SC-200 Practice Test 23 — 15 Questions

Question 1

During a ransomware response in Microsoft Defender XDR, you identify that multiple devices are communicating with a known C2 server over port 443. You need to block this communication across all devices immediately. What is the most effective course of action?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Create an indicator of compromise (IoC) in Microsoft Defender for Endpoint with action 'Block'. Creating an indicator of compromise in Microsoft Defender for Endpoint with action 'Block' is the most effective immediate action. The indicator is enforced by the Defender for Endpoint sensor and blocks the known C2 IP or domain across all onboarded devices, regardless of network location. Option A applies only to email and collaboration content. Option B only blocks traffic that passes through the firewall and may miss remote devices or non-firewall paths. Option D applies only to cloud app sessions, not general C2 network traffic.

Answer

Add the C2 server domain to the Microsoft Defender for Office 365 Tenant Allow/Block List

Answer

Create a firewall rule to block outbound traffic to the C2 server IP address

Answer

Add the C2 server URL to the custom indicator list in Microsoft Defender for Cloud Apps

Question 2

Your organization has a hybrid identity environment with Microsoft Entra ID and on-premises Active Directory. You are configuring Microsoft Defender for Identity to protect against lateral movement attacks. Which configuration should you prioritize to detect pass-the-hash attacks?

Accepted Answer

Enable 'Capture NTLM hashes' in the Microsoft Defender for Identity sensor configuration. Enabling 'Capture NTLM hashes' in the Microsoft Defender for Identity sensor configuration allows the sensor to extract NTLM hashes from network traffic. Pass-the-hash attacks rely on capturing and reusing NTLM hashes to authenticate laterally; by capturing these hashes, Defender for Identity can detect anomalies such as a hash being used from a different source or for suspicious logon attempts, directly identifying the attack.

Answer

Configure port mirroring for domain controllers

Answer

Enable 'SAM-R' (Remote SAM) in the Microsoft Defender for Identity sensor configuration

Answer

Configure Windows Event Forwarding (WEF) for domain controllers

Question 3

Refer to the exhibit. You have a KQL query in a Microsoft Sentinel analytics rule. The rule is not generating incidents even though there are 'Suspicious sign-in' alerts from non-contoso.com users. What is the most likely issue?

Accepted Answer

The query is querying the wrong table. 'Suspicious sign-in' alerts may be in a different table.. The query is likely querying the 'Alert' table, but 'Suspicious sign-in' alerts from non-contoso.com users are generated by Microsoft Defender for Identity or Microsoft Entra ID Protection and stored in the 'SecurityAlert' table (or 'AlertEvidence' in the new schema). The rule's query must reference the correct table to retrieve these alerts; otherwise, no matching records are found, and no incidents are created.

Answer

The 'extend' line is incorrectly parsing the entity.

Answer

The 'where' clause using !endswith is incorrect.

Answer

The query does not filter by AlertName correctly.

Question 4

A security analyst is investigating a potential data exfiltration incident in Microsoft 365 Defender. They have identified a suspicious email sent to an external recipient containing an attachment. They want to know if the attachment has been opened and if any sensitive data was accessed. Which advanced hunting table should the analyst query to find email attachment activities, such as file download or view?

Accepted Answer

EmailEvents. B is correct because EmailEvents is the advanced hunting table in Microsoft 365 Defender that captures email-level activities, including whether an attachment was opened or viewed by the recipient. This table contains actions such as 'Email open' and 'Attachment open', which directly answer the analyst's question about attachment access and potential data exfiltration.

Answer

DeviceFileEvents

Answer

EmailAttachmentInfo

Answer

UrlClickEvents

Question 5

A security administrator needs to view a list of all virtual machines that have a missing critical security update. Which Microsoft Defender for Cloud dashboard should they use?

Accepted Answer

Recommendations. The Recommendations dashboard in Microsoft Defender for Cloud provides a prioritized list of security recommendations, including missing critical security updates for virtual machines. This dashboard aggregates findings from vulnerability assessments and update management, allowing administrators to identify and remediate specific missing patches across their VM fleet.

Answer

Secure Score

Answer

Regulatory Compliance

Answer

Inventory

Question 6

A SOC manager wants to quickly view the number of incidents generated in Microsoft Sentinel over the past 7 days, grouped by Azure subscription. Which KQL query should be used on the SecurityIncident table?

Accepted Answer

SecurityIncident | where CreatedTime > ago(7d) | summarize count() by SubscriptionId. The SecurityIncident table stores incident records, and the CreatedTime field records when each incident was generated. Filtering with `where CreatedTime > ago(7d)` limits results to the past 7 days, and `summarize count() by SubscriptionId` groups the count by the Azure subscription that owns the resources involved in the incident. This directly meets the SOC manager's requirement to view the number of incidents per subscription over the last week.

Answer

SecurityAlert | where TimeGenerated > ago(7d) | summarize count() by SubscriptionId

Answer

SecurityIncident | where TimeGenerated > ago(7d) | summarize count() by SubscriptionId

Answer

SecurityIncident | where CreatedTime > ago(7d) | summarize count() by WorkspaceSubscriptionId

Question 7

You are a SOC analyst investigating a high-severity incident. The incident involves a user who received a phishing email and clicked a link. Microsoft Defender for Office 365 detected the email as phishing and blocked the URL at time of click, but a follow-up investigation reveals that the user's mailbox has suspicious forwarding rules. You need to ensure that similar incidents are automatically remediated in the future. What should you configure in Microsoft Sentinel?

Accepted Answer

Create an automation rule that triggers a playbook to remove the forwarding rule when an incident with the 'Phishing' tactic is created.. Microsoft Sentinel automation rules can trigger a playbook (an Azure Logic Apps workflow) when an incident is created with a specific tactic, such as 'Phishing'. This allows automatic remediation of suspicious forwarding rules without manual intervention, ensuring similar incidents are handled consistently.

Answer

Configure entity behavior analytics to automatically block the user.

Answer

Create an analytics rule that detects suspicious forwarding rules and automatically removes them.

Answer

Add the user to a watchlist that triggers an automated investigation.

Question 8

Refer to the exhibit. You run the PowerShell command against Microsoft Defender for Endpoint. What is the result?

Accepted Answer

An antivirus scan runs on the device.. The `Start-MpScan` cmdlet initiates a Microsoft Defender Antivirus scan on the device. The `-ScanType` parameter with value `QuickScan` specifies a quick scan of common malware locations, not a full scan. This is a direct antivirus action, not an investigation package collection, isolation, or Live Response session.

Answer

The investigation package is collected.

Answer

The device is isolated from the network.

Answer

A Live Response session is started.

Question 9

Your organization uses Microsoft Sentinel. You have a requirement to automatically add a tag to incidents that involve a specific user. The tag should be added when the incident is created. What should you configure?

Accepted Answer

Create an automation rule that triggers on incident creation and runs a playbook with the 'Add tag' action.. Automation rules in Microsoft Sentinel can be configured to trigger when an incident is created, and they can run a playbook that includes the 'Add tag' action. This allows you to automatically tag incidents involving a specific user by incorporating logic within the playbook to check for that user's presence in the incident entities.

Answer

Add the user to a watchlist and create a fusion rule.

Answer

Modify the analytics rule to include a tag in the incident configuration.

Answer

Enable entity behavior analytics to automatically tag incidents.

Question 10

Which TWO are valid methods to ingest logs into Microsoft Sentinel from a non-Azure virtual machine? (Select TWO.)

Accepted Answer

Azure Monitor Agent (AMA) with Azure Arc. Azure Arc bridges non-Azure VMs into Azure's management plane, allowing the Azure Monitor Agent (AMA) to be installed and managed as if the VM were native Azure. This enables log ingestion into Microsoft Sentinel without requiring direct Azure connectivity or a VPN, using the same AMA data collection rules (DCRs) as Azure VMs.

Answer

Microsoft Sentinel agent (standalone)

Answer

Azure Monitor Agent (AMA) without Azure Arc

Answer

Log Analytics agent (OMS) – deprecated

Question 11

Which TWO data connectors can be used to ingest Microsoft 365 audit logs into Microsoft Sentinel? (Choose two.)

Accepted Answer

Microsoft 365 Defender connector.. The Microsoft 365 Defender connector (Option B) ingests unified audit logs from Microsoft 365 Defender, which includes security-related events from Microsoft 365 services. The Office 365 connector (Option C) directly ingests audit logs from Exchange Online, SharePoint Online, and Microsoft Teams, which are part of the Microsoft 365 audit log. Both connectors are designed to bring Microsoft 365 audit log data into Microsoft Sentinel.

Answer

Microsoft Defender for Cloud Apps connector.

Answer

Azure Activity connector.

Answer

Azure AD connector (sign-in logs).

Question 12

Your organization uses Microsoft Defender for Endpoint. You need to configure a device group that automatically assigns devices to the group based on their domain membership. Devices joined to 'contoso.com' should be in the 'Corporate' group, and all others in 'Non-Corporate'. What should you use?

Accepted Answer

Create a device group with a rule using the device tag 'Contoso' and assign tags via GPO.. Microsoft Defender for Endpoint device groups can use device tags to automatically assign devices based on domain membership. By creating a device group with a rule that matches the device tag 'Contoso' and assigning that tag to domain-joined machines via Group Policy Object (GPO), you ensure that devices joined to 'contoso.com' are placed in the 'Corporate' group, while all others fall into the default 'Non-Corporate' group.

Answer

Use a custom detection rule to move devices based on risk level.

Answer

Create two device groups and manually move devices.

Answer

Create a device group with a rule using the domain field 'contoso.com'.

Question 13

Your organization has recently deployed Microsoft Sentinel and wants to ensure that all critical Azure resources are monitored for security misconfigurations. You have already enabled Microsoft Defender for Cloud on all subscriptions. You need to configure a solution that will automatically create a Sentinel incident whenever a new security recommendation with severity 'High' is generated in Defender for Cloud. The incident should be assigned to the 'Infrastructure' team. Additionally, you want to run a playbook that will open a ticket in your IT Service Management (ITSM) tool. What should you do?

Accepted Answer

Enable the Defender for Cloud connector, then create an automation rule that triggers on incident creation from the connector, assigns to 'Infrastructure', and runs a playbook.. The Defender for Cloud connector in Microsoft Sentinel ingests security recommendations and alerts as incidents. By creating an automation rule that triggers on incident creation from this connector, you can automatically assign incidents to the 'Infrastructure' team and run a playbook to open a ticket in your ITSM tool, fulfilling all requirements without custom queries or workbooks.

Answer

Use the Azure Activity connector to ingest recommendations, then create an analytics rule to generate incidents.

Answer

Enable the Defender for Cloud connector and create a workbook to monitor recommendations.

Answer

Create a custom analytics rule that queries the SecurityRecommendation table in the Log Analytics workspace.

Question 14

Which TWO of the following are valid actions that can be performed by an automation rule in Microsoft Sentinel? (Select two.)

Accepted Answer

Assign incident to an analyst. Automation rules in Microsoft Sentinel can assign incidents to specific analysts or groups as part of incident response workflows. This action helps ensure accountability and proper triage by routing incidents to the appropriate personnel based on criteria like severity or type.

Answer

Delete a watchlist

Answer

Create a task

Answer

Modify an analytics rule

Question 15

Your organization uses Microsoft Defender XDR. You need to ensure that alerts from Microsoft Defender for Identity are automatically correlated with alerts from Microsoft Defender for Endpoint in the unified incidents queue. What should you verify?

Accepted Answer

Microsoft Defender XDR incident correlation is enabled. Microsoft Defender XDR incident correlation is the feature that automatically aggregates alerts from different Microsoft Defender workloads—including Defender for Identity and Defender for Endpoint—into a single unified incident. When this setting is enabled, the correlation engine analyzes alert telemetry and entities (such as user accounts, devices, and IP addresses) to merge related alerts, reducing alert fatigue and providing a consolidated view. Without this setting enabled, alerts from different workloads remain isolated and are not automatically correlated in the unified incidents queue.

Answer

Microsoft Defender for Office 365 is enabled

Answer

Microsoft Sentinel is connected to Microsoft Defender XDR

Answer

Custom detection rules are created in Microsoft 365 Defender