SC-200 Practice Test 4 — 25 Questions

Question 1

Your organization has Microsoft Sentinel with UEBA enabled. An incident is generated for a user with high risk score. You need to identify if the user's recent behavior deviates from their baseline. Which Sentinel feature should you use?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The UEBA timeline in the entity page.. The UEBA timeline in the entity page is the correct feature because it provides a chronological view of a user's activities, including deviations from their established behavioral baseline. When UEBA is enabled, Sentinel profiles normal behavior for each user and flags anomalies; the timeline directly visualizes these deviations, such as unusual login times, locations, or resource access, which aligns with the need to identify if recent behavior deviates from the baseline.

Answer

A custom hunting query using the BehaviorAnalytics table.

Answer

The user's Azure AD sign-in logs.

Answer

The incident investigation graph.

Question 2

You are responding to an incident where a user's credentials were used to access a federated SaaS application from an IP address associated with a known threat actor. The user's account is not disabled. Which action is most effective to prevent further unauthorized access?

Accepted Answer

Reset the user's password and revoke active sessions. Resetting the user's password and revoking active sessions immediately invalidates the compromised credentials and terminates any existing authenticated sessions, including the session used by the threat actor. This directly addresses the root cause—credential compromise—without unnecessarily disrupting the user's account permanently. In a federated SaaS scenario, password reset combined with session revocation ensures the threat actor cannot re-authenticate even if they possess the previous password hash or tokens.

Answer

Create a Conditional Access policy to block the IP

Answer

Disable the user's account

Answer

Block the source IP address on the firewall

Question 3

Your organization uses Microsoft Sentinel with User and Entity Behavior Analytics (UEBA) enabled. You notice that the UEBA is not generating any anomalies for a particular user who has been inactive for 30 days. You have verified that the user's data is being ingested into the workspace. What is the most likely reason?

Accepted Answer

UEBA requires a minimum of 14 days of activity to establish a baseline.. UEBA in Microsoft Sentinel requires a minimum of 14 days of historical data to build a behavioral baseline for each user. If a user has been inactive for 30 days, the baseline may have expired or never been established, so no anomalies are generated. The data ingestion is confirmed, but without recent activity, UEBA cannot compare current behavior against a meaningful profile.

Answer

The user's license does not include UEBA.

Answer

UEBA only works with Active Directory data, not Microsoft Entra ID.

Answer

UEBA is not enabled for the workspace.

Question 4

Your organization uses Microsoft Defender for Cloud. You receive a security alert about a suspicious process on a virtual machine. You want to investigate the process further. What should you do?

Accepted Answer

Initiate a live response session on the VM from Microsoft Defender for Cloud.. Microsoft Defender for Cloud's live response capability allows you to remotely connect to a VM and perform real-time forensic actions, such as running commands, examining running processes, and collecting artifacts. This is the most direct way to investigate a suspicious process on a specific VM, as it provides interactive access without needing to install additional agents or reboot the machine.

Answer

Create a custom detection rule to alert on similar processes.

Answer

Run a vulnerability assessment scan on the VM.

Answer

Initiate an automated investigation on the VM.

Question 5

A SOC analyst creates a scheduled analytics rule in Microsoft Sentinel with the following KQL query: SigninLogs | where TimeGenerated > ago(1h) | summarize StartTime = min(TimeGenerated), EndTime = max(TimeGenerated) by UserPrincipalName, IPAddress | where EndTime - StartTime < 5m and count_IPAddress > 1 The intended purpose is to detect users logging in from multiple IP addresses in a short time (impossible travel). However, the rule does not generate any alerts. What is the most likely cause?

Accepted Answer

The query references a column 'count_IPAddress' that does not exist. The summarize operator does not create a column with that name.. The query uses `summarize ... by UserPrincipalName, IPAddress` which groups by both fields, so it does not create a column named `count_IPAddress`. The `where` clause then references `count_IPAddress`, which does not exist, causing the query to fail silently or return no results. This is why no alerts are generated.

Answer

The query does not filter for failed sign-ins (e.g., ResultType == 0).

Answer

The rule should use a longer time range, such as 24 hours.

Answer

The rule needs to use the 'make_set' function to correctly count distinct IP addresses.

Question 6

A security analyst receives a Microsoft Defender for Cloud Apps alert about a suspicious sign-in from an IP address in a sanctioned app. The analyst needs to immediately prevent further access from that IP. What should the analyst do?

Accepted Answer

Create an IP address-based access policy in Microsoft Defender for Cloud Apps.. Microsoft Defender for Cloud Apps provides native IP address-based access policies that can immediately block traffic from a specific IP address for a sanctioned app. This action is taken directly within Defender for Cloud Apps, without needing to modify Entra ID Conditional Access policies, and it applies in real time to the app session. The analyst can create a policy that blocks access from the suspicious IP, preventing further sign-ins from that address.

Answer

Create a mailbox rule to delete emails from that IP.

Answer

Create a Conditional Access policy in Microsoft Entra ID to block the IP.

Answer

Reset the user's password and require MFA re-registration.

Question 7

You are a SOC analyst using Microsoft Defender XDR. You notice that a user's account has been compromised and is being used to send phishing emails. You need to prevent the user from sending any more emails while preserving the ability to receive emails for investigation. What should you do?

Accepted Answer

Restrict the user from sending email using Microsoft Defender for Office 365 mailbox restrictions.. Microsoft Defender for Office 365 mailbox restrictions allow you to block a user from sending email while still permitting them to receive messages. This is done via the 'Restrict user from sending email' policy in the Microsoft 365 Defender portal, which applies a transport rule that rejects outbound mail from the user but leaves inbound delivery intact, enabling forensic analysis of incoming phishing responses.

Answer

Remove the user's Microsoft 365 license.

Answer

Disable the user account in Microsoft Entra ID.

Answer

Delete the user's mailbox in Exchange Online.

Question 8

Your organization uses Microsoft Sentinel with Azure Monitor Agent (AMA) to collect Windows security events. You need to collect process creation events (Event ID 4688) and include command-line information. The current Data Collection Rule (DCR) collects only basic security events. What should you modify?

Accepted Answer

Enable the 'Include command line in process creation events' policy in Windows Group Policy.. Event ID 4688 (process creation) can include command-line arguments, but this data is not captured by default. The 'Include command line in process creation events' Group Policy setting must be enabled on the Windows machines to populate the CommandLine field in the security event log. Without this policy, the AMA and DCR will collect the event but the command-line information will be empty.

Answer

Upgrade the AMA to the latest version.

Answer

Modify the DCR to include Event ID 4688 in the data source.

Answer

Switch to the Windows Security Events via Legacy Agent connector.

Question 9

Your organization uses Microsoft Sentinel with a Log Analytics workspace in the East US region. You need to ensure that incident investigation data is retained for two years for compliance. What should you configure?

Accepted Answer

Adjust the Interactive retention period to 730 days in the Log Analytics workspace.. Log Analytics workspaces allow you to configure the Interactive retention period independently from the Total retention period. Setting Interactive retention to 730 days ensures that incident investigation data remains available for interactive queries for the full two-year compliance requirement, without needing to enable archive or change log types.

Answer

Configure a data retention policy in Microsoft Purview.

Answer

Set the Total retention period to 730 days and enable Archive.

Answer

Enable Basic Logs and set retention to 730 days.

Question 10

In Microsoft 365 Defender, what is the primary function of the Action center?

Accepted Answer

View and manage pending and completed remediation actions from automated investigations.. The Action center in Microsoft 365 Defender is the centralized console for tracking and managing remediation actions generated by automated investigations. It consolidates both pending actions (requiring approval) and completed actions (e.g., quarantining a file, blocking an IP) across Defender for Endpoint, Office 365, Identity, and Cloud Apps, ensuring security teams can review and approve or reject responses without switching contexts.

Answer

Manage user roles and permissions for the security portal.

Answer

Create custom detection rules using advanced hunting queries.

Answer

Manage threat intelligence feeds and indicators.

Question 11

Your organization uses Microsoft Defender for Office 365. You need to configure a policy that automatically moves emails detected as 'Bulk' to the user's Junk Email folder. However, users must be able to override this by adding the sender to their Safe Senders list. What should you configure?

Accepted Answer

Anti-spam policy with Bulk email threshold set to a value that triggers junk action. The Bulk email threshold setting in an anti-spam policy allows you to specify a Bulk Complaint Level (BCL) value that, when exceeded, triggers a specific action such as moving the email to the Junk Email folder. This action respects the user's Safe Senders list, meaning if the sender is added to that list, the email will bypass the junk folder and be delivered to the inbox. Other policy types like anti-phishing, malware filter, or connection filter do not provide this granular control over bulk email classification and user override behavior.

Answer

Anti-phishing policy

Answer

Malware filter policy

Answer

Connection filter policy

Question 12

A security analyst in Microsoft Sentinel wants to create a scheduled analytics rule to detect repeated failed HTTP requests to an Azure Application Gateway, indicating a possible brute force attack. Which Azure Monitor table should the analyst query to capture the access and error logs from the Application Gateway?

Accepted Answer

AzureDiagnostics. AzureDiagnostics is the correct table because it stores resource-level logs for Azure services, including Application Gateway access and error logs. These logs contain detailed HTTP request data (e.g., client IP, URI, status code) necessary to detect repeated failed requests indicative of a brute force attack. Other tables like AzureActivity, AzureMetrics, or SecurityEvent do not capture this specific HTTP-level telemetry.

Answer

AzureActivity

Answer

AzureMetrics

Answer

SecurityEvent

Question 13

Your team uses Microsoft Defender XDR to manage incidents. You need to ensure that all incidents with a severity of 'High' are automatically assigned to a specific SOC analyst group. What should you configure?

Accepted Answer

Create an automation rule in Microsoft Defender XDR to automatically assign incidents.. Microsoft Defender XDR's automation rules allow you to define conditions (e.g., severity equals 'High') and actions (e.g., assign to a specific SOC analyst group) that are executed automatically when incidents are created or updated. This is the native, built-in mechanism for incident assignment without requiring external scripts, playbooks, or email-based workflows.

Answer

Set up an advanced hunting query to detect high severity incidents and send email.

Answer

Configure a playbook in Microsoft Sentinel triggered by incidents.

Answer

Use the 'New-MTPIncidentAssignment' cmdlet in a scheduled task.

Question 14

A security analyst is investigating a suspected lateral movement attack in Microsoft 365 Defender. The analyst wants to identify all devices where a specific user account (user@contoso.com) had an interactive logon, and then check which of those devices subsequently made outbound RDP connections to other internal IP addresses. Which KQL query approach is most efficient to find this chain?

Accepted Answer

Join DeviceLogonEvents (where AccountName == 'user@contoso.com' and LogonType == 'Interactive') with DeviceNetworkEvents (where RemotePort == 3389) on DeviceName, and filter for NetworkEvents timestamp > LogonEvents timestamp. It directly correlates interactive logon events (DeviceLogonEvents with LogonType == 'Interactive') for the specific user with subsequent outbound RDP connections (DeviceNetworkEvents with RemotePort == 3389) on the same device, using a join on DeviceName and a timestamp filter to ensure the network event occurs after the logon. This approach efficiently identifies the lateral movement chain by linking the initial compromise device to the target device via RDP, leveraging the native schema of Microsoft 365 Defender.

Answer

Use IdentityLogonEvents to find the user's logons and join with DeviceNetworkEvents on IP address

Answer

Query EmailEvents to find emails sent from the user and then check DeviceNetworkEvents on the sender device

Answer

Union DeviceLogonEvents and DeviceNetworkEvents, then summarize by DeviceName and filter for the user

Question 15

A security analyst is reviewing an incident in Microsoft 365 Defender where malware was detected on multiple endpoints. The analyst wants to see a visual representation of the attack progression, including the initial entry point and all affected devices. Which feature in the Microsoft 365 Defender portal should the analyst use?

Accepted Answer

Incident graph. The incident graph in Microsoft 365 Defender provides a visual, interactive map of the entire attack progression, showing the initial entry point, lateral movement, and all affected devices and users. It correlates alerts and evidence into a single timeline, enabling the analyst to understand the full scope of the incident at a glance. This directly meets the requirement for a visual representation of the attack progression.

Answer

Advanced hunting

Answer

Threat analytics

Answer

Action center

Question 16

Your organization uses Microsoft Sentinel in a hybrid environment with on-premises servers and Azure VMs. You need to ensure that all Windows servers forward their security events to Sentinel. The security team wants to use Windows Security Events via AMA connector. Windows servers are not domain-joined and are managed by a third-party RMM tool. What is the most efficient way to deploy the AMA agent?

Accepted Answer

Onboard the servers to Azure Arc and deploy the AMA agent via policy or script.. Azure Arc provides a control plane for non-Azure and on-premises servers, enabling them to be managed like Azure resources. Once onboarded to Azure Arc, you can deploy the Azure Monitor Agent (AMA) via Azure Policy or custom scripts, which is the most efficient method for non-domain-joined servers managed by a third-party RMM tool, as it avoids manual intervention and leverages Azure's centralized management.

Answer

Use Group Policy Objects (GPO) to push the agent installation.

Answer

Use Microsoft Intune to deploy the AMA agent to all servers.

Answer

Manually install the agent on each server using the setup wizard.

Question 17

A security team uses Microsoft Defender for Cloud with Defender for Servers enabled. They want to receive an alert whenever a new local user is added to the Administrators group on any Azure Windows virtual machine. Which data source must be configured in Defender for Cloud to capture this event?

Accepted Answer

Windows Security Events (Event ID 4732). The addition of a user to the Administrators group on a Windows system generates Windows Security Event ID 4732. Defender for Cloud with Defender for Servers must have the 'Windows Security Events' data source configured to collect these audit events, which then triggers a security alert for the new local administrator.

Answer

Windows Defender Antivirus logs

Answer

Azure Activity Logs

Answer

VM Insights

Question 18

A security analyst is investigating a phishing campaign targeting multiple users. The analyst has identified a malicious attachment with a known SHA256 hash. The analyst needs to find all email messages that were delivered to any user and contained this specific attachment. Which advanced hunting table should the analyst query in Microsoft 365 Defender to obtain the message IDs of emails containing the attachment?

Accepted Answer

EmailAttachmentInfo. The EmailAttachmentInfo table in Microsoft 365 Defender advanced hunting contains metadata about attachments on email messages, including the SHA256 hash of each attachment. By querying this table with the known malicious SHA256 hash, the analyst can retrieve the NetworkMessageId values for all emails that contained that specific attachment, regardless of whether the email was delivered or blocked.

Answer

EmailEvents

Answer

EmailPostDeliveryEvents

Answer

DeviceFileEvents

Question 19

A SOC analyst needs to create an automation rule that triggers only when an incident contains a specific custom tag (e.g., 'PII'). Which condition should the analyst use to filter incidents based on the presence of that tag?

Accepted Answer

Incident tag contains. Microsoft Sentinel automation rules use the 'Incident tag contains' condition to filter incidents based on the presence of specific custom tags. When an incident is enriched with a tag like 'PII' via analytics rules or playbooks, this condition allows the automation rule to match and trigger actions only on incidents carrying that exact tag, ensuring precise targeting without affecting unrelated incidents.

Answer

Incident severity

Answer

Alert product name

Answer

Entity type

Question 20

Your organization uses Microsoft Sentinel with Microsoft Defender XDR integration. You have a scheduled analytics rule that detects failed logon attempts across multiple on-premises domain controllers. The rule is configured to run every 5 minutes and create an incident when more than 10 failed attempts occur from a single IP address within 5 minutes. Recently, the SOC team noticed that the rule is generating a high volume of low-fidelity incidents, mostly from legitimate users mistyping passwords. You need to reduce the number of false positive incidents while still detecting real brute-force attacks. What should you do?

Accepted Answer

Modify the query to require at least 20 failed attempts from a single IP and include a condition that the attempts are against multiple user accounts.. The correct approach is to tune the analytics rule to be more specific: raising the threshold to 20 failed attempts and requiring attempts against multiple user accounts filters out single-user password mistypes while still catching brute-force attacks that spray across accounts. This directly reduces false positives without losing detection fidelity.

Answer

Increase the query frequency to every 1 minute and reduce the threshold to 5.

Answer

Disable the rule and create a new rule based on successful logons followed by failed attempts.

Answer

Decrease the threshold to 5 and add a condition to exclude known good IP addresses.