SC-200 Practice Test 2 — 25 Questions

Question 1

A user reports that they cannot access their Microsoft 365 apps after clicking a link in an email. You suspect token theft. In Microsoft Defender XDR, which incident investigation action should you take first to verify the scope?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Review the user's sign-in logs in Microsoft Entra ID for anomalous locations. The correct first action is to review the user's sign-in logs in Microsoft Entra ID for anomalous locations (Option A). This allows you to verify if the token is being used from unusual IP addresses or locations, which is a strong indicator of token theft. Isolating the device (B) is a containment step, not initial verification. Checking for malware (C) may be relevant later but does not directly confirm token theft. Investigating the email (D) is about the phishing vector, not the token usage.

Answer

Isolate the user's device from the network

Answer

Check the user's device for malware using Microsoft Defender for Endpoint

Answer

Investigate the email in Microsoft Defender for Office 365

Question 2

During a threat hunt, you discover a previously unknown malware variant that communicates over HTTPS to a command-and-control (C2) server. You want to create a custom detection in Microsoft Sentinel that triggers when any device in the organization resolves the C2 domain via DNS. Which data connector should you ensure is enabled?

Accepted Answer

DNS (Preview) via AMA. (DNS (Preview) via AMA) is correct because the DNS data connector in Microsoft Sentinel ingests DNS query logs from DNS servers, which allows you to detect when devices resolve a specific domain (e.g., the C2 domain). Option B (Azure Activity) is incorrect because it logs Azure resource management activities, not DNS queries. Option C (Office 365) is incorrect because it ingests Office 365 audit logs, not DNS. Option D (Windows Security Events via AMA) is incorrect because it collects security events like logons and process creation, not DNS query logs.

Answer

Azure Activity

Answer

Office 365 (Preview)

Answer

Windows Security Events via AMA

Question 3

Your organization uses Microsoft Sentinel with UEBA (User and Entity Behavior Analytics). An alert indicates a user's sign-in from an unusual location, followed by a mass download of sensitive files from SharePoint. The user is a low-privilege employee. What is the most likely conclusion?

Accepted Answer

The user's account is compromised. The combination of unusual location and mass download of sensitive files by a low-privilege user suggests account compromise. It is not necessarily ransomware or a false positive, and insider threat is less likely without evidence of intent.

Answer

The alert is a false positive due to user travel

Answer

The user is an insider threat

Answer

The user is conducting a ransomware attack

Question 4

A SOC analyst in your organization is investigating an incident in Microsoft Defender XDR that involves a compromised user account. The analyst needs to gather more information about the user's recent activities. Which THREE actions can the analyst take directly from the incident page?

Accepted Answer

Run an advanced hunting query related to the user.. From the Microsoft Defender XDR incident page, the analyst can perform several investigative actions directly. Option A is correct because the incident page provides an 'Advanced hunting' button that pre-fills a query related to the user. Option B is correct because the analyst can trigger an automated investigation playbook directly from the incident page to gather more information. Option C is correct because the incident page allows viewing the user's timeline of recent activities. Option D is incorrect because deleting a user account is not a standard action available from the incident page; account management is done via Microsoft Entra ID. Option E is incorrect because resetting a user's password is not directly available from the incident page; it must be done through Microsoft Entra ID admin center.

Answer

Delete the user account.

Answer

Reset the user's password directly from the incident.

Question 5

A SOC analyst needs to create a Microsoft Sentinel scheduled analytics rule that triggers when an Microsoft Entra ID user performs more than 10 failed sign-in attempts from different IP addresses within 15 minutes, using the SigninLogs table. Which KQL query aggregate pattern should be used?

Accepted Answer

SigninLogs | summarize DistinctIPs = dcount(IPAddress) by UserPrincipalName, bin(TimeGenerated, 15m) | where DistinctIPs > 10. The query uses `dcount(IPAddress)` to count distinct IP addresses per user within a 15-minute time window, then filters for users with more than 10 distinct IPs. This directly matches the requirement to detect failed sign-ins from different IP addresses, not just total failed attempts.

Answer

SigninLogs | summarize FailedCount = count() by UserPrincipalName, IPAddress, bin(TimeGenerated, 15m) | where FailedCount > 10

Answer

SigninLogs | summarize DistinctIPs = count() by UserPrincipalName, IPAddress | where DistinctIPs > 10

Answer

SigninLogs | where Status contains 'Failed' | summarize by UserPrincipalName, IPAddress | count > 10

Question 6

A threat hunter wants to identify anomalous DNS queries that may indicate data exfiltration. In Microsoft Sentinel, which data source is most appropriate for ingesting DNS logs from on-premises servers?

Accepted Answer

DNS connector using Azure Monitor Agent (AMA). The DNS connector using Azure Monitor Agent (AMA) is the most appropriate data source for ingesting DNS logs from on-premises Windows DNS servers. It collects DNS query and response logs directly and parses them into the normalized DNS schema. Option A (Syslog connector) is typically used for Linux-based logs and may not parse Windows DNS fields natively. Option C (Azure DNS connector) is for Azure-hosted DNS zones, not on-premises servers. Option D (Windows Event Forwarding) streams Windows events but does not specifically collect DNS query logs with the same depth as the DNS connector.

Answer

Syslog connector

Answer

Azure DNS connector

Answer

Windows Event Forwarding (WEF)

Question 7

Your Microsoft Sentinel workspace is ingesting data from multiple sources. You need to ensure that data from a specific source is retained for 2 years while other data remains at the default retention. What should you do?

Accepted Answer

Create a custom table for that source and set its retention to 2 years.. In Microsoft Sentinel, retention is set at the table level. By creating a custom table for the specific data source and configuring its retention period to 2 years, you can override the default workspace retention for that table only. This allows other tables to retain the default retention setting while the custom table retains data for the required duration.

Answer

Adjust the data ingestion settings for that source.

Answer

Set the workspace retention to 2 years.

Answer

Configure archiving for that source's data.

Question 8

Refer to the exhibit. You are reviewing a Microsoft Sentinel automation rule definition. The rule is intended to automatically change the severity to High, assign to tier2, and set status to Active for incidents triggered by alerts containing 'malware'. However, incidents are not being updated. What is the most likely cause?

Accepted Answer

The trigger type should be 'IncidentCreated', not 'AlertRule'.. The rule is set to trigger on 'Microsoft.SecurityInsights/AlertRule', which is not a valid trigger for automation rules. Automation rules in Microsoft Sentinel trigger on incident creation (IncidentCreated), not on alert rule creation. Therefore, the incidents are not being updated because the rule never triggers. Option C correctly identifies that the trigger type should be 'IncidentCreated'. Option A is incorrect because the action configuration does not require an 'incident' property; actions like changing severity and status are applied directly. Option B is incorrect because the 'Contains' operator is valid for condition evaluation on alert fields. Option D is incorrect because managed identities are not required for automation rules; they use system-assigned managed identities if needed for playbooks, but the issue here is the trigger type.

Answer

The action configuration is missing the 'incident' property.

Answer

The condition operator 'Contains' is incorrect; should be 'Equals'.

Answer

The playbook requires a managed identity to run.

Question 9

Your organization uses Microsoft Sentinel. You need to design a solution to automatically respond to a specific type of incident by sending an email to the SOC manager and creating a ticket in ServiceNow. What should you use?

Accepted Answer

Create a playbook in Microsoft Sentinel and trigger it with an automation rule.. Microsoft Sentinel uses Azure Logic Apps-based playbooks to execute complex, multi-step automated responses, such as sending an email and creating a ServiceNow ticket. An automation rule is required to trigger the playbook when an incident meets specific criteria, as analytics rules alone cannot directly invoke external systems like ServiceNow.

Answer

Create an analytics rule that directly sends an email.

Answer

Create a workbook that triggers a webhook.

Answer

Create an automation rule that sends an email and creates a ticket.

Question 10

Which TWO actions should you take when handling a confirmed ransomware incident in an environment protected by Microsoft Defender for Endpoint?

Accepted Answer

Block the ransomware file hash using threat intelligence indicators in Microsoft Defender.. Blocking the ransomware file hash via threat intelligence indicators in Microsoft Defender for Endpoint (MDE) immediately prevents further execution of that known malicious file across all endpoints in the environment, leveraging the built-in TI indicator feature. Option B is correct because initiating device isolation from the MDE console disconnects the affected device from the network while maintaining connectivity to the MDE service, containing the spread of ransomware without losing visibility or control.

Answer

Disable Windows Defender real-time protection.

Answer

Submit the ransomware sample to Microsoft for analysis.

Answer

Reimage all affected servers immediately.

Question 11

Match each Microsoft 365 Defender workload to its description.

Accepted Answer

Microsoft Defender for Endpoint: Provides enterprise-grade endpoint security, including antivirus, anti-malware, and advanced threat protection for devices.. Microsoft 365 Defender includes four main workloads: Defender for Endpoint (endpoint security), Defender for Office 365 (email & collaboration), Defender for Identity (on-premises AD security), and Defender for Cloud Apps (cloud app security). Common confusions involve mixing up definitions between these workloads.

Answer

Microsoft Defender for Endpoint: Safeguards email and collaboration tools (Exchange, SharePoint, Teams) against phishing, spam, malware, and other threats.

Answer

Microsoft Defender for Office 365: Uses on-premises Active Directory signals to identify, detect, and investigate advanced threats and identity compromises.

Question 12

You are a security operations analyst at a company that uses Microsoft Sentinel. You need to ensure that all incidents generated from Microsoft Defender for Cloud Apps are automatically assigned to the same SOC team. The team uses Microsoft Teams to collaborate. Which configuration should you implement?

Accepted Answer

Create an automation rule that sets the owner to the team entity.. Automation rules in Microsoft Sentinel can directly set the incident owner to a specific user or group (such as a SOC team) without requiring a playbook. This ensures all incidents from Microsoft Defender for Cloud Apps are automatically assigned to the designated team, streamlining ownership and collaboration via Microsoft Teams.

Answer

Create a playbook that assigns the incident to the team and configure an automation rule to run it.

Answer

Configure the Microsoft Defender for Cloud Apps connector to assign incidents to the team.

Answer

Use a logic app to automatically post incidents to a Teams channel and have the team claim them.

Question 13

Refer to the exhibit. A SOC analyst runs this KQL query in Microsoft Sentinel to investigate devices in the finance subnet. Which result would indicate that a device might be compromised?

Accepted Answer

A device with multiple connected networks, including an external IP.. A device with multiple connected networks, especially including an external IP, could indicate lateral movement or command and control activity, suggesting compromise. The other options are not inherently suspicious.

Answer

A device named 'finance-server-01' with a single network connection.

Answer

A device with no network connections in the last 7 days.

Answer

A device with a LocalIPAddress starting with 10.0.0.

Question 14

Your incident response team receives an alert from Microsoft Sentinel for a user account that has been compromised. The alert indicates that the user's credentials were used from an unfamiliar location. What is the first action you should take?

Accepted Answer

Disable the user account in Microsoft Entra ID. The first action should be to disable the user account in Microsoft Entra ID (Option A). This immediately stops any further unauthorized access using the compromised credentials. Reviewing sign-in logs (Option B) is important for investigation but should follow containment to prevent additional damage. Resetting the password (Option C) is a step after disabling, but disabling first is critical to block access instantly. Notifying the user (Option D) could tip off an attacker if the user is not the actual person or if they are compromised.

Answer

Review the sign-in logs to confirm the alert

Answer

Reset the user's password

Answer

Notify the user and ask them to change their password

Question 15

An organization uses Microsoft Defender for Cloud Apps to detect anomalous behavior. An alert indicates that a user has signed in from an impossible travel scenario. The SOC analyst confirms the alert is a false positive due to a VPN. What should the analyst do to prevent future false positives for this user?

Accepted Answer

Add the VPN IP range to the trusted IP addresses in Defender for Cloud Apps.. Adding the trusted IP range in Microsoft Defender for Cloud Apps allows the system to ignore impossible travel alerts from VPN IPs. The other options are not effective or appropriate.

Answer

Change the user's location in Microsoft Entra ID.

Answer

Ignore the alert and continue monitoring.

Answer

Disable the impossible travel detection rule.

Question 16

You are investigating a phishing incident in Microsoft Defender XDR. The alert indicates that a user clicked a malicious link in an email. After confirming the email was delivered to the user's inbox, what should be your first action?

Accepted Answer

Use Microsoft Defender for Office 365 to soft-delete the email from the user's mailbox and other recipients. The first action should be to use Microsoft Defender for Office 365 to soft-delete the email from the user's mailbox and other recipients. This immediately removes the malicious email from inboxes, preventing further access to the link. Option A is not the first action because blocking the URL does not remove the already delivered email; the email still resides in the inbox. Option B is incorrect because resetting the password is only necessary if credentials were compromised, and the priority is removal of the threat. Option C is incorrect because training is a long-term prevention measure, not an immediate response.

Answer

Add the URL to the tenant block list in Microsoft Defender for Office 365

Answer

Send a training notification to the user

Answer

Reset the user's password immediately

Question 17

Your organization is using Microsoft Sentinel and has deployed the Microsoft Entra ID (Azure AD) connector. You need to create an analytics rule that triggers an incident when a user from a specific IP address is assigned the Global Administrator role. The IP address is not in your trusted IP list. Which KQL query should you use as the rule logic?

Accepted Answer

AuditLogs | where ActivityDisplayName == 'Add member to role' and TargetResources[0].displayName == 'Global Administrator' and InitiatedBy.app.ipAddress !in (dynamic(['10.0.0.1', '10.0.0.2'])). It uses the `!in` operator to filter out specific IP addresses from the `InitiatedBy.app.ipAddress` field, ensuring that only events from IP addresses not in the trusted list trigger an incident. The query correctly targets `AuditLogs` with `ActivityDisplayName == 'Add member to role'` and checks that the role assigned is `Global Administrator` via `TargetResources[0].displayName`. This logic matches the requirement to alert when a user from a specific IP address (10.0.0.1) that is not in the trusted list is assigned the Global Administrator role.

Answer

AuditLogs | where ActivityDisplayName == 'Add member to role' and TargetResources[0].displayName == 'Global Administrator' and InitiatedBy.app.ipAddress == '10.0.0.1'

Answer

AuditLogs | where ActivityDisplayName == 'Add member to role' and TargetResources[0].displayName == 'Global Administrator' and InitiatedBy.app.ipAddress !has '10.0.'

Answer

AuditLogs | where ActivityDisplayName == 'Add member to role' and TargetResources[0].displayName == 'Global Administrator' and InitiatedBy.app.ipAddress !in ('trusted IP list')

Question 18

Your SOC team uses Microsoft Sentinel incident investigation. An analyst needs to quickly see all related entities (users, IPs, machines) for an incident. Which feature should the analyst use?

Accepted Answer

Incident investigation graph. The Incident investigation graph in Microsoft Sentinel provides a visual, interactive map of all entities (users, IPs, machines) linked to an incident, allowing analysts to quickly see relationships and pivot between entities. This is the dedicated feature for entity-centric incident exploration, unlike other options that serve different purposes.

Answer

Incident timeline

Answer

Hunting blade

Answer

Entity behavior analytics page

Question 19

An analyst runs this advanced hunting query to investigate suspicious command-line activity. Which type of activity is this query most likely detecting?

Accepted Answer

Execution of obfuscated scripts via encoded commands. The advanced hunting query likely detects the use of encoded commands (e.g., -EncodedCommand or -enc) in PowerShell execution, which is a common technique to obfuscate the actual script being run. Encoded commands are used to hide malicious intent from basic log inspection. Option A correctly identifies this as execution of obfuscated scripts via encoded commands. Option B is incorrect because data exfiltration would typically involve outbound network connections, not encoded commands. Option C is incorrect because privilege escalation does not directly rely on encoded commands. Option D is incorrect because port scanning involves network connections, not encoded command execution.

Answer

Data exfiltration to external IPs

Answer

Privilege escalation attempts

Answer

Port scanning activity

Question 20

You are reviewing the automation rule configuration shown in the exhibit. What is the purpose of this rule?

Accepted Answer

Run a playbook to isolate a device when an incident with 'Malware' in the alert title is created. The automation rule is configured to trigger when an incident is created with 'Malware' in the alert title. The action specified is to run a playbook, which in Microsoft Sentinel can perform complex remediation steps such as isolating a device. Option C correctly identifies this combination of trigger condition and action.

Answer

Automatically resolve incidents related to malware

Answer

Automatically close incidents with 'Malware' in the title

Answer

Create a playbook for malware alerts