SC-200 Practice Test 20 — 15 Questions

Question 1

A security analyst is creating a custom detection rule in Microsoft 365 Defender using Advanced Hunting. The rule should alert when a user signs in from an IP address that is not in the company's approved IP range (192.168.0.0/16). Which KQL function should be used to compare the sign-in IP against the approved range?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

ipv4_is_in_range(SigninIP, '192.168.0.0/16'). The correct KQL function is `ipv4_is_in_range()` because it is specifically designed to check whether an IPv4 address falls within a given CIDR range. In this scenario, the function compares the `SigninIP` field against the company's approved range `192.168.0.0/16` and returns `true` if the IP is within that range, enabling the rule to alert on out-of-range sign-ins. This function handles subnet mask calculations natively, ensuring accurate and efficient IP range matching without manual parsing.

Answer

has_any(SigninIP, dynamic(['192.168.0.0/16']))

Answer

ipv4_is_private(SigninIP)

Answer

SigninIP startswith '192.168.'

Question 2

You are investigating repeated SQL injection alerts. The KQL query returns IP addresses with more than 5 alerts in the last 7 days. What is the purpose of the `summarize` and `where AlertCount > 5` lines?

Accepted Answer

To identify IPs with a high number of alerts, indicating a possible attack.. The `summarize` operator in KQL aggregates data by grouping on the IP address field and counting the number of alerts per IP. The `where AlertCount > 5` filter then retains only those IP addresses whose aggregated count exceeds 5. This combination directly serves to identify IPs that have triggered a high volume of SQL injection alerts within the 7-day window, which is a strong indicator of a sustained or automated attack attempt.

Answer

To correlate alerts with other data sources.

Answer

To remove duplicate alerts from the same IP.

Answer

To count the number of distinct IP addresses.

Question 3

An organization uses Microsoft 365 Defender. A security analyst is reviewing an incident that involves a user who clicked a phishing link in an email. The analyst wants to see the email's full timeline, including delivery, click, and any follow-up actions. Which section of the email entity page provides this information?

Accepted Answer

Email timeline. The Email timeline section on the email entity page in Microsoft 365 Defender provides a chronological view of the email's lifecycle, including delivery, user clicks on the phishing link, and subsequent remediation actions such as soft delete or quarantine. This directly meets the analyst's need to see the full sequence of events for the incident.

Answer

Detection details

Answer

Threat types

Answer

Investigation graph

Question 4

An analyst writes an advanced hunting query to investigate a suspicious executable that initiated outbound connections. Which two Microsoft 365 Defender tables are most relevant? (Choose 2.)

Accepted Answer

DeviceProcessEvents.. DeviceProcessEvents is correct because it records process creation events, including the executable that initiated the outbound connection. By querying this table, you can identify the suspicious executable's name, command line, and parent process, which is essential for tracing the origin of the malicious activity.

Answer

EmailAttachmentInfo.

Answer

IdentityInfo.

Question 5

Your organization uses Microsoft Defender XDR. You need to ensure that when a user reports a phishing email in Outlook, it automatically triggers an investigation in Microsoft Defender XDR. What should you configure?

Accepted Answer

Enable user-reported message settings in Microsoft Defender for Office 365 and configure automated investigation.. Enabling user-reported message settings in Microsoft Defender for Office 365 allows users to report phishing emails directly from Outlook. When combined with automated investigation and response (AIR) policies, this triggers an automatic investigation in Microsoft Defender XDR, leveraging the unified incident and alerting pipeline to analyze the reported message and associated threats.

Answer

Create a playbook in Microsoft Sentinel triggered by a custom connector.

Answer

Configure a data loss prevention policy in Microsoft Purview.

Answer

Set up a session policy in Microsoft Defender for Cloud Apps.

Question 6

A security analyst in Microsoft 365 Defender needs to review all actions that were automatically taken by an investigation (e.g., isolating a device, deleting a file) that occurred during an incident. Where should the analyst find this list of executed actions?

Accepted Answer

Action center. The Action center in Microsoft 365 Defender is the centralized location that records all manual and automated response actions taken during investigations, such as device isolation, file deletion, or process termination. This includes actions automatically executed by automated investigation and response (AIR) playbooks during an incident. The analyst can filter the Action center by 'Automated' to see only those actions taken without manual intervention.

Answer

Hunting queries

Answer

Incidents page

Answer

Alerts page

Question 7

Which THREE of the following are valid incident management capabilities in Microsoft Sentinel? (Choose three.)

Accepted Answer

Assign incidents to analysts or teams. A is correct because Microsoft Sentinel allows incident owners to be assigned directly to an analyst or a team via the 'Owner' field in the incident details pane. This assignment is used for tracking responsibility, SLA enforcement, and escalation workflows within the Security Operations (SecOps) lifecycle.

Answer

Create playbooks to automate incident response

Answer

Create workbooks to visualize incident trends

Question 8

Which TWO actions should a security analyst take when responding to a confirmed malware outbreak in Microsoft Defender for Endpoint?

Accepted Answer

Isolate the affected device. Options A and B are correct. Option A: Isolating the affected device immediately contains the outbreak and prevents lateral movement to other endpoints. Option B: Running a full scan ensures all malware components and artifacts are identified and removed. Option C is wrong because creating a custom detection rule is a proactive measure for future detections, not an immediate response to a confirmed outbreak. Option D is wrong because deleting the user account is extreme and does not address the malware on the device. Option E is wrong because resetting the user's password helps with credential compromise but does not stop active malware.

Answer

Create a custom detection rule for the malware

Answer

Delete the user account

Answer

Reset the user's password

Question 9

You are configuring Microsoft Sentinel to send email notifications to the security team when high-severity incidents are created. Which feature should you use?

Accepted Answer

Automation rule. Automation rules in Microsoft Sentinel allow you to define automated responses to incidents, including sending email notifications to specified recipients when incidents meet certain criteria, such as high severity. This feature directly supports the requirement to notify the security team when high-severity incidents are created, without requiring additional logic or manual steps.

Answer

Watchlist

Answer

Analytics rule

Answer

Workbook

Question 10

You are a Microsoft Security Operations Analyst. Your organization recently deployed Microsoft Defender for Cloud Apps. You need to ensure that alerts generated by Defender for Cloud Apps are automatically forwarded to Microsoft Sentinel. What should you configure?

Accepted Answer

In Microsoft Sentinel, add the Microsoft Defender for Cloud Apps data connector.. The Microsoft Defender for Cloud Apps data connector in Microsoft Sentinel is the native integration that automatically forwards alerts and cloud discovery logs from Defender for Cloud Apps into Sentinel. This connector uses the Microsoft Graph Security API to ingest alerts without requiring additional configuration in Defender for Cloud Apps, enabling seamless correlation and investigation within Sentinel.

Answer

In Microsoft Sentinel, create an analytics rule with a query that pulls data from Defender for Cloud Apps API.

Answer

In Microsoft Defender for Cloud Apps, configure SIEM integration.

Answer

In Microsoft Sentinel, configure a playbook to retrieve alerts from Defender for Cloud Apps.

Question 11

A security analyst is using Microsoft 365 Defender advanced hunting to investigate a ransomware incident. The analyst wants to find all processes that were created with a specific parent process ID. Which column in the DeviceProcessEvents table should the analyst use to filter the parent process?

Accepted Answer

ParentProcessId. The ParentProcessId column in the DeviceProcessEvents table stores the process ID (PID) of the parent process that created a given process. By filtering on this column, the analyst can identify all child processes spawned by a specific parent, which is critical for tracing ransomware execution chains in advanced hunting queries.

Answer

ProcessId

Answer

InitiatingProcessId

Answer

LogonId

Question 12

Which THREE are valid incident management features in Microsoft Sentinel?

Accepted Answer

Incident creation from analytics rules. Incident creation from analytics rules is a core feature in Microsoft Sentinel. When an analytics rule detects a threat or suspicious activity, it automatically generates an incident, which serves as the primary object for investigation and response. This automation is fundamental to Sentinel's security orchestration, automation, and response (SOAR) capabilities.

Answer

Incident merging

Answer

Incident templates

Question 13

A security analyst is investigating a user who may have been compromised. The analyst sees a sign-in from an unusual location and then a series of suspicious actions performed by that user, including deleting files and sending emails. The analyst wants to find all emails sent by the user after the anomalous sign-in. Which advanced hunting tables should be used?

Accepted Answer

EmailEvents and IdentityLogonEvents. The investigation requires correlating a specific sign-in event (from IdentityLogonEvents) with subsequent email activity (from EmailEvents). IdentityLogonEvents captures authentication details including location, while EmailEvents records email send/receive metadata. Joining these tables on the user principal name (UPN) and timestamp allows the analyst to filter all emails sent after the anomalous sign-in.

Answer

EmailEvents and DeviceFileEvents

Answer

IdentityLogonEvents and DeviceEvents

Answer

EmailAttachmentInfo and EmailUrlInfo alone

Question 14

Your Microsoft Sentinel environment uses multiple workspaces. You need to centrally manage incidents from all workspaces in a single interface. What should you use?

Accepted Answer

Use cross-workspace queries in Sentinel incidents.. Cross-workspace queries in Microsoft Sentinel allow you to include multiple workspaces in a single query by using the `workspace()` expression. When you create an incident rule that uses such a query, Sentinel can centrally manage incidents generated from data across all specified workspaces, providing a unified incident queue in the Sentinel interface.

Answer

Create an Azure Monitor workbook.

Answer

Use the Microsoft 365 Defender portal.

Answer

Use Azure Logic Apps to aggregate incidents.

Question 15

You are reviewing a scheduled analytics rule in Microsoft Sentinel. What does the suppressionDuration setting affect?

Accepted Answer

It stops the rule from creating new alerts for that duration after an alert is generated.. The suppressionDuration setting in a Microsoft Sentinel scheduled analytics rule stops the rule from creating new alerts for a specified period after an alert is generated. This prevents alert fatigue by suppressing duplicate alerts from the same rule when the same conditions persist, allowing analysts to focus on unique incidents.

Answer

It groups alerts into a single incident within that time window.

Answer

It delays the execution of the query by that amount of time.

Answer

It determines how often the query runs.