SC-200 Practice Test 15 — 15 Questions

Question 1

A security analyst wants to identify all users who received a phishing email that contained a known malicious URL. The analyst has the URL. Which advanced hunting table should the analyst query first to find the emails that contained this URL?

Accepted Answer

EmailUrlInfo. The EmailUrlInfo table in Microsoft Defender XDR contains records of URLs extracted from email messages, including the specific URL and the email's unique identifier (NetworkMessageId). By querying this table for the known malicious URL, the analyst can retrieve the NetworkMessageIds of all emails containing that URL, which can then be joined with the EmailEvents table to identify the recipients. This is the most direct and efficient first step because EmailUrlInfo is purpose-built to map URLs to email messages.

Answer

EmailEvents

Answer

EmailAttachmentInfo

Answer

EmailPostDeliveryEvents

Question 2

A security administrator wants to ensure that all Azure virtual machines have automatic provisioning of the Log Analytics agent enabled by default in Microsoft Defender for Cloud. Where should this configuration be set?

Accepted Answer

In Microsoft Defender for Cloud, under 'Environment settings' > 'Data collection'. Option B is correct because the automatic provisioning of the Log Analytics agent for all Azure virtual machines in Defender for Cloud is configured under 'Environment settings' > 'Data collection'. This setting enables Defender for Cloud to automatically deploy the Log Analytics agent to new and existing VMs, ensuring security monitoring without manual intervention.

Answer

In the Azure portal under each virtual machine's 'Extensions + applications' blade

Answer

In Microsoft Sentinel, under 'Data connectors' for Defender for Cloud

Answer

In Azure Policy, by assigning the 'Deploy Log Analytics agent' initiative

Question 3

A SOC analyst is configuring an analytics rule in Microsoft Sentinel. The rule should run every hour and check for sign-ins from users who have been inactive for more than 30 days. The analyst uses the SigninLogs and IdentityInfo tables. Which KQL query pattern should be used to identify these users?

Accepted Answer

IdentityInfo | join kind=leftanti (SigninLogs | where TimeGenerated > ago(30d)) on UserPrincipalName. Option B is correct because it uses a `leftanti` join to return all rows from the `IdentityInfo` table that have no matching `UserPrincipalName` in the `SigninLogs` table for the last 30 days. This directly identifies users who are in the identity inventory but have not signed in within the past 30 days, which is the exact requirement for detecting inactive users.

Answer

union IdentityInfo, SigninLogs | where TimeGenerated > ago(30d) | summarize by UserPrincipalName

Answer

SigninLogs | where TimeGenerated > ago(30d) | summarize by UserPrincipalName | join kind=rightanti IdentityInfo on UserPrincipalName

Answer

SigninLogs | where TimeGenerated < ago(30d) | summarize by UserPrincipalName

Question 4

A security analyst wants to identify all devices in the organization that have a specific software vulnerability (CVE-2023-1234) installed using Microsoft 365 Defender Advanced Hunting. Which table should be queried?

Accepted Answer

DeviceTvmSoftwareVulnerabilities. The DeviceTvmSoftwareVulnerabilities table in Microsoft 365 Defender Advanced Hunting contains records of software vulnerabilities discovered on devices, including specific CVE identifiers like CVE-2023-1234. This table is designed to answer questions about which devices have a particular vulnerability installed, as it links device IDs to vulnerability details such as CVE ID, severity, and exploitability.

Answer

DeviceInfo

Answer

DeviceTvmSoftwareInventory

Answer

DeviceNetworkInfo

Question 5

A SOC analyst wants to ingest firewall logs from a Palo Alto Networks appliance into Microsoft Sentinel using the Common Event Format (CEF) connector. The analyst has already set up a Linux syslog forwarder. What is the next required step to complete the data ingestion?

Accepted Answer

Run the installation script provided by the Sentinel CEF connector page on the Linux forwarder.. The CEF connector for Palo Alto Networks in Microsoft Sentinel requires a Linux syslog forwarder to have the CEF agent installed and configured. The installation script provided on the Sentinel CEF connector page automates the setup of the Log Analytics agent (formerly OMS agent) with the correct syslog daemon configuration to parse and forward CEF-formatted logs. Since the forwarder is already deployed, running this script is the immediate next step to enable log ingestion.

Answer

Install the Azure Monitor Agent on the Linux forwarder.

Answer

Create a Syslog data connector in Sentinel and specify the Palo Alto facility.

Answer

Enable Azure Arc on the firewall appliance.

Question 6

A SOC analyst needs to create a Microsoft Sentinel scheduled analytics rule that triggers when an Microsoft Entra ID user performs more than 10 failed sign-in attempts from different IP addresses within 15 minutes, using the SigninLogs table. Which KQL query aggregate pattern should be used?

Accepted Answer

SigninLogs | summarize DistinctIPs = dcount(IPAddress) by UserPrincipalName, bin(TimeGenerated, 15m) | where DistinctIPs > 10. Option B is correct because the query uses `dcount(IPAddress)` to count distinct IP addresses per user within a 15-minute time window, then filters for users with more than 10 distinct IPs. This directly matches the requirement to detect failed sign-ins from different IP addresses, not just total failed attempts.

Answer

SigninLogs | summarize FailedCount = count() by UserPrincipalName, IPAddress, bin(TimeGenerated, 15m) | where FailedCount > 10

Answer

SigninLogs | summarize DistinctIPs = count() by UserPrincipalName, IPAddress | where DistinctIPs > 10

Answer

SigninLogs | where Status contains 'Failed' | summarize by UserPrincipalName, IPAddress | count > 10

Question 7

A SOC analyst is creating a Microsoft Sentinel scheduled analytics rule to detect failed sign-in attempts from a specific list of known malicious IP addresses. The IP addresses are stored in a CSV file that is updated weekly. The analyst uploads the file as a new table in the Log Analytics workspace. Which KQL operator should the analyst use to reference this table within the rule's query?

Accepted Answer

Use the custom table name directly in the query, e.g., 'MaliciousIPs_CL'.. Option A is correct because when a CSV file is uploaded as a new table in the Log Analytics workspace, it becomes a custom table with a '_CL' suffix (e.g., 'MaliciousIPs_CL'). The analyst can then reference this table directly in the KQL query, just like any other table in the workspace. This is the standard method for using custom log data ingested via the Log Analytics agent or direct upload.

Answer

Use 'externaldata()' to point to the CSV file in Azure Blob storage.

Answer

Use 'union' with the workspace name to include the CSV data.

Answer

Use 'watchlist' function, because CSV files are automatically treated as watchlists.

Question 8

A security team needs to enforce that all Azure virtual machines have a specific custom script execution baseline (e.g., block PowerShell from executing scripts from the internet). They want to use Microsoft Defender for Cloud to continuously monitor and alert when a VM deviates from this baseline. Which feature should they use?

Accepted Answer

Adaptive application controls. Adaptive application controls (AAC) in Microsoft Defender for Cloud allow you to define allowlists for applications and scripts that can run on your Azure VMs. By configuring AAC to block PowerShell scripts from the internet, the service uses machine learning to establish a baseline of allowed executables and scripts, then continuously monitors for deviations—such as an unauthorized PowerShell script execution—and generates security alerts. This directly meets the requirement for continuous monitoring and alerting on custom script execution baselines.

Answer

Just-In-Time VM Access (JIT)

Answer

Regulatory compliance dashboard

Answer

File Integrity Monitoring (FIM)

Question 9

An analyst is investigating a sophisticated attack involving a compromised device. The analyst has identified a malicious process that spawned multiple child processes. The analyst wants to create a custom detection rule in Microsoft 365 Defender that alerts when a specific parent process creates a child process that makes an outbound network connection to any IP not in the organization's internal range. Which KQL query and rule type should the analyst use?

Accepted Answer

Create a custom detection rule (Advanced Hunting rule) with a query that joins DeviceProcessEvents and DeviceNetworkEvents, filtering for the parent process and external IP addresses. Option A is correct because the analyst needs to correlate process creation events with network connection events across two separate tables (DeviceProcessEvents and DeviceNetworkEvents) in Advanced Hunting. A custom detection rule (Advanced Hunting rule) in Microsoft 365 Defender allows joining these tables to identify when a specific parent process spawns a child that makes an outbound connection to an external IP address, which is exactly the required detection logic.

Answer

Create a scheduled rule in Sentinel and export the data from M365 Defender

Answer

Use a custom detection rule with DeviceEvents only

Answer

Use a Microsoft Defender for Endpoint custom detection rule (built-in) that already detects child process connections

Question 10

A SOC team uses Microsoft Sentinel with multiple workspaces distributed across different regions. They need to create a single analytics rule that can query data from multiple workspaces to detect cross-tenant attacks. What is the recommended approach?

Accepted Answer

Use cross-workspace queries in a single analytics rule with the workspace() function. The recommended approach is to use cross-workspace queries in a single analytics rule with the workspace() function. This allows the rule to query data from multiple Sentinel workspaces in different regions without duplicating rules or ingesting data centrally. The workspace() function enables a single KQL query to reference tables from up to 100 workspaces, making it ideal for detecting cross-tenant attacks across distributed environments.

Answer

Create separate analytics rules for each workspace

Answer

Create a union workspace that ingests data from all workspaces

Answer

Use Azure Lighthouse to manage multiple workspaces and create rules on each

Question 11

A security team wants to enable advanced threat detection for all Azure SQL databases across multiple subscriptions. They want to receive alerts for SQL injection attempts and anomalous activities. Which action should they take in Microsoft Defender for Cloud?

Accepted Answer

Enable the Microsoft Defender for SQL plan at the subscription level.. Microsoft Defender for SQL provides advanced threat detection for Azure SQL databases, including alerts for SQL injection attempts and anomalous activities. Enabling the plan at the subscription level automatically protects all existing and future SQL databases within that subscription, ensuring centralized management and compliance.

Answer

Enable the Microsoft Defender for Servers plan on each subscription.

Answer

Configure SQL Auditing and Threat Detection on each SQL server individually.

Answer

Create an Azure Policy to deploy Azure SQL Firewall rules.

Question 12

A SOC team uses Microsoft Sentinel with multiple workspaces in a single region. They have deployed Azure Policy to send all Azure resource logs to a central Log Analytics workspace. Now they want to create a set of analytics rules that run across multiple workspaces to detect cross-workspace attacks. However, they note that the built-in analytics rules can only query data within the workspace they are defined. Which solution should the team implement to efficiently query data from multiple workspaces for detection?

Accepted Answer

Create a KQL function that unions the relevant tables from all workspaces using the workspace() expression, then use that function in the analytics rule query. Option B is correct because KQL functions can encapsulate cross-workspace queries using the `workspace()` expression, allowing an analytics rule to query multiple Log Analytics workspaces from a single rule definition. This approach efficiently reuses the union logic across rules without modifying each rule individually, addressing the limitation that built-in rules can only query their own workspace.

Answer

Use Azure Lighthouse to delegate management and then create rules in the managing workspace that use workspace() expressions

Answer

Configure the analytics rule to run in Log Analytics workspace manager and use cross-workspace queries native to Copilot for Security

Answer

Enable cross-workspace incident view in Sentinel settings and define the rule in the central workspace to automatically query all linked workspaces

Question 13

A security analyst wants to configure a playbook in Microsoft Sentinel that runs automatically when a specific alert is generated. Which trigger concept is used to invoke the playbook?

Accepted Answer

Azure Logic Apps trigger. In Microsoft Sentinel, playbooks are built on Azure Logic Apps, and the correct trigger to invoke a playbook automatically when an alert is generated is the Azure Logic Apps trigger. This trigger listens for the Sentinel alert creation event and initiates the playbook workflow. The other options are not valid trigger concepts within Sentinel's architecture.

Answer

Sentinel trigger

Answer

Alert trigger

Answer

Automation rule trigger

Question 14

A SOC team uses Microsoft Sentinel. They need to correlate syslog events from on-premises firewalls with Microsoft Entra ID sign-in logs to detect VPN-based intrusions. The correlation requires joining two tables (Syslog and SigninLogs) on a common field (IP address) and running on a 10-minute schedule. Which type of analytics rule should the analyst configure?

Accepted Answer

Scheduled query rule. A scheduled query rule is correct because the requirement involves joining two tables (Syslog and SigninLogs) on a common field (IP address) and running on a 10-minute schedule. Scheduled query rules are designed for complex, multi-table correlations that run at fixed intervals (e.g., every 10 minutes) and can aggregate or join data across tables, making them ideal for this VPN intrusion detection scenario.

Answer

Near-real-time (NRT) rule

Answer

Fusion rule

Answer

Anomaly rule

Question 15

An analyst is investigating a ransomware outbreak using Microsoft 365 Defender Advanced Hunting. They need to find all devices where a file with the extension '.locked' was created within one hour after a known malicious process (e.g., 'ransomware.exe') was executed on the same device. Which two tables should be joined in the query? (Choose 2.)

Accepted Answer

DeviceProcessEvents. DeviceProcessEvents is correct because it logs process creation events, including the execution of 'ransomware.exe'. This table is essential to identify the timestamp and device where the malicious process ran, which serves as the starting point for the time-bound investigation.

Answer

DeviceNetworkEvents

Answer

DeviceRegistryEvents