SC-200 Practice Test 16 — 15 Questions

Question 1

A security team uses Microsoft Defender for Cloud to protect Azure virtual machines. They notice that a VM is generating alerts for unusual outbound connections. The team wants to use a Defender for Cloud feature that learns the VM's typical network behavior and provides recommendations to tighten network security group rules, while also alerting on suspicious deviations. Which feature should they enable?

Accepted Answer

Adaptive network hardening. Adaptive network hardening (ANH) is the correct feature because it uses machine learning to learn a VM's typical traffic patterns (including outbound connections), then analyzes the current Network Security Group (NSG) rules against those learned patterns. It provides recommendations to tighten NSG rules to allow only the traffic that is actually used, and it generates security alerts when it detects deviations from the learned baseline, such as unusual outbound connections.

Answer

Just-In-Time VM access

Answer

File integrity monitoring

Answer

Vulnerability scanning

Question 2

A SOC analyst needs to create a custom watchlist in Microsoft Sentinel to use in an analytics rule. Order the following steps from first to last to correctly create and use the watchlist (Choose 4.)

Accepted Answer

1. Create a new watchlist in Microsoft Sentinel (e.g., from Sentinel > Watchlists > Add new).. Option A is correct because creating a new watchlist in Microsoft Sentinel is the initial step to define a custom data source for threat intelligence or reference data. This is done via Sentinel > Watchlists > Add new, where you specify the alias, description, and other metadata before uploading data. Without this step, there is no container to import the CSV file into, making it the logical first action.

Question 3

A SOC analyst is investigating a potential brute-force attack on an Azure VM. The analyst has ingested Windows Security Events into Microsoft Sentinel. Which KQL query would count the number of failed logon attempts (EventID 4625) per user account in the last hour?

Accepted Answer

SecurityEvent | where EventID == 4625 and TimeGenerated > ago(1h) | summarize Count = count() by Account. Option B is correct because it filters for EventID 4625 (failed logon) and restricts the time range to the last hour before summarizing the count per Account. This ensures only relevant events are counted, and the aggregation is performed on the correct field (Account) from the SecurityEvent table, which contains Windows Security Events ingested into Sentinel.

Answer

SecurityEvent | where EventID == 4625 | summarize Count = count() by Account | where TimeGenerated > ago(1h)

Answer

SigninLogs | where ResultType != 0 | summarize Count = count() by UserPrincipalName | where TimeGenerated > ago(1h)

Answer

SecurityEvent | where EventID == 4625 | make-series Count = count() default=0 on TimeGenerated from ago(1h) to now() step 1h by Account

Question 4

A SOC analyst is configuring a multi-region deployment of Microsoft Sentinel. The requirement is to ingest security logs from Azure resources located in three different Azure regions. The analyst needs to create the workspace in one region and then use cross-workspace queries to view data from all regions. What is the correct sequence of steps?

Accepted Answer

Step 1: Create Log Analytics workspaces in each region. Step 2: Enable Sentinel on each workspace. Step 3: Connect data sources. Step 4: Configure cross-workspace queries.. Option A is correct because to use cross-workspace queries in Microsoft Sentinel, you must first create a Log Analytics workspace in each region, enable Sentinel on each workspace, connect the data sources to their respective regional workspaces, and then configure cross-workspace queries to unify the data. This sequence ensures that each region's logs are ingested locally, which is required for cross-workspace queries to reference them via the `workspace()` expression.

Answer

Step 1: Enable Sentinel in one region. Step 2: Create workspaces in other regions. Step 3: Connect data sources. Step 4: Configure cross-workspace queries.

Answer

Step 1: Connect data sources. Step 2: Create workspaces. Step 3: Enable Sentinel. Step 4: Configure cross-workspace queries.

Answer

Step 1: Create a central workspace. Step 2: Enable Sentinel on it. Step 3: Connect data sources from all regions to the central workspace. Step 4: Configure cross-workspace queries.

Question 5

In Microsoft 365 Defender, after an automated investigation completes, where can an analyst review the specific remediation actions that were taken (e.g., file quarantine, device isolation)?

Accepted Answer

Action center. The Action center in Microsoft 365 Defender is the centralized location where all manual and automated remediation actions (such as file quarantine, device isolation, and process termination) are tracked and can be reviewed or approved. After an automated investigation completes, the specific actions taken are recorded in the Action center's history tab, allowing analysts to see exactly what was executed and the outcome. This is distinct from the Incident timeline, which shows alerts and events but not the detailed remediation action records.

Answer

Incident timeline

Answer

Threat analytics

Answer

Device inventory

Question 6

A SOC team wants to automate response to incidents detected by Microsoft Sentinel. When a new incident is created with severity "High" and contains a specific tag "malware", they want to run a playbook that isolates the affected device. What is the correct way to configure this automation?

Accepted Answer

Create an automation rule that triggers on "When incident is created" and set conditions for severity equals High and tag contains "malware", then set a playbook action.. Option A is correct because automation rules in Microsoft Sentinel are specifically designed to trigger playbooks based on incident creation events and conditions like severity and tag. By setting the trigger to 'When incident is created' and conditions for severity equals 'High' and tag contains 'malware', the rule will invoke the playbook to isolate the affected device automatically, without manual intervention.

Answer

Create a custom analytics rule that runs the playbook directly when triggered.

Answer

Configure a logic app with a trigger on "When a Microsoft Sentinel incident is created" and use conditions inside the logic app.

Answer

Use the Microsoft Sentinel API to create a webhook that triggers the playbook.

Question 7

A SOC team uses Microsoft Sentinel and ingests Windows Security Events from domain controllers using the Azure Monitor Agent (AMA). They want to create a scheduled analytics rule that generates an incident when a user account is created in a sensitive Active Directory group (e.g., Domain Admins) outside of approved change windows (e.g., after 9 PM). The required event IDs are 4728 (member added to security-enabled global group) and 4732 (member added to security-enabled local group). Which KQL query should the analyst use to filter for these specific events and the targeted group?

Accepted Answer

SecurityEvent | where EventID in (4728, 4732) | where TargetAccount contains 'Domain Admins'. Option A is correct because it uses the `SecurityEvent` table with the `EventID` filter for 4728 and 4732, which are the exact event IDs for member additions to security-enabled global and local groups. The `TargetAccount` field contains the name of the group being modified, so filtering for 'Domain Admins' correctly identifies when a user is added to that sensitive group. This query directly matches the requirement to detect account creation in a sensitive AD group outside approved change windows.

Answer

SecurityEvent | where EventID == 4624 | where Account contains 'Admin'

Answer

SecurityEvent | where EventID == 4738 | where TargetAccount contains 'Domain Admins'

Answer

SecurityEvent | where EventID == 4670 | where ObjectName contains 'Domain Admins'

Question 8

An analyst is using advanced hunting in Microsoft 365 Defender. A device made outbound RDP connections shortly after a suspicious PowerShell process started. Which join is most useful to identify the initiating process for those network connections?

Accepted Answer

Join DeviceNetworkEvents with DeviceProcessEvents by device and process identifiers/time window. Option D is correct because it joins DeviceNetworkEvents (which contain outbound RDP connection details) with DeviceProcessEvents (which contain process creation data like the suspicious PowerShell process) using device ID, process ID, and a time window. This join allows the analyst to directly correlate the network connection to the initiating process, identifying whether the PowerShell process spawned the RDP connection.

Answer

Join EmailEvents with UrlClickEvents

Answer

Join IdentityInfo with SecureScoreControls

Answer

Join CloudAppEvents with AlertEvidence only

Question 9

An analyst writes an advanced hunting query to investigate a suspicious executable that initiated outbound connections. Which two Microsoft 365 Defender tables are most relevant? (Choose 2.)

Accepted Answer

DeviceProcessEvents.. DeviceProcessEvents is correct because it records process creation events, including the executable that initiated the outbound connection. By querying this table, you can identify the suspicious executable's name, command line, and parent process, which is essential for tracing the origin of the malicious activity.

Answer

EmailAttachmentInfo.

Answer

IdentityInfo.

Question 10

An organization wants to enable vulnerability assessment for all Azure virtual machines, including future ones, using the integrated Qualys or Microsoft Defender Vulnerability Management solution. What is the recommended approach in Microsoft Defender for Cloud?

Accepted Answer

Enable the Defender for Servers plan and configure auto-provisioning of the vulnerability assessment solution.. The recommended approach is to enable the Defender for Servers plan, which automatically provisions the integrated vulnerability assessment solution (Qualys or Microsoft Defender Vulnerability Management) on all existing and future Azure VMs. This ensures continuous scanning without manual intervention, leveraging auto-provisioning to deploy the necessary extension.

Answer

Manually install the Log Analytics agent and then configure vulnerability assessment on each VM.

Answer

Use Azure Policy to assign the built-in initiative that deploys the vulnerability assessment solution and associates it with VMs.

Answer

Enable Azure Security Center's free tier and manually download the vulnerability assessment tool.

Question 11

A SOC team uses Microsoft Sentinel and needs to ingest custom logs from an on-premises Linux server that writes events to a local text file. The team installs the Azure Monitor Agent (AMA) on the Linux server. Which configuration step is required in Sentinel to collect the custom log file?

Accepted Answer

Create a custom table in the Log Analytics workspace and configure a Data Collection Rule (DCR) to ingest the file. Option A is correct because Azure Monitor Agent (AMA) requires a Data Collection Rule (DCR) to define the data source (custom log file path) and the destination table in the Log Analytics workspace. Since the log is a custom text file (not syslog or a standard Windows event), you must first create a custom table (using the workspace's schema or via the 'Create custom log' wizard) and then configure the DCR to ingest the file into that table. This is the only supported method for AMA-based custom log ingestion.

Answer

Use the Syslog connector and map the file to a facility

Answer

Install the Log Analytics agent (MMA) and configure Custom Logs in the agent settings

Answer

Create a scheduled analytics rule that reads the file via an API

Question 12

An organization uses Microsoft 365 Defender. A security analyst is reviewing an incident that involves a user who clicked a phishing link in an email. The analyst wants to see the email's full timeline, including delivery, click, and any follow-up actions. Which section of the email entity page provides this information?

Accepted Answer

Email timeline. The Email timeline section on the email entity page in Microsoft 365 Defender provides a chronological view of the email's lifecycle, including delivery, user clicks on the phishing link, and subsequent remediation actions such as soft delete or quarantine. This directly meets the analyst's need to see the full sequence of events for the incident.

Answer

Detection details

Answer

Threat types

Answer

Investigation graph

Question 13

An analyst wants to find all devices that have run a specific process named 'malware.exe' in the last 24 hours using Microsoft 365 Defender Advanced Hunting. Which table should be the primary source for this query?

Accepted Answer

DeviceProcessEvents. The DeviceProcessEvents table in Microsoft 365 Defender Advanced Hunting is the primary source for querying process creation events, including the execution of a specific process name like 'malware.exe'. This table captures process creation and termination events, making it the correct choice for finding devices that have run a specific process within a given time frame.

Answer

DeviceEvents

Answer

DeviceFileEvents

Answer

DeviceNetworkEvents

Question 14

An organization ingests its Palo Alto firewall logs into a custom table named 'PaloAlto_CL' in Microsoft Sentinel. A security analyst wants to create a scheduled analytics rule that triggers an incident when a single source IP is involved in more than 100 outbound connections to different destinations in 1 minute. Which KQL query and configuration would trigger the alert correctly?

Accepted Answer

summarize dcount(DestinationIP) by SourceIP, bin(TimeGenerated,1m) and set threshold >100. Option B is correct because the requirement is to count distinct destination IPs per source IP per minute, not total connections. Using `dcount(DestinationIP)` with `bin(TimeGenerated,1m)` ensures we count unique destinations, and setting the threshold to >100 triggers when a single source IP connects to more than 100 different destinations in one minute, exactly matching the alert condition.

Answer

summarize count() by SourceIP, bin(TimeGenerated,1m) and set threshold >100

Answer

summarize count() by DestinationIP and threshold >100

Answer

summarize dcount(SourceIP) by DestinationIP, bin(TimeGenerated,1m) and threshold >100

Question 15

An organization uses Microsoft 365 Defender. A security analyst is investigating an incident where a user's device was compromised. The analyst wants to determine if the attacker attempted to access sensitive files stored in SharePoint Online from that device. Which advanced hunting table should the analyst query to find file access events from cloud apps?

Accepted Answer

CloudAppEvents. The CloudAppEvents table in Microsoft 365 Defender captures audit logs for cloud applications, including SharePoint Online. It records file access events such as viewing, downloading, or modifying files, making it the correct table to query when investigating attacker attempts to access sensitive files from a compromised device.

Answer

IdentityLogonEvents

Answer

DeviceFileEvents

Answer

EmailEvents