SC-200 Practice Test 18 — 15 Questions

Question 1

You are managing Microsoft Defender for Endpoint. Which TWO actions can be taken directly from the Microsoft 365 Defender portal to respond to a compromised device?

Accepted Answer

Run a full antivirus scan on the device.. The Microsoft 365 Defender portal allows security operators to initiate a full antivirus scan on a compromised device directly from the device's action menu. This leverages Microsoft Defender Antivirus to detect and remediate threats without requiring local user interaction, providing an immediate response capability within the unified security operations interface.

Answer

Block the user's sign-in from Microsoft Entra ID.

Answer

Remotely wipe the device.

Answer

Reset the device's local administrator password.

Question 2

You are managing Microsoft Defender for Cloud Apps. Which TWO actions can be performed using the Microsoft Defender XDR integration?

Accepted Answer

Investigate user activities across cloud apps.. Microsoft Defender XDR integration with Defender for Cloud Apps enables cross-domain investigation of user activities across cloud apps, leveraging signals from Microsoft 365 Defender to correlate events like sign-ins, file downloads, and admin actions. This allows security analysts to trace a user's behavior across SaaS applications (e.g., SharePoint, OneDrive, Teams) without switching consoles, using the unified incidents and alerts in the Microsoft 365 Defender portal.

Answer

Quarantine malicious emails.

Answer

Manage device compliance policies in Microsoft Intune.

Answer

Onboard devices to Microsoft Defender for Endpoint.

Question 3

Which TWO Microsoft Defender XDR entities can be managed during incident response?

Accepted Answer

Devices. During incident response in Microsoft Defender XDR, you can manage devices (endpoints) and user accounts directly from the incident page. Devices can be isolated, have antivirus scans run, or be added to a blocklist, while user accounts can be disabled, forced to sign out, or have their password reset. These actions are executed via Microsoft Defender for Endpoint and Microsoft Defender for Identity integrations within the unified incident response workflow.

Answer

Network interfaces

Answer

Azure subscriptions

Answer

Microsoft 365 tenants

Question 4

Refer to the exhibit. The KQL query is used in a Microsoft Sentinel scheduled alert rule. What scenario does this query detect?

Accepted Answer

Attempts to sign in with disabled user accounts.. The KQL query filters for `ResultType == 50057`, which specifically indicates a sign-in attempt by a disabled user account in Microsoft Entra ID. This result type is unique to disabled accounts and does not cover MFA denials (53003), invalid password attempts (50126), or brute force patterns. Therefore, the query detects attempts to sign in with disabled user accounts.

Answer

Multiple MFA denial events from a single user.

Answer

Brute force attacks against Azure AD accounts using invalid passwords.

Answer

Brute force attacks from a single IP address against multiple accounts.

Question 5

Which THREE of the following are capabilities of Microsoft Defender XDR's automated investigation and response (AIR) that can be enabled or configured by a security operations analyst? (Choose three.)

Accepted Answer

Automatically block an email message or attachment.. Microsoft Defender XDR's automated investigation and response (AIR) allows security operations analysts to configure automatic actions such as blocking an email message or attachment. This is a core capability of AIR, which uses playbooks to automatically remediate threats by applying actions like soft-delete or quarantine to malicious emails or attachments based on investigation results.

Answer

Automatically modify Data Loss Prevention policies.

Answer

Automatically create new analytics rules based on incident patterns.

Question 6

A security team is investigating a ransomware incident that encrypted files on several Windows servers. Microsoft Defender for Endpoint detected the ransomware but the initial infection vector is unknown. Which KQL query in Microsoft Sentinel would BEST identify the initial process that executed the ransomware?

Accepted Answer

DeviceProcessEvents | where FileName contains 'ransomware.exe' | project DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, Timestamp. DeviceProcessEvents captures process creation events, and by filtering for the ransomware executable and projecting the InitiatingProcessFileName and InitiatingProcessCommandLine, you can trace back to the parent process that launched the ransomware. This directly identifies the initial infection vector, which is the core goal of the investigation.

Answer

DeviceNetworkEvents | where RemoteUrl contains 'malicious' | project DeviceName, RemoteIP, Timestamp

Answer

DeviceFileEvents | where FileName contains 'ransomware.exe' | project DeviceName, ActionType, Timestamp

Answer

DeviceEvents | where ActionType == 'RansomwareDetection' | project DeviceName, Timestamp

Question 7

Order the steps to create a Microsoft Sentinel automation rule that automatically closes low-severity incidents.

Accepted Answer

Step 1: Navigate to the Automation blade in Microsoft Sentinel.
Step 2: Create a new automation rule.
Step 3: Configure the condition to trigger when an incident is created with severity equals Low.
Step 4: Add an action to close the incident and set a comment.. Automation rules are created in the Automation blade, conditions define when to trigger, and actions define what to do.

Answer

Step 1: Create a new automation rule.
Step 2: Configure the condition to trigger when an incident is created with severity equals Low.
Step 3: Navigate to the Automation blade in Microsoft Sentinel.
Step 4: Add an action to close the incident and set a comment.

Answer

Step 1: Navigate to the Automation blade in Microsoft Sentinel.
Step 2: Configure the condition to trigger when an incident is created with severity equals Low.
Step 3: Create a new automation rule.
Step 4: Add an action to close the incident and set a comment.

Answer

Step 1: Navigate to the Automation blade in Microsoft Sentinel.
Step 2: Create a new automation rule.
Step 3: Add an action to close the incident and set a comment.
Step 4: Configure the condition to trigger when an incident is created with severity equals Low.

Question 8

An administrator creates a Microsoft Defender for Cloud Apps policy to block unsanctioned cloud storage apps. Despite the policy, users can still access these apps. What is the most likely cause?

Accepted Answer

The policy mode is set to 'Monitor', which only alerts and does not block. When a Microsoft Defender for Cloud Apps policy is set to 'Monitor' mode, it only generates alerts and does not enforce any blocking action. To actually block unsanctioned cloud storage apps, the policy must be configured with a 'Block' action type, typically in conjunction with a 'Governance' action that applies the block at the proxy or API level. The 'Monitor' mode is designed for detection and logging, not enforcement.

Answer

The action type 'Block' is incorrect; it should be 'Alert'

Answer

The policy requires a 'Device' filter to apply to all users

Answer

The filter uses 'Unsanctioned' tag, but apps are tagged 'Sanctioned'

Question 9

Which TWO actions can reduce the cost of Microsoft Sentinel while maintaining security coverage?

Accepted Answer

Configure some tables to use Basic Logs tier.. Configuring tables to use the Basic Logs tier reduces ingestion costs for high-volume, verbose logs (e.g., from firewalls or DNS servers) while still retaining the data for security analysis. Basic Logs are stored at a lower cost per GB but have reduced query capabilities (e.g., no interactive full-text search, limited to KQL summarization). This allows you to keep security coverage by retaining the logs for detection and investigation, albeit with a different query pattern.

Answer

Remove unused data connectors.

Answer

Switch to a pay-as-you-go workspace.

Answer

Reduce workspace retention to 30 days for all tables.

Question 10

Arrange the steps to run a Microsoft 365 Defender advanced hunting query and create a custom detection rule from it.

Accepted Answer

Step 1: Navigate to Advanced hunting in Microsoft 365 Defender. Step 2: Write a KQL query. Step 3: Run the query. Step 4: Create a custom detection rule from the query results.. After running a query in Advanced hunting, you can create a detection rule directly from the results to alert on future matches.

Answer

Step 1: Write a KQL query. Step 2: Navigate to Advanced hunting in Microsoft 365 Defender. Step 3: Run the query. Step 4: Create a custom detection rule from the query results.

Answer

Step 1: Navigate to Advanced hunting in Microsoft 365 Defender. Step 2: Run the query. Step 3: Write a KQL query. Step 4: Create a custom detection rule from the query results.

Answer

Step 1: Navigate to Advanced hunting in Microsoft 365 Defender. Step 2: Write a KQL query. Step 3: Create a custom detection rule from the query results. Step 4: Run the query.

Question 11

Your organization uses Microsoft Defender XDR and Microsoft Sentinel. You need to ensure that when a user reports a phishing email in Microsoft 365 Defender, the incident in Microsoft Sentinel is automatically updated with the user's comments. Which THREE components are required?

Accepted Answer

The Microsoft 365 Defender data connector in Microsoft Sentinel.. The Microsoft 365 Defender data connector in Microsoft Sentinel is required because it ingests alerts and incidents from Microsoft 365 Defender into Sentinel. Without this connector, the phishing email report from Microsoft 365 Defender would not create an incident in Sentinel, making it impossible to automatically update that incident with user comments.

Answer

A logic app in Azure that is triggered by the Microsoft 365 Defender alert.

Answer

The Microsoft Entra ID data connector in Microsoft Sentinel.

Question 12

You are reviewing the ARM template snippet shown in the exhibit. What is the purpose of this template?

Accepted Answer

Create a saved search in a Log Analytics workspace. The ARM template snippet defines a saved search resource of type 'Microsoft.OperationalInsights/workspaces/savedSearches'. This resource type is specifically used to create a saved query within a Log Analytics workspace, which can then be used for log queries, alert rules, or workbooks. Option C correctly identifies this purpose.

Answer

Create a workbook in Azure Monitor

Answer

Create an analytics rule in Microsoft Sentinel

Answer

Create a data connector in Microsoft Sentinel

Question 13

Refer to the exhibit. You are reviewing an automation rule in Microsoft Sentinel. What will happen when a new incident is created?

Accepted Answer

The playbook 'BlockIPPlaybook' will be executed. The automation rule is configured to trigger a playbook when an incident is created. The rule's action specifies 'Run playbook' with 'BlockIPPlaybook' selected, and the trigger condition is set to 'When incident is created'. This means that upon incident creation, Sentinel will execute the playbook as an automated response.

Answer

The incident severity will be changed

Answer

A new analytics rule will be created

Answer

The incident will be automatically closed

Question 14

You are investigating an incident in Microsoft Defender XDR. The incident involves multiple alerts from different workloads. You need to view all related alerts in a single timeline. What should you use?

Accepted Answer

Incident page. The Incident page in Microsoft Defender XDR aggregates all alerts from different workloads (e.g., Microsoft Defender for Endpoint, Office 365, Identity) into a single, unified timeline view. This allows you to see the sequence of events and alerts related to the incident in chronological order, which is essential for understanding the attack chain and coordinating response actions.

Answer

Advanced hunting

Answer

Action center

Answer

Device timeline

Question 15

Which TWO actions should be taken immediately when a compromised user account is detected in Microsoft Entra ID?

Accepted Answer

Revoke all current sessions.. Revoking all current sessions (Option A) is a critical immediate action because it terminates all active authentication tokens and sessions for the compromised account, preventing the attacker from continuing to use existing tokens to access resources. This action leverages Microsoft Entra ID's token revocation capabilities, which invalidate refresh tokens and access tokens issued before the revocation, effectively cutting off the attacker's current access without waiting for password changes or other mitigations.

Answer

Notify the user's manager.

Answer

Reset the user's password.

Answer

Block sign-ins from the user's IP address.