SC-200 Practice Test 17 — 15 Questions

Question 1

Your organization uses Microsoft Sentinel. A new incident is created from a fusion alert that combines multiple low-severity alerts. The analyst needs to determine the entities involved. What should the analyst review?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The incident's entities tab.. The incident's entities tab in Microsoft Sentinel provides a consolidated view of all entities (such as users, hosts, IP addresses, and processes) that were identified by the fusion alert. Since fusion alerts combine multiple low-severity alerts, the entities tab is the direct place to see the aggregated entities involved in the incident, enabling the analyst to understand the scope and pivot for investigation.

Answer

The Sentinel Overview workbook.

Answer

The analytics rule that generated the incident.

Answer

The incident's timeline.

Question 2

Your organization has Microsoft Defender XDR enabled. An incident is generated for a user who clicked a phishing link in an email. The analyst needs to automatically disable the user's mailbox for suspicious activity. Which automated action should the analyst configure in a Microsoft Sentinel automation rule?

Accepted Answer

Run a playbook that uses the Microsoft 365 Defender connector to disable the mailbox.. The goal is to disable the user's mailbox, which is a Microsoft 365 Exchange Online action. A Microsoft Sentinel automation rule can trigger a playbook that uses the Microsoft 365 Defender connector to execute the 'Disable mailbox' action directly against Exchange Online, effectively suspending the user's ability to send or receive email. This aligns with the requirement to automatically respond to a phishing incident by disabling the compromised mailbox.

Answer

Run a playbook that deletes the phishing email from the user's inbox.

Answer

Configure an automation rule to block the sender IP address in Defender for Cloud Apps.

Answer

Run a playbook that resets the user's password.

Question 3

Arrange the steps to run a Microsoft 365 Defender advanced hunting query and create a custom detection rule from it.

Accepted Answer

Step 1: Navigate to Advanced hunting in Microsoft 365 Defender. Step 2: Write a KQL query. Step 3: Run the query. Step 4: Create a custom detection rule from the query results.. After running a query in Advanced hunting, you can create a detection rule directly from the results to alert on future matches.

Answer

Step 1: Write a KQL query. Step 2: Navigate to Advanced hunting in Microsoft 365 Defender. Step 3: Run the query. Step 4: Create a custom detection rule from the query results.

Answer

Step 1: Navigate to Advanced hunting in Microsoft 365 Defender. Step 2: Run the query. Step 3: Write a KQL query. Step 4: Create a custom detection rule from the query results.

Answer

Step 1: Navigate to Advanced hunting in Microsoft 365 Defender. Step 2: Write a KQL query. Step 3: Create a custom detection rule from the query results. Step 4: Run the query.

Question 4

Which TWO of the following are valid sources for creating incidents in Microsoft Sentinel? (Choose two.)

Accepted Answer

Microsoft 365 Defender alerts. Microsoft 365 Defender alerts are a valid source for creating incidents in Microsoft Sentinel because Sentinel can ingest alerts from Microsoft 365 Defender (which includes Defender for Endpoint, Defender for Office 365, Defender for Identity, and Defender for Cloud Apps) via the Microsoft 365 Defender connector. When these alerts are ingested, Sentinel can automatically create incidents based on them, enabling unified incident management across the Microsoft security ecosystem.

Answer

Hunting query results

Answer

Workbook creation

Answer

Playbook execution

Question 5

Which TWO actions can you perform using Microsoft Sentinel automation rules?

Accepted Answer

Assign an incident to a specific analyst.. Microsoft Sentinel automation rules can directly assign an incident to a specific analyst using the 'Assign owner' action. This allows security operations teams to automatically route incidents to the appropriate personnel based on criteria such as severity, tactic, or entity, improving response efficiency.

Answer

Create a new analytics rule based on an incident.

Answer

Modify the data connector's polling interval.

Answer

Automatically create an incident from a log event.

Question 6

A Microsoft Sentinel scheduled analytics rule detects impossible travel but creates too many duplicate incidents for the same user within a short period. Which two rule settings should you tune? (Choose 2.)

Accepted Answer

Configure event grouping or incident grouping by user entity.. Configuring event grouping or incident grouping by user entity consolidates multiple alerts for the same user into a single incident, reducing duplicate incidents. In Microsoft Sentinel, this setting controls how alerts are aggregated into incidents based on entity fields like user account, ensuring that a burst of impossible travel alerts for the same user generates one incident instead of many.

Answer

Disable the data connector.

Answer

Delete the Log Analytics workspace.

Question 7

An organization uses Microsoft 365 Defender. An automated investigation on a device has determined that a file is malicious and has been blocked. The analyst wants to verify that the file was blocked and see the action taken (e.g., block, allow). Which entity page provides this information?

Accepted Answer

File entity page. The File entity page in Microsoft Defender XDR provides a centralized view of a file's reputation, detection details, and the specific actions taken (e.g., blocked, allowed, quarantined) during automated investigations. Since the analyst needs to confirm the block action on a specific malicious file, this page directly displays the investigation result and the applied remediation action.

Answer

Device entity page

Answer

User entity page

Answer

Email entity page

Question 8

Your organization is implementing Microsoft Sentinel and needs to ensure that incident response activities are compliant with regulatory requirements. You need to track and document all changes made to analytics rules and playbooks. Which TWO features should you enable?

Accepted Answer

Activity logs (Azure Monitor). Activity logs (Azure Monitor) record all management-plane operations, including changes to analytics rules and playbooks, while Azure Resource Change History (Change tracking) captures resource-level modifications. Together they provide comprehensive audit trails for regulatory compliance. Workbooks (A) are for visualization, Automation rules (B) trigger responses but don't log changes themselves, and Microsoft Purview (E) is for broader data governance, not operational change tracking.

Answer

Sentinel workbooks

Answer

Automation rules

Answer

Microsoft Purview Compliance Manager

Question 9

Your organization uses Microsoft Defender for Identity. You need to create a role that allows analysts to view security alerts but not modify them. Which built-in role should you assign?

Accepted Answer

Security Reader. The Security Reader role (D) is the correct choice because it provides read-only access to security-related features in Microsoft 365 Defender, including the ability to view security alerts from Microsoft Defender for Identity without the ability to modify or respond to them. This aligns directly with the requirement to allow analysts to view alerts but not modify them, as the role grants no write permissions to security configurations or alert states.

Answer

Security Administrator

Answer

Compliance Administrator

Answer

Global Administrator

Question 10

Refer to the exhibit. An incident in Microsoft Sentinel contains the entities shown. Which additional data source would be most useful to investigate this incident?

Accepted Answer

Microsoft Entra ID sign-in logs. The incident involves a suspicious sign-in from an unfamiliar IP. Checking Microsoft Entra ID sign-in logs can provide additional context like authentication details, user agent, and risk level. Option A is wrong because Microsoft Defender for Endpoint focuses on endpoints, not cloud sign-ins. Option C is wrong because Microsoft Purview is for compliance and data governance. Option D is wrong because Microsoft Intune is for device management, not sign-in events.

Answer

Microsoft Defender for Endpoint device timeline

Answer

Microsoft Purview audit logs

Answer

Microsoft Intune device compliance logs

Question 11

Your organization uses Microsoft Sentinel. You need to ensure that an Azure function app can send custom logs to a Log Analytics workspace. What should you configure?

Accepted Answer

Data collection rule (DCR) with Azure Monitor Agent. To send custom logs from an Azure function app to a Log Analytics workspace, you need a Data Collection Rule (DCR) configured with the Azure Monitor Agent (AMA). The DCR defines how the custom log data is ingested, transformed, and routed to the workspace, while the AMA collects the logs from the function app. This is the standard method for custom log ingestion in Microsoft Sentinel, as it supports the Log Analytics Ingestion API and allows for schema customization.

Answer

Threat intelligence data connector

Answer

Diagnostic settings on the function app

Answer

Microsoft Sentinel automation rule

Question 12

You have a Microsoft Sentinel workspace that uses Customer-Managed Keys (CMK). A security audit requires that all data at rest be encrypted with the CMK. You recently onboarded a new data connector that sends logs to a Log Analytics workspace in a different region. You need to ensure the new workspace uses CMK. What should you do?

Accepted Answer

Associate the new Log Analytics workspace with an Azure Key Vault containing the CMK before ingesting data.. Customer-Managed Keys (CMK) for Log Analytics workspaces must be configured at workspace creation time or before any data is ingested. The CMK is associated with the workspace via an Azure Key Vault, and once data is written, the encryption key cannot be changed. Therefore, to ensure the new workspace in a different region uses CMK, you must associate it with the Key Vault containing the CMK before any logs are ingested.

Answer

Update the data connector settings to enable CMK at the source.

Answer

Use Azure Policy to enforce CMK on the new workspace.

Answer

Configure CMK on the new workspace's tables individually.

Question 13

Which TWO actions can you perform in the Microsoft Defender XDR unified alert queue? (Select TWO.)

Accepted Answer

Link the alert to an existing incident. In the Microsoft Defender XDR unified alert queue, you can link an alert to an existing incident to consolidate related alerts into a single investigation. This action is supported directly from the alert queue interface, allowing analysts to manage incident correlation without leaving the queue. Linking alerts helps reduce alert fatigue and streamlines the incident management workflow.

Answer

Create a hunting query from the alert details

Answer

Edit the analytics rule that generated the alert

Answer

Run a playbook to automatically remediate the alert

Question 14

During a threat hunt, an analyst discovers that a user's device has been sending large amounts of data to an external IP address associated with a known C2 server. The analyst wants to trace the process responsible for the outbound connections. Which Microsoft Defender for Endpoint advanced hunting table should be queried to find the process that initiated the network connections?

Accepted Answer

DeviceNetworkEvents. DeviceNetworkEvents is the correct table because it captures network connection events, including the initiating process ID and name. This allows the analyst to identify which process established the outbound connection to the C2 server. DeviceProcessEvents only records process creation events, not network connections. DeviceEvents contains various system events but not detailed network connection data. DeviceFileEvents tracks file-related events such as creation and modification, not network connections.

Answer

DeviceProcessEvents

Answer

DeviceFileEvents

Answer

DeviceEvents

Question 15

Your organization uses Microsoft Sentinel. A new incident is created from a fusion alert that combines multiple low-severity alerts. The analyst needs to determine the entities involved. What should the analyst review?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Use Microsoft Defender for Cloud's Just-in-Time VM access to isolate the VM.. Microsoft Defender for Cloud's Just-in-Time VM access can be used to lock down inbound traffic to the VM, effectively isolating it from the network while preserving the VM for forensic analysis. This action reduces the attack surface and prevents lateral movement without destroying evidence, which is critical during incident response.

Answer

Delete the compromised VM to prevent further damage.

Answer

Update the VM's operating system to the latest patch.