SC-200 Practice Test 19 — 15 Questions

Question 1

A SOC analyst is responding to a ransomware incident. The analyst identifies that the ransomware encrypted files on a file share and left a ransom note. The analyst needs to prevent the ransomware from spreading to other shares. Which action should the analyst take first?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Isolate the server from the network using Microsoft Defender for Endpoint's device isolation.. The immediate priority in a ransomware incident is containment to prevent lateral movement and further encryption. Microsoft Defender for Endpoint's device isolation feature disconnects the compromised server from the network while allowing communication with the Defender for Cloud backend, stopping the ransomware from spreading to other shares. This aligns with the NIST incident response framework's containment phase, which must occur before eradication or recovery actions.

Answer

Revoke the user's access to the file share.

Answer

Run a full antivirus scan on the server.

Answer

Restore the encrypted files from backup.

Question 2

Which THREE are valid data connectors in Microsoft Sentinel for ingesting security events from Microsoft 365 services? (Choose three.)

Accepted Answer

Microsoft 365 Defender. Microsoft 365 Defender is a valid data connector in Microsoft Sentinel that ingests alerts and incidents from Microsoft 365 Defender components (Microsoft Defender for Endpoint, Defender for Office 365, Defender for Identity, and Defender for Cloud Apps). It uses the Microsoft 365 Defender API to pull correlated security events, enabling centralized investigation of advanced threats across the M365 ecosystem.

Answer

Microsoft Purview

Answer

Microsoft Intune

Question 3

Your SOC team needs to ensure that all incidents in Microsoft Sentinel are assigned to an analyst within 30 minutes of creation. Which TWO configurations should you implement?

Accepted Answer

Create a playbook that uses the Update Incident action to set the owner field.. A playbook (an Azure Logic Apps workflow) can use the 'Update Incident' action to programmatically set the owner field on an incident. This allows you to implement custom assignment logic, such as round-robin or based on analyst skill set, triggered by an automation rule or manually. Option C is correct because an automation rule can directly set the owner field when an incident is created, without needing a playbook, by using the 'Update incident' action within the rule itself. Both configurations ensure incidents are assigned within the required 30-minute window.

Answer

Set up a playbook that sends an email to the SOC manager when an incident is created.

Answer

Configure a Microsoft Teams connector to post incidents to a channel.

Answer

Modify the analytics rule to include a custom details field for analyst name.

Question 4

In Microsoft 365 Defender, an incident is created automatically. An analyst wants to see all related alerts for that incident. Which tab on the incident details page should the analyst select?

Accepted Answer

Alerts tab. The Alerts tab on the incident details page in Microsoft 365 Defender displays all alerts that have been automatically correlated into the incident. Since an incident is a collection of related alerts, selecting the Alerts tab is the correct way for an analyst to view every individual alert that contributed to the incident.

Answer

Devices tab

Answer

Users tab

Answer

Evidence tab

Question 5

You are responding to a ransomware incident in Microsoft Defender XDR. You have identified that the malware encrypted files on several devices and then deleted the volume shadow copies. Which of the following actions should you take first to contain the incident?

Accepted Answer

Isolate affected devices using Microsoft Defender for Endpoint. Isolating affected devices using Microsoft Defender for Endpoint is the correct first action because it immediately cuts off network communication, preventing the ransomware from spreading laterally to other devices and stopping further encryption or deletion of shadow copies. Containment must precede remediation to limit the blast radius, and Defender for Endpoint's device isolation feature achieves this at the network level without requiring physical disconnection.

Answer

Run a remediation action to delete the detected malware

Answer

Restore encrypted files from backup

Answer

Run a full antivirus scan on all devices

Question 6

Which TWO actions are valid ways to integrate on-premises firewall logs into Microsoft Sentinel for analysis?

Accepted Answer

Configure the firewall to send Common Event Format (CEF) logs to a syslog server running Azure Monitor Agent.. On-premises firewall logs can be forwarded in Common Event Format (CEF) over syslog to a server running the Azure Monitor Agent (AMA), which then ingests them into Microsoft Sentinel. CEF is a standard log format supported by many security appliances, and the AMA replaces the older Log Analytics Agent for this purpose. This setup allows Sentinel to parse and analyze the firewall events for security monitoring.

Answer

Enable the Office 365 connector.

Answer

Install the Windows DNS Server connector.

Answer

Connect the Azure Activity log connector.

Question 7

Which TWO are valid sources of evidence in a Microsoft Sentinel incident? (Choose two.)

Accepted Answer

Alerts. Alerts are a core evidence type in Microsoft Sentinel incidents because they represent the raw security findings that trigger an incident. When an alert is generated from a detection rule (e.g., analytics rule, fusion, or scheduled query), it is automatically linked to the incident as evidence, providing the initial context and supporting data for investigation.

Answer

Playbooks

Answer

Watchlists

Answer

Hunting queries

Question 8

Your organization uses Microsoft Sentinel with Azure Policy. You need to ensure that new Log Analytics workspaces are automatically connected to Sentinel and configured with a standard set of data connectors. What should you use?

Accepted Answer

Create Azure Policy definitions that deploy Sentinel and data connectors.. Azure Policy can be used to automatically deploy and configure Microsoft Sentinel and its data connectors on new Log Analytics workspaces. By creating policy definitions with 'DeployIfNotExists' or 'Modify' effects, you ensure that any new workspace is automatically onboarded to Sentinel and has the required data connectors installed, meeting the requirement for automated, consistent configuration at scale.

Answer

Deploy an ARM template to each new workspace manually.

Answer

Use Sentinel automation rules to configure new workspaces.

Answer

Develop a Logic App that runs on a schedule to check for new workspaces.

Question 9

During a security incident, a Microsoft Sentinel analytics rule generated an alert for a suspicious sign-in from an unusual location. The incident involves a user whose account has been compromised. The security team needs to take immediate actions to remediate and prevent further damage. Which THREE actions should the security team prioritize?

Accepted Answer

Reset the user's password. Resetting the user's password (A) is a critical immediate step because it invalidates the current compromised credentials, preventing the attacker from using the known password to authenticate again. In Microsoft Entra ID, a password reset forces the user to create a new credential, which the attacker does not possess, effectively cutting off one of the most common attack vectors.

Answer

Review audit logs for all users

Answer

Raise the user's risk level in Identity Protection

Question 10

Refer to the exhibit. You are reviewing a playbook configuration for Microsoft Sentinel. What does this playbook do?

Accepted Answer

It runs when a high severity incident is created. The playbook is configured with a trigger condition that specifies 'When a high severity incident is created'. This means the playbook will only execute when an incident with a severity level of 'High' is generated in Microsoft Sentinel. The condition filters out incidents of other severity levels, ensuring the playbook runs exclusively for high-severity incidents.

Answer

It runs only on medium severity incidents

Answer

It runs when a new alert is generated with high severity

Answer

It runs on all incidents regardless of severity

Question 11

Which THREE permissions are required for a user to manage Microsoft Sentinel playbooks using Azure Logic Apps? (Choose three.)

Accepted Answer

Microsoft Sentinel Contributor. Microsoft Sentinel Contributor is required because it grants the necessary permissions to create, update, and delete playbooks within Microsoft Sentinel, which are built on Azure Logic Apps. This role allows the user to manage playbooks as part of the security operations environment, including assigning playbooks to automation rules and incident triggers.

Answer

Global Administrator in Microsoft Entra ID

Answer

Reader on the Logic App

Question 12

Refer to the exhibit. You are a security analyst reviewing a KQL query in Microsoft Sentinel. The query is intended to show the count of high-severity malware alerts in the last 24 hours. However, the query returns results only for alerts with exact severity string 'High', but you also need to include 'Informational' severity alerts that are related to malware. What should you modify?

Accepted Answer

Change the 'where AlertSeverity == "High"' to 'where AlertSeverity in ("High", "Informational")'.. The query currently filters only for alerts where AlertSeverity equals 'High', but the requirement is to also include 'Informational' severity alerts related to malware. By changing the condition to 'where AlertSeverity in ("High", "Informational")', the query will return both severity levels while keeping the malware-related filter and the 24-hour time window intact.

Answer

Remove the 'summarize' and 'order by' clauses.

Answer

Remove the 'where AlertName contains "malware"' condition.

Answer

Change 'ago(24h)' to 'ago(48h)'.

Question 13

Which THREE actions are part of the containment phase in the Microsoft Incident Response process?

Accepted Answer

Block known malicious IP addresses at the firewall.. Blocking known malicious IP addresses at the firewall is a containment action because it immediately stops inbound or outbound communication with threat actors, preventing further data exfiltration or command-and-control traffic. In the Microsoft Incident Response (IR) process, containment focuses on limiting the blast radius and stopping the spread of an attack, and firewall rules are a primary technical control for achieving this at the network perimeter.

Answer

Notify senior management of the incident.

Answer

Collect forensic data from affected systems.

Question 14

Which THREE components are part of the Microsoft Sentinel SOAR capabilities? (Select THREE.)

Accepted Answer

Connectors. Connectors are part of Microsoft Sentinel's SOAR capabilities because they enable the ingestion of security alerts and events from various sources, which is the foundational step for triggering automated responses. Without connectors, Sentinel cannot receive the data needed to initiate playbooks or automation rules, making them an essential component of the SOAR workflow.

Answer

Workbooks

Answer

Analytics rules

Question 15

An organization ingests Windows Security Events into Microsoft Sentinel via the Security Events connector. An analyst wants to create a scheduled analytics rule that alerts when more than 10 failed logon events (Event ID 4625) occur for the same user within a 5-minute window. Which KQL operator should the analyst use to count events per user in that time window?

Accepted Answer

summarize. The `summarize` operator is correct because it groups events by user and then applies an aggregation function (like `count()`) to calculate the number of failed logon events per user within the 5-minute window. This directly supports the rule's requirement to count events per user and compare the count to a threshold of 10.

Answer

extend

Answer

project

Answer

where