SC-200 Practice Test 15 — 15 Questions

Question 1

A security operations analyst is creating a scheduled analytics rule in Microsoft Sentinel to detect brute force attempts on Microsoft Entra ID authentication. Which data source is most appropriate for this rule?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

SigninLogs. SigninLogs captures user authentication attempts to Microsoft Entra ID, including failed sign-ins, which are essential for detecting brute force attacks. This data source provides detailed properties such as IP address, application, and status codes (e.g., 50076 for invalid password), enabling accurate detection of repeated failed attempts. Azure Activity Logs, Office Activity Logs, and SecurityEvent do not contain Entra ID authentication events.

Answer

Azure Activity Logs

Answer

Office Activity Logs

Answer

SecurityEvent

Question 2

A company uses Microsoft Defender for Cloud to protect Azure resources. They have an Azure SQL Database containing sensitive customer data. The security team wants to be alerted if a user attempts to perform SQL injection attacks against the database. Which Defender for Cloud plan must be enabled to receive SQL injection alerts?

Accepted Answer

Defender for SQL. Defender for SQL is the correct plan because it specifically provides threat detection for Azure SQL Database, including alerts for SQL injection attempts. It analyzes database audit logs and anomalous query patterns to detect SQL injection attacks, which are a primary threat to sensitive data in SQL databases.

Answer

Defender for Servers

Answer

Defender for Storage

Answer

Defender for App Service

Question 3

Your organization uses Microsoft Defender XDR and you are configuring attack surface reduction (ASR) rules. You need to implement a rule that blocks executable files from running unless they meet a prevalence, age, or trusted list criterion. Which ASR rule should you enable?

Accepted Answer

Block executable files from running unless they meet a prevalence, age, or trusted list criterion. The ASR rule 'Block executable files from running unless they meet a prevalence, age, or trusted list criterion' (GUID: 01443614-cd74-433a-b99e-2ecdc07bfc25) is specifically designed to prevent executable files (e.g., .exe, .dll, .scr) from running unless they have been seen in the organization (prevalence), are old enough (age), or are on a trusted list. This rule uses cloud-delivered protection and Microsoft's reputation-based intelligence to evaluate files before execution, directly matching the requirement described in the question.

Answer

Block untrusted and unsigned processes that run from USB

Answer

Block Office applications from creating executable content

Answer

Block credential stealing from the Windows local security authority subsystem (lsass.exe)

Question 4

You are deploying Microsoft Sentinel using the above ARM template parameters. After deployment, you notice that Microsoft Defender for Cloud alerts are not being ingested. What is the MOST likely reason?

Accepted Answer

The 'MicrosoftThreatProtection' connector only ingests Microsoft Defender XDR signals, not Defender for Cloud alerts.. The 'MicrosoftThreatProtection' connector is specifically designed to ingest signals from Microsoft Defender XDR (formerly Microsoft 365 Defender), which includes Defender for Endpoint, Defender for Office 365, Defender for Identity, and Defender for Cloud Apps. It does not ingest Microsoft Defender for Cloud alerts. To ingest Defender for Cloud alerts, you must use the dedicated 'Defender for Cloud' data connector in Microsoft Sentinel. Therefore, deploying only the 'MicrosoftThreatProtection' connector will result in Defender for Cloud alerts not being ingested.

Answer

UEBA is enabled, which conflicts with Defender for Cloud data ingestion.

Answer

The workspace location (eastus) does not support Defender for Cloud connector.

Answer

The workspace name 'sentinel-workspace' is reserved for internal use.

Question 5

A security analyst is investigating an incident in Microsoft 365 Defender that involves a user who clicked a phishing link. The analyst wants to find all processes executed on the user's device immediately after the email was opened. Which advanced hunting table should the analyst query to obtain process creation events with timestamps relative to the email event?

Accepted Answer

DeviceProcessEvents. DeviceProcessEvents is the correct table because it stores process creation events (including image name, command line, and timestamp) for all devices onboarded to Microsoft Defender for Endpoint. By querying this table with a time range starting immediately after the email event (identified from EmailEvents), the analyst can correlate the phishing click with subsequent process executions on the user's device.

Answer

EmailEvents

Answer

DeviceNetworkEvents

Answer

IdentityLogonEvents

Question 6

Your organization uses Microsoft Sentinel to manage security incidents. The security team wants to automatically assign incidents to the appropriate analyst based on the incident’s severity and category. Which feature should you configure?

Accepted Answer

Automation rules. Automation rules in Microsoft Sentinel allow you to automatically assign incidents to specific analysts or teams based on conditions such as severity and category. This is the correct feature because it provides a rule-based engine that triggers on incident creation or update, enabling automatic assignment without manual intervention.

Answer

Analytics rules

Answer

Playbooks

Answer

Watchlists

Question 7

Your organization uses Microsoft Sentinel and has enabled UEBA (User and Entity Behavior Analytics). You notice that the UEBA timeline is not populating for some users. You have verified that the data sources are connected and the UEBA feature is enabled. What could be the issue?

Accepted Answer

There is insufficient data to build baselines for those users; UEBA needs at least 14 days of data.. UEBA requires a minimum of 14 days of historical data to establish behavioral baselines for each user. Without sufficient data, the timeline cannot detect anomalies or populate entries. Even if data sources are connected and UEBA is enabled, the feature will not generate timeline events until baselines are built.

Answer

Users must opt in to UEBA tracking.

Answer

UEBA only works with Azure Active Directory (now Microsoft Entra ID) audit logs.

Answer

The data sources are not sending logs for those users.

Question 8

A security analyst in Microsoft 365 Defender uses advanced hunting to detect possible credential theft. They want to find instances where a user signed in from an IP address that is not in their organization's known IP range. Which table should they query to get sign-in location and IP address?

Accepted Answer

IdentityLogonEvents. IdentityLogonEvents is the correct table because it contains cloud identity logon data from Microsoft Entra ID (formerly Azure AD), including sign-in location, IP address, and user details. This table is specifically designed for hunting authentication-related events like credential theft, where you need to correlate user sign-ins with IP addresses to detect anomalies against known IP ranges.

Answer

DeviceLogonEvents

Answer

EmailEvents

Answer

AlertInfo

Question 9

Refer to the exhibit. You are reviewing a Microsoft Sentinel analytics rule created via ARM template. What is the effect of the grouping configuration?

Accepted Answer

Groups alerts into one incident if all entities match within a 5-hour lookback.. The grouping configuration in the exhibit sets the grouping condition to 'Group alerts into a single incident if all entities match' with a 5-hour lookback period. This means that alerts generated within 5 hours that share identical entities (e.g., same IP, host, or account) will be merged into one incident, reducing alert noise. Option D correctly describes this behavior, as it specifies both the entity matching requirement and the time window.

Answer

Groups alerts into one incident if any entity matches.

Answer

Creates a separate incident for each alert.

Answer

Suppresses alerts for 5 hours after the first alert.

Question 10

Refer to the exhibit. A Microsoft Sentinel scheduled rule is configured as shown. The rule generates an alert, but the incident created contains only the first alert, and subsequent alerts do not update the incident. What is the most likely cause?

Accepted Answer

The rule does not have incident grouping enabled.. The exhibit shows the rule is configured to create a single incident from alerts grouped by entities, but the 'Grouping' settings are not enabled. Without incident grouping enabled, each alert generates a separate incident, and subsequent alerts do not update the existing incident. Enabling incident grouping allows alerts matching the same grouping criteria to be merged into the same incident, ensuring updates occur.

Answer

The triggerOperator and triggerThreshold are misconfigured.

Answer

The KQL query is missing a join to include more data.

Answer

The severity is set to High, which prevents incident updates.

Question 11

Your security team receives frequent false positive alerts from Microsoft Defender for Cloud Apps. You need to reduce noise without disabling any threat detection policies. What should you do?

Accepted Answer

Configure suppression rules based on user, IP, or app to automatically dismiss matching alerts.. Suppression rules in Microsoft Defender for Cloud Apps allow you to automatically dismiss alerts that match specific criteria (e.g., user, IP address, or app) without disabling the underlying threat detection policy. This reduces false positive noise while keeping the detection engine active for genuine threats. Disabling policies or adjusting severity thresholds would either remove detection entirely or fail to address the root cause of false positives.

Answer

Disable the built-in anomaly detection policies that generate false positives.

Answer

Adjust the alert severity thresholds in the policy settings.

Answer

Create custom detection policies to override default rules.

Question 12

Your Microsoft Defender XDR environment has an advanced hunting query that returns devices potentially affected by a known vulnerability. You want to create a custom detection rule that triggers an alert when more than 10 devices are affected. Which THREE steps are required?

Accepted Answer

Set the rule frequency and threshold to trigger when the query returns more than 10 results.. Setting the rule frequency and threshold to trigger when the query returns more than 10 results directly implements the requirement to alert when more than 10 devices are affected. In Microsoft Defender XDR custom detection rules, the threshold condition is configured in the rule settings to evaluate the number of query results against a specified count, enabling precise alert triggering based on result volume.

Answer

Assign the rule to a severity level.

Answer

Create a Power Automate flow to send an email when the rule triggers.

Question 13

Order the steps to configure a Microsoft Sentinel analytics rule using a scheduled query.

Accepted Answer

Define the query logic, then set the schedule, then set the alert threshold, then configure incident creation and automated responses.. Scheduled query rules run on a schedule and generate alerts based on query results meeting a threshold.

Answer

Define the query logic, then set the schedule, then configure incident creation and automated responses, then set the alert threshold.

Answer

Set the alert threshold, then define the query logic, then set the schedule, then configure incident creation and automated responses.

Answer

Configure incident creation and automated responses, then define the query logic, then set the schedule, then set the alert threshold.

Question 14

A SOC analyst is building a scheduled analytics rule in Microsoft Sentinel to detect when a user is added to a privileged Microsoft Entra ID role (e.g., Global Administrator). Which two tables must be included in the KQL query to capture the role assignment event and to retrieve user details? (Choose 2.)

Accepted Answer

AADAuditLogs. AADAuditLogs captures all directory audit events, including role assignment activities such as adding a user to a privileged Microsoft Entra ID role. This table is essential because it records the 'Add member to role' operation with details like the target user, role name, and initiating actor, which are required to detect the security event.

Answer

SigninLogs

Answer

AzureActivity

Question 15

You are investigating a ransomware incident in Microsoft Sentinel. The incident contains multiple alerts. You need to group related alerts under the same incident to reduce alert fatigue. What should you do?

Accepted Answer

Configure incident creation rules in the analytics rule.. In Microsoft Sentinel, incident creation is configured directly within the analytics rule. When you create or edit an analytics rule, the 'Incident creation' settings allow you to enable incident generation from alerts triggered by that rule. This ensures that all alerts from the same rule are grouped into a single incident, reducing alert fatigue by preventing multiple separate incidents for related alerts.

Answer

Enable User and Entity Behavior Analytics (UEBA).

Answer

Create a new analytics rule to combine alerts.

Answer

Use an automation rule to merge incidents.