SC-200 Practice Test 24 — 15 Questions

Question 1

Which THREE of the following are features of Microsoft Defender XDR that help manage a security operations environment?

Accepted Answer

Automated investigation and response. Automated Investigation and Response (AIR) in Microsoft Defender XDR uses AI-driven playbooks to automatically investigate alerts and take remediation actions, such as isolating a compromised device or blocking a malicious file, without requiring manual intervention. This directly supports managing a security operations environment by reducing alert fatigue and accelerating incident response.

Answer

Sentinel SIEM integration

Answer

Threat analytics

Question 2

Refer to the exhibit. You execute the Azure CLI command to create an analytics rule in Microsoft Sentinel. The rule is created but never triggers. What is the most likely cause?

Accepted Answer

The query references a column that does not exist in SigninLogs. If the KQL query in the analytics rule references a column that does not exist in the SigninLogs table, the query will run but return zero results (or an error depending on the query structure), causing the rule to never trigger an alert. In Microsoft Sentinel, analytics rules rely on the query to produce matching results; if the column name is misspelled or absent, no events will match the rule conditions, so no incidents are generated.

Answer

The --enabled parameter should be set to false

Answer

The severity must be set to Low for the rule to trigger

Answer

The resource group name is incorrect

Question 3

Which TWO of the following are valid data connectors in Microsoft Sentinel? (Select two.)

Accepted Answer

Office 365. Office 365 is a valid Microsoft Sentinel data connector because it ingests audit logs from Exchange Online, SharePoint Online, Teams, and other Office 365 services via the Office 365 Management Activity API. This connector enables security monitoring of user and admin activities across the Microsoft 365 tenant, making it a core data source for insider threat detection and compliance scenarios.

Answer

Windows Defender Firewall

Answer

Microsoft Forms

Answer

Azure DevOps

Question 4

Which THREE are valid incident management features in Microsoft Sentinel?

Accepted Answer

Incident creation from analytics rules. Incident creation from analytics rules is a core feature in Microsoft Sentinel. When an analytics rule detects a threat or suspicious activity, it automatically generates an incident, which serves as the primary object for investigation and response. This automation is fundamental to Sentinel's security orchestration, automation, and response (SOAR) capabilities.

Answer

Incident merging

Answer

Incident templates

Question 5

A security analyst is using Microsoft 365 Defender advanced hunting to investigate a phishing campaign. The analyst wants to find emails that were delivered to users (DeliveryAction != 'Blocked') and contained a specific malicious URL (e.g., 'https://malicious.com'). The EmailEvents table contains delivery information, and the EmailUrlInfo table contains URL details. Which KQL query correctly joins these two tables to find the desired emails?

Accepted Answer

EmailEvents | where DeliveryAction != 'Blocked' | join kind=inner EmailUrlInfo on NetworkMessageId | where Url == 'https://malicious.com'. It uses an inner join on NetworkMessageId, which is the proper key. However, Option B also produces the desired result: the leftouter join retains all delivered emails, but the `where Url == 'https://malicious.com'` predicate excludes rows where no matching URL was found (since null Url does not equal the target). Thus B's result set is identical to A's. Options C and D join on incorrect keys. In practice, inner join is more efficient, but B is not logically wrong.

Answer

EmailEvents | where DeliveryAction != 'Blocked' | join kind=leftouter EmailUrlInfo on NetworkMessageId | where Url == 'https://malicious.com'

Answer

EmailEvents | where DeliveryAction != 'Blocked' | join kind=inner EmailUrlInfo on Name | where Url == 'https://malicious.com'

Answer

EmailEvents | where DeliveryAction != 'Blocked' | join kind=inner EmailUrlInfo on SenderFromDomain | where Url == 'https://malicious.com'

Question 6

You are configuring a Microsoft Sentinel workbook to display incident metrics. You want to show the average time to triage incidents over the last 30 days. Which data source should you use?

Accepted Answer

SecurityIncident table.. The SecurityIncident table in Microsoft Sentinel contains all incident-related data, including timestamps for creation, triage, and resolution. To calculate the average time to triage (e.g., the time between incident creation and the first triage action), you query this table using KQL to compute the mean duration. The other tables (CommonSecurityLog, SecurityAlert, SigninLogs) do not store incident lifecycle metadata.

Answer

CommonSecurityLog table.

Answer

SecurityAlert table.

Answer

SigninLogs table.

Question 7

Which TWO are valid incident management actions in Microsoft Sentinel? (Choose two.)

Accepted Answer

Change the incident status to 'Closed'. Changing an incident's status to 'Closed' is a standard incident management action in Microsoft Sentinel. This action finalizes the incident after investigation and remediation, and it is a core part of the incident lifecycle within the Sentinel workspace.

Answer

Merge two incidents into one

Answer

Export the incident to a CSV file

Answer

Delete an incident

Question 8

Your organization uses Microsoft Sentinel. A new incident is created from a fusion alert that combines multiple low-severity alerts. The analyst needs to determine the entities involved. What should the analyst review?

Accepted Answer

The incident's entities tab.. The incident's entities tab in Microsoft Sentinel provides a consolidated view of all entities (such as users, hosts, IP addresses, and processes) that were identified by the fusion alert. Since fusion alerts combine multiple low-severity alerts, the entities tab is the direct place to see the aggregated entities involved in the incident, enabling the analyst to understand the scope and pivot for investigation.

Answer

The Sentinel Overview workbook.

Answer

The analytics rule that generated the incident.

Answer

The incident's timeline.

Question 9

Your organization has Microsoft Defender XDR enabled. An incident is generated for a user who clicked a phishing link in an email. The analyst needs to automatically disable the user's mailbox for suspicious activity. Which automated action should the analyst configure in a Microsoft Sentinel automation rule?

Accepted Answer

Run a playbook that uses the Microsoft 365 Defender connector to disable the mailbox.. The goal is to disable the user's mailbox, which is a Microsoft 365 Exchange Online action. A Microsoft Sentinel automation rule can trigger a playbook that uses the Microsoft 365 Defender connector to execute the 'Disable mailbox' action directly against Exchange Online, effectively suspending the user's ability to send or receive email. This aligns with the requirement to automatically respond to a phishing incident by disabling the compromised mailbox.

Answer

Run a playbook that deletes the phishing email from the user's inbox.

Answer

Configure an automation rule to block the sender IP address in Defender for Cloud Apps.

Answer

Run a playbook that resets the user's password.

Question 10

Which TWO of the following are valid sources for creating incidents in Microsoft Sentinel? (Choose two.)

Accepted Answer

Microsoft 365 Defender alerts. Microsoft 365 Defender alerts are a valid source for creating incidents in Microsoft Sentinel because Sentinel can ingest alerts from Microsoft 365 Defender (which includes Defender for Endpoint, Defender for Office 365, Defender for Identity, and Defender for Cloud Apps) via the Microsoft 365 Defender connector. When these alerts are ingested, Sentinel can automatically create incidents based on them, enabling unified incident management across the Microsoft security ecosystem.

Answer

Hunting query results

Answer

Workbook creation

Answer

Playbook execution

Question 11

Which TWO actions can you perform using Microsoft Sentinel automation rules?

Accepted Answer

Assign an incident to a specific analyst.. Microsoft Sentinel automation rules can directly assign an incident to a specific analyst using the 'Assign owner' action. This allows security operations teams to automatically route incidents to the appropriate personnel based on criteria such as severity, tactic, or entity, improving response efficiency.

Answer

Create a new analytics rule based on an incident.

Answer

Modify the data connector's polling interval.

Answer

Automatically create an incident from a log event.

Question 12

Which TWO features are available in Microsoft Sentinel to automate incident response?

Accepted Answer

Playbooks based on Azure Logic Apps.. Playbooks based on Azure Logic Apps (A) are the core automation mechanism in Microsoft Sentinel: they are Logic Apps workflows triggered by analytics rules or incidents that can run actions such as blocking an IP, posting to Teams, or opening a ticket, so they directly automate incident response. Automation rules (E) are also correct because they let you centrally manage and orchestrate incident handling — assigning owners, changing severity or status, tagging, and triggering playbooks — without writing code, which is exactly automation of incident response. Workbooks (B) are only for visualization and reporting dashboards, and KQL queries (C) are the query language used for hunting and analytics, not an automation feature. UEBA (D) provides behavioral analytics and entity insights to enrich detection, but it does not itself automate response actions.

Answer

Workbooks.

Answer

Kusto Query Language (KQL) queries.

Answer

UEBA.

Question 13

Which THREE indicators are commonly associated with ransomware activity in Microsoft Sentinel threat hunting?

Accepted Answer

Network connections to known C2 infrastructure. Ransomware activity commonly involves three indicators: network connections to known C2 infrastructure (command and control communication), mass file rename or extension changes (file encryption), and scheduled task creation on multiple endpoints (persistence mechanism). Option A (unusual DNS queries to known safe domains) is not typical for ransomware, and option C (excessive failed logon attempts) is more indicative of brute-force attacks. Therefore, the correct options are A, D, and E.

Answer

Unusual DNS queries to known safe domains

Answer

Excessive failed logon attempts from a single IP

Question 14

You are a threat hunter for a company that uses Microsoft Defender for Endpoint (now part of Microsoft Defender XDR). You need to investigate a potential privilege escalation attack. You have collected process creation events from endpoints and want to identify instances where a process with low integrity level spawned a process with high integrity level. The DeviceProcessEvents table includes fields: DeviceName, AccountName, InitiatingProcessFileName, InitiatingProcessIntegrityLevel, ProcessFileName, ProcessIntegrityLevel. You need to write an advanced hunting query that returns the top 10 devices where this escalation occurred most frequently in the last 7 days. Which query should you use?

Accepted Answer

DeviceProcessEvents | where Timestamp > ago(7d) | where InitiatingProcessIntegrityLevel == "Low" and ProcessIntegrityLevel == "High" | summarize count() by DeviceName | top 10 by count_. The query must filter for a genuine privilege escalation, which in Windows integrity-level terms means a low-integrity process spawning a high-integrity process. Option A correctly compares InitiatingProcessIntegrityLevel == "Low" against ProcessIntegrityLevel == "High", then aggregates by DeviceName and uses top 10 by count_ to surface the devices with the most escalation events in the last 7 days. This matches the stated requirement exactly.

Answer

DeviceProcessEvents | where Timestamp > ago(7d) | where InitiatingProcessIntegrityLevel == "Medium" and ProcessIntegrityLevel == "High" | summarize count() by DeviceName | top 10 by count_

Answer

DeviceProcessEvents | where Timestamp > ago(7d) | where InitiatingProcessIntegrityLevel != ProcessIntegrityLevel | summarize count() by DeviceName | top 10 by count_

Answer

DeviceProcessEvents | where Timestamp > ago(7d) | where InitiatingProcessFileName != ProcessFileName | summarize count() by DeviceName | top 10 by count_

Question 15

Your organization uses Microsoft Defender for Endpoint (MDE) and Microsoft Sentinel. You receive an alert in MDE about a suspicious PowerShell command executed on a device. You create an incident in Sentinel from this alert. You need to automatically collect a memory dump from the affected device for further analysis. You have a playbook that can initiate a memory dump collection via the MDE API. What is the best way to automate this?

Accepted Answer

Create an automation rule that triggers when an incident is created from a MDE alert and runs the playbook to collect the memory dump.. Automation rules in Microsoft Sentinel can trigger playbooks when an incident is created. Option B is correct because it creates an automation rule that triggers on incident creation from a Microsoft Defender for Endpoint alert and runs the playbook to collect the memory dump automatically. Option A is incorrect because alert details enrichment only adds enrichment details, it does not run playbooks. Option C is incorrect because entity behavior analytics does not directly trigger playbooks on incident creation. Option D is incorrect because the requirement is automation, not manual action.

Answer

Configure the alert details enrichment in Sentinel to automatically add the memory dump to the incident.

Answer

Use entity behavior analytics in Sentinel to trigger the playbook when suspicious behavior is detected.

Answer

Have the analyst manually run the playbook from the incident page.