SC-200 Practice Test 18 — 15 Questions

Question 1

Refer to the exhibit. You are reviewing an Azure Resource Manager (ARM) template for a Microsoft Sentinel analytics rule. Based on the exhibit, which statement is true?

Accepted Answer

The rule will generate one alert per user that has MFA disabled.. The ARM template configures a Microsoft Sentinel scheduled analytics rule that runs every hour, queries for users with MFA disabled, and uses the 'Alert Per Result' event grouping setting. This setting generates a separate alert for each unique result returned by the query, meaning each user who has MFA disabled triggers its own alert.

Answer

The rule will create one incident per alert and group alerts by entity.

Answer

The rule will only trigger if more than 5 users have MFA disabled.

Answer

The rule runs every hour and looks back 5 hours.

Question 2

Which TWO are valid methods to collect forensic evidence from a compromised Windows endpoint during an incident? (Choose TWO.)

Accepted Answer

Run KAPE (Kroll Artifact Parser and Extractor) to collect artifacts.. KAPE (Kroll Artifact Parser and Extractor) is a purpose-built tool for collecting and parsing forensic artifacts from live Windows endpoints during incident response. It efficiently gathers critical evidence such as prefetch files, registry hives, event logs, and browser history without altering the system state, making it a valid method for forensic collection.

Answer

Run Windows Update to fix vulnerabilities.

Answer

Reboot the system and boot from a forensic USB drive.

Answer

Use FTK Imager to create a forensically sound image of the hard drive.

Question 3

Which THREE actions can be performed by automation rules in Microsoft Sentinel?

Accepted Answer

Assign an incident to a specific owner. Automation rules in Microsoft Sentinel can automatically assign incidents to specific owners based on conditions such as severity, entity type, or custom criteria. This action helps streamline incident response by ensuring the right personnel are notified and responsible for handling the incident without manual intervention.

Answer

Modify a data connector to ingest more logs

Answer

Create a new analytics rule

Question 4

During an incident, an analyst wants to use Microsoft Defender XDR's automatic attack disruption to contain an ongoing attack. What prerequisite must be met?

Accepted Answer

Devices must be onboarded to Microsoft Defender for Endpoint.. Microsoft Defender XDR's automatic attack disruption relies on Microsoft Defender for Endpoint (MDE) signals to automatically contain compromised devices or user accounts. Devices must be onboarded to MDE so that the high-confidence alerts (e.g., from ransomware or lateral movement) can trigger automated containment actions like device isolation or blocking an IP. Without MDE onboarding, the attack disruption engine has no endpoint telemetry or remediation capability to act upon.

Answer

Microsoft Purview compliance portal must be configured.

Answer

Users must have Azure AD Premium P2 licenses.

Answer

Microsoft Sentinel must be enabled and connected to Defender XDR.

Question 5

Your SOC team uses Microsoft Sentinel with multiple workspaces across regions. You need to implement a solution that allows analysts to query all workspaces from a single location without moving data. Which feature should you configure?

Accepted Answer

Use cross-workspace queries with workspace() expressions in KQL.. Cross-workspace queries using the `workspace()` expression in KQL allow analysts to query multiple Log Analytics workspaces from a single query context without moving or centralizing the data. This is the native Microsoft Sentinel feature designed for multi-workspace environments, enabling seamless querying across regions while keeping data in its original workspace.

Answer

Export data to Azure Data Explorer and query there.

Answer

Create a single Log Analytics workspace and have all data sources send logs there.

Answer

Configure Azure Lighthouse to manage all workspaces.

Question 6

Which TWO of the following are valid data sources for Microsoft Sentinel threat hunting? (Choose 2)

Accepted Answer

Amazon Web Services CloudTrail. The correct answers are D (Amazon Web Services CloudTrail) and E (Azure Active Directory (Microsoft Entra ID)). Microsoft Sentinel provides native connectors for AWS CloudTrail via the AWS S3 connector and for Azure AD logs. Option A is incorrect because Syslog is a protocol, not a pre-built data source connector, though syslog data can be ingested via a custom mechanism. Option B is incorrect because Google Workspace is not natively supported as a connector in Microsoft Sentinel (requires custom integration). Option C is incorrect because ServiceNow is not a direct data source; it can be integrated via Logic Apps but not as a standard data connector.

Answer

Syslog

Answer

Google Workspace

Answer

ServiceNow

Question 7

Refer to the exhibit. You are reviewing a playbook configuration in Microsoft Sentinel. The playbook is supposed to create a task to generate a ServiceNow ticket and notify the SOC manager when a high-severity alert is triggered. However, when a high-severity alert occurs, only the notification task is created, and the ticket creation task is missing. What is the most likely cause?

Accepted Answer

The alertRuleId is a placeholder and does not correspond to a real analytics rule in the environment.. The playbook uses the 'alertRuleId' field as a placeholder, which means it does not reference a real analytics rule in the environment. When the playbook runs, the condition that checks for the specific alert rule ID fails, so the action to create a ServiceNow ticket is skipped, while the notification task (which does not depend on that condition) still executes. In Microsoft Sentinel playbooks, the alertRuleId must match an existing analytics rule's identifier for conditional branching to work correctly.

Answer

The playbook uses an unsupported trigger type.

Answer

The playbook JSON has an invalid structure for the trigger.

Answer

The severity filter is incorrectly specified; it should be an array of strings.

Question 8

Your organization uses Microsoft Sentinel with a Log Analytics workspace in the East US region. You need to ensure that incident investigation data is retained for two years for compliance. What should you configure?

Accepted Answer

Adjust the Interactive retention period to 730 days in the Log Analytics workspace.. Log Analytics workspaces allow you to configure the Interactive retention period independently from the Total retention period. Setting Interactive retention to 730 days ensures that incident investigation data remains available for interactive queries for the full two-year compliance requirement, without needing to enable archive or change log types.

Answer

Configure a data retention policy in Microsoft Purview.

Answer

Set the Total retention period to 730 days and enable Archive.

Answer

Enable Basic Logs and set retention to 730 days.

Question 9

A security administrator wants to ensure that all existing and future Azure virtual machines have Microsoft Defender for Cloud's built-in vulnerability assessment solution (Qualys or Microsoft) installed without manual intervention. Which feature should the administrator configure?

Accepted Answer

Auto-provisioning of the vulnerability assessment solution. Auto-provisioning of the vulnerability assessment solution ensures that Microsoft Defender for Cloud automatically installs either the Qualys or Microsoft built-in vulnerability assessment extension on all existing and future Azure VMs without manual intervention. This feature is specifically designed to enable continuous vulnerability scanning by deploying the agent at scale, covering both new and existing resources as they are provisioned or discovered.

Answer

Continuous export of security findings to Log Analytics

Answer

Just-in-time VM access

Answer

Regulatory compliance dashboard

Question 10

Your Microsoft Sentinel workspace ingests logs from Microsoft Defender for Cloud and Microsoft 365 Defender. You need to create an incident response playbook that automatically responds to high-severity incidents. Which THREE components are required? (Choose three.)

Accepted Answer

An analytics rule that generates the incident. The correct components are: an analytics rule to generate the incident (B), an automation rule to trigger the playbook (C), and a Logic Apps workflow with Microsoft Sentinel trigger to define the automated response actions (E). Option A (workbook) is for visualization, not automation. Option D (hunting query) is for proactive threat hunting, not automatic incident response.

Answer

A workbook to visualize the incident data

Answer

A hunting query to search for similar activity

Question 11

Which TWO are valid sources of evidence in a Microsoft Sentinel incident? (Choose two.)

Accepted Answer

Alerts. Alerts are a core evidence type in Microsoft Sentinel incidents because they represent the raw security findings that trigger an incident. When an alert is generated from a detection rule (e.g., analytics rule, fusion, or scheduled query), it is automatically linked to the incident as evidence, providing the initial context and supporting data for investigation.

Answer

Playbooks

Answer

Watchlists

Answer

Hunting queries

Question 12

Your organization uses Microsoft Sentinel. A new incident is created from a fusion alert that combines multiple low-severity alerts. The analyst needs to determine the entities involved. What should the analyst review?

Accepted Answer

The incident's entities tab.. The incident's entities tab in Microsoft Sentinel provides a consolidated view of all entities (such as users, hosts, IP addresses, and processes) that were identified by the fusion alert. Since fusion alerts combine multiple low-severity alerts, the entities tab is the direct place to see the aggregated entities involved in the incident, enabling the analyst to understand the scope and pivot for investigation.

Answer

The Sentinel Overview workbook.

Answer

The analytics rule that generated the incident.

Answer

The incident's timeline.

Question 13

Your organization has Microsoft Defender XDR enabled. An incident is generated for a user who clicked a phishing link in an email. The analyst needs to automatically disable the user's mailbox for suspicious activity. Which automated action should the analyst configure in a Microsoft Sentinel automation rule?

Accepted Answer

Run a playbook that uses the Microsoft 365 Defender connector to disable the mailbox.. The goal is to disable the user's mailbox, which is a Microsoft 365 Exchange Online action. A Microsoft Sentinel automation rule can trigger a playbook that uses the Microsoft 365 Defender connector to execute the 'Disable mailbox' action directly against Exchange Online, effectively suspending the user's ability to send or receive email. This aligns with the requirement to automatically respond to a phishing incident by disabling the compromised mailbox.

Answer

Run a playbook that deletes the phishing email from the user's inbox.

Answer

Configure an automation rule to block the sender IP address in Defender for Cloud Apps.

Answer

Run a playbook that resets the user's password.

Question 14

Arrange the steps to run a Microsoft 365 Defender advanced hunting query and create a custom detection rule from it.

Accepted Answer

Step 1: Navigate to Advanced hunting in Microsoft 365 Defender. Step 2: Write a KQL query. Step 3: Run the query. Step 4: Create a custom detection rule from the query results.. After running a query in Advanced hunting, you can create a detection rule directly from the results to alert on future matches.

Answer

Step 1: Write a KQL query. Step 2: Navigate to Advanced hunting in Microsoft 365 Defender. Step 3: Run the query. Step 4: Create a custom detection rule from the query results.

Answer

Step 1: Navigate to Advanced hunting in Microsoft 365 Defender. Step 2: Run the query. Step 3: Write a KQL query. Step 4: Create a custom detection rule from the query results.

Answer

Step 1: Navigate to Advanced hunting in Microsoft 365 Defender. Step 2: Write a KQL query. Step 3: Create a custom detection rule from the query results. Step 4: Run the query.

Question 15

Which TWO of the following are valid sources for creating incidents in Microsoft Sentinel? (Choose two.)

Accepted Answer

Microsoft 365 Defender alerts. Microsoft 365 Defender alerts are a valid source for creating incidents in Microsoft Sentinel because Sentinel can ingest alerts from Microsoft 365 Defender (which includes Defender for Endpoint, Defender for Office 365, Defender for Identity, and Defender for Cloud Apps) via the Microsoft 365 Defender connector. When these alerts are ingested, Sentinel can automatically create incidents based on them, enabling unified incident management across the Microsoft security ecosystem.

Answer

Hunting query results

Answer

Workbook creation

Answer

Playbook execution