management group-level scope.. Option D is correct because the 'Configure machines to receive a vulnerability assessment provider' policy with the 'DeployIfNotExists' effect directly deploys the Microsoft Defender Vulnerability Management (MDVM) extension to any VM that lacks it. By assigning this policy at the management group scope and enabling automatic remediation, the policy will automatically remediate non-compliant VMs without requiring additional runbooks or scripts, fulfilling both the detection and automatic remediation requirements.

Answer

Assign the 'Azure Security Benchmark' initiative at the management group, enable automatic remediation for the 'Vulnerability assessment should be enabled on your virtual machines' policy.

Answer

Assign the 'Defender for Cloud' initiative with the 'Configure machines to receive a vulnerability assessment provider' policy, and configure a remediation task with a deployment script.

Answer

Assign the 'Azure Security Benchmark' initiative and create an Azure Automation runbook triggered by a compliance alert to enable VA.

Question 2

A company runs SQL Server on Azure Virtual Machines (IaaS). They want to enable Advanced Threat Protection (ATP) for these instances to detect SQL injection attempts. What must they do first?

Accepted Answer

Enable Azure Defender for SQL on the server. Azure Defender for SQL is the specific plan within Microsoft Defender for Cloud that provides Advanced Threat Protection (ATP) for Azure SQL resources, including SQL Server on Azure VMs. Enabling this plan activates threat detection capabilities such as SQL injection alerts, anomalous access patterns, and vulnerability assessments. Without this plan, the VM's SQL Server instance is not monitored by Defender for Cloud's SQL-specific threat detection engine.

Answer

Deploy the Azure Security Center agent on the VM

Answer

Enable Azure Defender for Servers

Answer

Configure SQL Server auditing manually

Question 3

A SOC analyst wants to create a watchlist in Microsoft Sentinel from a CSV file that contains IP addresses. The analyst needs to configure the watchlist so that it can be efficiently queried using IP address comparison operators (e.g., IP prefix matching). Which data type should be set for the key column?

Accepted Answer

ipaddress. The 'ipaddress' data type is correct because it enables Microsoft Sentinel to parse and index the column values as IP addresses, allowing efficient use of IP-specific operators such as 'has_ip_prefix()' for prefix matching. Without this type, the watchlist would treat IPs as plain strings, preventing optimized IP comparison queries.

Answer

string

Answer

dynamic

Answer

guid

Question 4

A security administrator wants to quickly view the overall security posture of all Azure subscriptions under a single management group that are monitored by Microsoft Defender for Cloud. Where in the Azure portal should they navigate?

Accepted Answer

Microsoft Defender for Cloud overview page. The Microsoft Defender for Cloud overview page provides a unified dashboard that displays the secure score, regulatory compliance, and security alerts across all subscriptions under a management group. This is the default landing page for assessing the overall security posture, aggregating data from all monitored subscriptions in a single view.

Answer

Azure Monitor

Answer

Azure Policy Compliance dashboard

Answer

Azure Advisor

Question 5

A security administrator wants to ensure that all Azure virtual machines have Microsoft Defender for Cloud's vulnerability assessment (VA) solution enabled automatically. They need to deploy the VA solution to new and existing VMs without manual intervention. Which method should they use?

Accepted Answer

Assign an Azure Policy with DeployIfNotExists effect for the VA solution. Option B is correct because Azure Policy with a DeployIfNotExists effect can automatically deploy the Microsoft Defender for Cloud integrated vulnerability assessment (VA) solution (Qualys or Microsoft) to both new and existing Azure VMs without manual intervention. This policy evaluates VMs that do not have the VA extension installed and triggers a remediation task to deploy it, ensuring continuous compliance across the subscription.

Answer

Configure 'Vulnerability assessment for machines' in Defender for Cloud settings

Answer

Enable the Defender for Servers plan on the subscription

Answer

Run a PowerShell script to install the VA solution on all VMs

Question 6

A company has enabled Microsoft Defender for Cloud on their subscription containing Azure SQL databases. They receive an alert about a potential SQL injection attack. The analyst wants to see the actual query that was executed. Where can the analyst find the query details associated with the alert?

Accepted Answer

In the alert's entity tab. Option A is correct because when Microsoft Defender for Cloud detects a SQL injection attack, the alert details include an 'Entities' tab that contains the actual SQL query that was executed. This tab provides the raw query text, which is essential for the analyst to understand the exact payload used in the attack and to assess the impact on the database.

Answer

By opening the SQL database's threat detection logs

Answer

In the Azure Activity Log

Answer

In the alert's diagnostic data

Question 7

A security operations center (SOC) uses Microsoft Sentinel. The team wants to automatically assign incidents to the appropriate analyst based on the severity level of the alert. Which feature should be configured to achieve this automation?

Accepted Answer

Automation rules. Automation rules in Microsoft Sentinel allow you to define conditions (such as alert severity) and corresponding actions (like assigning an incident to a specific analyst or group) without requiring custom code. This directly meets the SOC's requirement to automatically route incidents based on severity levels, as automation rules can trigger on incident creation or update and perform assignment actions.

Answer

Playbooks

Answer

Analytics rules

Answer

Watchlists

Question 8

A security analyst in Microsoft Defender for Cloud is reviewing the Security Alerts for an Azure subscription. The analyst sees an alert titled "Suspicious PowerShell activity detected" on an Azure VM. The analyst needs to view the full command line of the suspicious script and the parent process that launched it. Where in the alert details can the analyst find this information?

Accepted Answer

The "Investigate" tab (with timeline and entities). The 'Investigate' tab in Microsoft Defender for Cloud provides a detailed timeline and entity graph that includes the full command line of the suspicious script and the parent process that launched it. This tab is specifically designed for deep forensic analysis, allowing analysts to trace process ancestry and view raw command-line arguments, which are not available in the general alert description or the Attack story tab.

Answer

The "Attack story" tab

Answer

The "Alert details" pane (general description)

Answer

The "Take action" tab (recommendations)

Question 9

A company uses Microsoft Defender for Cloud with enhanced security features enabled. The security team wants to automatically disable the local administrative account on all existing and future Azure virtual machines by applying a guest configuration policy. Which Defender for Cloud feature should they use?

Accepted Answer

Guest configuration (Azure Policy). Option B is correct because Guest configuration (Azure Policy) is the only feature that can audit and remediate settings inside a virtual machine's operating system, such as disabling the local administrative account. Defender for Cloud integrates with Azure Policy's guest configuration extension to enforce desired state configurations on both existing and future VMs via policy assignments.

Answer

Just-In-Time (JIT) VM access

Answer

Adaptive application controls

Answer

Regulatory compliance dashboard

Question 10

A company uses Microsoft Defender for Cloud with Defender for Containers enabled. The security team wants to view security alerts generated for their Azure Kubernetes Service (AKS) clusters. Where should they navigate to see these alerts?

Accepted Answer

In the Microsoft Defender for Cloud 'Security alerts' page.. Microsoft Defender for Cloud is the central console for security alerts generated by Defender for Containers, including those for AKS clusters. The 'Security alerts' page within Defender for Cloud aggregates all cloud workload protection alerts, making it the correct location to view AKS-specific alerts. Alerts from Defender for Containers are automatically surfaced here without additional configuration.

Answer

In Microsoft Sentinel incidents.

Answer

In the Microsoft 365 Defender portal.

Answer

In Azure Monitor alerts.

Question 11

A company wants to enable Microsoft Defender for Cloud's enhanced security features for all Azure virtual machines in a subscription. What is the first action they should take in the Defender for Cloud pricing & settings page?

Accepted Answer

Turn on the 'Servers' plan for the subscription. To enable Microsoft Defender for Cloud's enhanced security features for Azure VMs, the first step is to turn on the 'Servers' plan at the subscription level in the Defender for Cloud pricing & settings page. This activates Defender for Servers, which provides threat detection, vulnerability assessment, and just-in-time access. Without enabling this plan, no enhanced security features are available, regardless of other configurations.

Answer

Install the Log Analytics agent on each VM

Answer

Enable vulnerability assessment

Answer

Assign a regulatory compliance policy

Question 12

A global enterprise uses Microsoft 365 Defender across multiple tenants. During an incident, a security analyst needs to search for a specific file hash indicator of compromise (IOC) across all mailboxes and endpoints in all tenants from a single interface. Which feature allows the analyst to run a query across multiple tenants without switching contexts?

Accepted Answer

Cross-tenant advanced hunting. Cross-tenant advanced hunting in Microsoft 365 Defender allows a security analyst to run Kusto Query Language (KQL) queries across multiple tenants from a single interface. This feature is specifically designed for hunting for indicators of compromise (IOCs), such as file hashes, across all mailboxes and endpoints in a multi-tenant environment without requiring the analyst to switch between tenant portals.

Answer

Multi-tenant management

Answer

Unified audit log

Answer

Microsoft Graph Security API

Question 13

A company uses Microsoft Defender for Cloud with enhanced security features enabled. They have several Azure virtual machines running SQL Server. The security team wants to enable advanced threat protection for their Azure SQL databases. What should they do?

Accepted Answer

Enable Microsoft Defender for SQL on the subscription.. Microsoft Defender for SQL (formerly Advanced Threat Protection for Azure SQL) is the specific plan that provides threat detection for Azure SQL databases, including SQL Server on Azure VMs. Enabling it at the subscription level ensures all existing and future Azure SQL databases under that subscription are protected, which is the recommended and most efficient approach.

Answer

Enable Microsoft Defender for Servers on the subscription.

Answer

Enable Microsoft Defender for Database on the subscription.

Answer

Configure SQL Vulnerability Assessment in the Azure portal for each database.

Question 14

A security operations analyst is reviewing recommendations in Microsoft Defender for Cloud. For a virtual machine that is missing critical security updates, which recommendation category will highlight this issue?

Accepted Answer

Secure score. In Microsoft Defender for Cloud, the Secure score category directly reflects the security posture of your resources by tracking the implementation of security recommendations. Missing critical security updates on a virtual machine are flagged as a recommendation within this category, and resolving them improves your secure score percentage. This is because secure score is calculated based on the compliance status of each recommendation, with missing updates being a key control for vulnerability management.

Answer

Regulatory compliance

Answer

Workload protections

Answer

Inventory

Question 15

A security analyst in Microsoft 365 Defender uses advanced hunting to detect possible credential theft. They want to find instances where a user signed in from an IP address that is not in their organization's known IP range. Which table should they query to get sign-in location and IP address?

Accepted Answer

IdentityLogonEvents. IdentityLogonEvents is the correct table because it contains cloud identity logon data from Microsoft Entra ID (formerly Azure AD), including sign-in location, IP address, and user details. This table is specifically designed for hunting authentication-related events like credential theft, where you need to correlate user sign-ins with IP addresses to detect anomalies against known IP ranges.

Answer

DeviceLogonEvents

Answer

EmailEvents

Answer

AlertInfo