SC-200 Practice Test 2 — 25 Questions

Question 1

A company has multiple Azure subscriptions under a management group. They want to ensure that all VMs across all subscriptions have Microsoft Defender for Cloud's vulnerability assessment solution (using the Microsoft Defender Vulnerability Management engine) enabled. They also want to automatically remediate any non-compliant VMs by enabling the VA solution when a VM is missing it. Which combination of policy initiatives and automation should they use?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Assign the 'Configure machines to receive a vulnerability assessment provider' policy with 'DeployIfNotExists' effect and set it to auto-remediate at the management group-level scope.. The 'Configure machines to receive a vulnerability assessment provider' policy with the 'DeployIfNotExists' effect directly deploys the Microsoft Defender Vulnerability Management (MDVM) extension to any VM that lacks it. By assigning this policy at the management group scope and enabling automatic remediation, the policy will automatically remediate non-compliant VMs without requiring additional runbooks or scripts, fulfilling both the detection and automatic remediation requirements.

Answer

Assign the 'Azure Security Benchmark' initiative at the management group, enable automatic remediation for the 'Vulnerability assessment should be enabled on your virtual machines' policy.

Answer

Assign the 'Defender for Cloud' initiative with the 'Configure machines to receive a vulnerability assessment provider' policy, and configure a remediation task with a deployment script.

Answer

Assign the 'Azure Security Benchmark' initiative and create an Azure Automation runbook triggered by a compliance alert to enable VA.

Question 2

A security analyst needs to connect a Palo Alto Networks firewall to Microsoft Sentinel to ingest logs. The firewall supports Syslog and Common Event Format (CEF). Which data connector should the analyst use?

Accepted Answer

Palo Alto Networks (via Syslog CEF). The Palo Alto Networks firewall supports sending logs in Common Event Format (CEF) over Syslog, and Microsoft Sentinel provides a dedicated data connector specifically for Palo Alto Networks (via Syslog CEF). This connector parses the CEF-formatted syslog messages using a Log Analytics agent or AMA, normalizing fields into the CommonSecurityLog table for seamless ingestion. Using the vendor-specific connector ensures proper field mapping and schema alignment, unlike a generic CEF connector which may not handle Palo Alto's specific CEF extensions correctly.

Answer

Common Event Format (CEF) via Syslog (generic)

Answer

Syslog (without CEF)

Answer

Custom Text Logs

Question 3

A security analyst is investigating a sophisticated attack that involved multiple devices. The analyst needs to create a custom detection rule in Microsoft 365 Defender that triggers when a process with a specific SHA256 hash is executed on any device AFTER an attacker-controlled file is created on another device. Which approach should the analyst use to build this detection?

Accepted Answer

Create a custom detection rule using an advanced hunting query that joins DeviceFileEvents and DeviceProcessEvents, and schedule it in Microsoft 365 Defender.. The requirement is to correlate two distinct events (file creation on one device and process execution on another) across time and devices. An advanced hunting query in Microsoft 365 Defender can join DeviceFileEvents and DeviceProcessEvents tables using a common indicator (e.g., attacker-controlled file hash) and schedule the query as a custom detection rule. This is the only native Microsoft 365 Defender approach that supports multi-device, multi-event correlation with scheduled evaluation.

Answer

Use the Microsoft 365 Defender incident creation rule to generate an incident when the behavior is observed.

Answer

Use Microsoft Sentinel analytics rules with a data connector to Microsoft 365 Defender.

Answer

Use Microsoft Defender for Cloud's workload protection alerts.

Question 4

A SOC team uses Microsoft Sentinel and wants to ingest custom log events from an on-premises Linux application that writes to a local file. The team sets up the Log Analytics agent on the Linux server and configures a data connector. Which of the following is the necessary configuration step to collect the custom log file?

Accepted Answer

Use the Custom Logs feature in the Log Analytics workspace to specify the path to the application log file and define the log type name.. The Custom Logs feature in the Log Analytics workspace is specifically designed to ingest text-based log files from on-premises Linux servers via the Log Analytics agent. You must specify the exact file path (e.g., /var/log/myapp.log) and define a custom log type name (e.g., MyApp_CL) to parse the file and send the data to a custom table in the Log Analytics workspace. This is the only method that directly collects custom application log files without requiring syslog or API-based ingestion.

Answer

Create a Syslog data connector and specify the facility and severity to filter the application logs from /var/log.

Answer

Configure the Log Analytics agent to collect performance counters for the application process.

Answer

Deploy a Log Analytics gateway and configure the application to write directly to the gateway using the HTTP Data Collector API.

Question 5

A company runs SQL Server on Azure Virtual Machines (IaaS). The security team wants to enable Advanced Threat Protection (ATP) to detect threats like SQL injection against these SQL Server instances. Which single action is required to achieve this?

Accepted Answer

Enable Microsoft Defender for SQL on the Azure subscription or at the SQL Server resource level.. To enable Advanced Threat Protection (ATP) for SQL Server on Azure VMs, you must enable Microsoft Defender for SQL at the Azure subscription or SQL Server resource level. This activates the SQL-specific threat detection capabilities, including alerts for SQL injection, anomalous access patterns, and suspicious activities. Without this, the SQL Server instances lack the dedicated security monitoring that ATP provides.

Answer

Install the SQL Server IaaS Agent extension on each virtual machine.

Answer

Enable just Microsoft Defender for Servers on the subscription.

Answer

Configure an Azure SQL firewall rule to allow only trusted IP addresses.

Question 6

A security team wants to automatically block an IP address in Azure Firewall when Microsoft Sentinel detects a high number of failed logins from that IP. Which automation approach should they use?

Accepted Answer

Create an automation rule that triggers on incident creation and runs a playbook that uses the Azure Firewall connector to add a rule.. It uses an automation rule triggered on incident creation to run a playbook, which can leverage the Azure Firewall connector to add a blocking rule. This approach directly integrates Sentinel's detection of a high number of failed logins with automated remediation in Azure Firewall, ensuring a real-time response without manual intervention.

Answer

Create an automation rule that triggers a playbook directly.

Answer

Create a scheduled analytics rule that runs a playbook.

Answer

Configure a Logic App to poll Sentinel alerts and block IPs.

Question 7

A SOC analyst is creating an automation rule in Microsoft Sentinel to trigger a playbook when a new incident is created. The analyst wants the rule to apply only to incidents that have a severity of 'High' and where the 'User' entity is present. Which condition configuration should the analyst use?

Accepted Answer

Set 'Incident severity equals High' and 'Entity type contains User'. Microsoft Sentinel automation rules evaluate conditions at the incident level, not the alert level. The 'Incident severity equals High' condition filters by incident severity, and 'Entity type contains User' checks that the incident's entities include a User entity, which is required for the playbook to receive entity context.

Answer

Set 'Incident severity equals High' and 'Incident tag contains User'

Answer

Set 'Alert severity equals High' and 'Alert entity type contains User'

Answer

Set 'Incident provider equals Microsoft Sentinel' and 'Entity type contains User'

Question 8

You are configuring Microsoft Defender for Cloud Apps session controls for a SharePoint site containing sensitive data. Which condition must be met to apply real-time monitoring?

Accepted Answer

Users must be configured with Conditional Access policies from Microsoft Entra ID.. Microsoft Defender for Cloud Apps session controls for SharePoint require users to be routed through the Cloud App Security proxy, which is invoked by Conditional Access policies in Microsoft Entra ID. Conditional Access app controls apply session policies to traffic when users access SharePoint, enabling real-time monitoring. The Microsoft Entra ID application proxy is designed for on-premises apps, not for SaaS apps like SharePoint Online. Therefore, the correct prerequisite is having Conditional Access policies configured.

Answer

The SharePoint site must be added as a custom app in Defender for Cloud Apps.

Answer

Users must access the site through Microsoft Entra ID application proxy.

Answer

A browser extension must be installed on all client devices.

Question 9

A cloud security administrator needs to ensure that all Azure virtual machines have the Microsoft Defender for Cloud agent (Log Analytics agent) installed automatically when they are provisioned. Which configuration should be set in Microsoft Defender for Cloud?

Accepted Answer

Enable auto-provisioning in the Defender for Cloud environment settings.. Microsoft Defender for Cloud includes an auto-provisioning setting that, when enabled, automatically installs the Log Analytics agent (Microsoft Monitoring Agent) on all existing and newly provisioned Azure virtual machines. This setting is configured in the Defender for Cloud environment settings under 'Auto provisioning' and ensures seamless coverage without manual intervention or additional policy management.

Answer

Deploy a custom Azure Policy to install the agent on all VMs.

Answer

Use an Azure Automation runbook to install the agent on newly created VMs.

Answer

Enable Azure Update Management on the VMs.

Question 10

A security administrator wants to enable vulnerability assessment for all existing and future Azure virtual machines using the integrated Microsoft Defender Vulnerability Management solution. Which action should they take in Microsoft Defender for Cloud?

Accepted Answer

Enable 'Microsoft Defender for Servers' plan and check the 'Vulnerability assessment' option in the environment settings. To enable vulnerability assessment for all existing and future Azure VMs using the integrated Microsoft Defender Vulnerability Management solution, you must enable the 'Microsoft Defender for Servers' plan in Defender for Cloud and then check the 'Vulnerability assessment' option within the environment settings. This action activates the built-in, agentless vulnerability assessment engine that is part of Defender for Cloud, automatically scanning VMs without requiring additional agents or manual deployment.

Answer

Install the Log Analytics agent and configure the Qualys connector on each VM

Answer

Create a policy assignment from the built-in initiative 'Enable Azure Monitor for VMs'

Answer

Enable 'Servers' workload protection in Defender for Cloud and then manually deploy the VA agent to each existing VM using Azure Policy

Question 11

A SOC team uses Microsoft Sentinel. They need to correlate syslog events from on-premises firewalls with Microsoft Entra ID sign-in logs to detect VPN-based intrusions. The correlation requires joining two tables (Syslog and SigninLogs) on a common field (IP address) and running on a 10-minute schedule. Which type of analytics rule should the analyst configure?

Accepted Answer

Scheduled query rule. A scheduled query rule is correct because the requirement involves joining two tables (Syslog and SigninLogs) on a common field (IP address) and running on a 10-minute schedule. Scheduled query rules are designed for complex, multi-table correlations that run at fixed intervals (e.g., every 10 minutes) and can aggregate or join data across tables, making them ideal for this VPN intrusion detection scenario.

Answer

Near-real-time (NRT) rule

Answer

Fusion rule

Answer

Anomaly rule

Question 12

Your SOC team uses Microsoft Defender XDR. You want to ensure that all incidents are automatically classified and determined by the built-in AI before any manual review. What should you configure?

Accepted Answer

Enable the incident summarization and classification feature in Microsoft Defender XDR.. Microsoft Defender XDR includes a built-in AI-driven incident summarization and classification feature that automatically assigns a classification (e.g., true positive, false positive) and determination (e.g., malicious, clean) to each incident before manual review. This feature leverages machine learning models trained on Microsoft's global threat intelligence to reduce alert fatigue and streamline SOC workflows.

Answer

Create a custom detection rule in Microsoft Defender XDR.

Answer

Enable automation rules in Microsoft Sentinel to classify incidents.

Answer

Configure a workbook in Microsoft Sentinel to analyze incidents.

Question 13

A security analyst is configuring Microsoft Sentinel scheduled analytics rules to detect brute-force attacks on Microsoft Entra ID. Arrange the steps in the correct order from first to last.

Accepted Answer

Create a query using KQL to count failed sign-ins. → Set the rule schedule (run every 5 minutes). → Set the alert threshold (e.g., >5 failed sign-ins from same IP in 5 minutes). → Define incident properties (title, severity, tactics). → Configure grouping settings to group alerts into incidents.. The standard workflow for creating a scheduled analytics rule in Microsoft Sentinel begins with defining the detection logic via a KQL query, then configuring the schedule and threshold, followed by incident properties and grouping settings. This sequence ensures the rule has a valid query before setting operational parameters like run frequency and alert aggregation.

Answer

Verify results before configuring the source or rule settings.

Answer

Configure alert grouping before defining the detection query or source.

Answer

Skip validation and enable the rule or plan immediately.

Question 14

A security analyst wants to identify all users who received a phishing email that contained a known malicious URL. The analyst has the URL. Which advanced hunting table should the analyst query first to find the emails that contained this URL?

Accepted Answer

EmailUrlInfo. The EmailUrlInfo table in Microsoft Defender XDR contains records of URLs extracted from email messages, including the specific URL and the email's unique identifier (NetworkMessageId). By querying this table for the known malicious URL, the analyst can retrieve the NetworkMessageIds of all emails containing that URL, which can then be joined with the EmailEvents table to identify the recipients. This is the most direct and efficient first step because EmailUrlInfo is purpose-built to map URLs to email messages.

Answer

EmailEvents

Answer

EmailAttachmentInfo

Answer

EmailPostDeliveryEvents

Question 15

A company has enabled Microsoft Defender for Cloud on their subscription containing Azure SQL databases. They receive an alert about a potential SQL injection attack. The analyst wants to see the actual query that was executed. Where can the analyst find the query details associated with the alert?

Accepted Answer

In the alert's entity tab. When Microsoft Defender for Cloud detects a SQL injection attack, the alert details include an 'Entities' tab that contains the actual SQL query that was executed. This tab provides the raw query text, which is essential for the analyst to understand the exact payload used in the attack and to assess the impact on the database.

Answer

By opening the SQL database's threat detection logs

Answer

In the Azure Activity Log

Answer

In the alert's diagnostic data

Question 16

Your organization uses Microsoft Defender for Cloud to monitor hybrid workloads. You need to ensure that security alerts from on-premises servers running Windows Server 2022 are forwarded to Microsoft Sentinel. The servers are not yet onboarded to Azure Arc. What should you do first?

Accepted Answer

Onboard the servers to Azure Arc and enable Defender for Cloud.. On-premises servers must first be onboarded to Azure Arc to establish a management identity and connectivity with Azure. Without Azure Arc, Defender for Cloud cannot apply its security policies or forward alerts to Microsoft Sentinel. Enabling Defender for Cloud on the servers after Arc onboarding allows security alerts to be collected and forwarded to Sentinel.

Answer

Install the Azure Monitor Agent on the servers.

Answer

Deploy Azure Policy to enable Defender for Cloud on the servers.

Answer

Install Microsoft Defender for Endpoint on the servers.

Question 17

A SOC team uses Microsoft Sentinel with multiple workspaces distributed across different regions. They need to create a single analytics rule that can query data from multiple workspaces to detect cross-tenant attacks. What is the recommended approach?

Accepted Answer

Use cross-workspace queries in a single analytics rule with the workspace() function. The recommended approach is to use cross-workspace queries in a single analytics rule with the workspace() function. This allows the rule to query data from multiple Sentinel workspaces in different regions without duplicating rules or ingesting data centrally. The workspace() function enables a single KQL query to reference tables from up to 100 workspaces, making it ideal for detecting cross-tenant attacks across distributed environments.

Answer

Create separate analytics rules for each workspace

Answer

Create a union workspace that ingests data from all workspaces

Answer

Use Azure Lighthouse to manage multiple workspaces and create rules on each

Question 18

A SOC analyst creates a scheduled analytics rule in Microsoft Sentinel that uses the following KQL query to detect impossible travel: SigninLogs | where TimeGenerated > ago(1d) | summarize Countries = make_set(Location) by UserPrincipalName | where array_length(Countries) > 1 However, the analyst notices that the rule generates too many false positives for users who travel legitimately. What is the best way to refine the rule to reduce false positives without missing actual impossible travel?

Accepted Answer

Modify the query to include a time difference condition using the partition operator or a join to find sign-ins from different countries within a short time window.. Impossible travel detection requires correlating sign-ins from different geographic locations within a time window that is too short for physical travel. By using the partition operator or a join to compare timestamps between sign-ins from different countries, the query can distinguish between legitimate sequential travel (e.g., a user flying from New York to London over 8 hours) and truly impossible simultaneous sign-ins (e.g., sign-ins from New York and London within 30 minutes). This reduces false positives while still catching actual impossible travel.

Answer

Add a condition to filter out VPN IP addresses from the Log Analytics workspace.

Answer

Instead of using make_set, use the dcount() function to estimate distinct countries.

Answer

Use the time series anomaly detection function series_decompose() on the signin data.

Question 19

A security analyst is investigating a ransomware incident and needs to find all files that were written to a specific device within a 5-minute window before the ransomware process started. The analyst knows the device name and the ransomware process start time. Which advanced hunting table and KQL operator combination would be most efficient to find the file creation events?

Accepted Answer

DeviceFileEvents with where. DeviceFileEvents is the correct table because it specifically captures file creation, modification, and deletion events on devices. Using the `where` operator to filter by device name and a timestamp range (5 minutes before the ransomware process start time) is the most efficient way to retrieve the exact file creation events needed for the investigation.

Answer

DeviceProcessEvents with join

Answer

DeviceEvents with where

Answer

DeviceImageLoadEvents with where

Question 20

Your organization uses Microsoft Sentinel with Microsoft Defender XDR integrated. A critical incident has been raised involving a user account that was used to access a confidential SharePoint site from an unusual location at 2:00 AM. The incident includes alerts from Microsoft Defender for Cloud Apps, Microsoft Defender for Identity, and Microsoft Defender for Office 365. The analyst needs to contain the incident, investigate the scope, and begin remediation. The environment has the following: Microsoft Entra ID with conditional access policies, Microsoft Intune for device management, and Microsoft Defender for Endpoint on all devices. The analyst has identified the user account and the device used. Which course of action should the analyst take first?

Accepted Answer

Disable the user account in Microsoft Entra ID and revoke all sessions.. Disabling the user account in Microsoft Entra ID and revoking all sessions is the immediate containment step because it stops the compromised account from being used for any further access, including the suspicious SharePoint access and any lateral movement. This action directly addresses the core of the incident—the user account—and is the fastest way to cut off the attacker's current authentication tokens and sessions, preventing further damage while the investigation proceeds.

Answer

Create a conditional access policy to block the user.

Answer

Isolate the user's device using Microsoft Defender for Endpoint.

Answer

Run a KQL query to find all resources accessed by the user.