SC-200 Practice Test 21 — 15 Questions

Question 1

Your organization uses Microsoft Sentinel and Microsoft Defender for Cloud. During an incident, you need to automatically disable a compromised Azure VM from the network. Which playbook action should you use?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Add a rule to the VM's network security group to deny all traffic.. Adding a rule to the VM's network security group (NSG) to deny all traffic is the most direct and immediate way to isolate a compromised Azure VM at the network level. NSG rules are evaluated in order of priority, and a deny-all rule (e.g., denying any inbound and outbound traffic) effectively cuts off all network communication to and from the VM, which is a common containment step during incident response. This action can be automated via a Microsoft Sentinel playbook using the Azure Network Security Group connector.

Answer

Apply an Azure Policy to deny network changes.

Answer

Create an Azure Firewall rule to block the VM's IP.

Answer

Remove the VM's role assignment from Azure RBAC.

Question 2

An incident in Microsoft Sentinel was assigned to you. After investigation, you determine it is a false positive. What should you do to resolve the incident?

Accepted Answer

Close the incident with classification 'FalsePositive'. In Microsoft Sentinel, when an incident is determined to be a false positive, the correct resolution is to close it with the classification 'FalsePositive'. This action properly documents the outcome, updates the incident status to 'Closed', and ensures the incident is tracked for reporting and analytics. Leaving it open or changing status to 'Active' does not resolve it, while deleting is not supported and reassignment does not address the determination.

Answer

Add a comment and leave it open

Answer

Delete the incident

Answer

Reassign to another analyst

Answer

Change the status to 'Active'

Question 3

Your security team uses Microsoft Sentinel and Microsoft Purview. You need to classify incidents that involve sensitive data according to Microsoft Purview's sensitivity labels. Which THREE components should you use?

Accepted Answer

Analytics rules that trigger on data sensitivity events from Microsoft Purview.. Microsoft Purview's data sensitivity events, such as when a file is labeled with a specific sensitivity label, can be ingested into Microsoft Sentinel via the Purview Data Connector. Analytics rules can then be configured to trigger on these events, allowing the security team to automatically generate incidents when sensitive data is detected or mishandled, directly integrating Purview's classification into Sentinel's incident pipeline.

Answer

Microsoft Defender for Cloud to apply sensitivity labels.

Answer

Microsoft Intune compliance policies to label data.

Question 4

Refer to the exhibit. You have an automation rule in Microsoft Sentinel configured as shown. An analyst reports that low-severity incidents are not being closed automatically. The rule is enabled and has the highest order. What is the most likely reason?

Accepted Answer

The automation rule does not have the required permissions to modify incidents.. The automation rule requires an automation account with Microsoft Sentinel contributor permissions to run playbooks or modify incidents. Without these permissions, the rule cannot close incidents regardless of its order or enabled status. The rule being enabled and having the highest order does not override the missing permissions.

Answer

The rule is triggered by alerts, not incidents.

Answer

The rule is set to close incidents with classification 'TruePositive' but low-severity incidents are not true positives.

Answer

The rule is disabled due to a conflict with another rule.

Question 5

You are a Security Operations Analyst at a company that uses Microsoft Defender XDR. An incident named 'Phishing campaign targeting finance' is assigned to you. The incident contains multiple alerts across Exchange Online and Microsoft Defender for Office 365. You need to perform a manual investigation and then take remediation actions. Which built-in incident management capability in the Microsoft 365 Defender portal allows you to view the attack story, evidence, and response actions for this incident in a single pane?

Accepted Answer

The incident investigation page in the Microsoft 365 Defender portal. The incident investigation page in Microsoft Defender XDR consolidates alerts, entities, evidence, and the attack story for a single incident. It is purpose-built for analysts to move from triage to investigation and then to response, with actions like email soft delete and device isolation available inline. Other pages either list incidents, provide raw query access, or focus on a different workload, so they do not meet the single-pane investigation and remediation requirement.

Answer

The Microsoft Defender for Cloud Apps portal

Answer

The Incidents queue page in the Microsoft 365 Defender portal

Answer

The Advanced hunting page in the Microsoft 365 Defender portal

Question 6

A security operations center (SOC) team uses Microsoft Defender XDR and Microsoft Sentinel. An incident is created in Defender XDR that involves a malicious email and a compromised device. The team wants the incident to automatically sync to Sentinel. What is the minimum configuration required?

Accepted Answer

Configure the Microsoft Defender XDR connector in Sentinel. The Microsoft Defender XDR connector in Microsoft Sentinel is the dedicated connector that ingests incidents and advanced hunting events from all Defender XDR workloads (Defender for Endpoint, Office 365, Identity, Cloud Apps) and syncs them into Sentinel. Because the incident spans email and device, only the unified Defender XDR connector provides the cross-workload incident stream required for automatic synchronization.

Answer

Configure the Microsoft Defender for Office 365 connector in Sentinel

Answer

Configure the Azure AD Identity Protection connector in Sentinel

Answer

Configure the Microsoft 365 Defender connector in Sentinel

Question 7

Match each Microsoft Purview compliance feature to its description.

Accepted Answer

Data Lifecycle Management: Governs data retention and deletion to meet compliance and legal obligations.. The correct matches are: Data Lifecycle Management with retention/deletion, MIP with classification/protection, Insider Risk Management with internal risk detection, and Communication Compliance with monitoring communications. Common confusions arise from overlapping scopes, such as communication monitoring being mistaken for data lifecycle or classification being misattributed to insider risk.

Answer

Data Lifecycle Management: Monitors communications to detect policy violations and ensure regulatory compliance.

Answer

Insider Risk Management: Classifies sensitive data and applies protection policies.

Question 8

Refer to the exhibit. You are reviewing a Microsoft Sentinel scheduled analytics rule defined in JSON. The rule is intended to trigger an incident when more than 5 sign-ins from anomalous locations occur within an hour. However, the rule is not triggering as expected. What is the most likely cause?

Accepted Answer

The query references a column that does not exist in the SigninLogs table.. The query references a column that does not exist in the SigninLogs table. In Microsoft Sentinel, if a scheduled analytics rule's KQL query references a non-existent column, the query will fail silently or return no results, preventing the rule from triggering an incident. The rule logic depends on the query returning a result set that meets the trigger threshold, and a missing column causes the query to fail or return zero rows.

Answer

The severity is set to 'Medium', but it must be an integer.

Answer

The triggerThreshold is set to 5, but it should be a string like '5'.

Answer

The queryFrequency and queryPeriod are set to the same value, which is not allowed.

Question 9

Your organization uses Microsoft Defender for Identity. You receive an alert about a suspected Kerberoasting attack targeting a service account. You need to investigate the affected user and identify any related lateral movement. Which Microsoft Defender for Identity feature should you use to view the user's profile, including their activity timeline, associated alerts, and lateral movement paths?

Accepted Answer

The user's profile page in the Microsoft 365 Defender portal. The user profile page in Microsoft 365 Defender consolidates identity data from Defender for Identity, including the activity timeline, alerts, and lateral movement paths. It is designed for investigating a specific user and understanding their behavior and relationships. Other pages either list users, show health status, or provide raw query access, but none offer the integrated investigative profile needed here.

Answer

The 'Advanced hunting' page in the Microsoft 365 Defender portal

Answer

The 'Users' page in the Microsoft Defender for Identity portal

Answer

The 'Health issues' page in the Microsoft Defender for Identity portal

Question 10

You are a security operations analyst for a company that uses Microsoft Sentinel. You need to create a workbook that displays the top 10 most common alert types over the last 7 days. The workbook will be used by the SOC manager to identify trends. You have already created a new workbook and added a query step. Which KQL query should you use in the query step?

Accepted Answer

AlertInfo | where TimeGenerated > ago(7d) | summarize Count = count() by AlertName | top 10 by Count desc | render barchart. It uses the `summarize` operator to count alerts by `AlertName`, then `top 10 by Count desc` to return the ten most frequent alert types, and `render barchart` to visualize the data in the workbook. This directly meets the requirement to display the top 10 most common alert types over the last 7 days.

Answer

AlertInfo | where TimeGenerated > ago(7d) | project AlertName

Answer

AlertInfo | where TimeGenerated > ago(7d) | project AlertName, count()

Answer

AlertInfo | where TimeGenerated > ago(7d) | summarize count() by bin(TimeGenerated, 1d) | render timechart

Question 11

A SOC analyst needs to create a Microsoft Sentinel scheduled analytics rule that detects a potential brute-force attack. The rule should alert when a single IP address attempts to sign in to more than 10 different user accounts within 5 minutes. The data is in the 'SigninLogs' table. Which KQL operator should the analyst use to count distinct users per IP address per 5-minute time window?

Accepted Answer

summarize dcount(UserPrincipalName) by IPAddress, bin(TimeGenerated, 5m). The requirement is to count distinct user accounts per IP address within a 5-minute window. The `dcount()` function estimates the number of distinct values of `UserPrincipalName`, `bin(TimeGenerated, 5m)` groups the logs into 5-minute buckets, and `summarize ... by IPAddress` ensures the count is per source IP. This directly matches the brute-force detection logic of more than 10 distinct users from a single IP in 5 minutes.

Answer

summarize count(UserPrincipalName) by IPAddress

Answer

summarize dcount(IPAddress) by UserPrincipalName, bin(TimeGenerated, 5m)

Answer

make-set(UserPrincipalName) by IPAddress

Question 12

Which TWO actions are valid containment steps for a compromised user account in Microsoft Defender XDR?

Accepted Answer

Disable the user account in Microsoft Entra ID. Disabling the user account in Microsoft Entra ID is a valid containment step because it immediately revokes the user's access to all cloud resources, including Microsoft 365, Azure, and any applications relying on Entra ID authentication. This prevents the compromised account from being used for further malicious activities while preserving the account for investigation. It is a core incident response action in Microsoft Defender XDR for containing identity-based threats.

Answer

Create a new email rule to forward emails

Answer

Add the user to a privileged role

Answer

Run a full antivirus scan on the user's device

Question 13

A SOC team uses Microsoft Sentinel with Microsoft Defender XDR integration. An incident is created from a Defender for Endpoint alert. The analyst wants to run a KQL query across all affected devices without creating a new analytics rule. How can the analyst achieve this?

Accepted Answer

Use the incident's Logs blade to run a KQL query.. The incident's Logs blade in Microsoft Sentinel allows analysts to run KQL queries directly against the data ingested into the workspace, scoped to the incident's context. This enables ad-hoc investigation across all affected devices without modifying or creating any analytics rules, which would require rule authoring and deployment.

Answer

Modify the analytics rule that created the incident.

Answer

Use the Microsoft Sentinel Hunting blade.

Answer

Create a new workbook.

Question 14

A SOC analyst is using Microsoft Sentinel to investigate an incident involving a user who accessed a sensitive database from an unusual location. The analyst wants to find all activities performed by this user within the last 24 hours from multiple data sources. Which KQL operator should the analyst use to combine the results of two queries that return different schemas?

Accepted Answer

union. The union operator in KQL combines the results of two or more queries that may have different schemas, appending rows and filling missing columns with nulls. This is exactly what the analyst needs to pull user activity from multiple data sources (e.g., SigninLogs, AuditLogs, OfficeActivity) into a single result set for the last 24 hours. join, by contrast, requires matching columns and merges rows horizontally.

Answer

summarize

Answer

join

Answer

where

Question 15

A Microsoft Defender XDR incident shows that a user's device has been communicating with a known malicious C2 server. The device is online and the user is actively working. You need to contain the threat with minimal business disruption. What should you do?

Accepted Answer

Initiate device isolation from Microsoft Defender XDR. Initiating device isolation in Microsoft Defender XDR stops all network communication to and from the device while allowing the user to continue working locally, thus containing the threat with minimal business disruption. Option A is incorrect because disabling the switch port would require physical access to the network infrastructure and may not be feasible remotely. Option B is incorrect because shutting down the device remotely causes immediate disruption and loss of user productivity. Option C is incorrect because a full antivirus scan does not stop ongoing C2 communication and may allow the threat to continue spreading.

Answer

Remove the device from the network by disabling the switch port

Answer

Shut down the device remotely

Answer

Run a full antivirus scan on the device