SC-200 Practice Test 18 — 15 Questions

Question 1

A security analyst in Microsoft 365 Defender is investigating an incident that involves multiple devices. The analyst wants to see a visual representation of the attack, showing how the attacker moved from one device to another. Which feature provides this view?

Accepted Answer

Incident graph. The Incident graph in Microsoft 365 Defender provides a visual, interactive representation of an attack, showing how the attacker moved from one device to another, including lateral movement paths and related alerts. This feature is specifically designed to help analysts understand the full scope of an incident by mapping out the relationships between entities such as devices, users, and alerts.

Answer

Alert queue

Answer

Advanced hunting

Answer

Action center

Question 2

A security analyst is using advanced hunting in Microsoft 365 Defender to detect lateral movement. The analyst wants to find all devices where a specific user account had an interactive logon, and then identify which of those devices subsequently initiated outbound Remote Desktop Protocol (RDP) connections to other internal IP addresses. Which KQL approach is most efficient for this investigation?

Accepted Answer

Use DeviceLogonEvents and DeviceNetworkEvents with a join on DeviceId and a time range. Option A is correct because it uses DeviceLogonEvents to identify interactive logons for the specific user account on devices, then joins those results with DeviceNetworkEvents on DeviceId within a time range to find subsequent outbound RDP connections (destination port 3389) to internal IPs. This approach directly correlates the user's logon activity with network connections from the same device, which is the most efficient and precise method for detecting lateral movement via RDP.

Answer

Use IdentityLogonEvents and DeviceNetworkEvents with a join on IP address

Answer

Use DeviceProcessEvents and DeviceNetworkEvents with a join on DeviceId

Answer

Use EmailEvents and DeviceLogonEvents with a join on RecipientEmail

Question 3

A SOC analyst is building a scheduled analytics rule in Microsoft Sentinel to detect when a user is added to a privileged Microsoft Entra ID role (e.g., Global Administrator). Which two tables must be included in the KQL query to capture the role assignment event and to retrieve user details? (Choose 2.)

Accepted Answer

AADAuditLogs. AADAuditLogs captures all directory audit events, including role assignment activities such as adding a user to a privileged Microsoft Entra ID role. This table is essential because it records the 'Add member to role' operation with details like the target user, role name, and initiating actor, which are required to detect the security event.

Answer

SigninLogs

Answer

AzureActivity

Question 4

A SOC analyst is creating a scheduled analytics rule in Microsoft Sentinel to detect potential account compromise. The rule should trigger when a user account is created in Microsoft Entra ID and, within one hour, that same account is used to sign in from an unfamiliar location. The queries use the AuditLogs table for account creation and the SigninLogs table for sign-ins. Which KQL operator should be used to correlate these two events from different tables within a specific time window?

Accepted Answer

join. The correct answer is B (join) because the scenario requires correlating two events from different tables (AuditLogs and SigninLogs) based on a common field (e.g., UserPrincipalName) and within a specific time window (one hour). The join operator in KQL allows you to combine rows from two tables by matching keys, and you can use the 'where' clause on the time fields to enforce the one-hour window. This is the only operator that supports row-wise correlation across tables with a time constraint.

Answer

where

Answer

union

Answer

summarize

Question 5

A security analyst is investigating an incident in Microsoft 365 Defender where a user's device is suspected to be compromised. The analyst wants to collect a copy of a specific suspicious file from the device for offline analysis without disrupting the user. Which action should the analyst initiate?

Accepted Answer

Initiate a Live Response session. A Live Response session allows the analyst to remotely connect to the device in real time, collect a specific suspicious file via commands like 'getfile', and download it for offline analysis without interrupting the user's workflow. This is the only action that provides targeted file collection while the device remains operational.

Answer

Isolate the device from the network

Answer

Initiate an automated investigation

Answer

Run a full antivirus scan

Question 6

A security analyst wants to create a custom detection rule in Microsoft Sentinel that alerts when a user logs in from an IP address that is not in the company's approved IP range. The analyst has an existing watchlist named 'ApprovedIPs' containing the allowed ranges. Which KQL operator should the analyst use to compare the IP address from the SigninLogs table against the watchlist?

Accepted Answer

lookup. The `lookup` operator is the correct choice because it is specifically designed to enrich or filter data in one table based on a dimension table (like a watchlist) without requiring a full merge of columns. In this scenario, the analyst needs to compare IP addresses from the SigninLogs table against the ApprovedIPs watchlist to find logins from non-approved ranges, and `lookup` performs this efficiently by matching on a key field (the IP address) and returning only rows that do not have a match in the watchlist when used with a `kind=leftanti` parameter.

Answer

join

Answer

evaluate

Answer

where

Question 7

A company uses Microsoft Defender for Cloud with Defender for Servers enabled. The security team wants to receive an alert when a new user is added to the local Administrators group on a Windows virtual machine. Which data source must be enabled in Defender for Cloud to capture this event?

Accepted Answer

Enable the collection of Windows Security Event Log events (e.g., Event ID 4732) through the Log Analytics agent configuration.. Option A is correct because the event of adding a user to the local Administrators group on Windows is logged as Security Event ID 4732. To capture this event in Defender for Cloud, the Log Analytics agent must be configured to collect Windows Security Event Log events, which includes Event ID 4732. This data source enables Defender for Cloud to generate security alerts based on such privileged group modifications.

Answer

Enable Just-in-Time (JIT) VM access on the virtual machine.

Answer

Enable Adaptive Application Controls (AAC) for the virtual machine.

Answer

Enable Azure Defender for SQL on the subscription.

Question 8

A company uses Microsoft Defender for Cloud's Just-In-Time (JIT) VM access to secure its Azure virtual machines. A security analyst needs to grant a developer temporary RDP access to a specific VM for debugging purposes. Instead of using the default request approval flow, the analyst wants to configure an exemption so that the developer's access request never triggers a recommendation for that VM. Which action must the analyst perform?

Accepted Answer

Add an exemption for the VM on the 'Management ports should be closed on just-in-time based virtual machines' recommendation.. To prevent a specific VM from triggering a recommendation for open management ports, you must add an exemption directly on the 'Management ports should be closed on just-in-time based virtual machines' recommendation in Defender for Cloud. This exemption tells the recommendation engine to exclude that VM from compliance evaluation, so no alert or recommendation is generated for it. Approving a request with a long expiration does not suppress the underlying recommendation; it only grants temporary access.

Answer

Approve the access request once from the JIT blade and set a long expiration.

Answer

Configure a custom Azure Policy to allow open management ports for that VM.

Answer

Disable the JIT solution for the entire subscription from the Defender for Cloud environment settings.

Question 9

A security analyst is investigating a ransomware incident in Microsoft 365 Defender. The analyst wants to see a timeline of all actions performed on a specific device, including file creation, registry modifications, and network connections, in chronological order. Which feature should the analyst use?

Accepted Answer

Device timeline. The Device timeline in Microsoft Defender for Endpoint provides a chronological view of all events and actions on a specific device, including file creation, registry modifications, and network connections. This feature is specifically designed for forensic investigation of incidents like ransomware, offering a time-ordered list of activities without requiring custom queries.

Answer

Advanced hunting

Answer

Incident graph

Answer

Action center

Question 10

A security analyst in Microsoft 365 Defender is investigating an incident that involves a malicious email attachment. Which advanced hunting table should the analyst use to find information about the email including sender, recipient, and subject?

Accepted Answer

EmailEvents. The EmailEvents table in Microsoft 365 Defender advanced hunting contains the core email metadata, including sender (SenderFromAddress), recipient (RecipientEmailAddress), and subject (Subject). This table records events such as email delivery, blocking, and filtering actions, making it the primary source for investigating email-related incidents. The other tables focus on specific components like attachments or URLs, not the full email envelope details.

Answer

EmailAttachmentInfo

Answer

EmailUrlInfo

Answer

IdentityLogonEvents

Question 11

A cloud security team uses Microsoft Defender for Cloud with Defender for Servers enabled. They want to integrate a third-party vulnerability assessment solution for their Azure VMs and ensure findings appear in the Defender for Cloud recommendations. What must be done?

Accepted Answer

Enable the 'Integrated' partner solution in Defender for Cloud and install the scanner on VMs.. Option B is correct because Defender for Cloud supports integrating third-party vulnerability assessment solutions through the 'Integrated' partner solution setting. Once enabled, you must install the partner's scanner agent on each Azure VM. The findings are then ingested into Defender for Cloud and appear in the 'Vulnerabilities in your virtual machines should be remediated' recommendation, allowing the security team to view and manage them alongside built-in assessments.

Answer

Configure a data connector in Microsoft Sentinel to forward the partner's findings.

Answer

Deploy the Microsoft Defender Vulnerability Management solution instead of a third-party tool.

Answer

Use Azure Policy to assign a built-in initiative that mandates vulnerability scanning.

Question 12

A company enables Microsoft Defender for Cloud on its Azure subscription. The security team wants to ensure that all existing and future Azure VMs have Just-In-Time (JIT) VM access configured. Which of the following actions must the team take first to enable JIT for VMs?

Accepted Answer

Enable the 'Just-In-Time VM access' plan in Microsoft Defender for Cloud's environment settings. Option A is correct because enabling the 'Just-In-Time VM access' plan in Microsoft Defender for Cloud's environment settings is the prerequisite step that activates the JIT feature for the subscription. Without this plan enabled, Defender for Cloud cannot enforce JIT policies on any VMs, regardless of NSG or agent configurations.

Answer

Configure a network security group (NSG) to allow RDP traffic from a specific IP range

Answer

Create a security policy assignment to block all inbound RDP traffic

Answer

Install the Log Analytics agent on all VMs

Question 13

A company uses Microsoft Defender for Cloud to secure its Azure environment. The security team wants to receive notifications via email whenever a high-severity security alert is generated. What should they configure in Defender for Cloud?

Accepted Answer

Set up email notifications for high-severity alerts in the Defender for Cloud environment settings.. Option C is correct because Defender for Cloud provides a built-in email notification configuration specifically for security alerts. By navigating to the 'Environment settings' for the subscription or management group, then selecting 'Email notifications', you can enable and configure alerts to be sent to specified recipients when high-severity alerts are generated. This is the direct, purpose-built method for email notification of Defender for Cloud alerts without requiring additional services.

Answer

Enable the 'Continuous Export' feature to send alerts to a Log Analytics workspace.

Answer

Configure an alert rule in Azure Monitor.

Answer

Create an automation rule in Microsoft Sentinel.

Question 14

A company runs SQL Server on Azure Virtual Machines (IaaS). The security team wants to enable Advanced Threat Protection (ATP) to detect threats like SQL injection against these SQL Server instances. Which single action is required to achieve this?

Accepted Answer

Enable Microsoft Defender for SQL on the Azure subscription or at the SQL Server resource level.. To enable Advanced Threat Protection (ATP) for SQL Server on Azure VMs, you must enable Microsoft Defender for SQL at the Azure subscription or SQL Server resource level. This activates the SQL-specific threat detection capabilities, including alerts for SQL injection, anomalous access patterns, and suspicious activities. Without this, the SQL Server instances lack the dedicated security monitoring that ATP provides.

Answer

Install the SQL Server IaaS Agent extension on each virtual machine.

Answer

Enable just Microsoft Defender for Servers on the subscription.

Answer

Configure an Azure SQL firewall rule to allow only trusted IP addresses.

Question 15

A company has several Azure virtual machines running SQL Server (IaaS). The security team wants to enable Advanced Threat Protection for these SQL Server instances to detect threats like SQL injection. What should they do?

Accepted Answer

Deploy the SQL Server IaaS Agent extension on each VM and enable Azure Defender for SQL in Microsoft Defender for Cloud.. To enable Advanced Threat Protection for SQL Server IaaS, you must deploy the SQL Server IaaS Agent extension on each VM, which allows the VM to register with the SQL IaaS platform. Then, you enable Azure Defender for SQL in Microsoft Defender for Cloud, which provides threat detection for SQL injection and other anomalous activities. This combination ensures the SQL Server instances are monitored by Defender for Cloud's SQL-specific protections.

Answer

Enable Azure Defender for Servers on the subscription; it automatically protects SQL Server workloads.

Answer

Enable Azure Defender for SQL on the Log Analytics workspace used by the VMs.

Answer

Configure the Microsoft Sentinel SQL connector to ingest SQL audit logs.