SC-200 Practice Test 3 — 25 Questions

Question 1

An organization has connected a Palo Alto Networks firewall to Microsoft Sentinel using the Common Event Format (CEF) connector via a Linux log forwarder. The analyst notices that some expected firewall logs are missing in Sentinel. Which troubleshooting step should be performed first to check if the logs are reaching the Sentinel workspace?

Accepted Answer

Run a KQL query in the Sentinel Logs workspace: CommonSecurityLog | where TimeGenerated > ago(1h) | take 10. Option A is correct because the first step in troubleshooting missing logs in Microsoft Sentinel is to verify whether the logs are actually reaching the workspace. Running a KQL query against the CommonSecurityLog table (which stores CEF data) with a recent time filter confirms if any CEF logs have been ingested. If the query returns results, the issue lies elsewhere (e.g., parsing or missing events); if it returns no results, the problem is upstream (connector, forwarder, or source). This step isolates the problem to the Sentinel ingestion pipeline before investigating network or configuration issues.

Answer

Check the firewall configuration to ensure syslog forwarding is enabled and pointing to the correct Linux forwarder

Answer

Verify network connectivity between the firewall and the Linux forwarder on port 514 (or the configured port)

Answer

Restart the Log Analytics agent on the Linux forwarder

Question 2

Match each Microsoft Sentinel data connector on the left with the table name it populates on the right.

Accepted Answer

Microsoft Entra ID → SigninLogs; Windows Security Events via AMA → SecurityEvent; Cisco ASA via Syslog → CommonSecurityLog; Azure Activity → AzureActivity. Option A is correct because it accurately maps each Microsoft Sentinel data connector to its corresponding log table. Microsoft Entra ID populates the SigninLogs table, Windows Security Events via AMA populates the SecurityEvent table, Cisco ASA via Syslog populates the CommonSecurityLog table (which is the standard schema for syslog-based security appliances), and Azure Activity populates the AzureActivity table. These mappings are defined by the data connectors themselves and are fundamental to querying the correct data in Sentinel.

Answer

The first and last mappings are swapped.

Answer

Every item maps to the same log table or feature category.

Answer

Only identity-related items are mapped; workload and network items are omitted.

Question 3

Arrange the steps in the correct order to create and save a custom hunting query in Microsoft Sentinel.

Accepted Answer

Open the Microsoft Sentinel workspace in the Azure portal → Navigate to the Hunting blade in the Sentinel menu → Click on the 'New Query' button → Write the KQL query in the query editor → Run the query to verify results → Save the query with a meaningful name and description. Option A is correct because creating a custom hunting query in Microsoft Sentinel requires first accessing the workspace, then navigating to the Hunting blade, clicking 'New Query', writing the KQL query, running it to validate results, and finally saving it with a meaningful name and description. This sequence ensures the query is tested before being stored, aligning with Sentinel's workflow for ad-hoc threat hunting.

Answer

Verify results before configuring the source or rule settings.

Answer

Configure alert grouping before defining the detection query or source.

Answer

Skip validation and enable the rule or plan immediately.

Question 4

In Microsoft 365 Defender advanced hunting, an analyst is investigating a case where a user's device was compromised via a malicious base64-encoded PowerShell script. The analyst wants to find all processes that were created by this script by decoding the command line. Which KQL function should be applied to the ProcessCommandLine column in the DeviceProcessEvents table?

Accepted Answer

base64_decode_tostring(ProcessCommandLine). The correct KQL function to decode a Base64-encoded string into a readable text format in Microsoft 365 Defender advanced hunting is `base64_decode_tostring()`. This function takes a string column (like ProcessCommandLine) and returns the decoded plaintext, allowing the analyst to see the actual PowerShell commands executed. The other options are either invalid KQL functions or do not exist in the Kusto Query Language used in advanced hunting.

Answer

parse_base64(ProcessCommandLine)

Answer

decode_base64(ProcessCommandLine)

Answer

convertstring(ProcessCommandLine, 'base64')

Question 5

During an incident investigation in Microsoft 365 Defender, an analyst examines an email that was reported as phishing. The analyst opens the email entity page and looks at the 'Detection details' section. Which piece of information would the analyst find there?

Accepted Answer

The detection technology (e.g., Advanced ML, Reputation) and if the email was part of a phish simulation or a campaign.. Option D is correct because the 'Detection details' section on the email entity page in Microsoft 365 Defender specifically shows the detection technology used (e.g., Advanced ML, Reputation, Bulk) and whether the email was part of a phishing simulation or a campaign. This information helps analysts understand how the email was identified as malicious and its context within broader threat activity.

Answer

The delivery location and whether the email was delivered to Inbox, Junk, or Quarantine.

Answer

The authentication statuses (SPF, DKIM, DMARC) for the sender domain.

Answer

The sender IP address and the recipient email address.

Question 6

Your organization has multiple Azure subscriptions and wants to ensure that all of them have Microsoft Defender for Cloud's enhanced security features enabled. What is the minimal step required to achieve this for all subscriptions?

Accepted Answer

Enable the required Defender for Cloud plans at the management group level. Enabling Microsoft Defender for Cloud plans at the management group level is the minimal step because it applies the configuration to all child subscriptions under that management group in a single action. This leverages Azure's hierarchical management structure, ensuring every subscription inherits the enhanced security features without needing individual subscription-level configuration.

Answer

Assign an Azure Policy initiative to enable Defender for Cloud on each subscription

Answer

Install the Log Analytics agent on all virtual machines in each subscription

Answer

Create a security contact email for each subscription

Question 7

An organization uses Microsoft Sentinel to monitor Microsoft Entra ID sign-ins. A SOC analyst creates a scheduled analytics rule that runs every 15 minutes and uses the following KQL query: SigninLogs | where TimeGenerated > ago(30m) | summarize count() by IPAddress | where count_ > 10. The rule is intended to detect brute-force attacks from a single IP address. However, the analyst notices that alerts are generated even when IP addresses are within the company's trusted corporate network range. What is the most appropriate fix to reduce false positives?

Accepted Answer

Modify the query to exclude IP addresses from the corporate network by adding '| where IPAddress notin (dynamic(['10.0.0.0/8', '172.16.0.0/12', '192.168.0.0/16']))' or by using a watchlist. Option A is correct because the query currently counts all sign-in attempts, including those from trusted corporate IP ranges, which generates false positives for brute-force detection. By adding a filter to exclude corporate IP addresses (e.g., RFC 1918 ranges) or using a watchlist, the rule only alerts on external IPs that exceed the threshold, reducing noise. This directly addresses the root cause—internal traffic being incorrectly flagged—without altering detection logic or data sources.

Answer

Increase the threshold from 10 to 20 failed attempts

Answer

Decrease the rule's run frequency to every 5 minutes

Answer

Change the data source to AADNonInteractiveUserSignInLogs

Question 8

Your organization uses Microsoft Sentinel. You have been asked to configure automated responses to security incidents. Which TWO of the following can be used to automate responses in Microsoft Sentinel?

Accepted Answer

Playbooks (Azure Logic Apps). Playbooks in Microsoft Sentinel are built on Azure Logic Apps, allowing you to automate complex, multi-step response workflows triggered by security incidents. They can execute actions like blocking IPs, resetting passwords, or enriching alerts with threat intelligence, making them a core automation tool for incident response.

Answer

Workbooks

Answer

Power Automate flows

Answer

Custom connectors

Question 9

A security team enables Microsoft Defender for Cloud on an Azure subscription and wants to ensure that all Azure SQL databases have threat detection enabled. Which plan must be enabled to receive alerts for SQL injection attempts?

Accepted Answer

Defender for SQL. Defender for SQL is the specific Microsoft Defender for Cloud plan that provides threat detection for Azure SQL databases, including alerts for SQL injection attacks. It monitors database activity for anomalous patterns, such as SQL injection attempts, and generates security alerts. Without this plan enabled, threat detection for SQL databases remains disabled, even if other Defender plans are active.

Answer

Defender for Servers

Answer

Defender for Storage

Answer

Defender for Key Vault

Question 10

Match each Microsoft Sentinel analytics rule type to its correct description.

Accepted Answer

Scheduled → Runs a KQL query on a schedule and generates alerts based on the query results.; Fusion → Correlates multiple high-fidelity alerts from various sources to create a single, comprehensive incident.; Anomaly → Uses machine learning to identify unusual patterns in activity by analyzing entity behavior over time.; Microsoft Security → Creates incidents from alerts generated by Microsoft security products such as Microsoft Defender for Endpoint.. Option A is correct because it accurately describes the four distinct Microsoft Sentinel analytics rule types. Scheduled rules execute KQL queries at defined intervals to generate alerts based on query results. Fusion rules use advanced machine learning to correlate multiple high-fidelity alerts from different sources into a single incident, reducing alert fatigue. Anomaly rules leverage machine learning to detect unusual patterns by analyzing entity behavior over time. Microsoft Security rules automatically create incidents from alerts generated by Microsoft security products like Microsoft Defender for Endpoint, integrating native security signals.

Answer

The first and last mappings are swapped.

Answer

Every item maps to the same log table or feature category.

Answer

Only identity-related items are mapped; workload and network items are omitted.

Question 11

A SOC analyst needs to create an analytics rule in Microsoft Sentinel that triggers when a single user attempts to sign in from more than three different countries within 10 minutes. Which tables and KQL operators are needed?

Accepted Answer

SigninLogs, summarize dcount(Country) by UserPrincipalName, bin(TimeGenerated, 10m) having dcount > 3. Option B is correct because it uses the `SigninLogs` table, which contains Azure AD sign-in events with geographic data, and the `summarize dcount(Country) by UserPrincipalName, bin(TimeGenerated, 10m)` pattern to count distinct countries per user within a 10-minute window. The `having dcount > 3` clause filters for users who signed in from more than three distinct countries, directly matching the requirement.

Answer

SigninLogs, summarize make_set(Country) by UserPrincipalName, then where countof(Country) > 3

Answer

AADSignInEventsMicrosoft, summarize count() by UserPrincipalName

Answer

AzureActivity, summarize make_list(Country) by Caller

Question 12

A security administrator wants to enable vulnerability assessment for all existing and future Azure virtual machines using the integrated Microsoft Defender Vulnerability Management solution. Which action should they take in Microsoft Defender for Cloud?

Accepted Answer

Enable 'Microsoft Defender for Servers' plan and check the 'Vulnerability assessment' option in the environment settings. To enable vulnerability assessment for all existing and future Azure VMs using the integrated Microsoft Defender Vulnerability Management solution, you must enable the 'Microsoft Defender for Servers' plan in Defender for Cloud and then check the 'Vulnerability assessment' option within the environment settings. This action activates the built-in, agentless vulnerability assessment engine that is part of Defender for Cloud, automatically scanning VMs without requiring additional agents or manual deployment.

Answer

Install the Log Analytics agent and configure the Qualys connector on each VM

Answer

Create a policy assignment from the built-in initiative 'Enable Azure Monitor for VMs'

Answer

Enable 'Servers' workload protection in Defender for Cloud and then manually deploy the VA agent to each existing VM using Azure Policy

Question 13

A security analyst is investigating an incident in Microsoft 365 Defender involving a user who received a phishing email. The analyst needs to identify all devices on which the user clicked a link from the email. Which advanced hunting table should the analyst query to find the click events?

Accepted Answer

UrlClickEvents. UrlClickEvents is the correct table because it specifically records click events on URLs in Microsoft Defender for Office 365, including clicks on links in phishing emails. This table captures the user's click action, the URL, and the verdict (e.g., allowed, blocked), enabling the analyst to identify all devices where the user clicked the link.

Answer

EmailEvents

Answer

DeviceEvents

Answer

NetworkEvents

Question 14

A security analyst is investigating an incident in Microsoft 365 Defender where a device is detected as infected with a trojan. The analyst wants to use automated investigation to contain the threat. Which action can be automatically taken on the affected device as part of a standard AIR playbook for endpoint detection and response?

Accepted Answer

Initiate a device isolation.. In Microsoft Defender for Endpoint, the Automated Investigation and Response (AIR) playbook for endpoint detection and response includes the ability to isolate a device from the network. This action stops the device from communicating with other devices or the internet, containing the threat while allowing the investigation to continue. Option D is correct because device isolation is a standard containment action in the AIR playbook for trojan infections.

Answer

Remove the user account from the device.

Answer

Execute a full antivirus scan on the device.

Answer

Disable the network adapter.

Question 15

A company uses Microsoft Defender for Cloud with enhanced security features enabled. They have several Azure virtual machines running SQL Server. The security team wants to enable advanced threat protection for their Azure SQL databases. What should they do?

Accepted Answer

Enable Microsoft Defender for SQL on the subscription.. Microsoft Defender for SQL (formerly Advanced Threat Protection for Azure SQL) is the specific plan that provides threat detection for Azure SQL databases, including SQL Server on Azure VMs. Enabling it at the subscription level ensures all existing and future Azure SQL databases under that subscription are protected, which is the recommended and most efficient approach.

Answer

Enable Microsoft Defender for Servers on the subscription.

Answer

Enable Microsoft Defender for Database on the subscription.

Answer

Configure SQL Vulnerability Assessment in the Azure portal for each database.

Question 16

A company uses Microsoft Defender for Cloud to protect Azure resources. They have an Azure SQL Database containing sensitive customer data. The security team wants to be alerted if a user attempts to perform SQL injection attacks against the database. Which Defender for Cloud plan must be enabled to receive SQL injection alerts?

Accepted Answer

Defender for SQL. Defender for SQL is the correct plan because it specifically provides threat detection for Azure SQL Database, including alerts for SQL injection attempts. It analyzes database audit logs and anomalous query patterns to detect SQL injection attacks, which are a primary threat to sensitive data in SQL databases.

Answer

Defender for Servers

Answer

Defender for Storage

Answer

Defender for App Service

Question 17

A security analyst in Microsoft 365 Defender is investigating an incident that contains multiple alerts from different sources (e.g., Microsoft Defender for Endpoint, Microsoft 365 Defender for Office). The analyst wants to see a consolidated list of all alerts associated with the incident, including their severity, status, and detection source. Which tab within the incident details page should the analyst use?

Accepted Answer

Alerts tab. The Alerts tab on the incident details page in Microsoft 365 Defender provides a consolidated, filterable list of all alerts linked to the incident, regardless of their source (e.g., Microsoft Defender for Endpoint, Microsoft Defender for Office 365). This tab displays each alert's severity, status, and detection source, allowing the analyst to triage and correlate alerts from different workloads in a single view. The other tabs focus on specific entities (devices, users, mailboxes) rather than the unified alert list.

Answer

Devices tab

Answer

Users tab

Answer

Mailboxes tab

Question 18

A cloud security administrator needs to ensure that all Azure virtual machines have the Microsoft Defender for Cloud agent (Log Analytics agent) installed automatically when they are provisioned. Which configuration should be set in Microsoft Defender for Cloud?

Accepted Answer

Enable auto-provisioning in the Defender for Cloud environment settings.. Option A is correct because Microsoft Defender for Cloud includes an auto-provisioning setting that, when enabled, automatically installs the Log Analytics agent (Microsoft Monitoring Agent) on all existing and newly provisioned Azure virtual machines. This setting is configured in the Defender for Cloud environment settings under 'Auto provisioning' and ensures seamless coverage without manual intervention or additional policy management.

Answer

Deploy a custom Azure Policy to install the agent on all VMs.

Answer

Use an Azure Automation runbook to install the agent on newly created VMs.

Answer

Enable Azure Update Management on the VMs.

Question 19

Match each Microsoft Sentinel data connector to its data source.

Accepted Answer

Azure Activity connector: Azure subscription activity logs. Correct matches: Azure Activity → subscription logs, Office 365 → Exchange/SharePoint/Teams, Azure AD → sign-in/audit logs, AWS CloudTrail → API calls. Common confusions include swapping Azure Activity with Azure AD logs, and Office 365 with Azure subscription logs.

Answer

Azure Activity connector: Azure AD sign-in and audit logs

Answer

Office 365 connector: Azure subscription activity logs

Question 20

A SOC analyst needs to create a Microsoft Sentinel scheduled analytics rule that triggers when an Microsoft Entra ID user performs more than 10 failed sign-in attempts from different IP addresses within 15 minutes, using the SigninLogs table. Which KQL query aggregate pattern should be used?

Accepted Answer

SigninLogs | summarize DistinctIPs = dcount(IPAddress) by UserPrincipalName, bin(TimeGenerated, 15m) | where DistinctIPs > 10. Option B is correct because the query uses `dcount(IPAddress)` to count distinct IP addresses per user within a 15-minute time window, then filters for users with more than 10 distinct IPs. This directly matches the requirement to detect failed sign-ins from different IP addresses, not just total failed attempts.

Answer

SigninLogs | summarize FailedCount = count() by UserPrincipalName, IPAddress, bin(TimeGenerated, 15m) | where FailedCount > 10

Answer

SigninLogs | summarize DistinctIPs = count() by UserPrincipalName, IPAddress | where DistinctIPs > 10

Answer

SigninLogs | where Status contains 'Failed' | summarize by UserPrincipalName, IPAddress | count > 10