SC-200 Practice Exam 3 — 20 Questions

Question 1

As a SOC analyst, you need to quickly identify if a specific user account has been involved in any incidents in the past week. Which feature in Microsoft Sentinel allows you to search for user-related incidents?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Entity behavior blade. The Entity behavior blade in Microsoft Sentinel provides a user-centric view that aggregates all incidents, alerts, and activities associated with a specific user account. By selecting a user entity and navigating to the 'Incidents' tab within the blade, you can quickly filter incidents involving that user over a defined time range, such as the past week. This feature is designed specifically for investigating user-related security events without needing to write custom queries.

Answer

Incidents blade with time range filter

Answer

Hunting blade with user query

Answer

Workbooks with KQL query

Question 2

Match each Microsoft Defender for Cloud feature on the left with its primary purpose on the right.

Accepted Answer

Just-In-Time VM Access → Provides time-limited access to management ports via NSG rules; Adaptive Application Controls → Allowlists known safe applications to run on VMs; File Integrity Monitoring → Detects changes to sensitive registry keys and files; Regulatory Compliance Dashboard → Assesses Azure resources against industry standards. It accurately matches each Microsoft Defender for Cloud feature to its primary purpose. Just-In-Time (JIT) VM Access reduces the attack surface by locking down management ports (e.g., RDP 3389, SSH 22) and granting time-limited access via NSG rules only when requested. Adaptive Application Controls uses machine learning to create an allowlist of known safe applications, blocking unknown executables on VMs. File Integrity Monitoring (FIM) tracks changes to sensitive registry keys, files, and certificates, alerting on unauthorized modifications. The Regulatory Compliance Dashboard continuously assesses Azure resources against built-in standards like CIS, NIST, and Azure Security Benchmark, providing a compliance score and recommendations.

Answer

The first and second mappings are reversed; the remaining mappings are unchanged.

Answer

All features map to the same monitoring purpose.

Answer

The compliance and access-control mappings are swapped.

Question 3

During a security incident, a Microsoft Sentinel analytics rule generated an alert for a suspicious sign-in from an unusual location. The incident involves a user whose account has been compromised. The security team needs to take immediate actions to remediate and prevent further damage. Which THREE actions should the security team prioritize?

Accepted Answer

Reset the user's password. Resetting the user's password (A) is a critical immediate step because it invalidates the current compromised credentials, preventing the attacker from using the known password to authenticate again. In Microsoft Entra ID, a password reset forces the user to create a new credential, which the attacker does not possess, effectively cutting off one of the most common attack vectors.

Answer

Review audit logs for all users

Answer

Raise the user's risk level in Identity Protection

Question 4

Which THREE capabilities are provided by Microsoft Sentinel's UEBA (User and Entity Behavior Analytics)? (Select THREE.)

Accepted Answer

Identify users whose behavior deviates from their peers. Microsoft Sentinel's UEBA uses machine learning models to establish a baseline of normal behavior for each user and then compares individual user activity against peer group behavior. When a user's actions deviate significantly from their peers, such as accessing unusual resources or performing atypical data transfers, an anomaly is generated, enabling security analysts to investigate potential insider threats or compromised accounts.

Answer

Automatically run playbooks when anomalies are detected

Answer

Create watchlists for high-value users

Question 5

Which TWO of the following are valid actions that can be performed by an automation rule in Microsoft Sentinel? (Select two.)

Accepted Answer

Assign incident to an analyst. Automation rules in Microsoft Sentinel can assign incidents to specific analysts or groups as part of incident response workflows. This action helps ensure accountability and proper triage by routing incidents to the appropriate personnel based on criteria like severity or type.

Answer

Delete a watchlist

Answer

Create a task

Answer

Modify an analytics rule

Question 6

Your company has a hybrid identity environment with Microsoft Entra ID and on-premises Active Directory. You recently deployed Microsoft Defender for Identity (MDI) to monitor on-premises domain controllers. The SOC team needs to receive alerts from MDI in Microsoft Sentinel. You have already installed the MDI sensor on all domain controllers and confirmed that the MDI portal shows alerts. However, no MDI alerts appear in Sentinel. The Microsoft Defender for Identity data connector in Sentinel shows 'Connected'. What should you do next?

Accepted Answer

Enable the Microsoft 365 Defender connector in Sentinel, as MDI alerts are ingested through that connector.. MDI alerts are ingested into Sentinel via the Microsoft 365 Defender connector, not the MDI connector directly. The MDI connector is for other data. Option A is not needed; Option C is for health; Option D is incorrect because the connector is already connected.

Answer

Update the MDI sensor to the latest version.

Answer

Reconfigure the MDI data connector to select all alert severities.

Answer

Check the MDI sensor health status on each domain controller.

Question 7

You are a security analyst at a company that uses Microsoft Sentinel. You need to create a custom analytics rule that detects failed logon attempts from multiple IP addresses within 5 minutes. Which two KQL operators should you use?

Accepted Answer

bin. The `bin` operator is correct because it groups timestamps into fixed-size time buckets (e.g., 5-minute intervals), which is essential for detecting patterns like failed logon attempts from multiple IPs within a specific time window. The `summarize` operator is correct because it aggregates data (e.g., counting distinct IP addresses) per each time bucket, enabling the rule to identify when the count exceeds a threshold.

Answer

where

Answer

project

Answer

join

Question 8

Your organization uses Microsoft Sentinel. You need to design a solution to automatically respond to a specific type of incident by sending an email to the SOC manager and creating a ticket in ServiceNow. What should you use?

Accepted Answer

Create a playbook in Microsoft Sentinel and trigger it with an automation rule.. Microsoft Sentinel uses Azure Logic Apps-based playbooks to execute complex, multi-step automated responses, such as sending an email and creating a ServiceNow ticket. An automation rule is required to trigger the playbook when an incident meets specific criteria, as analytics rules alone cannot directly invoke external systems like ServiceNow.

Answer

Create an analytics rule that directly sends an email.

Answer

Create a workbook that triggers a webhook.

Answer

Create an automation rule that sends an email and creates a ticket.

Question 9

Which TWO actions should you take when handling a confirmed ransomware incident in an environment protected by Microsoft Defender for Endpoint?

Accepted Answer

Block the ransomware file hash using threat intelligence indicators in Microsoft Defender.. Blocking the ransomware file hash via threat intelligence indicators in Microsoft Defender for Endpoint (MDE) immediately prevents further execution of that known malicious file across all endpoints in the environment, leveraging the built-in TI indicator feature. Option B is correct because initiating device isolation from the MDE console disconnects the affected device from the network while maintaining connectivity to the MDE service, containing the spread of ransomware without losing visibility or control.

Answer

Disable Windows Defender real-time protection.

Answer

Submit the ransomware sample to Microsoft for analysis.

Answer

Reimage all affected servers immediately.

Question 10

Which TWO data connectors can be used to ingest Microsoft 365 audit logs into Microsoft Sentinel? (Choose two.)

Accepted Answer

Microsoft 365 Defender connector.. The Microsoft 365 Defender connector (Option B) ingests unified audit logs from Microsoft 365 Defender, which includes security-related events from Microsoft 365 services. The Office 365 connector (Option C) directly ingests audit logs from Exchange Online, SharePoint Online, and Microsoft Teams, which are part of the Microsoft 365 audit log. Both connectors are designed to bring Microsoft 365 audit log data into Microsoft Sentinel.

Answer

Microsoft Defender for Cloud Apps connector.

Answer

Azure Activity connector.

Answer

Azure AD connector (sign-in logs).

Question 11

Your organization uses Microsoft Defender XDR. The incident queue shows multiple alerts related to a single endpoint: malware detected, suspicious PowerShell execution, and data exfiltration attempts. The analyst needs to investigate the incident. Which tool should the analyst use to correlate these events?

Accepted Answer

Advanced hunting in Microsoft Defender XDR.. Advanced hunting in Microsoft Defender XDR allows the analyst to query across multiple data sources—including endpoint detection and response (EDR), identity, email, and cloud app data—using Kusto Query Language (KQL). This enables correlation of the malware detection, suspicious PowerShell execution, and data exfiltration alerts on the same device by joining tables such as DeviceEvents, DeviceProcessEvents, and DeviceNetworkEvents, providing a unified timeline of the attack chain.

Answer

Microsoft Defender for Office 365 Explorer.

Answer

Microsoft Defender for Cloud Apps activity log.

Answer

Microsoft Sentinel incident workspace.

Question 12

Match each Microsoft 365 Defender workload to its description.

Accepted Answer

Microsoft Defender for Endpoint: Provides enterprise-grade endpoint security, including antivirus, anti-malware, and advanced threat protection for devices.. Microsoft 365 Defender includes four main workloads: Defender for Endpoint (endpoint security), Defender for Office 365 (email & collaboration), Defender for Identity (on-premises AD security), and Defender for Cloud Apps (cloud app security). Common confusions involve mixing up definitions between these workloads.

Answer

Microsoft Defender for Endpoint: Safeguards email and collaboration tools (Exchange, SharePoint, Teams) against phishing, spam, malware, and other threats.

Answer

Microsoft Defender for Office 365: Uses on-premises Active Directory signals to identify, detect, and investigate advanced threats and identity compromises.

Question 13

Which THREE of the following are valid ways to ingest logs into Microsoft Sentinel?

Accepted Answer

Syslog. Syslog is a valid data connector in Microsoft Sentinel that ingests logs from Linux-based and network devices using the standard syslog protocol (RFC 5424 or RFC 3164). Sentinel collects these logs via the Log Analytics agent (or Azure Monitor Agent) listening on UDP port 514 or TCP port 6514, and parses them into the Syslog table for analysis. This makes option A correct because it is a native, supported ingestion method.

Answer

Windows Event Logs

Answer

Custom logs via direct API

Question 14

A security operations center (SOC) uses Microsoft Sentinel. The team wants to automatically assign incidents to the appropriate analyst based on the severity level of the alert. Which feature should be configured to achieve this automation?

Accepted Answer

Automation rules. Automation rules in Microsoft Sentinel allow you to define conditions (such as alert severity) and corresponding actions (like assigning an incident to a specific analyst or group) without requiring custom code. This directly meets the SOC's requirement to automatically route incidents based on severity levels, as automation rules can trigger on incident creation or update and perform assignment actions.

Answer

Playbooks

Answer

Analytics rules

Answer

Watchlists

Question 15

Which TWO data sources can you connect to Microsoft Sentinel to ingest security logs? (Select TWO.)

Accepted Answer

Azure Active Directory (Microsoft Entra ID) audit logs. Azure Active Directory (Microsoft Entra ID) audit logs are a native data source for Microsoft Sentinel. They can be connected directly via the Azure AD connector, which ingests sign-in logs, audit logs, and provisioning logs into the Log Analytics workspace. This integration is essential for monitoring identity-related security events and is a standard requirement for SC-200 scenarios.

Answer

Google Cloud Platform audit logs

Answer

Trello activity logs

Answer

GitHub Actions logs

Question 16

You are a security operations analyst at a company that uses Microsoft Sentinel. You need to ensure that all incidents generated from Microsoft Defender for Cloud Apps are automatically assigned to the same SOC team. The team uses Microsoft Teams to collaborate. Which configuration should you implement?

Accepted Answer

Create an automation rule that sets the owner to the team entity.. Automation rules in Microsoft Sentinel can directly set the incident owner to a specific user or group (such as a SOC team) without requiring a playbook. This ensures all incidents from Microsoft Defender for Cloud Apps are automatically assigned to the designated team, streamlining ownership and collaboration via Microsoft Teams.

Answer

Create a playbook that assigns the incident to the team and configure an automation rule to run it.

Answer

Configure the Microsoft Defender for Cloud Apps connector to assign incidents to the team.

Answer

Use a logic app to automatically post incidents to a Teams channel and have the team claim them.

Question 17

Your company uses Microsoft Sentinel to monitor security events. You have configured a daily email report that summarizes the top 10 incidents from the past 24 hours. The report is sent using a Logic App playbook triggered by a scheduled query. Recently, the report has stopped being delivered. You check the Logic App run history and see that the last run failed with an HTTP 403 error when connecting to the Microsoft Sentinel API. The Logic App uses a managed identity for authentication. What is the most likely cause of the failure?

Accepted Answer

The managed identity does not have the required permissions on the Sentinel workspace.. The HTTP 403 error indicates a permissions failure when the Logic App attempted to call the Microsoft Sentinel API. Since the Logic App uses a managed identity for authentication, the most likely cause is that the managed identity lacks the necessary role assignments on the Sentinel workspace, such as 'Microsoft Sentinel Contributor' or 'Microsoft Sentinel Reader', which are required to query incidents via the API.

Answer

The managed identity's client ID has changed.

Answer

The Logic App is not connected to Microsoft Entra ID.

Answer

The scheduled query is no longer running.

Question 18

Your SOC uses Microsoft Sentinel and Microsoft Defender XDR. An incident is created from a Defender for Endpoint alert about a malware detection on a device. The incident has low priority, but you want to automatically isolate the device from the network if the alert is confirmed as a true positive by the SOC. What is the recommended approach?

Accepted Answer

Create an automation rule in Microsoft Sentinel that triggers a playbook with an approval step before executing device isolation.. It aligns with the recommended SOC workflow: an automation rule in Microsoft Sentinel triggers a playbook that includes an approval step, ensuring that device isolation only occurs after the SOC confirms the alert as a true positive. This approach maintains human oversight for low-priority incidents while leveraging automation for the response action.

Answer

Create a separate analytics rule that triggers on the same alert and uses a playbook to isolate the device.

Answer

Use automatic attack disruption in Microsoft Defender XDR to isolate the device automatically.

Answer

Configure an automated response in Defender for Endpoint to isolate the device immediately when an alert is generated.

Question 19

You are reviewing an analytics rule configuration in Microsoft Sentinel using ARM template JSON. The rule is enabled and incident creation is set to true. However, when alerts are generated, they are not being grouped into a single incident. What is the most likely reason?

Accepted Answer

The groupingConfiguration is disabled.. The groupingConfiguration in Microsoft Sentinel analytics rules controls whether alerts are grouped into a single incident. When this configuration is disabled, each alert generates its own separate incident, even if the rule is enabled and incident creation is set to true. Therefore, the most likely reason alerts are not being grouped is that the groupingConfiguration is disabled.

Answer

The lookbackDuration is set to 5 hours which is too short.

Answer

The matchingMethod is set to 'AllEntities' which is not supported.

Answer

The rule is not enabled properly.

Question 20

Which TWO actions are valid for automation rules in Microsoft Sentinel? (Choose two.)

Accepted Answer

Change the severity of an incident.. Automation rules in Microsoft Sentinel allow you to automate incident management tasks without requiring a playbook. Changing the severity of an incident is a supported action, enabling you to adjust the priority based on custom criteria such as incident properties or enrichment data.

Answer

Delete an incident.

Answer

Add tags to an incident.

Answer

Modify an existing analytics rule.