SC-200 Practice Test 3 — 25 Questions

Question 1

During a security incident response, you need to collect forensic evidence from a Windows 10 device that is suspected to be compromised. The device is not domain-joined and is located in a remote office. You have remote administrative access. Which Microsoft 365 tool should you use to acquire a memory dump of the device?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Microsoft Defender for Endpoint. Microsoft Defender for Endpoint (MDE) includes Live Response capabilities that allow authorized administrators to remotely connect to a Windows 10 device and collect forensic data, including memory dumps. Option A is incorrect because Microsoft Sentinel is a SIEM and SOAR platform, not a tool for direct endpoint forensic collection. Option B is incorrect because Microsoft Purview eDiscovery is designed for content searches and legal holds in Microsoft 365, not live memory acquisition. Option C is incorrect because Microsoft Intune focuses on device management, policy enforcement, and application deployment, not live forensic evidence collection.

Answer

Microsoft Sentinel

Answer

Microsoft Purview eDiscovery

Answer

Microsoft Intune

Question 2

Refer to the exhibit. You are reviewing an automation rule in Microsoft Sentinel. What is the effect of this rule?

Accepted Answer

It changes the status of newly created incidents from 'New' to 'Active'.. The automation rule is configured to run when an incident is created, and the action taken is to change the incident status from 'New' to 'Active'. This is a common initial triage step to indicate that the incident is being worked on, rather than leaving it in the default 'New' state. The rule does not assign ownership, suppress incidents, or create tasks.

Answer

It assigns the incident to the SOC team.

Answer

It suppresses the incident if it is a false positive.

Answer

It creates a task in the incident for investigation.

Question 3

You are a SOC analyst investigating an incident where a user's credentials were used to access a sensitive SharePoint site from an unusual location. Microsoft Defender for Cloud Apps detected the activity as a suspicious sign-in. You need to create a detection rule that alerts whenever a user accesses SharePoint from a location not in the allowed list. What type of rule should you create in Microsoft Defender for Cloud Apps?

Accepted Answer

Activity policy.. An Activity policy in Microsoft Defender for Cloud Apps allows you to create custom rules that trigger alerts based on specific user activities, such as accessing SharePoint from a location not in the allowed list. This policy type evaluates each activity against defined conditions (e.g., IP address ranges, geolocation) and can generate alerts or take automated actions. It is the correct choice because it directly matches the requirement to detect a specific access pattern (location-based anomaly) rather than broad behavioral patterns.

Answer

App discovery policy.

Answer

Session policy.

Answer

Anomaly detection policy.

Question 4

You are a security analyst at Contoso. You manage a Microsoft Sentinel workspace with Microsoft Defender for Cloud Apps, Microsoft Defender for Endpoint, and Microsoft Entra ID (formerly Azure AD) data connectors. You are performing a proactive threat hunt for potential data exfiltration via external file sharing services like Dropbox and Google Drive. Your organization blocks these services on managed devices but users can access them from personal devices. You want to detect when users log in to these services from a corporate network using Microsoft Entra ID credentials. You have access to CloudAppEvents, AADSignInEventsBeta, and DeviceNetworkEvents tables in Microsoft Defender XDR advanced hunting. You need to create a hunting query that identifies sign-ins to external file sharing apps from corporate IP ranges. The query should also exclude sign-ins from known good service accounts. Which approach should you take?

Accepted Answer

Join AADSignInEventsBeta with CloudAppEvents on AccountUpn, filter for app categories containing 'file sharing', and where IPAddress is in the corporate range.. This query joins AADSignInEventsBeta with CloudAppEvents on the AccountUpn field, then filters for app categories containing 'file sharing' and where the IPAddress is within the corporate IP range. This directly identifies sign-ins to external file sharing apps from corporate IPs using Microsoft Entra ID credentials, and can exclude known good service accounts by adding a filter on the user or account name. Option A only uses network events without sign-in context, so it cannot determine if the user actually signed in with Entra ID credentials. Option B uses CloudAppEvents and filters by IP, but then joins with DeviceInfo for device ownership; this does not include the sign-in events, and it may miss personal devices not managed. Option D relies on high-volume traffic analysis, which is less precise and lacks the app-level context.

Answer

Use DeviceNetworkEvents to find connections to file sharing service IPs, then correlate with AADSignInEventsBeta by user.

Answer

Filter CloudAppEvents for app categories 'file sharing' and where IP is in corporate range, then join with DeviceInfo for device ownership.

Answer

Use DeviceNetworkEvents to find high-volume outbound traffic to cloud storage provider IP ranges, then manually investigate users.

Question 5

Which TWO data sources are natively supported by Microsoft Sentinel for ingesting security events? (Choose two.)

Accepted Answer

Windows Security Events. Windows Security Events are natively supported by Microsoft Sentinel via the Windows Security Events via AMA connector or the legacy Log Analytics agent. This connector ingests security event logs (e.g., Event ID 4625 for failed logons) directly into Sentinel without requiring a third-party parser or custom data connector. Azure Activity Logs are also natively supported through the Azure Activity connector, which streams subscription-level operational events (e.g., resource creation, policy changes) into Sentinel at no additional cost.

Answer

Salesforce audit logs

Answer

GitHub audit logs

Answer

Google Cloud Platform (GCP) logs

Question 6

You are the lead security operations analyst for a company that uses Microsoft Defender XDR. The company has recently deployed Microsoft Copilot for Security to help analysts investigate incidents. During a recent incident involving a potential ransomware attack on multiple devices, the analysts used Copilot to generate an investigation summary and recommended actions. However, the analysts report that Copilot's responses are not specific to the incident; they are generic and do not include device-specific details. You need to ensure that Copilot provides context-aware responses that include specific device information from the incident. What should you do?

Accepted Answer

Instruct analysts to use the 'Investigate' capability in Copilot and provide the incident ID.. To get context-aware responses with device-specific details, analysts must use the 'Investigate' capability within Copilot and provide the incident ID. This enables Copilot to retrieve and analyze data specific to that incident, including device information from Defender XDR. Option A is incorrect because assigning a role in Entra ID does not affect Copilot's access to incident details. Option B is incorrect because the Defender XDR data connector in Sentinel is for ingesting data into Sentinel, not for providing context to Copilot. Option D is incorrect because Copilot does not rely on custom plugins for this functionality; the built-in 'Investigate' capability is designed for this purpose.

Answer

Assign the Microsoft 365 Defender role to the analysts in Microsoft Entra ID.

Answer

Enable the Microsoft Defender XDR data connector in Microsoft Sentinel.

Answer

Configure a custom plugin in Copilot to fetch device data from Defender XDR.

Question 7

Which TWO remediation actions are available in Microsoft Defender for Endpoint when responding to a malware infection?

Accepted Answer

Run a full antivirus scan. Microsoft Defender for Endpoint allows running a full antivirus scan as a remediation action for malware infections. Option E is correct because isolating the device from the network is a built-in remediation action to contain the threat and prevent lateral movement. Option B is incorrect because disabling the user account is an identity-related action typically performed in Microsoft Entra ID, not within MDE's remediation capabilities. Option C is incorrect because resetting to factory settings is not a standard remediation action in MDE; it would be a post-remediation step. Option D is incorrect because blocking the application in Defender for Cloud Apps is a cloud app security control, not a remediation action within Endpoint.

Answer

Disable the user account

Answer

Reset the device to factory settings

Answer

Block the application in Defender for Cloud Apps

Question 8

You are investigating a security incident in Microsoft Sentinel where a user reported receiving a phishing email with a malicious attachment. You need to identify all users who received the same email within the last 24 hours. Which KQL query should you use?

Accepted Answer

EmailEvents | where SenderFromAddress == 'attacker@example.com' and Subject == 'Invoice' and Timestamp > ago(24h) | project RecipientEmailAddress. This KQL query filters the EmailEvents table by the attacker's sender address and the specific subject 'Invoice' within the last 24 hours, then projects the RecipientEmailAddress to list all users who received that email. Option A is incorrect because it filters by a specific recipient, which only returns that one user's record, not all recipients. Option B is incorrect because it uses EmailUrlInfo, which is for URL clicks, not email delivery; it would only show users who clicked a malicious URL. Option C uses EmailAttachmentInfo and filters by a filename, but this would only identify recipients of emails with that specific attachment; it may miss variations. Option D directly identifies all recipients of the phishing campaign by matching the sender and subject.

Answer

EmailEvents | where RecipientEmailAddress == 'user@contoso.com' and Timestamp > ago(24h) | project SenderFromAddress, Subject

Answer

EmailUrlInfo | where Url == 'http://malicious.com' | project RecipientEmailAddress

Answer

EmailAttachmentInfo | where FileName == 'malicious.doc' | project RecipientEmailAddress

Question 9

Which THREE actions should be taken when a phishing attack is detected in Microsoft Defender XDR?

Accepted Answer

Report the email as phishing in Microsoft Defender for Office 365. Reporting the email as phishing in Microsoft Defender for Office 365 triggers automated investigation and remediation workflows, including tenant-level block actions and threat intelligence updates. This action directly supports the incident response process by enabling the security team to analyze the phishing attempt and prevent further delivery to other users.

Answer

Run a full antivirus scan on the user's device

Answer

Reset the user's password

Question 10

Which THREE components are required to use Microsoft Sentinel's automation rules to automatically respond to incidents?

Accepted Answer

The appropriate permissions to run playbooks.. Automation rules require appropriate permissions (e.g., Microsoft Sentinel Contributor or Automation Contributor) to execute playbooks. Without these permissions, the automation rule cannot invoke the playbook when an incident is created or updated, even if the rule and playbook are properly configured.

Answer

A playbook created in Azure Logic Apps.

Answer

An analytics rule generating alerts.

Question 11

Your organization uses Microsoft Sentinel. A security analyst receives an alert from a custom analytics rule that triggers on a specific sequence of failed logon attempts followed by a successful logon from an unusual location. The incident is generated but the analyst is not sure if the activity is malicious or a user error. What should the analyst do first to quickly gather additional context?

Accepted Answer

Use the Investigation graph to explore related entities and events. Using the Investigation graph in Microsoft Sentinel allows the analyst to visually explore related entities and events to understand the scope and context of the incident. Option A is wrong because running a KQL query across the entire workspace is time-consuming and less efficient. Option B is wrong because creating a new analytics rule would not help with immediate investigation. Option D is wrong because modifying the existing rule is not appropriate for investigating a single incident.

Answer

Run a KQL query across the entire workspace to find all related events

Answer

Create a new analytics rule to detect similar patterns

Answer

Modify the existing analytics rule to add more conditions

Question 12

You have deployed Microsoft Defender for Endpoint and integrated it with Microsoft Sentinel. You notice that alerts from Defender for Endpoint are not appearing in Sentinel. What should you check first?

Accepted Answer

Verify that the Microsoft 365 Defender connector in Sentinel is enabled and configured.. The Microsoft 365 Defender connector in Microsoft Sentinel is the specific data connector responsible for ingesting alerts from Microsoft Defender for Endpoint (and other Defender products). If this connector is not enabled or misconfigured, alerts will not flow into Sentinel regardless of licensing, device onboarding, or analytics rules. This is the first and most direct check because the connector acts as the ingestion pipeline.

Answer

Confirm that Defender for Endpoint is licensed for all users.

Answer

Check that the alert severity is not being filtered out by analytics rules.

Answer

Ensure that all devices are onboarded to Defender for Endpoint.

Question 13

Your organization uses Microsoft Sentinel for security operations. You need to ensure that a specific AWS CloudTrail log is ingested into Microsoft Sentinel. Which data connector should you use?

Accepted Answer

Amazon Web Services S3 Connector. The Amazon Web Services S3 Connector is the correct choice because AWS CloudTrail logs are stored as JSON files in an S3 bucket. Microsoft Sentinel ingests these logs by connecting directly to the S3 bucket, reading the CloudTrail log files, and pulling them into the Log Analytics workspace. The AWS CloudTrail Connector, by contrast, is a legacy connector that requires a separate AWS Lambda function and is deprecated in favor of the S3 connector.

Answer

AWS CloudTrail Connector

Answer

Azure Functions (AWS)

Answer

AWS Security Hub Connector

Question 14

You are configuring Microsoft Sentinel to ingest logs from a third-party firewall via Syslog. The data connector shows 'Connected' but no events are being received. You have verified network connectivity and firewall configuration. What should you check next?

Accepted Answer

Validate that the Data Collection Rule (DCR) is properly configured to ingest the Syslog facility and severity.. When a Syslog data connector shows 'Connected' but no events are received, the most common cause is a misconfigured Data Collection Rule (DCR). The DCR defines which Syslog facilities and severities to collect; if it does not match the firewall's actual Syslog output (e.g., facility 'local0' with severity 'informational'), events will be filtered out before ingestion. Network connectivity and firewall configuration are already verified, so the DCR is the next logical check.

Answer

Verify that the connector has the necessary OAuth permissions in Microsoft Entra ID.

Answer

Check that the user who configured the connector has the Microsoft Sentinel Contributor role.

Answer

Ensure the firewall is registered in Azure Policy as a compliant resource.

Question 15

You are investigating a potential ransomware incident detected by Microsoft Defender XDR. The incident shows multiple machines with suspicious encryption activity. You need to contain the threat immediately. What should you do first?

Accepted Answer

Initiate device isolation on affected machines from Microsoft Defender XDR. In a ransomware incident, immediate containment is critical. Device isolation from Microsoft Defender XDR disconnects the affected machines from the network, preventing the ransomware from spreading to other systems and stopping further encryption. This is the most effective first step. Running a full antivirus scan (B) is reactive and may not halt active encryption. Resetting passwords (A) or disabling user accounts (D) does not stop malware already executing on the endpoints. Therefore, initiating device isolation (C) is the correct initial action.

Answer

Reset the passwords of all users on the affected machines

Answer

Run a full antivirus scan on all endpoints

Answer

Disable the user accounts associated with the affected machines

Question 16

A security analyst receives a high-severity alert for a suspicious login from an unusual location. The alert was generated by Microsoft Sentinel from Microsoft Entra ID sign-in logs. The analyst needs to determine if the login was successful and if any data exfiltration occurred. What is the MOST efficient first step?

Accepted Answer

Run a KQL query in Microsoft Sentinel to review the SigninLogs table for the user within the alert time range.. The most efficient first step is to run a KQL query in Microsoft Sentinel against the SigninLogs table for the specific user within the alert time range. This directly confirms whether the suspicious login was successful by checking the 'ResultType' and 'ResultDescription' fields, which is the fastest way to validate the alert's core claim before investigating data exfiltration.

Answer

Use Microsoft Defender XDR to check the user's device timeline for suspicious activity.

Answer

Run a KQL query in Microsoft Sentinel to check Microsoft Defender for Cloud Apps alerts for the user.

Answer

Check the firewall logs in Azure Firewall for outbound connections from the user's IP.

Question 17

You are investigating a suspicious sign-in to a privileged account. You need to determine if the sign-in was from a known malicious IP address. Which Microsoft Sentinel data source should you query?

Accepted Answer

ThreatIntelligenceIndicator. The ThreatIntelligenceIndicator table in Microsoft Sentinel contains indicators of compromise, including known malicious IP addresses, making it the correct data source to query for this investigation. Option B (SecurityEvent) contains Windows security event logs, not threat intelligence. Option C (SigninLogs) shows sign-in events but does not include threat intelligence data. Option D (AuditLogs) records directory changes and administrative activities, not threat indicators.

Answer

SecurityEvent

Answer

SigninLogs

Answer

AuditLogs

Question 18

A SOC analyst needs to write a KQL query for a Microsoft Sentinel scheduled analytics rule that detects impossible travel activity. The rule should alert when a user signs in from two different countries within 60 minutes. The analyst has the SigninLogs table with columns: UserPrincipalName, IPAddress, Location (country), TimeGenerated. Which KQL query pattern correctly triggers an alert for each pair of sign-ins meeting the condition?

Accepted Answer

Self-join SigninLogs on UserPrincipalName, where TimeGenerated difference < 60m and Location != Location, then summarize by bin(TimeGenerated, 1h).. It uses a self-join on SigninLogs to compare each sign-in event with every other sign-in event for the same user (UserPrincipalName). The join matches pairs where the absolute time difference is less than 60 minutes (TimeGenerated difference < 60m) and the locations are different (Location != Location). This produces one row per pair of sign-ins that meet the impossible travel condition, directly alerting for each pair. The subsequent summarize by bin(TimeGenerated, 1h) is used to group the pairs into hourly buckets to avoid duplicate alerts for the same detection window, but the core logic identifies each individual pair.

Answer

Use the `make_list()` function to aggregate all locations per user within a 60-minute window and check if the list has more than one distinct value.

Answer

Use the `series_decompose()` function to detect outliers in location sequences.

Answer

Use the `rolling_join()` function to compare each sign-in with the previous one per user.

Question 19

As a threat hunter at Contoso, you are investigating a potential advanced persistent threat (APT) that may have compromised multiple Azure subscriptions. You have Microsoft Defender for Cloud enabled and Microsoft Sentinel collecting data from all subscriptions. You suspect the attacker is using Azure Resource Manager operations to create malicious resources. You need to create a hunting query that identifies anomalous Azure management operations, specifically focusing on operations that create new resources (e.g., virtual machines, storage accounts) from unusual IP addresses or at unusual times. Which approach should you take?

Accepted Answer

Use the AzureActivity table to filter for operations where HttpMethod == 'PUT' (create/update), then summarize by CallerIpAddress and bin(TimeGenerated, 1h) to find spikes or unusual caller IPs.. The correct approach because it uses the AzureActivity table (which captures Azure Resource Manager operations) and filters for HTTP PUT (write) operations, then summarizes by caller IP and time bins to detect unusual activity. Option A is incorrect because CommonSecurityLog is used for network traffic from security appliances, not Azure management operations. Option B is inefficient as it requires manual review of all write operations without any aggregation or anomaly detection. Option D is incorrect because SigninLogs captures authentication events, not resource management operations.

Answer

Use the CommonSecurityLog table to analyze network traffic from management tools.

Answer

Use the AzureActivity table in Microsoft Sentinel to query for any operation where the OperationNameValue contains 'write' and then manually review each result.

Answer

Query the SigninLogs table in Microsoft Sentinel for all interactive sign-ins to the Azure portal, then cross-reference with Azure Activity logs.

Question 20

Your organization uses Microsoft Sentinel with multiple workspaces. You need to ensure that incidents involving the same alert in different workspaces are automatically grouped into a single incident. What should you configure?

Accepted Answer

Create an analytics rule that runs across all workspaces.. You can create a scheduled analytics rule that queries across multiple workspaces (using the workspace() function or union operator) and if the same alert appears in multiple workspaces, the rule can generate a single incident. This allows automatic grouping of correlated alerts from different workspaces into one incident. Option D is incorrect because Microsoft Sentinel does not have a dedicated 'incident grouping rule' that groups alerts from multiple workspaces; that feature does not exist.

Answer

Enable UEBA to correlate alerts across workspaces.

Answer

Set up an automation rule to merge incidents.

Answer

Configure an incident grouping rule in Microsoft Sentinel.