SC-200 Practice Test 17 — 15 Questions

Question 1

In Microsoft 365 Defender, a security analyst reviews an automated investigation that found a potentially unwanted application on multiple devices. The analyst wants to manually approve the suggested remediation action of uninstalling the application. Where should the analyst go?

Accepted Answer

The Action center. The Action center in Microsoft 365 Defender is the centralized location where security analysts can view and manually approve or reject remediation actions that were suggested by automated investigations, such as uninstalling a potentially unwanted application. This is the correct place because the Action center consolidates all pending and completed actions across devices, allowing the analyst to take direct manual intervention on the recommended remediation.

Answer

The Incidents page

Answer

The Alerts queue

Answer

The Device inventory

Question 2

Which of the following detection scenarios can be implemented using a scheduled analytics rule in Microsoft Sentinel? (Select all that apply.) (Choose 2.)

Accepted Answer

Identifying sign-ins from IP addresses listed in a custom threat intelligence watchlist.. Option A is correct because scheduled analytics rules in Microsoft Sentinel can be configured to run queries at regular intervals, and these queries can reference watchlists, including custom threat intelligence watchlists. By querying sign-in logs and joining them with a watchlist of known malicious IPs, the rule can identify sign-ins from those IPs and generate alerts. This is a common pattern for leveraging external threat intelligence within Sentinel's detection capabilities.

Answer

Detecting anomalous sign-in behavior based on user entity behavior.

Answer

Automatically blocking malicious IPs on a firewall.

Question 3

An SOC analyst wants to quickly enable detection for when a user account is added to the Global Administrator role in Microsoft Entra ID using a built-in analytics rule template in Microsoft Sentinel. Which type of analytics rule template should the analyst use?

Accepted Answer

Scheduled. The analyst should use a Scheduled analytics rule template because the detection for when a user account is added to the Global Administrator role in Microsoft Entra ID requires querying the AuditLogs table at a regular interval. Scheduled rules allow you to define a KQL query that runs on a schedule (e.g., every 5 minutes) and generates alerts based on the results. This is the only built-in rule type that supports custom log queries for specific activities like role assignments.

Answer

Microsoft Security

Answer

Fusion

Answer

Machine Learning (ML)

Question 4

A user reports receiving a suspicious email that bypassed the spam filter. An analyst opens the Microsoft 365 Defender portal to investigate. Which component provides a detailed entity view of the email including delivery actions, phish simulation details, and campaign information?

Accepted Answer

Microsoft Defender for Office 365 (Threat Explorer). Microsoft Defender for Office 365's Threat Explorer (now part of the unified investigation experience) provides a detailed entity view of an email, including delivery actions (e.g., delivered to Junk, blocked, or allowed), whether the email was part of a phishing simulation, and the associated campaign information. This tool is specifically designed for deep email threat investigation within the Defender for Office 365 portal, leveraging telemetry from Exchange Online Protection (EOP) and Defender for Office 365.

Answer

Microsoft Defender for Endpoint

Answer

Microsoft Defender for Identity

Answer

Microsoft Defender for Cloud Apps

Question 5

Which of the following resource types are supported by Microsoft Defender for Cloud's workload protection plans? (Select all that apply.) (Choose 3.)

Accepted Answer

Azure virtual machines. Microsoft Defender for Cloud's workload protection plans support Azure virtual machines by providing integrated threat detection and advanced security features like just-in-time VM access, file integrity monitoring, and vulnerability assessments. These capabilities leverage the Microsoft Monitoring Agent or Azure Monitor Agent to analyze security events and detect suspicious activities within the VM's operating system and network traffic.

Answer

Azure Logic Apps

Question 6

A security engineer is configuring Microsoft Defender for Cloud in a hybrid environment that includes on-premises servers connected via Azure Arc. The engineer wants to enable the Defender for Cloud plans for servers (including vulnerability assessment) on all Azure Arc-enabled machines. What is the correct method to deploy the Log Analytics agent (or Azure Monitor Agent) and the Microsoft Defender for Endpoint (MDE) integration?

Accepted Answer

Enable Azure Policy 'Configure Azure Arc machines to run Azure Monitor Agent' with a DeployIfNotExists policy that also installs the MDE extension.. Option B is correct because it leverages Azure Policy with a DeployIfNotExists effect to automatically deploy the Azure Monitor Agent (AMA) and the Microsoft Defender for Endpoint (MDE) extension on Azure Arc-enabled servers. This ensures compliance at scale without manual intervention, and it is the recommended method in Defender for Cloud for hybrid machines. The policy also handles the vulnerability assessment integration by enabling the Defender for Cloud plans for servers.

Answer

Manually install the agents on each server via Group Policy.

Answer

Use the Azure Automation Update Management to deploy agents.

Answer

Enable the 'Log Analytics agent for Windows' extension on each Arc machine via Azure Arc management.

Question 7

An analyst is investigating a malware incident in Microsoft 365 Defender and has isolated the compromised device using automated investigation and response. The analyst now needs to collect a copy of a suspicious file from that device for further analysis in a sandbox. Which action should the analyst take from the device's entity page?

Accepted Answer

Initiate 'Collect investigation package' action.. The 'Collect investigation package' action is the correct choice because it is specifically designed to gather a comprehensive set of forensic data from a device, including suspicious files, without requiring interactive access. This action automatically collects the file and other relevant artifacts, which can then be submitted to Microsoft 365 Defender's sandbox for analysis. It is a one-click, automated process that aligns with the analyst's need to obtain a copy of the file for further investigation.

Answer

Run a live response session and manually download the file.

Answer

Use the 'Add indicator' to allow the file and then collect.

Answer

Use the 'Device isolation' action to isolate again with different settings.

Question 8

A company uses Microsoft Defender for Cloud with Defender for Servers enabled. The security team wants to integrate a third-party vulnerability assessment solution (e.g., Qualys) and have findings appear in the Defender for Cloud recommendations. What must be done?

Accepted Answer

Install the Qualys agent on the VMs and configure the vulnerability assessment solution in Defender for Cloud.. Option A is correct because to integrate a third-party vulnerability assessment solution like Qualys with Microsoft Defender for Cloud, you must install the Qualys agent on the VMs and then configure the vulnerability assessment solution in Defender for Cloud. This allows Defender for Cloud to receive and display the vulnerability findings from Qualys as part of its security recommendations. Without this explicit configuration, Defender for Cloud cannot ingest third-party scanner data.

Answer

Enable the built-in Microsoft Defender Vulnerability Management (MDVM) solution; it automatically integrates with any third-party scanner.

Answer

Set up automatic provisioning of the Log Analytics agent and enable vulnerability assessment in the regulatory compliance dashboard.

Answer

Nothing; Defender for Cloud automatically scans all Azure VMs for vulnerabilities using the integrated Qualys scanner.

Question 9

A SOC analyst creates a scheduled analytics rule in Microsoft Sentinel to detect anomalous Microsoft Entra ID sign-ins. The rule uses the SigninLogs table and runs every 15 minutes. The analyst wants to alert when a user signs in from a country that is not in the allowed list (['US', 'CA']). Which KQL query pattern should be used in the rule?

Accepted Answer

SigninLogs | where Location.countryOrRegion !in (dynamic(['US','CA'])). Option A is correct because the SigninLogs table stores the sign-in location in the `Location.countryOrRegion` field, which is a nested property of the `Location` dynamic object. The KQL operator `!in` with `dynamic(['US','CA'])` correctly performs a case-sensitive comparison against a list of string values, ensuring that only sign-ins from countries outside the allowed list trigger the alert.

Answer

SigninLogs | where Country !in ('US','CA')

Answer

SigninLogs | where location != 'US' and location != 'CA'

Answer

SigninLogs | where geoLocation !in (dynamic(['US','CA']))

Question 10

A company uses Microsoft Defender for Cloud to protect Azure virtual machines. The security team wants to identify which VMs have missing system updates such as critical security patches. Which Defender for Cloud feature should they use?

Accepted Answer

Vulnerability assessment. Vulnerability assessment in Microsoft Defender for Cloud scans Azure VMs for missing system updates, including critical security patches, by integrating with built-in or partner vulnerability scanners (e.g., Qualys). This feature provides a continuous assessment of OS and application vulnerabilities, directly addressing the need to identify VMs with missing patches.

Answer

Adaptive application controls

Answer

Just-in-time VM access

Answer

File integrity monitoring

Question 11

A company uses Microsoft Defender for Cloud with enhanced security features enabled. They have an Azure subscription with many VMs that are all protected by Defender for Servers. The security team wants to identify VMs that have not had a vulnerability assessment scan in the last 7 days. The integrated vulnerability assessment (Microsoft Defender Vulnerability Management) is enabled. Which KQL query in Azure Resource Graph or Log Analytics can achieve this?

Accepted Answer

securityresources | where type == 'microsoft.security/assessments' and properties.displayName == 'Vulnerability assessment solution should be enabled on your virtual machines' and properties.status.code == 'Healthy' | project id, properties.timeGenerated | where properties.timeGenerated < ago(7d). Option B is correct because it queries the 'securityresources' table in Azure Resource Graph for assessments where the display name matches 'Vulnerability assessment solution should be enabled on your virtual machines' and the status code is 'Healthy'. A 'Healthy' status indicates the assessment passed, meaning a scan occurred within the configured period. By filtering for 'properties.timeGenerated < ago(7d)', it identifies VMs where the last scan was more than 7 days ago, directly meeting the requirement.

Answer

securityresources | where type == 'microsoft.security/assessments' | summarize arg_max(properties.status.severity, properties.timeGenerated) by id

Answer

resources | where type == 'microsoft.compute/virtualmachines' | join kind=leftouter (securityresources) on $left.id == $right.id

Answer

operationalinsights | where TimeGenerated < ago(7d)

Question 12

A security analyst in Microsoft Sentinel wants to create a scheduled analytics rule to detect repeated failed HTTP requests to an Azure Application Gateway, indicating a possible brute force attack. Which Azure Monitor table should the analyst query to capture the access and error logs from the Application Gateway?

Accepted Answer

AzureDiagnostics. AzureDiagnostics is the correct table because it stores resource-level logs for Azure services, including Application Gateway access and error logs. These logs contain detailed HTTP request data (e.g., client IP, URI, status code) necessary to detect repeated failed requests indicative of a brute force attack. Other tables like AzureActivity, AzureMetrics, or SecurityEvent do not capture this specific HTTP-level telemetry.

Answer

AzureActivity

Answer

AzureMetrics

Answer

SecurityEvent

Question 13

A security analyst is reviewing phishing emails in Microsoft 365 Defender and wants to identify all messages that were blocked by an anti-phish policy before delivery. The analyst plans to use advanced hunting. Which table column indicates whether an email was blocked as phishing?

Accepted Answer

EmailEvents table, the 'DeliveryAction' column. The EmailEvents table records actions taken on emails before delivery, including whether a message was blocked by anti-phish policies. The 'DeliveryAction' column specifically indicates the final disposition, such as 'Blocked' for phishing. This makes it the correct source for identifying pre-delivery phishing blocks in advanced hunting.

Answer

EmailPostDeliveryEvents table, the 'Action' column

Answer

EmailAttachmentInfo table, the 'FileType' column

Answer

EmailUrlInfo table, the 'Url' column

Question 14

A security analyst is using advanced hunting in Microsoft 365 Defender to investigate a potential brute-force attack against an on-premises Exchange server. The analyst wants to find authentication failures from a specific IP address. Which table should the analyst query?

Accepted Answer

IdentityLogonEvents. IdentityLogonEvents is the correct table because it captures authentication events from Microsoft Defender for Identity, including failed logon attempts against on-premises Active Directory and Exchange servers. This table specifically logs interactive and non-interactive logon failures with source IP details, making it ideal for investigating brute-force attacks from a specific IP address.

Answer

EmailEvents

Answer

DeviceLogonEvents

Answer

CloudAppEvents

Question 15

An organization uses Microsoft 365 Defender. A security analyst is investigating an incident where a user received a phishing email that contained a link to a malicious domain. The user clicked the link, but the domain was blocked by Microsoft Defender for Office 365 at the time of click. The analyst needs to view the full details of the click verdict, including the time of click and the specific block action (e.g., blocked by custom block list). Where can the analyst find this information?

Accepted Answer

Detection details section. The Detection details section in the Microsoft 365 Defender portal provides the full click verdict for a URL, including the exact time of the click and the specific block action (e.g., blocked by custom block list, blocked by reputation). This information is part of the URL click verdict data logged by Microsoft Defender for Office 365 when Safe Links evaluates a clicked link. The analyst can access this by navigating to the incident's URL entity and selecting the Detection details tab.

Answer

Attachments tab

Answer

Timeline section

Answer

User entity page