SC-200 Practice Test 2 — 10 Questions

Question 1

Your organization uses Microsoft Defender XDR. You need to investigate a potential ransomware incident that has affected multiple devices. The security team wants to identify the initial access vector. Which advanced hunting table should you query to find the process that initiated the encryption?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

DeviceProcessEvents. DeviceProcessEvents logs process creation events, including the command line and parent process details. To identify the initial access vector in a ransomware incident, you need to trace the process tree back to the executable that launched the encryption process, which is precisely what this table captures.

Answer

DeviceRegistryEvents

Answer

DeviceFileEvents

Answer

DeviceNetworkEvents

Question 2

During a ransomware incident, Microsoft Defender for Cloud Apps alerts indicate that a user is uploading large volumes of data to an external cloud storage provider not approved by your organization. Which two actions should you take first? (Choose two.)

Accepted Answer

Block the unapproved cloud storage app. Blocking the unapproved cloud storage app in Microsoft Defender for Cloud Apps immediately stops the ongoing data exfiltration by preventing further uploads to that external provider. This is a direct, real-time containment action that leverages Defender for Cloud Apps's app governance and conditional access controls to enforce organizational policies without disrupting the user's access to other resources.

Answer

Notify the user about the policy violation

Answer

Initiate a legal hold on the user's data

Question 3

Which THREE components are part of Microsoft Defender XDR? (Select three.)

Accepted Answer

Microsoft Defender for Endpoint. Microsoft Defender XDR is the unified extended detection and response suite that correlates signals across Microsoft's first-party security workloads, and its core components include Microsoft Defender for Endpoint (A), which provides endpoint detection and response (EDR) for devices; Microsoft Defender for Identity (C), which monitors on-premises Active Directory Domain Services signals via sensors to detect identity-based attacks; and Microsoft Defender for Office 365 (E), which protects email, collaboration, and Office apps against phishing, malware, and business email compromise. These three services natively share incidents, alerts, and advanced hunting data in the Microsoft 365 Defender portal, which is why they are part of Defender XDR. Microsoft Entra ID (B) is the identity and access management service (formerly Azure AD) and is not itself a Defender XDR workload, though it feeds identity signals into the suite. Microsoft Defender for Cloud (D) is a cloud security posture management and workload protection offering for Azure, multicloud, and hybrid resources, and it belongs to the Microsoft Defender for Cloud family rather than being one of the Defender XDR components.

Answer

Microsoft Entra ID

Answer

Microsoft Defender for Cloud

Question 4

Your organization, Fabrikam, has a hybrid environment with on-premises Active Directory and Microsoft Entra ID. You are using Microsoft Sentinel and Microsoft Defender XDR. You have enabled Microsoft Defender for Identity (MDI) to protect on-premises Active Directory. Recently, you received an incident in Microsoft Sentinel indicating a potential DCSync attack from a domain controller. The incident was generated from an MDI alert. You need to investigate the incident and determine if the attack was successful. You have the following options: A) Use the Microsoft Sentinel incident investigation graph to view entities and relationships. Then query the IdentityDirectoryEvents table for the domain controller to see if any directory replication requests were made. B) Use the Microsoft Defender XDR advanced hunting to query the IdentityLogonEvents table for the domain controller. C) Use the Microsoft Sentinel workbook for MDI to visualize the attack timeline. D) Use the Microsoft Defender for Cloud Apps activity log to review the domain controller's activities. Which option should you choose?

Accepted Answer

Use the Microsoft Sentinel incident investigation graph to view entities and relationships. Then query the IdentityDirectoryEvents table for the domain controller to see if any directory replication requests were made.. A DCSync attack involves an attacker impersonating a domain controller to request directory replication via the MS-DRSR protocol. The IdentityDirectoryEvents table in Microsoft Defender for Identity captures directory service replication activities, including the DirectoryReplication request action. Querying this table for the domain controller allows you to confirm if unauthorized replication requests were made, directly indicating a successful DCSync attack.

Answer

Use the Microsoft Sentinel workbook for MDI to visualize the attack timeline.

Answer

Use the Microsoft Defender XDR advanced hunting to query the IdentityLogonEvents table for the domain controller.

Answer

Use the Microsoft Defender for Cloud Apps activity log to review the domain controller's activities.

Question 5

During a threat hunt, you want to identify processes that have made network connections to known malicious IP addresses. Which data source in Microsoft Defender for Endpoint would provide the necessary information?

Accepted Answer

DeviceNetworkEvents. DeviceNetworkEvents logs network connections including destination IP addresses, which is needed for this threat hunt. Option A is wrong because DeviceFileEvents logs file operations, not network connections. Option C is wrong because DeviceProcessEvents logs process creation, not network connections. Option D is wrong because DeviceRegistryEvents logs registry changes, not network connections.

Answer

DeviceFileEvents

Answer

DeviceProcessEvents

Answer

DeviceRegistryEvents

Question 6

You are investigating an incident where a user reported receiving a suspicious email with a malicious attachment. Microsoft Defender for Office 365 did not block it. The email originated from a known malicious sender domain. What configuration should you check first?

Accepted Answer

Anti-phishing policy in Microsoft Defender for Office 365. The anti-phishing policy in Microsoft Defender for Office 365 is the primary configuration that evaluates sender reputation, impersonation attempts, and spoof intelligence. Since the email originated from a known malicious sender domain and was not blocked, the anti-phishing policy's spoof settings or impersonation protection may be misconfigured or not applied to the affected user. This policy directly controls how Defender handles emails from malicious domains, making it the first place to check.

Answer

User-reported message settings

Answer

SPF record for the sender domain

Answer

Safe Attachments policy

Question 7

During a threat hunt in Microsoft Sentinel, you find a series of suspicious sign-ins to Microsoft Entra ID from an IP address known to be associated with a threat actor. Which entity should you pivot on to investigate further?

Accepted Answer

IP address. The IP address is the key entity that links all suspicious sign-ins and is the initial pivot point for investigation. Option A is correct because the IP address is the common element across the sign-ins. Options B, C, and D are incorrect: the user account, application, and device may be related but are not the primary pivot from the IP address.

Answer

User account

Answer

Application

Answer

Device

Question 8

Your organization has a hybrid identity environment with Microsoft Entra ID and on-premises Active Directory. You suspect a compromised on-premises admin account that has been used to modify security groups. You want to quickly contain the threat. What should you do first?

Accepted Answer

Revoke the user's sessions in Microsoft Entra ID and reset the password in both on-premises AD and Entra ID.. When a hybrid identity admin account is compromised and has modified security groups, the fastest containment is to revoke the user's sessions in Microsoft Entra ID and reset the password in both on-premises AD and Entra ID. Revoking sessions invalidates refresh tokens and active sessions, while resetting in both directories ensures the attacker cannot re-authenticate via either identity plane. This addresses both cloud and on-premises access paths.

Answer

Move the user account to an Organizational Unit (OU) with blocked logon hours.

Answer

Reset the user's password in on-premises Active Directory.

Answer

Disable the user account in Microsoft Entra ID.

Question 9

A security analyst in Microsoft Defender for Cloud receives an alert that an Azure VM has a vulnerability with a high severity. The analyst wants to see the detailed finding, including the steps to remediate. Which blade or page should the analyst open?

Accepted Answer

Vulnerability Assessment findings. The Vulnerability Assessment findings blade in Microsoft Defender for Cloud displays detailed results from integrated vulnerability scanners (such as Qualys or Microsoft Defender Vulnerability Management), including the specific vulnerability ID, severity, description, and remediation steps. This is the correct location to view the detailed finding and remediation guidance for a high-severity vulnerability on an Azure VM.

Answer

Secure Score

Answer

Regulatory Compliance

Answer

Workload protections alerts

Question 10

As a threat hunter at Contoso, you are investigating a potential advanced persistent threat (APT) that may have compromised multiple Azure subscriptions. You have Microsoft Defender for Cloud enabled and Microsoft Sentinel collecting data from all subscriptions. You suspect the attacker is using Azure Resource Manager operations to create malicious resources. You need to create a hunting query that identifies anomalous Azure management operations, specifically focusing on operations that create new resources (e.g., virtual machines, storage accounts) from unusual IP addresses or at unusual times. Which approach should you take?

Accepted Answer

Use the AzureActivity table to filter for operations where HttpMethod == 'PUT' (create/update), then summarize by CallerIpAddress and bin(TimeGenerated, 1h) to find spikes or unusual caller IPs.. Azure Resource Manager write operations are logged in the AzureActivity table, and create/update operations use HTTP PUT (or sometimes PATCH). Filtering for HttpMethod == 'PUT' isolates resource-creation activity, and summarizing by CallerIpAddress with a time bin (e.g., 1h) surfaces spikes or unusual source IPs that indicate anomalous management-plane activity. This directly targets the APT's resource-creation behavior from unusual IPs or times.

Answer

Use the CommonSecurityLog table to analyze network traffic from management tools.

Answer

Use the AzureActivity table in Microsoft Sentinel to query for any operation where the OperationNameValue contains 'write' and then manually review each result.

Answer

Query the SigninLogs table in Microsoft Sentinel for all interactive sign-ins to the Azure portal, then cross-reference with Azure Activity logs.