SC-200 Practice Exam 3 — 20 Questions

Question 1

A SOC analyst in Microsoft Sentinel is creating a scheduled analytics rule to detect a possible password spray attack. The rule must trigger when a single source IP address has more than 10 failed logon attempts on different user accounts within a 30-minute window. The analyst writes a KQL query starting with 'SigninLogs | where ResultType == 50057' (failed logon). Which operator should the analyst use to group events by source IP and count distinct user accounts, then filter for counts above 10?

Accepted Answer

summarize. The `summarize` operator is required to group events by source IP address and count distinct user accounts using `dcount()` or `count()`. After summarizing, you apply a `where` clause to filter for counts above 10, which meets the rule's threshold. This is the standard pattern for aggregation in KQL.

Answer

where

Answer

extend

Answer

project

Question 2

An organization uses Microsoft Defender for Office 365. The security team wants to automatically remove from all user mailboxes any messages that were already delivered but are later identified as malicious. Which feature should they enable?

Accepted Answer

Zero-hour auto purge (ZAP). Zero-hour auto purge (ZAP) is the correct feature because it automatically detects and removes malicious messages that have already been delivered to user mailboxes, including messages retroactively identified as threats after delivery. ZAP acts on phishing, malware, and spam verdicts by querying the mailbox for the original message and moving it to the Junk Email folder or deleting it, based on the configured policy. This directly meets the requirement to remove already-delivered malicious messages without manual intervention.

Answer

Automated investigation and response (AIR)

Answer

Safe Attachments

Answer

Safe Links

Question 3

During an incident investigation, an analyst notices a compromised user account that was used to access sensitive data from SharePoint Online. Which Microsoft 365 Defender workload would provide the most relevant alerts for suspicious file access patterns?

Accepted Answer

Microsoft Defender for Cloud Apps. Microsoft Defender for Cloud Apps (Option C) is the correct workload because it provides visibility into cloud application usage, including SharePoint Online, and can generate alerts for suspicious file access patterns such as mass download, unusual file sharing, or access from anomalous locations. It uses behavioral analytics and anomaly detection to identify compromised accounts accessing sensitive data in SaaS applications like SharePoint.

Answer

Microsoft Defender for Endpoint

Answer

Microsoft Defender for Office 365

Answer

Microsoft Defender for Identity

Question 4

An organization has connected a Palo Alto Networks firewall to Microsoft Sentinel using the Common Event Format (CEF) connector via a Linux log forwarder. The analyst notices that some expected firewall logs are missing in Sentinel. Which troubleshooting step should be performed first to check if the logs are reaching the Sentinel workspace?

Accepted Answer

Run a KQL query in the Sentinel Logs workspace: CommonSecurityLog | where TimeGenerated > ago(1h) | take 10. Option A is correct because the first step in troubleshooting missing logs in Microsoft Sentinel is to verify whether the logs are actually reaching the workspace. Running a KQL query against the CommonSecurityLog table (which stores CEF data) with a recent time filter confirms if any CEF logs have been ingested. If the query returns results, the issue lies elsewhere (e.g., parsing or missing events); if it returns no results, the problem is upstream (connector, forwarder, or source). This step isolates the problem to the Sentinel ingestion pipeline before investigating network or configuration issues.

Answer

Check the firewall configuration to ensure syslog forwarding is enabled and pointing to the correct Linux forwarder

Answer

Verify network connectivity between the firewall and the Linux forwarder on port 514 (or the configured port)

Answer

Restart the Log Analytics agent on the Linux forwarder

Question 5

Match each Microsoft Sentinel data connector on the left with the table name it populates on the right.

Accepted Answer

Microsoft Entra ID → SigninLogs; Windows Security Events via AMA → SecurityEvent; Cisco ASA via Syslog → CommonSecurityLog; Azure Activity → AzureActivity. Option A is correct because it accurately maps each Microsoft Sentinel data connector to its corresponding log table. Microsoft Entra ID populates the SigninLogs table, Windows Security Events via AMA populates the SecurityEvent table, Cisco ASA via Syslog populates the CommonSecurityLog table (which is the standard schema for syslog-based security appliances), and Azure Activity populates the AzureActivity table. These mappings are defined by the data connectors themselves and are fundamental to querying the correct data in Sentinel.

Answer

The first and last mappings are swapped.

Answer

Every item maps to the same log table or feature category.

Answer

Only identity-related items are mapped; workload and network items are omitted.

Question 6

Arrange the steps in the correct order to create and save a custom hunting query in Microsoft Sentinel.

Accepted Answer

Open the Microsoft Sentinel workspace in the Azure portal → Navigate to the Hunting blade in the Sentinel menu → Click on the 'New Query' button → Write the KQL query in the query editor → Run the query to verify results → Save the query with a meaningful name and description. Option A is correct because creating a custom hunting query in Microsoft Sentinel requires first accessing the workspace, then navigating to the Hunting blade, clicking 'New Query', writing the KQL query, running it to validate results, and finally saving it with a meaningful name and description. This sequence ensures the query is tested before being stored, aligning with Sentinel's workflow for ad-hoc threat hunting.

Answer

Verify results before configuring the source or rule settings.

Answer

Configure alert grouping before defining the detection query or source.

Answer

Skip validation and enable the rule or plan immediately.

Question 7

In Microsoft 365 Defender advanced hunting, an analyst is investigating a case where a user's device was compromised via a malicious base64-encoded PowerShell script. The analyst wants to find all processes that were created by this script by decoding the command line. Which KQL function should be applied to the ProcessCommandLine column in the DeviceProcessEvents table?

Accepted Answer

base64_decode_tostring(ProcessCommandLine). The correct KQL function to decode a Base64-encoded string into a readable text format in Microsoft 365 Defender advanced hunting is `base64_decode_tostring()`. This function takes a string column (like ProcessCommandLine) and returns the decoded plaintext, allowing the analyst to see the actual PowerShell commands executed. The other options are either invalid KQL functions or do not exist in the Kusto Query Language used in advanced hunting.

Answer

parse_base64(ProcessCommandLine)

Answer

decode_base64(ProcessCommandLine)

Answer

convertstring(ProcessCommandLine, 'base64')

Question 8

During an incident investigation in Microsoft 365 Defender, an analyst examines an email that was reported as phishing. The analyst opens the email entity page and looks at the 'Detection details' section. Which piece of information would the analyst find there?

Accepted Answer

The detection technology (e.g., Advanced ML, Reputation) and if the email was part of a phish simulation or a campaign.. Option D is correct because the 'Detection details' section on the email entity page in Microsoft 365 Defender specifically shows the detection technology used (e.g., Advanced ML, Reputation, Bulk) and whether the email was part of a phishing simulation or a campaign. This information helps analysts understand how the email was identified as malicious and its context within broader threat activity.

Answer

The delivery location and whether the email was delivered to Inbox, Junk, or Quarantine.

Answer

The authentication statuses (SPF, DKIM, DMARC) for the sender domain.

Answer

The sender IP address and the recipient email address.

Question 9

Your organization has multiple Azure subscriptions and wants to ensure that all of them have Microsoft Defender for Cloud's enhanced security features enabled. What is the minimal step required to achieve this for all subscriptions?

Accepted Answer

Enable the required Defender for Cloud plans at the management group level. Enabling Microsoft Defender for Cloud plans at the management group level is the minimal step because it applies the configuration to all child subscriptions under that management group in a single action. This leverages Azure's hierarchical management structure, ensuring every subscription inherits the enhanced security features without needing individual subscription-level configuration.

Answer

Assign an Azure Policy initiative to enable Defender for Cloud on each subscription

Answer

Install the Log Analytics agent on all virtual machines in each subscription

Answer

Create a security contact email for each subscription

Question 10

An organization uses Microsoft Sentinel to monitor Microsoft Entra ID sign-ins. A SOC analyst creates a scheduled analytics rule that runs every 15 minutes and uses the following KQL query: SigninLogs | where TimeGenerated > ago(30m) | summarize count() by IPAddress | where count_ > 10. The rule is intended to detect brute-force attacks from a single IP address. However, the analyst notices that alerts are generated even when IP addresses are within the company's trusted corporate network range. What is the most appropriate fix to reduce false positives?

Accepted Answer

Modify the query to exclude IP addresses from the corporate network by adding '| where IPAddress notin (dynamic(['10.0.0.0/8', '172.16.0.0/12', '192.168.0.0/16']))' or by using a watchlist. Option A is correct because the query currently counts all sign-in attempts, including those from trusted corporate IP ranges, which generates false positives for brute-force detection. By adding a filter to exclude corporate IP addresses (e.g., RFC 1918 ranges) or using a watchlist, the rule only alerts on external IPs that exceed the threshold, reducing noise. This directly addresses the root cause—internal traffic being incorrectly flagged—without altering detection logic or data sources.

Answer

Increase the threshold from 10 to 20 failed attempts

Answer

Decrease the rule's run frequency to every 5 minutes

Answer

Change the data source to AADNonInteractiveUserSignInLogs

Question 11

A security team enables Microsoft Defender for Cloud on an Azure subscription and wants to ensure that all Azure SQL databases have threat detection enabled. Which plan must be enabled to receive alerts for SQL injection attempts?

Accepted Answer

Defender for SQL. Defender for SQL is the specific Microsoft Defender for Cloud plan that provides threat detection for Azure SQL databases, including alerts for SQL injection attacks. It monitors database activity for anomalous patterns, such as SQL injection attempts, and generates security alerts. Without this plan enabled, threat detection for SQL databases remains disabled, even if other Defender plans are active.

Answer

Defender for Servers

Answer

Defender for Storage

Answer

Defender for Key Vault

Question 12

Match each Microsoft Sentinel analytics rule type to its correct description.

Accepted Answer

Scheduled → Runs a KQL query on a schedule and generates alerts based on the query results.; Fusion → Correlates multiple high-fidelity alerts from various sources to create a single, comprehensive incident.; Anomaly → Uses machine learning to identify unusual patterns in activity by analyzing entity behavior over time.; Microsoft Security → Creates incidents from alerts generated by Microsoft security products such as Microsoft Defender for Endpoint.. Option A is correct because it accurately describes the four distinct Microsoft Sentinel analytics rule types. Scheduled rules execute KQL queries at defined intervals to generate alerts based on query results. Fusion rules use advanced machine learning to correlate multiple high-fidelity alerts from different sources into a single incident, reducing alert fatigue. Anomaly rules leverage machine learning to detect unusual patterns by analyzing entity behavior over time. Microsoft Security rules automatically create incidents from alerts generated by Microsoft security products like Microsoft Defender for Endpoint, integrating native security signals.

Answer

The first and last mappings are swapped.

Answer

Every item maps to the same log table or feature category.

Answer

Only identity-related items are mapped; workload and network items are omitted.

Question 13

A company uses Microsoft Defender for Cloud to manage security posture. The compliance team needs to continuously monitor resources against the CIS Microsoft Azure Foundations Benchmark and receive a consolidated score across all subscriptions. Which Defender for Cloud feature should they use?

Accepted Answer

Regulatory compliance dashboard. The Regulatory compliance dashboard in Microsoft Defender for Cloud provides continuous monitoring of resources against specific compliance standards, such as the CIS Microsoft Azure Foundations Benchmark, and aggregates a consolidated score across all subscriptions. This feature maps Azure Policy initiatives to compliance controls, showing pass/fail status and a compliance score, which directly meets the compliance team's requirement for ongoing assessment and a unified score.

Answer

Secure Score

Answer

Adaptive application controls

Answer

File Integrity Monitoring (FIM)

Question 14

A company uses Microsoft Defender for Cloud to protect Azure virtual machines. The security team receives an alert indicating that a VM is communicating with a known malicious IP address. Which Defender for Cloud feature can be used to automatically block outbound traffic to that IP address by adjusting the network security group (NSG)?

Accepted Answer

Adaptive network hardening. Adaptive network hardening (C) is the correct feature because it uses machine learning to analyze traffic patterns and recommend NSG rules to restrict traffic to known trusted sources. When a VM communicates with a malicious IP, adaptive network hardening can automatically create a deny rule in the NSG to block outbound traffic to that IP, reducing the attack surface without manual intervention.

Answer

Adaptive application controls

Answer

Just-in-time VM access

Answer

File integrity monitoring

Question 15

A security analyst uses advanced hunting in Microsoft 365 Defender to investigate a potential lateral movement attack. The analyst suspects that an attacker used stolen credentials to authenticate to multiple workstations via RDP. Which KQL query would return a list of devices where a single user account (user@contoso.com) had successful interactive logons on more than 5 distinct devices within a 10-minute window?

Accepted Answer

DeviceLogonEvents | where AccountUpn == 'user@contoso.com' and LogonType == 'Interactive' | summarize dcount(DeviceName) by bin(Timestamp, 10m) | where dcount_DeviceName > 5. Option C is correct because DeviceLogonEvents is the Microsoft 365 Defender table that captures logon events on devices, including RDP interactive logons. The query filters for the specific user account and interactive logon type, then uses summarize with dcount(DeviceName) by bin(Timestamp, 10m) to count distinct devices within each 10-minute window, and finally filters for windows where the distinct device count exceeds 5, which matches the lateral movement scenario.

Answer

DeviceNetworkEvents | where RemoteIP == 'user@contoso.com' | summarize dcount(DeviceName) by bin(Timestamp, 10m) | where dcount_DeviceName > 5

Answer

IdentityLogonEvents | where AccountUpn == 'user@contoso.com' and LogonType == 'Interactive' | summarize dcount(DeviceName) by bin(Timestamp, 10m) | where dcount_DeviceName > 5

Answer

DeviceLogonEvents | where AccountUpn == 'user@contoso.com' | summarize count() by DeviceName, bin(Timestamp, 10m) | where count_ > 5

Question 16

A company uses Microsoft Defender for Cloud with enhanced security features enabled. The security team wants to view a consolidated list of all security recommendations across multiple Azure subscriptions in a single view. Which blade should they navigate to in the Microsoft Defender for Cloud portal?

Accepted Answer

Security posture. The Security posture blade in Microsoft Defender for Cloud provides a consolidated view of all security recommendations across multiple Azure subscriptions, enabling the security team to assess and prioritize improvements. This blade aggregates recommendations from various security controls and displays them in a single, unified interface, directly addressing the requirement for a consolidated list.

Answer

Regulatory compliance

Answer

Workload protections

Answer

Inventory

Question 17

A SOC analyst needs to create an analytics rule in Microsoft Sentinel that triggers when a single user attempts to sign in from more than three different countries within 10 minutes. Which tables and KQL operators are needed?

Accepted Answer

SigninLogs, summarize dcount(Country) by UserPrincipalName, bin(TimeGenerated, 10m) having dcount > 3. Option B is correct because it uses the `SigninLogs` table, which contains Azure AD sign-in events with geographic data, and the `summarize dcount(Country) by UserPrincipalName, bin(TimeGenerated, 10m)` pattern to count distinct countries per user within a 10-minute window. The `having dcount > 3` clause filters for users who signed in from more than three distinct countries, directly matching the requirement.

Answer

SigninLogs, summarize make_set(Country) by UserPrincipalName, then where countof(Country) > 3

Answer

AADSignInEventsMicrosoft, summarize count() by UserPrincipalName

Answer

AzureActivity, summarize make_list(Country) by Caller

Question 18

A security administrator wants to enable vulnerability assessment for all existing and future Azure virtual machines using the integrated Microsoft Defender Vulnerability Management solution. Which action should they take in Microsoft Defender for Cloud?

Accepted Answer

Enable 'Microsoft Defender for Servers' plan and check the 'Vulnerability assessment' option in the environment settings. To enable vulnerability assessment for all existing and future Azure VMs using the integrated Microsoft Defender Vulnerability Management solution, you must enable the 'Microsoft Defender for Servers' plan in Defender for Cloud and then check the 'Vulnerability assessment' option within the environment settings. This action activates the built-in, agentless vulnerability assessment engine that is part of Defender for Cloud, automatically scanning VMs without requiring additional agents or manual deployment.

Answer

Install the Log Analytics agent and configure the Qualys connector on each VM

Answer

Create a policy assignment from the built-in initiative 'Enable Azure Monitor for VMs'

Answer

Enable 'Servers' workload protection in Defender for Cloud and then manually deploy the VA agent to each existing VM using Azure Policy

Question 19

A security analyst is investigating an incident in Microsoft 365 Defender involving a user who received a phishing email. The analyst needs to identify all devices on which the user clicked a link from the email. Which advanced hunting table should the analyst query to find the click events?

Accepted Answer

UrlClickEvents. UrlClickEvents is the correct table because it specifically records click events on URLs in Microsoft Defender for Office 365, including clicks on links in phishing emails. This table captures the user's click action, the URL, and the verdict (e.g., allowed, blocked), enabling the analyst to identify all devices where the user clicked the link.

Answer

EmailEvents

Answer

DeviceEvents

Answer

NetworkEvents

Question 20

A security analyst is investigating an incident in Microsoft 365 Defender where a device is detected as infected with a trojan. The analyst wants to use automated investigation to contain the threat. Which action can be automatically taken on the affected device as part of a standard AIR playbook for endpoint detection and response?

Accepted Answer

Initiate a device isolation.. In Microsoft Defender for Endpoint, the Automated Investigation and Response (AIR) playbook for endpoint detection and response includes the ability to isolate a device from the network. This action stops the device from communicating with other devices or the internet, containing the threat while allowing the investigation to continue. Option D is correct because device isolation is a standard containment action in the AIR playbook for trojan infections.

Answer

Remove the user account from the device.

Answer

Execute a full antivirus scan on the device.

Answer

Disable the network adapter.