SC-200 Practice Test 21 — 15 Questions

Question 1

A security analyst is using Microsoft Defender for Cloud's adaptive application controls (AAC) to allowlist trusted applications on Azure VMs. After enabling AAC and running in 'Audit' mode for a week, the analyst wants to switch to 'Enforce' mode. Which pre-requisite must be met before enforcement can be applied?

Accepted Answer

The VM must have a baseline of allowed applications generated from at least two weeks of audit data.. Adaptive application controls require a minimum of two weeks of audit data to establish a reliable baseline of allowed applications before enforcement can be applied. This baseline ensures that legitimate applications are not blocked when switching from Audit to Enforce mode, reducing false positives and operational disruptions.

Answer

The VM must have the Guest Configuration extension installed.

Answer

A valid Microsoft Defender for Servers Plan 2 license must be assigned to the VM.

Answer

The VM must be running on a supported operating system like Windows Server 2016 or later.

Question 2

A security analyst is using Microsoft 365 Defender advanced hunting to investigate potential lateral movement. The analyst has identified a compromised device (DeviceA) and wants to find all other devices that initiated a remote desktop connection from DeviceA to other devices in the last 24 hours. Which table and query approach should the analyst use?

Accepted Answer

Query DeviceNetworkEvents for events from DeviceA with RemotePort 3389, then join with DeviceInfo to get target device names.. Option A is correct because DeviceNetworkEvents logs network connections, including outbound RDP traffic (port 3389). By filtering for events from DeviceA with RemotePort 3389, the analyst captures all RDP connections initiated by DeviceA. Joining with DeviceInfo resolves the target IP addresses to device names, providing a complete list of devices that received an RDP connection from DeviceA in the last 24 hours.

Answer

Query DeviceLogonEvents for LogonType 10 (RemoteInteractive), filtering by initiating device.

Answer

Query IdentityLogonEvents to find logons associated with DeviceA.

Answer

Query EmailEvents to find emails sent from DeviceA that contain RDP configuration files.

Question 3

A security analyst is investigating lateral movement in Microsoft 365 Defender. They have identified a compromised device (DeviceA) and want to find all other devices that have been accessed from DeviceA via RDP in the last 24 hours. Which advanced hunting table contains RDP connection events?

Accepted Answer

DeviceNetworkEvents. DeviceNetworkEvents is the correct table because it captures network-level connection events, including outbound RDP (TCP port 3389) connections. When a compromised device initiates an RDP session to another device, the network event is logged here, allowing the analyst to trace lateral movement by filtering for `RemotePort == 3389` and `RemoteIP` of the target.

Answer

DeviceLogonEvents

Answer

DeviceProcessEvents

Answer

IdentityLogonEvents

Question 4

A security analyst is using Microsoft 365 Defender advanced hunting to investigate a phishing campaign. The analyst wants to find emails that were delivered to users (DeliveryAction != 'Blocked') and contained a specific malicious URL (e.g., 'https://malicious.com'). The EmailEvents table contains delivery information, and the EmailUrlInfo table contains URL details. Which KQL query correctly joins these two tables to find the desired emails?

Accepted Answer

EmailEvents | where DeliveryAction != 'Blocked' | join kind=inner EmailUrlInfo on NetworkMessageId | where Url == 'https://malicious.com'. Option A is correct because it uses an inner join on the `NetworkMessageId` column, which is the common key between `EmailEvents` and `EmailUrlInfo` tables in Microsoft 365 Defender advanced hunting. The query first filters `EmailEvents` to only delivered emails (`DeliveryAction != 'Blocked'`), then joins with `EmailUrlInfo` to match URLs to those emails, and finally filters for the specific malicious URL. This ensures only emails that were delivered and contained the target URL are returned.

Answer

EmailEvents | where DeliveryAction != 'Blocked' | join kind=leftouter EmailUrlInfo on NetworkMessageId | where Url == 'https://malicious.com'

Answer

EmailEvents | where DeliveryAction != 'Blocked' | join kind=inner EmailUrlInfo on Name | where Url == 'https://malicious.com'

Answer

EmailEvents | where DeliveryAction != 'Blocked' | join kind=inner EmailUrlInfo on SenderFromDomain | where Url == 'https://malicious.com'

Question 5

A security analyst suspects a user's device is exfiltrating data via DNS queries to a known malicious domain. Which Advanced Hunting table should the analyst query to find DNS requests made from the device?

Accepted Answer

DeviceNetworkEvents. DeviceNetworkEvents is the correct table because it contains network-level events, including DNS queries, from devices monitored by Microsoft Defender for Endpoint. The analyst needs to inspect DNS requests to identify exfiltration to a known malicious domain, and this table specifically logs the destination URL (including FQDNs) and the initiating process, making it the appropriate source for such queries.

Answer

DeviceProcessEvents

Answer

IdentityLogonEvents

Answer

EmailUrlInfo

Question 6

A security analyst is using Microsoft 365 Defender and discovers that a legitimate business application has been incorrectly blocked as malicious by an automated investigation. The analyst needs to unblock this application immediately so it can run on all endpoints in the organization. What action should the analyst take from the file's entity page in Microsoft 365 Defender?

Accepted Answer

Add an indicator to allow the file. Adding an indicator to allow the file creates a custom indicator of compromise (IoC) in Microsoft 365 Defender that explicitly overrides the automated investigation's verdict. This action immediately permits the file to run on all endpoints in the organization by adding an 'allow' entry to the threat intelligence feed, which takes precedence over the automated detection logic.

Answer

Submit the file to Microsoft for analysis

Answer

Remove the existing indicator for the file

Answer

Restore the file from quarantine

Question 7

A security analyst needs to create a custom watchlist in Microsoft Sentinel to correlate IP addresses known to be used by a threat actor. The watchlist will be uploaded from a CSV file. Which data type should the analyst specify for the watchlist alias?

Accepted Answer

String. The watchlist alias in Microsoft Sentinel is a string identifier used to reference the watchlist in KQL queries. Since IP addresses are stored as text values in CSV files and are not numeric integers, dates, or boolean flags, the correct data type for the alias is String. This ensures the alias can be used in join or lookup operations without type mismatch errors.

Answer

Integer

Answer

DateTime

Answer

Boolean

Question 8

A security engineer is responsible for protecting containerized workloads in Azure Kubernetes Service (AKS) clusters. They want to enable Microsoft Defender for Cloud to detect threats against the Kubernetes control plane and container runtime. Additionally, they want to ensure vulnerability assessments are performed on images stored in Azure Container Registry. Which Defender for Cloud plan should the engineer enable?

Accepted Answer

Enable the Microsoft Defender for Containers plan on the subscription.. Option B is correct because the Microsoft Defender for Containers plan is the only plan that provides integrated threat detection for the AKS control plane and container runtime, as well as vulnerability assessment for images in Azure Container Registry. This plan replaces the legacy Defender for Container Registries and Defender for Kubernetes plans, offering a unified solution for container security.

Answer

Enable the Microsoft Defender for Servers plan on the subscription.

Answer

Enable the Microsoft Defender for App Service plan on the subscription.

Answer

Enable the Microsoft Defender for Container Registries plan (legacy) on the registry.

Question 9

A security engineer needs to ensure that all Azure subscriptions under a management group are continuously assessed against the Azure Security Benchmark. They want to see the aggregated compliance score at the management group level. What should the engineer do in Microsoft Defender for Cloud?

Accepted Answer

Assign the Azure Security Benchmark initiative to the management group.. Assigning the Azure Security Benchmark initiative to the management group ensures that all subscriptions under that management group are continuously assessed against the benchmark. The aggregated compliance score is then visible at the management group level in the Regulatory Compliance dashboard, providing a single view of compliance across the entire hierarchy.

Answer

Assign the Azure Security Benchmark initiative to each subscription individually and use the secure score dashboard.

Answer

Enable the Regulatory Compliance dashboard and select the Azure Security Benchmark from the built-in standards list.

Answer

Configure Secure Score policies at the management group and enable Azure Security Benchmark.

Question 10

A security analyst uses Microsoft 365 Defender advanced hunting to investigate a phishing campaign. The analyst knows the Internet Message ID of a malicious email. Which table should the analyst query to find all users who received that specific email?

Accepted Answer

EmailEvents. The EmailEvents table in Microsoft 365 Defender advanced hunting stores records of email transactions, including the Internet Message ID and recipient information. By querying this table with the known Internet Message ID, the analyst can retrieve all users who received that specific email, as it contains the RecipientEmailAddress field for each delivery event.

Answer

EmailAttachmentInfo

Answer

EmailUrlInfo

Answer

EmailPostDeliveryEvents

Question 11

A security operations team has Microsoft Defender for Cloud enabled on all subscriptions and wants to forward security alerts and recommendations to Microsoft Sentinel for analysis and automation. Which configuration should the team implement to enable this integration?

Accepted Answer

In Microsoft Sentinel, add the 'Microsoft Defender for Cloud' data connector and select the subscriptions to stream alerts and recommendations.. Option A is correct because the 'Microsoft Defender for Cloud' data connector in Microsoft Sentinel is the native integration point that allows you to stream security alerts and recommendations from Defender for Cloud into Sentinel. By adding this connector and selecting the subscriptions, you enable a direct, bi-directional connection that ingests Defender for Cloud data into Sentinel's Log Analytics workspace for analysis and automation.

Answer

In Microsoft Defender for Cloud, create a continuous export to a Log Analytics workspace that is already connected to Sentinel.

Answer

Create an Azure Policy that deploys Azure Monitor Agent to all VMs and configures data collection rules to send data to Sentinel.

Answer

Enable the 'Enable integration with Microsoft Sentinel' option in the Defender for Cloud pricing & settings blade.

Question 12

A SOC analyst in Microsoft Sentinel needs to create an automation rule that triggers a playbook when a new incident is created and the incident severity is 'High'. Additionally, the playbook should only run if the incident is not already assigned to an analyst. Which two conditions must the analyst include in the automation rule? (Select all that apply.) (Choose 2.)

Accepted Answer

Condition: 'Severity' equals 'High'. Option A is correct because the automation rule must trigger only when the incident severity is 'High'. In Microsoft Sentinel, automation rules evaluate conditions against incident properties, and the 'Severity' condition filters incidents by their assigned severity level. This ensures the playbook runs exclusively for high-severity incidents, aligning with the SOC's requirement to prioritize critical alerts.

Answer

Condition: 'Status' equals 'New'

Answer

Condition: 'Provider' contains 'Microsoft Sentinel'

Question 13

A security analyst wants to create a custom detection rule in Microsoft 365 Defender that alerts when a user receives more than 5 emails with the same attachment name within 1 hour, indicating a possible malware campaign. Which advanced hunting tables should be joined to achieve this detection?

Accepted Answer

Join EmailEvents and EmailAttachmentInfo on NetworkMessageId. To detect when a user receives more than 5 emails with the same attachment name within 1 hour, you need to correlate email metadata with attachment details. The EmailEvents table contains email-level information (e.g., recipient, timestamp), while the EmailAttachmentInfo table stores attachment-level data (e.g., file name). Joining these on NetworkMessageId allows you to count occurrences of the same attachment name per recipient within a time window, enabling the custom detection rule.

Answer

Join EmailEvents and EmailUrlInfo on NetworkMessageId

Answer

Use only EmailAttachmentInfo table with a filter on file name

Answer

Join EmailEvents and DeviceFileEvents on SHA1 hash

Question 14

A SOC analyst in Microsoft Sentinel is creating a scheduled analytics rule to detect sign-ins from IP addresses known to be associated with a threat actor. The list of threat actor IPs is maintained in a custom Microsoft Sentinel watchlist and is updated daily. The analyst wants the rule to query the SigninLogs table and compare the IP address against this list. What is the most efficient way to reference the list in the KQL query?

Accepted Answer

Use the _GetWatchlist() function to retrieve the watchlist.. Option C is correct because the `_GetWatchlist()` function is the built-in, optimized way to reference a Microsoft Sentinel watchlist within a KQL query. It retrieves the watchlist data directly from the Sentinel workspace, ensuring the query always uses the latest daily-updated list without manual maintenance or external dependencies. This approach is both efficient and aligns with Sentinel's intended design for dynamic threat intelligence.

Answer

Use the externaldata operator to read from a blob storage URL.

Answer

Use the let statement to define a static list inline.

Answer

Use the datatable operator to define the list directly in the query.

Question 15

A security team uses Microsoft Defender for Cloud with Defender for Servers enabled. They want to receive an alert whenever a new local user is added to the Administrators group on any Azure Windows virtual machine. Which data source must be configured in Defender for Cloud to capture this event?

Accepted Answer

Windows Security Events (Event ID 4732). Option A is correct because the addition of a user to the Administrators group on a Windows system generates Windows Security Event ID 4732. Defender for Cloud with Defender for Servers must have the 'Windows Security Events' data source configured to collect these audit events, which then triggers a security alert for the new local administrator.

Answer

Windows Defender Antivirus logs

Answer

Azure Activity Logs

Answer

VM Insights