SC-200 Practice Exam 4 — 20 Questions

Question 1

An organization uses Microsoft 365 Defender. An automated investigation on a device identifies a malicious file and blocks it. The analyst now wants to allow a specific trusted application that was incorrectly blocked, while keeping other malicious files blocked. Which action should the analyst take from the device's entity page?

Accepted Answer

Use the 'Add indicator' feature to create a custom IOC for the file hash with action 'Allow'.. The 'Add indicator' feature in Microsoft Defender XDR allows analysts to create custom indicators of compromise (IOCs) based on file hashes, IPs, or domains. By setting the action to 'Allow' for the specific file hash, the analyst can override the automated block for that trusted application while keeping other malicious files blocked. This is the correct approach because it provides granular control without affecting the overall automated investigation settings.

Answer

Initiate a live response session and delete the file manually.

Answer

Change the automated investigation settings to 'No action' and rerun investigation.

Answer

Collect the file for analysis; the allow decision must be made by Microsoft after analysis.

Question 2

A SOC analyst creates a scheduled analytics rule in Microsoft Sentinel with the following KQL query: SigninLogs | where TimeGenerated > ago(1h) | summarize StartTime = min(TimeGenerated), EndTime = max(TimeGenerated) by UserPrincipalName, IPAddress | where EndTime - StartTime < 5m and count_IPAddress > 1 The intended purpose is to detect users logging in from multiple IP addresses in a short time (impossible travel). However, the rule does not generate any alerts. What is the most likely cause?

Accepted Answer

The query references a column 'count_IPAddress' that does not exist. The summarize operator does not create a column with that name.. The query uses `summarize ... by UserPrincipalName, IPAddress` which groups by both fields, so it does not create a column named `count_IPAddress`. The `where` clause then references `count_IPAddress`, which does not exist, causing the query to fail silently or return no results. This is why no alerts are generated.

Answer

The query does not filter for failed sign-ins (e.g., ResultType == 0).

Answer

The rule should use a longer time range, such as 24 hours.

Answer

The rule needs to use the 'make_set' function to correctly count distinct IP addresses.

Question 3

A company uses Microsoft Defender for Cloud to protect Azure resources. They have an Azure SQL Database containing sensitive customer data. The security team wants to be alerted if a user attempts to perform SQL injection attacks against the database. Which Defender for Cloud plan must be enabled to receive SQL injection alerts?

Accepted Answer

Defender for SQL. Defender for SQL is the correct plan because it specifically provides threat detection for Azure SQL Database, including alerts for SQL injection attempts. It analyzes database audit logs and anomalous query patterns to detect SQL injection attacks, which are a primary threat to sensitive data in SQL databases.

Answer

Defender for Servers

Answer

Defender for Storage

Answer

Defender for App Service

Question 4

A cloud security administrator needs to ensure that all Azure virtual machines have the Microsoft Defender for Cloud agent (Log Analytics agent) installed automatically when they are provisioned. Which configuration should be set in Microsoft Defender for Cloud?

Accepted Answer

Enable auto-provisioning in the Defender for Cloud environment settings.. Option A is correct because Microsoft Defender for Cloud includes an auto-provisioning setting that, when enabled, automatically installs the Log Analytics agent (Microsoft Monitoring Agent) on all existing and newly provisioned Azure virtual machines. This setting is configured in the Defender for Cloud environment settings under 'Auto provisioning' and ensures seamless coverage without manual intervention or additional policy management.

Answer

Deploy a custom Azure Policy to install the agent on all VMs.

Answer

Use an Azure Automation runbook to install the agent on newly created VMs.

Answer

Enable Azure Update Management on the VMs.

Question 5

Match each Microsoft Defender for Cloud security alert to its description.

Question 6

Match each Microsoft Purview compliance feature to its description.

Question 7

Match each Microsoft Sentinel data connector to its data source.

Question 8

Match each incident severity level to its description in Microsoft 365 Defender.

Question 9

Match each Microsoft 365 Defender role to its permission level.

Question 10

Match each Microsoft Sentinel incident management action to its purpose.

Question 11

Arrange the steps to enable and configure Microsoft Defender for Identity (MDI) sensor on a domain controller.

Question 12

Order the steps to investigate a user account compromise using Microsoft Sentinel incidents.

Question 13

Order the steps to configure a Microsoft Sentinel analytics rule using a scheduled query.

Question 14

Arrange the steps to configure an Azure Sentinel data connector for Windows Security Events via Azure Monitor Agent in the correct order.

Question 15

Order the steps to create a Microsoft Sentinel automation rule that automatically closes low-severity incidents.

Question 16

Arrange the steps to run a Microsoft 365 Defender advanced hunting query and create a custom detection rule from it.

Question 17

Order the steps to perform a threat hunting exercise using Microsoft 365 Defender advanced hunting.

Question 18

Arrange the steps to configure a Microsoft Sentinel playbook (automation) using Azure Logic Apps.

Question 19

Order the steps to set up a Microsoft Sentinel workspace and connect Microsoft 365 Defender data.

Question 20

An organization uses Microsoft Defender for Cloud and has enabled enhanced security features. They want to receive alerts when a user attempts to connect to an Azure VM via RDP from a public IP address that is not in a predefined list of trusted IP ranges. Which Defender for Cloud plan or feature provides this capability?

Accepted Answer

Just-In-Time (JIT) VM access. Just-In-Time (JIT) VM access in Microsoft Defender for Cloud allows you to lock down inbound traffic to Azure VMs, reducing exposure to attacks while providing easy access when needed. When enabled, JIT creates rules in the network security group (NSG) that permit RDP (TCP 3389) or SSH (TCP 22) traffic only from specific IP addresses or ranges that you define, and only during a requested time window. If a user attempts an RDP connection from a public IP not in the trusted list, Defender for Cloud generates an alert, as the traffic is blocked by the JIT policy.

Answer

Adaptive network hardening

Answer

Network security groups (NSG) flow logs

Answer

File Integrity Monitoring (FIM)