SC-200 Practice Test 25 — 15 Questions

Question 1

Which TWO of the following are recommended practices when performing threat hunting in Microsoft Sentinel? (Choose 2)

Accepted Answer

Create custom hunting queries based on hypothesis. Option A is correct because threat hunting in Microsoft Sentinel is hypothesis-driven: analysts write custom hunting queries in KQL (via the Hunting blade or Logs) to proactively search for evidence of the hypothesized adversary behavior rather than waiting for alerts. Option E is correct because watchlists let you upload and manage lists of high-value indicators (IPs, accounts, hashes, domains) that hunting queries can join against using the _GetWatchlist() function, keeping threat intel current without editing each query. Option B is wrong because relying solely on automated analytics rules is reactive detection, not proactive hunting, and misses threats the rules do not cover. Option C is wrong because disabling all built-in analytics rules removes valuable detections and creates blind spots instead of tuning noise. Option D is wrong because deleting log data destroys the historical evidence hunting depends on and undermines retention/compliance; query performance is addressed with table plans, summaries, and scoping, not data deletion.

Answer

Rely solely on automated detection rules

Answer

Disable all built-in analytics rules to avoid noise

Answer

Delete log data older than 30 days to improve query performance

Question 2

Which TWO actions can you perform in the Microsoft Defender XDR unified alert queue? (Select TWO.)

Accepted Answer

Link the alert to an existing incident. In the Microsoft Defender XDR unified alert queue, you can link an alert to an existing incident to consolidate related alerts into a single investigation. This action is supported directly from the alert queue interface, allowing analysts to manage incident correlation without leaving the queue. Linking alerts helps reduce alert fatigue and streamlines the incident management workflow.

Answer

Create a hunting query from the alert details

Answer

Edit the analytics rule that generated the alert

Answer

Run a playbook to automatically remediate the alert

Question 3

Your organization uses Microsoft Defender for Identity. You need to monitor for potential lateral movement attacks using pass-the-hash techniques. Which entity type in Microsoft Defender for Identity should you focus on in the security alert timeline?

Accepted Answer

Account. In Microsoft Defender for Identity, lateral movement attacks using pass-the-hash (PtH) techniques are tracked at the account entity level because the attacker reuses a stolen NTLM hash to authenticate as a specific user account across multiple devices. The security alert timeline groups related activities by the compromised account, enabling analysts to trace the attacker's steps from the initial breach to subsequent resource access. Focusing on the account entity provides the clearest view of the authentication attempts and successful logons that indicate PtH behavior.

Answer

IP address

Answer

Device

Answer

Computer

Question 4

Your organization uses Microsoft Sentinel and Microsoft Defender XDR. During an incident investigation, you find that a device is exfiltrating data to an external IP. You need to isolate the device from the network using automated response. Which action should you configure in an automation rule?

Accepted Answer

Run a playbook that triggers a Microsoft Defender for Endpoint 'Isolate device' action.. The scenario requires network isolation of a device that is actively exfiltrating data. Microsoft Defender for Endpoint provides a built-in 'Isolate device' action that can be triggered via a playbook from a Microsoft Sentinel automation rule. This action immediately blocks all inbound and outbound network traffic to and from the device, except for communication with the Defender for Endpoint service, effectively containing the threat.

Answer

Trigger a Microsoft Purview data loss prevention policy.

Answer

Run a Microsoft Entra ID playbook to disable the device.

Answer

Create an automation rule in Microsoft Intune to wipe the device.

Question 5

Your organization uses Microsoft Sentinel. You are investigating an incident and need to gather additional context about a suspicious IP address. Which TWO Microsoft Sentinel features can you use to enrich the investigation?

Accepted Answer

Threat intelligence. Threat intelligence is correct because it allows you to cross-reference the suspicious IP address against known threat intelligence feeds (e.g., Tor exit nodes, known C2 servers) directly within Microsoft Sentinel. This enriches the investigation by providing context such as reputation scores, associated malware families, and geographic origin, helping you assess the IP's maliciousness.

Answer

Watchlist

Answer

Hunting

Answer

User and Entity Behavior Analytics (UEBA)

Question 6

An analyst in your SOC receives a Microsoft Defender for Cloud Apps alert indicating a suspicious Power Automate flow that is forwarding emails to an external domain. The analyst needs to disable the flow immediately. Which action should they take?

Accepted Answer

Use the governance action in Microsoft Defender for Cloud Apps to disable the flow. Microsoft Defender for Cloud Apps (MDCA) provides governance actions directly on discovered app activities, including the ability to disable a Power Automate flow from within the alert. This is the fastest, most targeted remediation because it acts on the specific flow rather than broader controls.

Answer

Block the external domain in Exchange Online mail flow rules

Answer

Remove the flow from the Microsoft 365 admin center

Answer

Disable the user account in Microsoft Entra ID

Question 7

You are a security analyst using Microsoft Sentinel. You want to proactively search for signs of a specific threat actor known to use PowerShell encoded commands. Which hunting technique is most appropriate?

Accepted Answer

Use a hunting query in the Microsoft Sentinel hunting blade to search for PowerShell encoded commands.. Hunting queries in Microsoft Sentinel allow proactive searching for suspicious patterns. Option D is correct because it directly aligns with the need to create a custom KQL query to detect encoded PowerShell commands in the hunting blade. Option A is incorrect because analytics rules trigger alerts after detection, not for proactive hunting. Option B is incorrect because a watchlist is used for correlation with known indicators, not proactive hunting. Option C is incorrect because UEBA identifies anomalies, not specific threat actor techniques.

Answer

Create an analytics rule to trigger an alert when PowerShell encoded commands are detected.

Answer

Create a watchlist of known malicious IPs and correlate with PowerShell events.

Answer

Enable UEBA to detect anomalous PowerShell usage.

Question 8

An organization uses Microsoft Sentinel and Microsoft Defender XDR. A critical incident is created when a user is detected as compromised. The incident severity is set to High. The SOC manager wants to ensure that all incidents with severity High or above are automatically assigned to the senior analyst tier. What should the analyst configure?

Accepted Answer

Define an automation rule to assign incidents based on severity.. Microsoft Sentinel automation rules are designed to trigger on incident creation and perform actions such as assigning owners, changing severity, adding tags, or running playbooks. To automatically assign all High-or-above incidents to the senior analyst tier, an automation rule with a severity condition and an 'Assign owner' action is the correct mechanism.

Answer

Set a playbook to run when an incident is created.

Answer

Create an analytics rule with a custom severity.

Answer

Configure an alert tuning rule.

Question 9

You are investigating an incident in Microsoft Defender XDR that involves a user who clicked a link in a phishing email. The email was detected and blocked by Microsoft Defender for Office 365, but the user still clicked the link before it was blocked. The incident includes an alert for 'Malicious URL click'. What additional information should you check to determine if the user's credentials were compromised?

Accepted Answer

Check for sign-in events from unusual locations or anonymous IP addresses after the click. The 'Malicious URL click' alert confirms the user interacted with the phishing link, but it does not confirm credential theft. The definitive indicator of compromise is a subsequent successful authentication using those credentials from an anomalous source. Checking Microsoft Entra ID sign-in logs (via Defender XDR's Advanced Hunting with AADSignInEventsBeta or the Entra sign-in log) for sign-ins from unusual geolocations, anonymous proxies (e.g., Tor exit nodes), or unfamiliar IPs immediately after the click timestamp reveals whether the attacker actually used the harvested credentials.

Answer

Check if the link was blocked by the time the user clicked

Answer

Check if the user has recently changed their password

Answer

Check if the email had any attachments

Question 10

An organization uses Microsoft Sentinel for security operations. A security engineer needs to automatically disable a compromised user account in Microsoft Entra ID when a high-severity incident is created in Sentinel. Which feature should the engineer use?

Accepted Answer

Automation rule with a playbook. To automatically disable a compromised user account in Microsoft Entra ID when a high-severity incident is created in Sentinel, the engineer should use an automation rule that triggers a playbook. Automation rules in Microsoft Sentinel allow you to define conditions (e.g., incident severity) and then invoke a playbook, which can contain the logic to call Microsoft Graph or Entra ID to disable the user. This is the standard method for automated response.

Answer

Analytics rule

Answer

Workbook

Answer

Hunting query

Question 11

Your organization has Microsoft Sentinel and Microsoft Defender for Identity deployed. An incident is created for a user whose account was used to access a sensitive database from an unusual workstation. The user is a member of the 'Database Admins' group. The security team needs to prevent further unauthorized access and preserve evidence. What should you do first?

Accepted Answer

Disable the user's account in Active Directory. Disabling the user's account in Active Directory is the fastest and most effective way to immediately prevent further unauthorized access while preserving the account and its associated evidence for forensic investigation. It stops all authentication and access without deleting data or altering group memberships that investigators may need to review. Resetting the password or removing group membership does not immediately terminate existing sessions or prevent access as decisively.

Answer

Reset the user's password

Answer

Force the user to log off all sessions

Answer

Remove the user from the Database Admins group

Question 12

Your organization uses Microsoft Sentinel. You receive an incident for a potential data exfiltration involving a sensitive blob storage container. You need to determine if the data was accessed from an unusual IP address. What should you do?

Accepted Answer

Use the Incident details pane to review the entity timeline.. The Incident details pane in Microsoft Sentinel includes an entity timeline that shows activities and events associated with entities (such as IP addresses, accounts, hosts) tied to the incident. Reviewing the entity timeline lets you see whether the blob storage was accessed from an unusual IP and correlate that IP with other activity. This is the direct investigative step for the question.

Answer

Modify the analytics rule that triggered the incident.

Answer

Run a playbook to collect IP information.

Answer

Open the Sentinel workbook for storage monitoring.

Question 13

A company uses Microsoft Sentinel as its SIEM. The security team is investigating an incident that involves multiple alerts from different data sources. The team wants to see a timeline of all related activities across all data sources in one view. Which Microsoft Sentinel feature should they use?

Accepted Answer

Incident timeline. The Incident timeline in Microsoft Sentinel provides a unified chronological view of all alerts and events related to an incident. Option A is wrong because Workbooks are for custom dashboards and reporting, not for viewing incident timelines. Option C is wrong because the Investigation graph focuses on entity relationships, not a chronological timeline. Option D is wrong because the Hunting page is for proactive threat hunting, not incident investigation.

Answer

Workbooks

Answer

Investigation graph

Answer

Hunting page

Question 14

Your organization uses Microsoft Sentinel with a workspace in the East US region. You need to respond to an incident involving data exfiltration from a virtual machine in West Europe. The incident was created from a custom analytics rule that queries the AzureActivity table. What should you do to ensure the incident contains all relevant evidence from the West Europe region?

Accepted Answer

Ensure that Azure activity logs from West Europe are streamed to the same Sentinel workspace in East US. To have the analytics rule in the East US workspace evaluate AzureActivity logs from West Europe, those logs must be collected into the same workspace. Streaming activity logs from West Europe to the East US workspace ensures all relevant data is available for the rule to query. Option A is incorrect because creating a separate workspace in West Europe would isolate the data, and the incident is in the East US workspace; cross-workspace queries would be required. Option C is incorrect because the analytics rule runs only in the workspace where it is defined; to query data from another workspace, you would need a cross-workspace query, but the rule is already defined in East US and cannot directly query the West Europe workspace without additional configuration. Option D is incorrect because incident merge is used to combine duplicate incidents within the same workspace, not across different workspaces.

Answer

Create the analytics rule in a separate workspace in West Europe

Answer

Configure the analytics rule to query the West Europe workspace

Answer

Use the incident merge feature to combine incidents from multiple workspaces

Question 15

Your organization uses Microsoft Sentinel. You have configured a data connector to ingest events from a third-party firewall. However, you notice that the logs are not appearing in Sentinel. What is the first thing you should check?

Accepted Answer

Check the connector health page in Microsoft Sentinel.. The connector health page in Microsoft Sentinel is the first place to check because it shows whether the data connector is connected, when data was last received, and any ingestion errors. If the connector shows a healthy status but no data arrives, the issue is likely upstream (firewall or agent); if it shows disconnected or error, the problem is with the connector itself. This diagnostic step narrows the fault domain before investigating the firewall or agent.

Answer

Check the firewall's syslog server configuration.

Answer

Verify that the workspace is in the correct region.

Answer

Reinstall the Log Analytics agent on the firewall.