SC-200 Practice Test 14 — 15 Questions

Question 1

A security administrator is configuring Microsoft Defender for Cloud's regulatory compliance dashboard. The organization needs to be compliant with the NIST SP 800-53 standard. Which built-in initiative should the administrator assign to the subscription to populate the dashboard with NIST controls?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

NIST SP 800-53 R5. The NIST SP 800-53 R5 built-in initiative is the correct choice because Microsoft Defender for Cloud includes a dedicated regulatory compliance policy initiative that maps directly to the NIST SP 800-53 standard's controls. Assigning this initiative to the subscription populates the regulatory compliance dashboard with the specific NIST controls and their compliance status, enabling the organization to track and report against that framework.

Answer

Azure Security Benchmark

Answer

CIS Microsoft Azure Foundations Benchmark

Answer

ISO 27001

Question 2

You are a security analyst at a company that uses Microsoft Defender XDR. You receive an alert about a potential ransomware activity on a workstation. The alert is generated by Microsoft Defender for Endpoint. You need to contain the threat by isolating the workstation from the network while allowing forensic analysis to proceed. You want to use Microsoft Defender XDR's built-in actions. What should you do?

Accepted Answer

Use the 'Isolate device' action from the Microsoft Defender XDR portal.. The 'Isolate device' action in Microsoft Defender XDR (specifically from the Microsoft Defender for Endpoint component) disconnects the device from all network traffic except for the Defender for Endpoint service and a few authorized services (such as Windows Update and the Microsoft Update Service). This allows forensic analysis tools (like Live Response) to continue communicating with the device while preventing the ransomware from spreading laterally or communicating with command-and-control servers. This is the built-in, recommended containment action for such scenarios.

Answer

Create a firewall rule in Microsoft Defender for Cloud Apps to block the device's IP.

Answer

Unenroll the device from Microsoft Intune.

Answer

Disable the network adapter on the workstation remotely.

Question 3

A KQL query detects brute-force attempts by summarizing failed sign-ins by user, IP address, and five-minute time bins. Which operator is most appropriate for this aggregation?

Accepted Answer

summarize.. The `summarize` operator is the correct choice because it groups rows by specified columns (user, IP address, and five-minute time bins) and applies an aggregation function (e.g., `count()`) to detect brute-force patterns. In KQL, `summarize` is the only operator that can create time-binned aggregations using the `bin()` function, which is essential for grouping failed sign-ins into fixed five-minute intervals. This directly supports the brute-force detection requirement by counting failed attempts per user/IP/time window.

Answer

project-away.

Answer

parse_json.

Answer

extend.

Question 4

A security analyst wants to quickly check the number of incidents created in Microsoft Sentinel in the last 7 days, grouped by severity. Which KQL query should the analyst use?

Accepted Answer

SecurityIncident | where TimeGenerated > ago(7d) | summarize count() by Severity. The SecurityIncident table in Microsoft Sentinel stores incident records, and the query filters for incidents created in the last 7 days using `where TimeGenerated > ago(7d)`, then groups them by severity with `summarize count() by Severity`. This directly answers the analyst's need to check the number of incidents grouped by severity.

Answer

SecurityAlert | where TimeGenerated > ago(7d) | summarize count() by Severity

Answer

SigninLogs | where TimeGenerated > ago(7d) | summarize count() by Status

Answer

DeviceEvents | where TimeGenerated > ago(7d) | summarize count() by ActionType

Question 5

An analyst is creating a custom detection rule in Microsoft 365 Defender to detect lateral movement. The rule should trigger when a device (DeviceA) connects to another device (DeviceB) via SMB (port 445) and, within 5 minutes, a scheduled task is created on DeviceB. Which Advanced Hunting query pattern correctly correlates these events across devices?

Accepted Answer

Join DeviceNetworkEvents (where RemoteIP is DeviceB's IP and RemotePort 445) with DeviceEvents (where ActionType == 'ScheduledTaskCreated' and DeviceId == DeviceB's ID) using a time window of 5 minutes. It uses a `join` between `DeviceNetworkEvents` (filtered for SMB traffic on port 445 from DeviceA to DeviceB) and `DeviceEvents` (filtered for `ActionType == 'ScheduledTaskCreated'` on DeviceB) with a 5-minute time window. This directly correlates the network connection with the subsequent scheduled task creation, which is a classic lateral movement pattern (e.g., PsExec or WMI abuse). The time window ensures the events are causally related within the detection rule's scope.

Answer

Use DeviceProcessEvents to find smb.exe on DeviceA, then join with DeviceFileEvents on DeviceB

Answer

Use only DeviceNetworkEvents on DeviceA and DeviceB separately

Answer

Use EmailEvents and DeviceEvents on DeviceB

Question 6

Your organization uses Microsoft Sentinel. You have a scheduled analytics rule that queries Windows Security Events to detect local admin group modifications. The rule runs every hour and looks back 1 hour. However, you are missing events that occur within the first few minutes of the hour. What is the most likely cause?

Accepted Answer

The event time is in local time, and the query uses UTC, causing events near the boundary to be excluded.. The scheduled analytics rule uses a lookback period of 1 hour, but if the event time is stored in local time while the query uses UTC, events near the hour boundary can be excluded due to time zone offset. Microsoft Sentinel stores events in UTC by default, and the query's time filter (e.g., 'TimeGenerated > ago(1h)') compares against UTC timestamps. If the Windows Security Events are logged in local time and not converted, events occurring just after the hour in local time may fall outside the UTC lookback window, causing them to be missed.

Answer

The query period is too short; it should be 2 hours.

Answer

The rule is using 'Last activity' instead of 'TimeGenerated'.

Answer

There is a 5-minute ingestion delay for Windows events.

Question 7

A security analyst in Microsoft Sentinel wants to create a custom analytics rule that triggers when more than 10 failed logon attempts from a single source IP address occur within 5 minutes. The analyst writes a KQL query to aggregate sign-in logs. Which KQL operator should the analyst use to group events by source IP and count each failure?

Accepted Answer

summarize. The `summarize` operator is correct because it groups rows by a specified key (source IP) and applies an aggregation function (like `count()`) to produce a single output row per group. In this scenario, the analyst needs to count failed logon attempts per source IP, which requires grouping and counting—exactly what `summarize` does.

Answer

extend

Answer

project

Answer

where

Question 8

Your organization uses Microsoft Defender for Cloud with enhanced security features enabled. You need to ensure that all Azure subscriptions are covered by a single Defender for Cloud policy that enforces specific security standards. The policy must be automatically applied to new subscriptions. What should you do?

Accepted Answer

Create a custom policy initiative and assign it to the root management group.. Assigning a custom policy initiative to the root management group ensures that the policy is inherited by all subscriptions under that management group, including new subscriptions as they are added. This approach enforces consistent security standards across the entire Azure environment without requiring manual intervention for each subscription.

Answer

Enable the default Defender for Cloud policy from the Azure portal.

Answer

Manually assign the policy to each subscription using PowerShell.

Answer

Configure the security contact email for each subscription.

Question 9

Your organization uses Microsoft Defender XDR and Microsoft Sentinel. The security operations center (SOC) team frequently receives false positive alerts for a specific user login pattern from a legacy application. You need to reduce alert fatigue without disabling the underlying detection rule. What should you configure?

Accepted Answer

Configure an automated investigation and remediation rule in Microsoft Defender XDR to suppress alerts matching the legacy application pattern.. Configuring an automated investigation and remediation rule in Microsoft Defender XDR allows you to suppress alerts that match a specific pattern (e.g., legacy application login behavior) without disabling the underlying detection rule. This directly reduces alert fatigue by automatically closing or ignoring false positive alerts while keeping the rule active for genuine threats.

Answer

Use Microsoft Sentinel bookmarks to mark the alerts as false positives.

Answer

Create a watchlist in Microsoft Sentinel containing the legacy application's user accounts and use it in the rule.

Answer

Modify the analytics rule in Microsoft Sentinel to exclude the legacy application IP range.

Question 10

A SOC analyst wants to create a scheduled analytics rule in Microsoft Sentinel that runs every hour and detects multiple failed user login attempts from a single IP address within a 5-minute window. Which KQL function should be used in the query to group the failed events by 5-minute time intervals?

Accepted Answer

summarize count() by IPAddress, bin(TimeGenerated, 5m). The `bin()` function in KQL is specifically designed to group data into fixed-size time buckets, such as 5-minute intervals. By using `summarize count() by IPAddress, bin(TimeGenerated, 5m)`, the query counts failed login attempts per IP address within each 5-minute window, which directly meets the requirement for a scheduled rule that detects multiple failures from a single IP in a 5-minute period.

Answer

summarize count() by IPAddress, TimeGenerated

Answer

extend interval = datetime_diff('minute', TimeGenerated, ago(5m))

Answer

scan with (match all events within 5m by IPAddress)

Question 11

An analyst is investigating a phishing campaign that targeted multiple users. The analyst needs to identify if any users clicked a malicious link in the email. Which Microsoft Defender for Office 365 feature should be used?

Accepted Answer

Threat Explorer. Threat Explorer (also known as Explorer) in Microsoft Defender for Office 365 provides a real-time, interactive view of threat data, including email delivery status and user actions such as clicks on malicious links. It allows analysts to filter by 'Click action' to identify users who clicked a URL that was determined to be malicious, making it the correct tool for this investigation.

Answer

Safe Attachments

Answer

Attack Simulator

Answer

Safe Links

Question 12

You are managing a Microsoft Sentinel environment with multiple workspaces across different regions. You need to centralize incident management and allow security analysts to triage incidents from all workspaces in a single view. What should you configure?

Accepted Answer

Configure a central Microsoft Sentinel workspace with cross-workspace analytics rules.. Cross-workspace analytics rules in Microsoft Sentinel allow you to define a single analytics rule that queries multiple workspaces, enabling centralized incident creation and management. This configuration ensures that security analysts can view and triage incidents from all workspaces in a single Microsoft Sentinel instance, without needing to switch between different workspace blades.

Answer

Create a workbook that queries all workspaces.

Answer

Use the Microsoft Sentinel SIEM Migration experience.

Answer

Use Azure Lighthouse to manage all workspaces from a single pane of glass.

Question 13

Your SOC uses Microsoft Sentinel and Microsoft Defender XDR. An incident is created from a Defender for Endpoint alert about a malware detection on a device. The incident has low priority, but you want to automatically isolate the device from the network if the alert is confirmed as a true positive by the SOC. What is the recommended approach?

Accepted Answer

Create an automation rule in Microsoft Sentinel that triggers a playbook with an approval step before executing device isolation.. It aligns with the recommended SOC workflow: an automation rule in Microsoft Sentinel triggers a playbook that includes an approval step, ensuring that device isolation only occurs after the SOC confirms the alert as a true positive. This approach maintains human oversight for low-priority incidents while leveraging automation for the response action.

Answer

Create a separate analytics rule that triggers on the same alert and uses a playbook to isolate the device.

Answer

Use automatic attack disruption in Microsoft Defender XDR to isolate the device automatically.

Answer

Configure an automated response in Defender for Endpoint to isolate the device immediately when an alert is generated.

Question 14

Your organization uses Microsoft Sentinel. You need to ensure that an alert is created when a user accesses a sensitive SharePoint site from an unusual location. What should you create?

Accepted Answer

An analytics rule. An analytics rule in Microsoft Sentinel defines the conditions under which alerts are generated. To detect a user accessing a sensitive SharePoint site from an unusual location, you would create an analytics rule that queries the Office 365 activity logs (e.g., SharePoint operations) and uses the 'Unusual Geo-Location' anomaly detection or a custom KQL query comparing the user's location against a baseline of their typical access patterns. This rule will then generate an alert when the condition is met.

Answer

A watchlist

Answer

A playbook

Answer

An automation rule

Question 15

Your organization uses Microsoft Defender for Office 365. You detect a phishing email that was delivered to a user's inbox. You want to remove the email from all recipients. What should you do?

Accepted Answer

Use Threat Explorer to find the email and take action to delete it.. Threat Explorer in Microsoft Defender for Office 365 allows security analysts to search for specific emails based on attributes like sender, subject, or recipient, and then take bulk remediation actions such as soft-delete (move to Deleted Items) or hard-delete (purge from mailbox). This is the correct tool to remove a phishing email that has already been delivered to users' inboxes, as it provides granular search and remediation capabilities for existing messages.

Answer

Submit the email to Microsoft for analysis.

Answer

Create a mail flow rule to delete similar emails in the future.

Answer

Block the sender using the Tenant Allow/Block List.