SC-200 Practice Exam 2 — 20 Questions

Question 1

Refer to the exhibit. You run this KQL query in Microsoft Sentinel. What does it return?

Accepted Answer

Top 5 incident owners by number of high-severity incidents in the last 7 days.. The KQL query uses `summarize` with `count()` by `Owner`, then `top 5 by count_`, and filters with `where Severity == 'High'` and `TimeGenerated > ago(7d)`. This returns the top 5 incident owners ranked by the number of high-severity incidents they own in the last 7 days, making option C correct.

Answer

Number of high-severity incidents per status.

Answer

Total count of high-severity incidents in the last 7 days.

Answer

Top 5 users assigned to high-severity incidents.

Question 2

Your organization uses Microsoft Sentinel with a workspace in the East US region. You have a playbook that escalates incidents to ServiceNow. Due to compliance requirements, all data must remain in the West Europe region. You need to ensure that the playbook execution and any data it processes stays within West Europe. What should you do?

Accepted Answer

Create the playbook as a Logic App in the West Europe region and ensure it uses a managed identity for authentication.. Playbooks run in the same region as the Logic Apps resource, which can be created in West Europe. By creating the playbook in West Europe, it will process data there. Option D is correct. Option A is wrong because moving the Sentinel workspace is not possible without redeployment. Option B is wrong because the API connector does not control data location. Option C is wrong because using a different workspace would require changing all data collection.

Answer

Use a different Sentinel workspace in West Europe for the incidents.

Answer

Move the Sentinel workspace to West Europe.

Answer

Configure the ServiceNow connector to use a West Europe endpoint.

Question 3

You are a security operations analyst for a company that uses Microsoft Sentinel. You need to create a custom analytics rule that detects when a user account is created and then deleted within 24 hours, which could indicate a test account used for malicious purposes. The rule should only run on the SecurityEvent table. You have written the KQL query and now need to configure the rule settings. Which alert scheduling configuration should you set to minimize latency while ensuring that the rule catches the pattern?

Accepted Answer

Run query every 1 hour with a 1-hour lookback.. Running the query every 1 hour with a 1-hour lookback ensures that any account creation and deletion occurring within a 24-hour window is captured with minimal latency. The 1-hour lookback allows the rule to detect events that span across the current and previous execution windows, which is essential for catching the creation and deletion pattern without missing events due to scheduling gaps.

Answer

Run query every 24 hours with a 24-hour lookback.

Answer

Run query every 1 hour with no lookback.

Answer

Run query every 5 minutes with a 5-minute lookback.

Question 4

Refer to the exhibit. An analyst runs the query to identify the top 10 entities with the most malware alerts. However, the query returns no results. What is the most likely reason?

Accepted Answer

The AlertName field does not contain the substring 'Malware' (case-sensitive issue).. The query uses 'has' which is case-insensitive, but 'Malware' may not be the exact substring in the AlertName field. Option A is wrong because the query uses SecurityAlert table, which is correct. Option C is wrong because 'has' works on strings, not just exact matches. Option D is wrong because 'take 10' limits results, but would not cause zero results.

Answer

The SecurityAlert table does not contain the AlertName field.

Answer

The 'has' operator requires an exact match.

Answer

The 'take 10' operator returns no results because there are fewer than 10 alerts.

Question 5

A company uses Microsoft Defender for Cloud. They need to continuously assess the compliance of their Azure resources against the CIS benchmark. Which feature should they enable?

Accepted Answer

Regulatory compliance dashboard. The Regulatory Compliance dashboard in Defender for Cloud provides built-in compliance standards such as CIS, SOC 2, and Azure CIS. By assigning the appropriate initiative, the dashboard continuously scans resources and reports compliance status. Secure Score is an aggregated risk score, not a compliance standard. Azure Policy is the underlying service used to enforce policies, but the feature that presents compliance is the dashboard. Just-in-Time VM access is a security control, not a compliance assessment tool.

Answer

Secure Score

Answer

Azure Policy

Answer

Just-In-Time VM access

Question 6

A SOC analyst is responding to a ransomware incident. The analyst identifies that the ransomware encrypted files on a file share and left a ransom note. The analyst needs to prevent the ransomware from spreading to other shares. Which action should the analyst take first?

Accepted Answer

Isolate the server from the network using Microsoft Defender for Endpoint's device isolation.. The immediate priority in a ransomware incident is containment to prevent lateral movement and further encryption. Microsoft Defender for Endpoint's device isolation feature disconnects the compromised server from the network while allowing communication with the Defender for Cloud backend, stopping the ransomware from spreading to other shares. This aligns with the NIST incident response framework's containment phase, which must occur before eradication or recovery actions.

Answer

Revoke the user's access to the file share.

Answer

Run a full antivirus scan on the server.

Answer

Restore the encrypted files from backup.

Question 7

Which THREE actions are appropriate when investigating a potential data exfiltration incident in Microsoft Defender for Cloud Apps?

Accepted Answer

Use the app dashboard to view unusual behavior alerts. Options B, D, and E are correct. Option B: Using the app dashboard to view unusual behavior alerts provides context about potential exfiltration. Option D: Checking file policy matches helps identify which files were flagged as suspicious. Option E: Reviewing the user's activity log in Defender for Cloud Apps helps determine the scope of the exfiltration. Option A is incorrect because checking device inventory is not a cloud app investigation action—it applies to endpoint devices. Option C is incorrect because suspending the user's account is a containment action, not an investigative step.

Answer

Check the device inventory for suspicious applications

Answer

Suspend the user's account immediately

Question 8

You receive an incident in Microsoft Sentinel that is a low-confidence alert from Microsoft Defender for Identity. What should be your first step?

Accepted Answer

Investigate the alert by reviewing related entities and logs.. A low-confidence alert from Microsoft Defender for Identity indicates a potential but uncertain threat. The first step should always be to investigate the alert by reviewing related entities and logs to gather context and determine if the alert is a true positive or false positive. Prematurely closing, escalating, or isolating without investigation risks missing a real threat or causing unnecessary disruption.

Answer

Close the incident as a false positive.

Answer

Escalate to senior management.

Answer

Isolate the affected account immediately.

Question 9

A security analyst in Microsoft Defender for Cloud receives an alert that an Azure VM has a vulnerability with a high severity. The analyst wants to see the detailed finding, including the steps to remediate. Which blade or page should the analyst open?

Accepted Answer

Vulnerability Assessment findings. The Vulnerability Assessment findings blade in Microsoft Defender for Cloud displays detailed results from integrated vulnerability scanners (such as Qualys or Microsoft Defender Vulnerability Management), including the specific vulnerability ID, severity, description, and remediation steps. This is the correct location to view the detailed finding and remediation guidance for a high-severity vulnerability on an Azure VM.

Answer

Secure Score

Answer

Regulatory Compliance

Answer

Workload protections alerts

Question 10

Your organization uses Microsoft Sentinel. You have a requirement to automatically add a tag to incidents that involve a specific user. The tag should be added when the incident is created. What should you configure?

Accepted Answer

Create an automation rule that triggers on incident creation and runs a playbook with the 'Add tag' action.. Automation rules in Microsoft Sentinel can be configured to trigger when an incident is created, and they can run a playbook that includes the 'Add tag' action. This allows you to automatically tag incidents involving a specific user by incorporating logic within the playbook to check for that user's presence in the incident entities.

Answer

Add the user to a watchlist and create a fusion rule.

Answer

Modify the analytics rule to include a tag in the incident configuration.

Answer

Enable entity behavior analytics to automatically tag incidents.

Question 11

Your organization uses Microsoft Sentinel with UEBA (User and Entity Behavior Analytics). An alert indicates a user's sign-in from an unusual location, followed by a mass download of sensitive files from SharePoint. The user is a low-privilege employee. What is the most likely conclusion?

Accepted Answer

The user's account is compromised. The combination of unusual location and mass download of sensitive files by a low-privilege user suggests account compromise. It is not necessarily ransomware or a false positive, and insider threat is less likely without evidence of intent.

Answer

The alert is a false positive due to user travel

Answer

The user is an insider threat

Answer

The user is conducting a ransomware attack

Question 12

Which TWO conditions must be met to enable Microsoft Sentinel UEBA? (Choose two.)

Accepted Answer

Microsoft Entra ID P2 licenses must be assigned to users.. Microsoft Sentinel UEBA requires the SecurityInsights solution to be installed in the Log Analytics workspace, as this solution provides the UEBA data connectors and analytics rules. Additionally, Microsoft Entra ID P2 licenses are required because UEBA relies on the identity protection and risk detection capabilities that are only available with P2 licensing, enabling the enrichment of entity behavior profiles with risk data.

Answer

KQL queries must be created for entity behavior.

Answer

Microsoft Defender XDR must be onboarded.

Answer

Azure SQL Database must be deployed.

Question 13

Your organization uses Microsoft Sentinel and wants to ensure that all incident-related data is retained for at least 90 days for compliance purposes. Which configuration should you check?

Accepted Answer

Log Analytics workspace retention settings. Log Analytics workspace retention settings directly control how long raw data ingested into Microsoft Sentinel is stored. For compliance requiring 90-day retention of incident-related data, you must configure the workspace retention period to at least 90 days (or use archive policies for longer retention). Incident data in Sentinel is derived from this underlying workspace data, so retention settings at the workspace level ensure the data persists for the required duration.

Answer

Watchlist settings

Answer

Analytics rule settings

Answer

Incident settings in Sentinel

Question 14

You are reviewing a hunting query. What is the primary purpose of this query?

Accepted Answer

Find users with medium-risk sign-ins that share IP addresses with service principal sign-ins, indicating possible token theft or lateral movement. The query filters for users with medium risk sign-ins and joins with service principal sign-ins on IP address, then counts occurrences per user exceeding 5, indicating potential compromise involving both user and service principal activity from the same IP. Option A is wrong because it does not focus on service principal compromise alone. Option B is wrong because it does not look for admin consent grants. Option D is wrong because it uses only medium risk, not high.

Answer

List all users with any risk level during sign-in in the last 7 days

Answer

Detect users who have granted admin consent to malicious OAuth apps

Answer

Identify service principals that have been compromised and are performing high-risk sign-ins

Question 15

As a SOC analyst, you need to quickly identify if a specific user account has been involved in any incidents in the past week. Which feature in Microsoft Sentinel allows you to search for user-related incidents?

Accepted Answer

Entity behavior blade. The Entity behavior blade in Microsoft Sentinel provides a user-centric view that aggregates all incidents, alerts, and activities associated with a specific user account. By selecting a user entity and navigating to the 'Incidents' tab within the blade, you can quickly filter incidents involving that user over a defined time range, such as the past week. This feature is designed specifically for investigating user-related security events without needing to write custom queries.

Answer

Incidents blade with time range filter

Answer

Hunting blade with user query

Answer

Workbooks with KQL query

Question 16

During a security incident, a Microsoft Sentinel analytics rule generated an alert for a suspicious sign-in from an unusual location. The incident involves a user whose account has been compromised. The security team needs to take immediate actions to remediate and prevent further damage. Which THREE actions should the security team prioritize?

Accepted Answer

Reset the user's password. Resetting the user's password (A) is a critical immediate step because it invalidates the current compromised credentials, preventing the attacker from using the known password to authenticate again. In Microsoft Entra ID, a password reset forces the user to create a new credential, which the attacker does not possess, effectively cutting off one of the most common attack vectors.

Answer

Review audit logs for all users

Answer

Raise the user's risk level in Identity Protection

Question 17

Which THREE capabilities are provided by Microsoft Sentinel's UEBA (User and Entity Behavior Analytics)? (Select THREE.)

Accepted Answer

Identify users whose behavior deviates from their peers. Microsoft Sentinel's UEBA uses machine learning models to establish a baseline of normal behavior for each user and then compares individual user activity against peer group behavior. When a user's actions deviate significantly from their peers, such as accessing unusual resources or performing atypical data transfers, an anomaly is generated, enabling security analysts to investigate potential insider threats or compromised accounts.

Answer

Automatically run playbooks when anomalies are detected

Answer

Create watchlists for high-value users

Question 18

Which TWO of the following are valid actions that can be performed by an automation rule in Microsoft Sentinel? (Select two.)

Accepted Answer

Assign incident to an analyst. Automation rules in Microsoft Sentinel can assign incidents to specific analysts or groups as part of incident response workflows. This action helps ensure accountability and proper triage by routing incidents to the appropriate personnel based on criteria like severity or type.

Answer

Delete a watchlist

Answer

Create a task

Answer

Modify an analytics rule

Question 19

Your company has a hybrid identity environment with Microsoft Entra ID and on-premises Active Directory. You recently deployed Microsoft Defender for Identity (MDI) to monitor on-premises domain controllers. The SOC team needs to receive alerts from MDI in Microsoft Sentinel. You have already installed the MDI sensor on all domain controllers and confirmed that the MDI portal shows alerts. However, no MDI alerts appear in Sentinel. The Microsoft Defender for Identity data connector in Sentinel shows 'Connected'. What should you do next?

Accepted Answer

Enable the Microsoft 365 Defender connector in Sentinel, as MDI alerts are ingested through that connector.. MDI alerts are ingested into Sentinel via the Microsoft 365 Defender connector, not the MDI connector directly. The MDI connector is for other data. Option A is not needed; Option C is for health; Option D is incorrect because the connector is already connected.

Answer

Update the MDI sensor to the latest version.

Answer

Reconfigure the MDI data connector to select all alert severities.

Answer

Check the MDI sensor health status on each domain controller.

Question 20

You are a security analyst at a company that uses Microsoft Sentinel. You need to create a custom analytics rule that detects failed logon attempts from multiple IP addresses within 5 minutes. Which two KQL operators should you use?

Accepted Answer

bin. The `bin` operator is correct because it groups timestamps into fixed-size time buckets (e.g., 5-minute intervals), which is essential for detecting patterns like failed logon attempts from multiple IPs within a specific time window. The `summarize` operator is correct because it aggregates data (e.g., counting distinct IP addresses) per each time bucket, enabling the rule to identify when the count exceeds a threshold.

Answer

where

Answer

project

Answer

join