SC-200 Practice Test 24 — 15 Questions

Question 1

A security administrator wants to enforce Just-in-Time (JIT) VM access for all Azure virtual machines in a management group to reduce the attack surface. The administrator wants to automatically enable JIT on any new VM and remediate existing non-compliant VMs. What should the administrator configure in Microsoft Defender for Cloud?

Accepted Answer

Assign the built-in policy initiative 'Configure just-in-time network access on virtual machines' at the management group level.. The built-in policy initiative 'Configure just-in-time network access on virtual machines' can be assigned at the management group scope to automatically enable JIT on new VMs and remediate existing non-compliant VMs via a DeployIfNotExists effect. This ensures consistent enforcement across all subscriptions under that management group without manual per-subscription configuration.

Answer

Manually enable JIT in Defender for Cloud's 'Just-in-time VM access' blade for each subscription.

Answer

Configure Azure Policy Guest Configuration to require JIT on virtual machines.

Answer

Create a custom Azure Policy definition to enforce JIT and assign it to each subscription.

Question 2

A company manages multiple Azure subscriptions under a single management group. The security team wants to enable Microsoft Defender for Cloud's enhanced security features (e.g., Defender for Servers) for all subscriptions under that management group with minimal administrative effort. Which method should they use?

Accepted Answer

Enable the plans at the management group level. Enabling Microsoft Defender for Cloud's enhanced security features at the management group level applies the plans to all current and future subscriptions under that management group with a single action, minimizing administrative effort. This is the most efficient method because Defender for Cloud supports inheritance of security policies and plans from the management group down to subscriptions, eliminating the need for per-subscription configuration.

Answer

Enable the plans individually on each subscription

Answer

Use Azure Blueprints to assign the plans to each subscription

Answer

Create a custom Azure Policy that enforces the installation of the Log Analytics agent

Question 3

A security analyst receives an alert in Microsoft Defender for Cloud that an Azure virtual machine is running a process with a known indicator of compromise (IOC). The analyst wants to investigate the process details, including the command line and parent process. Which feature should the analyst use to gather this information from the VM?

Accepted Answer

Live response. Live Response in Microsoft Defender for Cloud provides a remote shell connection to the VM, allowing the analyst to run commands to inspect running processes, command-line arguments, and parent process details in real time. This is the correct feature for deep forensic investigation of an active IOC on the VM.

Answer

Vulnerability assessment

Answer

Inventory of resources

Answer

Secure score

Question 4

A SOC team wants to automatically run a playbook that retrieves threat intelligence details whenever a high-severity incident is created in Microsoft Sentinel. Which type of automation should they configure?

Accepted Answer

Automation rule with incident trigger. Automation rules in Microsoft Sentinel can be configured with an incident trigger to automatically run playbooks when incidents are created or updated. Since the requirement is to run a playbook on high-severity incidents, an automation rule with an incident trigger allows you to filter by severity (e.g., High) and invoke the playbook without manual intervention.

Answer

Automation rule with alert trigger

Answer

Playbook with manual trigger

Answer

Logic app with recurrence

Question 5

An organization needs to meet PCI DSS compliance requirements and also enforce a custom policy requiring that encryption keys be stored in a specific Azure Key Vault. The security administrator wants to view a unified compliance score that includes both the built-in PCI DSS standard and the custom policy. What should the administrator do in Microsoft Defender for Cloud?

Accepted Answer

Create a custom initiative that includes the PCI DSS built-in policy set and the custom key vault policy, then assign it to the scope. Option B is correct because Microsoft Defender for Cloud's regulatory compliance dashboard can only display a unified compliance score when all relevant standards and custom policies are grouped into a single initiative. By creating a custom initiative that includes both the built-in PCI DSS policy set and the custom Key Vault policy, then assigning that initiative to the scope, the administrator ensures the compliance score reflects both requirements in one view.

Answer

Assign the built-in PCI DSS regulatory compliance standard and add a custom policy through Azure Policy

Answer

Use Azure Blueprints to deploy the PCI DSS standard and custom policies

Answer

Enable the Secure Score dashboard to measure compliance

Question 6

A SOC analyst wants to automate a response in Microsoft Sentinel: whenever an incident is created that contains a compromised user entity (e.g., a user whose credentials were used in a breach), a playbook should run to disable that user in Microsoft Entra ID. Which condition should be configured in the automation rule to trigger this playbook?

Accepted Answer

Set the condition to 'When incident is created with entity type Account'.. Option C is correct because the automation rule must trigger when an incident is created with an entity type of 'Account' to match the compromised user entity. In Microsoft Sentinel, a user whose credentials were used in a breach is represented as an 'Account' entity, not an 'IP' or 'Host'. The playbook to disable the user in Microsoft Entra ID requires this entity type to pass the user principal name (UPN) or object ID to the action.

Answer

Set the trigger to 'When incident is created' with no additional condition.

Answer

Set the condition to 'When incident is created with entity type IP'.

Answer

Set the condition to 'When incident is updated with entity type Host'.

Question 7

Your organization uses Microsoft Sentinel. You have configured a data connector to ingest events from a third-party firewall. However, you notice that the logs are not appearing in Sentinel. What is the first thing you should check?

Accepted Answer

Check the connector health page in Microsoft Sentinel.. The connector health page provides status and error messages for data connectors, making it the first place to troubleshoot. Options A, C, and D are less direct or irrelevant to connector issues.

Answer

Check the firewall's syslog server configuration.

Answer

Verify that the workspace is in the correct region.

Answer

Reinstall the Log Analytics agent on the firewall.

Question 8

Match each Microsoft 365 Defender workload to its description.

Question 9

Match each Microsoft Sentinel feature to its purpose.

Question 10

An organization manages multiple Azure subscriptions under a single management group. They want to automatically enable Microsoft Defender for Cloud's enhanced security plans (e.g., Defender for Servers) on any new subscription added to the management group. Which configuration method should they use?

Accepted Answer

Create an Azure Policy that assigns the Defender for Cloud pricing tier at the management group level. Option A is correct because Azure Policy can be assigned at the management group scope to enforce the 'Configure Microsoft Defender for Cloud plans to be enabled' policy, which automatically sets the pricing tier (e.g., Standard) for Defender for Servers on any new subscription added to that management group. This ensures compliance without manual intervention, as the policy evaluates and remediates new subscriptions upon creation or addition.

Answer

Enable auto-provisioning in Defender for Cloud's settings

Answer

Use Azure Blueprints to define the subscription configurations

Answer

Manually enable plans per subscription as they are added

Question 11

A cloud security team uses Microsoft Defender for Cloud with Defender for Servers enabled. They want to ensure that all Azure virtual machines have automatic provisioning of the Log Analytics agent (Azure Monitor Agent) turned on. Where should this configuration be set to cover existing and future VMs?

Accepted Answer

In Microsoft Defender for Cloud > Environment settings > Select subscription > Settings & monitoring > Log Analytics agent for Azure VMs > Set to 'On'. Option A is correct because the 'Settings & monitoring' pane under Environment settings in Microsoft Defender for Cloud is the centralized location to enable automatic provisioning of the Log Analytics agent (Azure Monitor Agent) at the subscription level. This setting ensures that both existing Azure VMs and any future VMs are automatically provisioned with the agent, without requiring individual VM configuration or manual policy assignment.

Answer

In Azure Policy > Assign a policy that deploys the Log Analytics agent to VMs

Answer

In Microsoft Defender for Cloud > Security policy > Data collection

Answer

In Azure virtual machine blade > Auto-provisioning

Question 12

A SOC analyst wants to create an automation rule in Microsoft Sentinel that runs a playbook to disable a user's Microsoft Entra ID account every time an incident is created with a specific 'User' entity (e.g., compromised user). Which condition should be configured in the automation rule?

Accepted Answer

When incident is created, if entity type equals 'Account' and entity value equals 'user@domain.com'. Option A is correct because the automation rule must trigger specifically when an incident is created that contains a 'User' entity with a specific value (e.g., user@domain.com). By setting the condition to 'entity type equals Account' and 'entity value equals user@domain.com', the rule ensures the playbook only runs for incidents involving that exact compromised user, preventing unnecessary or incorrect automation. This matches the requirement to disable a specific user's Microsoft Entra ID account based on the entity present in the incident.

Answer

When incident is created, if the incident contains a 'User' entity

Answer

When incident is created with severity High

Answer

When incident is created, the playbook automatically runs without conditions

Question 13

A large organization manages multiple Azure subscriptions under a single management group. The security team wants to ensure that when new subscriptions are added to the management group, the Microsoft Defender for Cloud plans (e.g., Defender for Servers) are automatically enabled. What is the most efficient way to achieve this?

Accepted Answer

Assign the Azure Policy initiative 'Configure Azure Defender to be enabled on subscriptions' to the management group with appropriate policy parameters.. Option A is correct because assigning the built-in Azure Policy initiative 'Configure Azure Defender to be enabled on subscriptions' to the management group ensures that any new subscription added under that management group automatically inherits the policy. This initiative uses DeployIfNotExists effect to enable the specified Defender plans (e.g., Defender for Servers) on subscriptions that do not already have them enabled, providing a fully automated, scalable solution without manual intervention.

Answer

Enable all Microsoft Defender plans at the management group level in the Microsoft Defender for Cloud portal.

Answer

Manually enable the Defender plans on each new subscription as they are created.

Answer

Use an Azure Blueprint to assign the Defender plans to the subscription.

Question 14

A SOC team uses Microsoft Sentinel and wants to automate the response to high-severity incidents. When a new incident of severity 'High' is created, they need to send an email notification to the on-call analyst and assign the incident to that analyst. Which two components must be configured together to achieve this? (Choose the best answer.)

Accepted Answer

Automation rule and a playbook. Automation rules in Microsoft Sentinel allow you to define triggers based on incident creation or update, including severity conditions. By configuring an automation rule to trigger when a 'High' severity incident is created, you can run a playbook that sends an email to the on-call analyst and assigns the incident to them. This combination provides a no-code or low-code automated response without requiring a scheduled or Fusion rule.

Answer

Scheduled analytics rule and a playbook

Answer

Watchlist and an automation rule

Question 15

An analyst is building a custom detection rule in Microsoft 365 Defender to identify potential data exfiltration. The rule should alert when a process (e.g., powershell.exe) initiates multiple outbound network connections to an external IP address that is not in the company's corporate IP range within a short time. Which two Advanced Hunting tables must be joined to correlate process execution with network connection details?

Accepted Answer

DeviceProcessEvents and DeviceNetworkEvents. The rule requires correlating process execution (e.g., powershell.exe) with outbound network connections to external IPs. DeviceProcessEvents logs process creation events, while DeviceNetworkEvents logs network connection details including destination IP and port. Joining these two tables on DeviceId and Timestamp (within a short time window) allows the analyst to identify which process initiated the suspicious outbound connections, making A correct.

Answer

DeviceProcessEvents and DeviceFileEvents

Answer

DeviceProcessEvents and EmailEvents