SC-200 Practice Test 4 — 25 Questions

Question 1

An organization uses Microsoft Defender for Cloud and has enabled enhanced security features. They want to receive alerts when a user attempts to connect to an Azure VM via RDP from a public IP address that is not in a predefined list of trusted IP ranges. Which Defender for Cloud plan or feature provides this capability?

Accepted Answer

Just-In-Time (JIT) VM access. Just-In-Time (JIT) VM access in Microsoft Defender for Cloud allows you to lock down inbound traffic to Azure VMs, reducing exposure to attacks while providing easy access when needed. When enabled, JIT creates rules in the network security group (NSG) that permit RDP (TCP 3389) or SSH (TCP 22) traffic only from specific IP addresses or ranges that you define, and only during a requested time window. If a user attempts an RDP connection from a public IP not in the trusted list, Defender for Cloud generates an alert, as the traffic is blocked by the JIT policy.

Answer

Adaptive network hardening

Answer

Network security groups (NSG) flow logs

Answer

File Integrity Monitoring (FIM)

Question 2

Which TWO are valid methods to collect forensic evidence from a compromised Windows endpoint during an incident? (Choose TWO.)

Accepted Answer

Run KAPE (Kroll Artifact Parser and Extractor) to collect artifacts.. KAPE (Kroll Artifact Parser and Extractor) is a purpose-built tool for collecting and parsing forensic artifacts from live Windows endpoints during incident response. It efficiently gathers critical evidence such as prefetch files, registry hives, event logs, and browser history without altering the system state, making it a valid method for forensic collection.

Answer

Run Windows Update to fix vulnerabilities.

Answer

Reboot the system and boot from a forensic USB drive.

Answer

Use FTK Imager to create a forensically sound image of the hard drive.

Question 3

Your organization uses Microsoft Sentinel with UEBA enabled. You need to investigate a potential insider threat where a user is accessing sensitive data outside of business hours. Which three built-in UEBA entities should you review?

Accepted Answer

User account. User account (B) is correct because UEBA in Microsoft Sentinel profiles user behavior to detect anomalies such as accessing sensitive data outside business hours. The user account entity is the primary identity used to correlate activities, logon events, and data access patterns, enabling the detection of insider threats based on deviations from established baselines.

Answer

Azure subscription

Answer

Resource group

Question 4

Refer to the exhibit. You are deploying a Microsoft Sentinel workspace using an ARM template. After deployment, you notice the workspace is in a disabled state for ingesting data. Which parameter is most likely causing this?

Accepted Answer

The dailyQuotaInGB parameter sets a daily cap that may have been exceeded. The dailyQuotaInGB parameter sets a daily ingestion cap for the Log Analytics workspace. If this cap is reached, data ingestion is disabled until the next day, causing the workspace to appear in a disabled state for ingesting data. This is the most likely cause because the question explicitly states the workspace is disabled for data ingestion, which aligns with the behavior of the daily cap being exceeded.

Answer

The location parameter is set to 'eastus' but Sentinel is not available in that region

Answer

The retentionInDays parameter is set to 90, which is less than the default 30 days

Answer

The workspaceName parameter is set to 'SentinelWorkspace' but the name must be globally unique

Question 5

Refer to the exhibit. You run this KQL query in Microsoft Sentinel. What is the purpose of the query?

Accepted Answer

To count alerts by severity over the last week. The KQL query uses the `SecurityAlert` table and summarizes alerts by `AlertSeverity` using the `count()` aggregation function. The `where TimeGenerated > ago(7d)` filter restricts results to the last 7 days, and the `project` clause outputs only the severity and count columns. This directly produces a count of alerts grouped by severity over the last week, matching option B.

Answer

To list all incidents in the last 7 days

Answer

To find the most recent high-severity alert

Answer

To identify hunting results

Question 6

Which THREE actions are part of the containment phase in the Microsoft Incident Response process?

Accepted Answer

Block known malicious IP addresses at the firewall.. Blocking known malicious IP addresses at the firewall is a containment action because it immediately stops inbound or outbound communication with threat actors, preventing further data exfiltration or command-and-control traffic. In the Microsoft Incident Response (IR) process, containment focuses on limiting the blast radius and stopping the spread of an attack, and firewall rules are a primary technical control for achieving this at the network perimeter.

Answer

Notify senior management of the incident.

Answer

Collect forensic data from affected systems.

Question 7

You run the above KQL query in Microsoft Sentinel to identify ransomware alerts from the last day. The result shows zero rows. Which is the most likely reason?

Accepted Answer

No alerts with 'ransomware' in the name occurred in the last day. The KQL query filters for alerts where the name contains 'ransomware'. If no such alerts were generated in the last day, the query returns zero rows. This is the most likely reason because the query logic is correct, and the absence of data is a valid outcome, not an error.

Answer

The table name 'SecurityAlert' is incorrect; it should be 'Alert'

Answer

The user does not have permission to access the SecurityAlert table

Answer

The time filter of 1 day is too restrictive; need to increase range

Question 8

A company uses Microsoft Sentinel with Microsoft Defender for Cloud Apps. An incident is created when a user downloads 500 GB from SharePoint in one hour. The analyst wants to create a playbook that automatically suspends the user in Microsoft Entra ID when such activity is detected. Which connector and action should the analyst use in the playbook?

Accepted Answer

Microsoft Entra ID connector with 'Update user' action to set accountEnabled to false.. The correct answer is B because the Microsoft Entra ID connector provides the 'Update user' action, which can set the 'accountEnabled' property to false, effectively suspending the user in Microsoft Entra ID. This directly addresses the requirement to automatically disable a user account when a high-volume SharePoint download incident is detected in Microsoft Sentinel. The playbook can be triggered by the incident and use this action to perform the suspension without manual intervention.

Answer

Microsoft Teams connector with 'Post message' action to notify admin.

Answer

Microsoft 365 Defender connector with 'Run advanced hunting' action.

Answer

Exchange Online connector with 'Set mailbox' action.

Question 9

In Microsoft 365 Defender, an analyst is investigating an incident involving a malicious script. The analyst wants to see the command-line arguments executed by the script on a specific device. Which Advanced Hunting table should the analyst query?

Accepted Answer

DeviceProcessEvents. The DeviceProcessEvents table in Advanced Hunting captures process creation events, including the command-line arguments used to execute a process. Since the analyst needs to see the command-line arguments executed by a malicious script on a specific device, querying DeviceProcessEvents is the correct approach because it records the ProcessCommandLine column for each process creation event.

Answer

DeviceNetworkEvents

Answer

DeviceFileEvents

Answer

DeviceEvents

Question 10

A security administrator wants to ensure that all existing and future Azure virtual machines have Microsoft Defender for Cloud's built-in vulnerability assessment solution (Qualys or Microsoft) installed without manual intervention. Which feature should the administrator configure?

Accepted Answer

Auto-provisioning of the vulnerability assessment solution. Auto-provisioning of the vulnerability assessment solution ensures that Microsoft Defender for Cloud automatically installs either the Qualys or Microsoft built-in vulnerability assessment extension on all existing and future Azure VMs without manual intervention. This feature is specifically designed to enable continuous vulnerability scanning by deploying the agent at scale, covering both new and existing resources as they are provisioned or discovered.

Answer

Continuous export of security findings to Log Analytics

Answer

Just-in-time VM access

Answer

Regulatory compliance dashboard

Question 11

Your organization uses Microsoft Defender for Office 365. You detect a phishing email that was delivered to a user's inbox. You want to remove the email from all recipients. What should you do?

Accepted Answer

Use Threat Explorer to find the email and take action to delete it.. Threat Explorer in Microsoft Defender for Office 365 allows security analysts to search for specific emails based on attributes like sender, subject, or recipient, and then take bulk remediation actions such as soft-delete (move to Deleted Items) or hard-delete (purge from mailbox). This is the correct tool to remove a phishing email that has already been delivered to users' inboxes, as it provides granular search and remediation capabilities for existing messages.

Answer

Submit the email to Microsoft for analysis.

Answer

Create a mail flow rule to delete similar emails in the future.

Answer

Block the sender using the Tenant Allow/Block List.

Question 12

A cloud security administrator receives an alert from Microsoft Defender for Cloud indicating that a virtual machine has been compromised. The administrator wants to quickly isolate the VM from the network to prevent further spread while preserving the disk for forensic analysis. Which action should the administrator take?

Accepted Answer

Use the "Isolate VM" action in the security alert.. The 'Isolate VM' action in Microsoft Defender for Cloud is designed specifically for compromised VMs. It applies a network security group (NSG) rule that denies all inbound and outbound traffic to the VM, effectively quarantining it from the network while leaving the disk intact for forensic analysis. This is the fastest and most direct method to contain the threat without altering the VM's configuration or disk state.

Answer

Apply a just-in-time (JIT) access policy to the VM.

Answer

Enable the Azure Security Benchmark initiative for the VM.

Answer

Configure a custom Azure Policy to deny network access.

Question 13

A company has enabled Microsoft Defender for Cloud on its Azure subscription. The security team wants to ensure that all existing virtual machines have a vulnerability assessment solution installed. Which Defender for Cloud feature can automatically deploy a vulnerability assessment agent to supported VMs?

Accepted Answer

Vulnerability assessment recommendations. The Vulnerability Assessment (VA) recommendations in Microsoft Defender for Cloud can automatically deploy a vulnerability assessment agent (such as the Qualys or Microsoft Defender Vulnerability Management agent) to supported Azure VMs. When a VM is found to be missing a VA solution, Defender for Cloud can enable the 'Auto-provision' setting for the VA recommendation, which triggers the agent installation without manual intervention. This directly meets the requirement to ensure all existing VMs have a vulnerability assessment solution installed.

Answer

Defender for Servers plan

Answer

Security policies

Answer

Workload protections

Question 14

A company uses Microsoft Defender for Cloud to protect their Azure resources. They have enabled the enhanced security features on a subscription that contains several Azure SQL databases. They want to be alerted if a user attempts to perform SQL injection attacks against these databases. Which Defender for Cloud plan specifically enables SQL injection detection alerts?

Accepted Answer

Defender for SQL. Defender for SQL is the specific Microsoft Defender for Cloud plan that provides SQL-specific threat detection, including alerts for SQL injection attacks. This plan monitors SQL databases for anomalous activities such as SQL injection attempts, brute-force attacks, and unusual access patterns by analyzing query logs and audit records. Enabling Defender for SQL on the subscription activates these detection capabilities for Azure SQL databases, making it the correct choice for the scenario.

Answer

Defender for Servers

Answer

Defender for App Service

Answer

Defender for Storage

Question 15

A Microsoft Sentinel incident contains alerts from multiple analytics rules. The analyst suspects the same compromised account performed impossible travel followed by suspicious mailbox access. Which two actions best help correlate identity and mailbox activity?

Accepted Answer

Query SigninLogs for the account around the alert timestamps. Option A is correct because querying SigninLogs for the account around the alert timestamps directly retrieves Azure AD authentication events, which are essential for identifying the source IP addresses, locations, and timestamps that define the impossible travel pattern. This data is the primary evidence for the first part of the suspected compromise.

Answer

Delete the incident to force it to regenerate

Answer

Disable all analytics rules that contributed alerts

Question 16

A security administrator needs to ensure that only approved applications can run on a set of Windows Server virtual machines. The administrator has already enabled Microsoft Defender for Cloud's enhanced security features. Which Defender for Cloud feature should the administrator configure to define a list of allowed applications and get alerts when unapproved applications are executed?

Accepted Answer

Adaptive Application Controls. Adaptive Application Controls (AAC) is the correct feature because it uses machine learning to establish a baseline of known-safe processes on your Windows Server VMs, then enforces an allowlist so that only those approved applications can run. When an unapproved application is executed, AAC generates a security alert in Microsoft Defender for Cloud, meeting the requirement to both define allowed applications and receive alerts on violations.

Answer

File Integrity Monitoring (FIM)

Answer

Just-in-Time VM Access (JIT)

Answer

Vulnerability Assessment

Question 17

A security administrator wants to see the overall security posture of all their Azure subscriptions in a single numerical score. Which dashboard in Microsoft Defender for Cloud provides this score based on implemented security controls?

Accepted Answer

Secure Score. The Secure Score dashboard in Microsoft Defender for Cloud aggregates the security posture across all Azure subscriptions into a single numerical score. This score is calculated based on the implementation of security controls and recommendations, reflecting the percentage of completed security measures. The administrator needs this consolidated view, which is exactly what Secure Score provides.

Answer

Regulatory Compliance

Answer

Inventory

Answer

Recommendations

Question 18

A security analyst is building a custom detection rule in Microsoft 365 Defender to identify ransomware activity. The rule should trigger when files with specific extensions (e.g., .encrypted, .locked) are created on multiple devices within a short time frame, suggesting a widespread attack. Which combination of advanced hunting tables should be used to obtain both file creation events and device information?

Accepted Answer

DeviceFileEvents and DeviceInfo. Option A is correct because DeviceFileEvents captures file creation events, including the specific extensions like .encrypted and .locked, while DeviceInfo provides device metadata such as device name, OS platform, and device group. Joining these tables on DeviceId allows the analyst to correlate file creation events across multiple devices, enabling detection of widespread ransomware activity within a short time frame.

Answer

DeviceProcessEvents and DeviceInfo

Answer

DeviceFileEvents and DeviceNetworkEvents

Answer

DeviceFileEvents and DeviceLogonEvents

Question 19

A security analyst is configuring a Microsoft Sentinel workspace. The analyst needs to connect a third-party firewall that sends logs via Syslog and supports a common event format (CEF). Which data connector should the analyst use to ingest these logs?

Accepted Answer

Common Event Format (CEF) via AMA. The Common Event Format (CEF) via AMA data connector is specifically designed to ingest logs from security appliances that send Syslog messages in CEF format. CEF is an industry-standard format that allows firewalls and other devices to send structured event data, and the Azure Monitor Agent (AMA) replaces the older Log Analytics Agent for this purpose. This connector parses the CEF headers and maps the fields to the appropriate Microsoft Sentinel tables, enabling efficient threat detection and analysis.

Answer

Windows Security Events via AMA

Answer

Azure Activity Log

Answer

Office 365 connector

Question 20

A security analyst is investigating a potential data exfiltration incident in Microsoft 365 Defender. They have identified a suspicious email sent to an external recipient containing an attachment. They want to know if the attachment has been opened and if any sensitive data was accessed. Which advanced hunting table should the analyst query to find email attachment activities, such as file download or view?

Accepted Answer

EmailEvents. B is correct because EmailEvents is the advanced hunting table in Microsoft 365 Defender that captures email-level activities, including whether an attachment was opened or viewed by the recipient. This table contains actions such as 'Email open' and 'Attachment open', which directly answer the analyst's question about attachment access and potential data exfiltration.

Answer

DeviceFileEvents

Answer

EmailAttachmentInfo

Answer

UrlClickEvents