SC-200 Practice Test 17 — 15 Questions

Question 1

An organization uses Microsoft 365 Defender. A security analyst wants to identify all devices that have been accessed from a compromised device via RDP in the past 24 hours. Which advanced hunting table should the analyst query?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

DeviceLogonEvents. DeviceLogonEvents is the correct table because it records authentication events, including remote interactive logons such as RDP (LogonType 10). By filtering for logon type 10 and the compromised device's IP address, the analyst can identify all devices that accepted an RDP connection from that source within the past 24 hours.

Answer

DeviceEvents

Answer

DeviceNetworkEvents

Answer

DeviceProcessEvents

Question 2

Your organization uses Microsoft Defender for Identity. You need to create a role that allows analysts to view security alerts but not modify them. Which built-in role should you assign?

Accepted Answer

Security Reader. The Security Reader role (D) is the correct choice because it provides read-only access to security-related features in Microsoft 365 Defender, including the ability to view security alerts from Microsoft Defender for Identity without the ability to modify or respond to them. This aligns directly with the requirement to allow analysts to view alerts but not modify them, as the role grants no write permissions to security configurations or alert states.

Answer

Security Administrator

Answer

Compliance Administrator

Answer

Global Administrator

Question 3

Your organization wants to use Microsoft Sentinel's built-in threat intelligence feeds to enrich alerts. Which data connector should you enable?

Accepted Answer

Threat Intelligence - TAXII connector.. The Threat Intelligence - TAXII connector is the correct choice because it ingests threat intelligence feeds from STIX/TAXII servers, which are the standard protocol (Trusted Automated eXchange of Intelligence Indicator) used by built-in threat intelligence feeds. This connector allows Microsoft Sentinel to pull indicators of compromise (IOCs) from external threat intelligence sources, enriching alerts with context like malicious IPs, domains, or hashes.

Answer

Office 365 connector.

Answer

Microsoft 365 Defender connector.

Answer

Microsoft Defender for Cloud connector.

Question 4

Your organization uses Microsoft Defender for Cloud Apps. A security investigator discovers that a user's session token was stolen and used to access sensitive data in SharePoint Online from an anomalous IP address. You need to immediately revoke the attacker's access while minimizing impact on the legitimate user. What should you do?

Accepted Answer

From Microsoft Defender for Cloud Apps, use the 'Require re-authentication' action on the anomalous session.. The 'Require re-authentication' action in Microsoft Defender for Cloud Apps immediately terminates the attacker's session by invalidating the stolen session token, forcing the attacker to re-authenticate. This action targets only the anomalous session, leaving the legitimate user's other sessions intact and minimizing disruption. It directly addresses the session token theft without affecting the user's account status or requiring password changes.

Answer

Suspend the user account in Microsoft Entra ID until the investigation is complete.

Answer

Revoke all refresh tokens for the user in Microsoft Entra ID.

Answer

Reset the user's password immediately.

Question 5

A SOC team wants to automatically run a playbook that retrieves threat intelligence details whenever a high-severity incident is created in Microsoft Sentinel. Which type of automation should they configure?

Accepted Answer

Automation rule with incident trigger. Automation rules in Microsoft Sentinel can be configured with an incident trigger to automatically run playbooks when incidents are created or updated. Since the requirement is to run a playbook on high-severity incidents, an automation rule with an incident trigger allows you to filter by severity (e.g., High) and invoke the playbook without manual intervention.

Answer

Automation rule with alert trigger

Answer

Playbook with manual trigger

Answer

Logic app with recurrence

Question 6

Your organization is using Microsoft Defender for Identity (MDI) and Microsoft Sentinel. The security team wants to correlate alerts from MDI with other data sources in Sentinel. What is the recommended approach?

Accepted Answer

Enable the Microsoft Defender for Identity data connector in Sentinel. The Microsoft Defender for Identity data connector in Microsoft Sentinel is the recommended approach because it provides native, out-of-the-box integration that automatically ingests MDI alerts and events into Sentinel without requiring additional infrastructure or manual configuration. This connector leverages the Microsoft Graph Security API to pull alerts, enabling seamless correlation with other data sources for unified threat detection and investigation.

Answer

Export MDI logs manually to Sentinel

Answer

Configure MDI to send syslog to Sentinel

Answer

Create a playbook to pull MDI alerts

Question 7

A company uses Microsoft Defender for Cloud with enhanced security features enabled. The security team wants to automatically disable the local administrative account on all existing and future Azure virtual machines by applying a guest configuration policy. Which Defender for Cloud feature should they use?

Accepted Answer

Guest configuration (Azure Policy). Guest configuration (Azure Policy) is the only feature that can audit and remediate settings inside a virtual machine's operating system, such as disabling the local administrative account. Defender for Cloud integrates with Azure Policy's guest configuration extension to enforce desired state configurations on both existing and future VMs via policy assignments.

Answer

Just-In-Time (JIT) VM access

Answer

Adaptive application controls

Answer

Regulatory compliance dashboard

Question 8

A company has enabled Microsoft Defender for Cloud on multiple Azure subscriptions. The security team wants to view a unified security score that aggregates the scores from all subscriptions. Which feature should they use?

Accepted Answer

Secure Score dashboard. The Secure Score dashboard in Microsoft Defender for Cloud aggregates the security scores from all selected subscriptions into a single, unified score. This allows the security team to view the overall security posture across multiple Azure subscriptions at a glance, based on the compliance status of security recommendations.

Answer

Azure Policy compliance dashboard

Answer

Security alerts dashboard

Answer

Workload protection dashboard

Question 9

Refer to the exhibit. You are reviewing an automation rule configuration in Microsoft Sentinel. Based on the JSON snippet, what will happen when a high-severity incident is created?

Accepted Answer

The rule will run a playbook when a high-severity incident is created. The automation rule's trigger condition is set to 'When incident is created' and the condition filters for incidents with a severity of 'High'. When a high-severity incident is created, the rule will execute the associated playbook, which is a common use case for automated response in Microsoft Sentinel.

Answer

The rule will change the severity of the incident to Medium

Answer

The rule will assign the incident to the SOC manager

Answer

The rule will run the playbook when a new alert is created

Question 10

Your company uses Microsoft Defender for Cloud Apps to monitor cloud applications. You have discovered that a user is accessing a sanctioned cloud storage app from an IP address that belongs to a known malicious botnet. You need to automatically block the user's access to the app and require them to re-authenticate. You have already configured session policies in Defender for Cloud Apps. What should you do next?

Accepted Answer

Configure a session policy in Defender for Cloud Apps with the action 'Block' and 'Require re-authentication'.. Session policies in Defender for Cloud Apps can enforce real-time controls on sanctioned apps. By configuring a session policy with the actions 'Block' and 'Require re-authentication', you can immediately terminate the user's session and force them to re-authenticate, which effectively blocks access from the malicious IP while ensuring the user re-verifies their identity.

Answer

Create an access policy in Defender for Cloud Apps to block the user.

Answer

Create an app governance policy in Microsoft Purview to block the app.

Answer

Create a device compliance policy in Microsoft Intune to block the device.

Question 11

Your organization uses Microsoft Sentinel and has deployed multiple analytics rules. You need to evaluate the effectiveness of these rules by identifying which rules generate the most incidents and have the highest false positive rate. What should you use?

Accepted Answer

Incidents view in Microsoft Sentinel filtered by analytics rule. The Incidents view in Microsoft Sentinel allows you to filter incidents by analytics rule, enabling you to see the count of incidents generated per rule and assess their effectiveness. By reviewing the incident details, you can identify which rules produce the most incidents and, by analyzing the closed or resolved incidents, determine the false positive rate. This directly addresses the requirement to evaluate rule effectiveness based on incident volume and false positives.

Answer

Hunting view in Microsoft Sentinel

Answer

MITRE ATT&CK view in Microsoft Sentinel

Answer

Entity behavior analytics view in Microsoft Sentinel

Question 12

Your organization is planning to deploy Microsoft Sentinel. You need to ensure that security events from on-premises servers are sent to Sentinel. Which connector should you use?

Accepted Answer

Install the Azure Monitor Agent (AMA) on the servers and configure a Data Collection Rule (DCR) to send events to Sentinel.. The Azure Monitor Agent (AMA) is the current recommended agent for collecting security events from on-premises servers and forwarding them to Microsoft Sentinel. By installing AMA and configuring a Data Collection Rule (DCR), you can specify which security events (e.g., Windows Security Event logs) to collect and send directly to the Sentinel workspace, ensuring efficient and modern data ingestion.

Answer

Install the Log Analytics agent (MMA) on the servers and connect to Sentinel workspace.

Answer

Use the Microsoft Defender for Cloud (MDC) connector to stream security events.

Answer

Enable Azure Arc on the servers and use the Arc agent to forward events.

Question 13

Which TWO actions require the Global Administrator role in Microsoft 365?

Accepted Answer

Configure tenant-wide settings in Microsoft 365. Configuring tenant-wide settings in Microsoft 365 requires the Global Administrator role because these settings affect the entire organization, including security, compliance, and user management. Only the Global Administrator has the broadest permissions to modify such high-level configurations, as defined by Microsoft's role-based access control (RBAC) model.

Answer

Create a data loss prevention (DLP) policy in Microsoft Purview

Answer

Create a custom role in Microsoft Defender XDR

Answer

View the Microsoft 365 Defender incident queue

Question 14

An analyst is investigating a potential data exfiltration incident involving a user who accessed sensitive files from a personal device. The analyst wants to gather evidence about the device's compliance status and recent activity. Which Microsoft Intune feature should the analyst use?

Accepted Answer

Microsoft Intune device inventory and compliance reports. Microsoft Intune device inventory and compliance reports provide detailed information about a device's compliance status, including whether it meets security policies, has required updates, and is managed correctly. This is essential for investigating potential data exfiltration from a personal device, as it allows the analyst to verify if the device was compliant and review recent activity logs within Intune.

Answer

Exchange Online message trace

Answer

Azure Activity Log

Answer

Microsoft 365 Defender's service health dashboard

Question 15

Your organization wants to use Microsoft Copilot for Security to generate incident summaries. What is the minimum license required?

Accepted Answer

Microsoft Copilot for Security standalone or add-on. Microsoft Copilot for Security is a standalone product that can be licensed independently or as an add-on to existing security subscriptions. It is not included in any Microsoft 365 or Defender plan by default; therefore, the minimum license required is either the standalone Copilot for Security SKU or the add-on license. This ensures the organization has the necessary entitlements to generate incident summaries using Copilot for Security.

Answer

Microsoft 365 E5

Answer

Microsoft Sentinel

Answer

Microsoft Defender for Office 365 P2