SC-200 Practice Test 5 — 25 Questions

Question 1

You are a threat hunter and you want to identify potential lateral movement in your environment. Which Microsoft Defender XDR hunting table would you query to find network connections from a compromised workstation to other internal devices?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

DeviceNetworkEvents. (DeviceNetworkEvents). This table contains network connection events, such as outbound and inbound connections, making it ideal for identifying lateral movement via network connections from a compromised workstation to other internal devices. Option A (DeviceProcessEvents) captures process creation events, not network connections. Option B (DeviceLogonEvents) records authentication events. Option D (DeviceFileEvents) logs file creation and modification events. None of these directly show network connections.

Answer

DeviceProcessEvents

Answer

DeviceLogonEvents

Answer

DeviceFileEvents

Question 2

Which TWO actions can be taken directly from within a Microsoft Sentinel incident to aid in investigation? (Choose two.)

Accepted Answer

Create a bookmark to preserve a specific event. Options A and B are correct because Microsoft Sentinel incidents allow creating bookmarks to preserve evidence and running playbooks directly from the incident page. Option C is incorrect because user risk level is reviewed in Microsoft Entra ID Protection, not directly from the incident. Option D is incorrect because assigning severity is done during incident creation or editing, but it is not considered a primary investigation action taken directly from the incident page. Option E is incorrect because resetting a user's password is not an action available from the Sentinel incident page.

Answer

Review the user risk level in Microsoft Entra ID

Answer

Assign a severity to the incident

Answer

Reset the user's password

Question 3

During a ransomware incident, Microsoft Sentinel generated an incident with high severity. The incident includes alerts from Microsoft Defender for Endpoint, Microsoft Defender for Office 365, and Microsoft Entra ID. Your team needs to automate the containment process. What is the best approach to automatically isolate affected devices and disable compromised accounts?

Accepted Answer

Create an automation rule in Microsoft Sentinel that runs a playbook to isolate devices and disable accounts. Automation rules in Microsoft Sentinel can trigger playbooks that perform cross-product actions like device isolation and account disablement. Option A is wrong because advanced hunting is a manual query tool, not an automated response mechanism. Option C is wrong because custom detection rules only create incidents/alerts, not automated responses. Option D is wrong because automated investigation and response in Microsoft Defender for Endpoint focuses on endpoint containment and does not handle account disablement or cross-product orchestration.

Answer

Use advanced hunting to find all affected devices and accounts

Answer

Create a custom detection rule in Microsoft Sentinel to trigger an incident

Answer

Configure automated investigation and response in Microsoft Defender for Endpoint

Question 4

The exhibit shows the output of a Microsoft Defender for Endpoint API call to get machine information. What does the isolationStatus value indicate?

Accepted Answer

The device has been isolated from the network.. The isolationStatus value in Microsoft Defender for Endpoint indicates whether a device has been isolated from the network. When the value is 'Isolated', it means the device is blocked from communicating with other devices or the internet, typically as a response to a security incident. Option D is correct because this status directly reflects that the device is isolated from the network.

Answer

The device is healthy and has no issues.

Answer

The device is currently being scanned for malware.

Answer

The device is not isolated and is fully connected.

Question 5

Refer to the exhibit. The KQL query is used for threat hunting. What is the primary purpose of this query?

Accepted Answer

Identify devices where cmd.exe launched PowerShell and made outbound HTTPS connections.. The query joins cmd.exe executions containing 'powershell' with network connections to port 443 on the same device, indicating possible PowerShell download cradles initiated from cmd.exe. Option B is wrong because the query focuses on cmd.exe, not generic PowerShell downloads. Option C is wrong because the query does not specifically detect lateral movement via remote services. Option D is wrong because the query does not inspect process integrity levels.

Answer

Find devices where PowerShell was used to download files.

Answer

Detect lateral movement using remote services.

Answer

Identify cmd.exe running with high integrity.

Question 6

An organization uses Microsoft Defender for Endpoint (MDE) to hunt for signs of credential dumping. An analyst runs a custom advanced hunting query that searches for processes accessing LSASS.exe. The query uses DeviceProcessEvents and DeviceFileEvents. The analyst notices that some known credential dumping tools are detected, but they want to find previously unknown variants. Which approach should the analyst take to improve the hunt?

Accepted Answer

Look for anomalous LSASS access patterns using process lineage and call stacks.. Analyzing anomalous LSASS access patterns, such as unusual processes accessing LSASS or suspicious call stacks, helps identify previously unknown credential dumping techniques that do not match existing signatures. Option A is incorrect because Microsoft Defender for Endpoint already collects LSASS access events via its built-in sensors; enabling additional Windows Security Event Log auditing is not necessary and does not directly help discover novel variants. Option B is incorrect because relying on file reputation may miss fileless attacks or signed malicious tools that are not yet categorized as malicious. Option C is incorrect because adding more signature-based indicators will only improve detection of known tools, not unknown variants.

Answer

Enable LSASS auditing via Windows Security Event Log.

Answer

Focus on file reputation data to exclude clean files.

Answer

Add more signature-based indicators to the query.

Question 7

Refer to the exhibit. You are analyzing a KQL query in Microsoft Sentinel that generates an incident for users with more than 5 failed sign-in attempts (error code 50057 indicates user account is disabled) from a single IP in the last hour. After enabling the rule, you receive too many incidents from a service account that legitimately fails frequently. How should you modify the query to reduce false positives?

Accepted Answer

Add a filter to exclude the service account: and UserPrincipalName !="svc-account@domain.com". Adding a filter to exclude the service account directly addresses the false positives. The service account legitimately fails frequently, so excluding it from the query prevents incidents from that account while maintaining detection for other users. Option A is incorrect because changing the error code to 50126 would alter the detection logic and not target the service account issue. Option C is incorrect because removing IPAddress from the summarize clause would eliminate the 'from a single IP' condition, potentially generating incidents for failed attempts from multiple IPs and not solving the false positives. Option D is incorrect because increasing the threshold to 10 would reduce sensitivity but does not specifically exclude the service account, potentially still generating false positives if the service account fails more than 10 times.

Answer

Change the error code to 50126

Answer

Remove the IPAddress from the summarize clause and group only by UserPrincipalName

Answer

Increase the Threshold to 10

Question 8

You are a Microsoft Security Operations Analyst for a large enterprise with 50,000 users. Your organization uses Microsoft Defender XDR, Microsoft Sentinel, and Microsoft Defender for Cloud Apps. The security team has observed an increase in alerts related to SaaS applications (e.g., Box, Salesforce) accessed from unusual locations. You need to design a solution to automatically investigate and respond to these alerts. The solution should: (1) correlate user activity across multiple SaaS apps, (2) automatically isolate a user's account if the risk score exceeds 90, and (3) create an incident in Sentinel. Which approach should you use?

Accepted Answer

Configure Microsoft Defender for Cloud Apps to use session policies that require reauthentication or block access when risk is high, and stream alerts to Sentinel.. Microsoft Defender for Cloud Apps provides session policies that can automatically block access or require reauthentication when risk is high, and it streams alerts to Microsoft Sentinel to create incidents. This meets all requirements: correlating activity across SaaS apps, automatic response based on risk score, and incident creation in Sentinel. Option A requires manual trigger, which is not automated. Option B focuses on endpoint device risk, not SaaS application activity. Option D involves creating separate analytics rules per app and a playbook, which is less integrated and may not provide the same automatic isolation as Defender for Cloud Apps session policies.

Answer

Use Microsoft Sentinel UEBA to detect anomalies and manually trigger a playbook to block the user.

Answer

Deploy Microsoft Defender for Endpoint on all devices and use device risk as a factor for conditional access.

Answer

Create analytics rules in Sentinel for each SaaS app and a playbook to isolate accounts using Microsoft Entra ID conditional access.

Question 9

A threat hunter is using Microsoft Sentinel to hunt for signs of privilege escalation via Azure AD role assignment changes. Which TWO KQL operators or functions are most useful for identifying changes that added a user to a high-privilege role?

Accepted Answer

summarize. The correct answers are D: summarize and E: where. The 'where' operator filters for specific operations like 'Add member to role', which is essential to identify privilege escalation. The 'summarize' operator can count changes per user or role, allowing the analyst to see which users or roles have been modified. Option A (project) only selects columns and does not help with identification. Option B (evaluate) is used for plugin operators and is not relevant here. Option C (mvexpand) expands multi-valued fields, which is not directly useful for this purpose.

Answer

project

Answer

evaluate

Answer

mvexpand

Question 10

Which TWO actions should an analyst take when a user reports receiving a suspicious email with an attachment? (Select TWO.)

Accepted Answer

Submit the email to Microsoft for analysis using the Submissions page in Microsoft 365 Defender.. When a user reports a suspicious email with an attachment, the analyst should submit the email to Microsoft for analysis using the Submissions page in Microsoft 365 Defender (Option A) to improve detection, and delete the email from the user's mailbox using Microsoft 365 Defender (Option C) to remove the threat. Opening the attachment (Option D) is unsafe and could compromise the system. Running a PowerShell script (Option B) is not a recommended security practice. Blocking the sender in Outlook (Option E) only affects that specific user and does not address the broader threat.

Answer

Run a PowerShell script to automatically forward the email to IT.

Answer

Open the attachment to verify if it is malicious.

Answer

Block the sender in the user's Outlook settings.

Question 11

A junior security analyst reports that they cannot create a new analytics rule in Microsoft Sentinel. They have the 'Microsoft Sentinel Contributor' role on the workspace. What could be the issue?

Accepted Answer

The workspace is in a locked resource group preventing modifications.. A resource group lock (e.g., ReadOnly or Delete) prevents any modifications to resources within the group, including the Sentinel workspace. The Microsoft Sentinel Contributor role allows creating analytics rules, so option B is incorrect. Option C is incorrect because the Responder role is for incident response, not rule creation. Option D is incorrect because the Contributor role assigned at the subscription level would be inherited by the workspace, so it should still work unless a lock exists.

Answer

They need the 'Owner' role to create analytics rules.

Answer

They do not have the 'Microsoft Sentinel Responder' role.

Answer

They are assigned the role at the subscription level but not at the workspace level.

Question 12

You are a threat hunter using Microsoft Sentinel. You have ingested syslog data from a Palo Alto firewall. You want to create a scheduled query rule that alerts when more than 10 outbound connections to a known bad IP address occur within 5 minutes. Which KQL function should you use to summarize the count?

Accepted Answer

summarize count() by SourceIp, DestinationIp. `summarize count() by SourceIp, DestinationIp` groups the data by the source and destination IP addresses and counts the number of occurrences in each group, which is exactly what we need to alert when more than 10 outbound connections to a known bad IP occur within 5 minutes. Option A is wrong because `project` selects columns without performing any aggregation; it merely filters the columns returned. Option B is wrong because `extend` adds a new column (here a constant 1) but does not count or group data. Option D is wrong because `join` merges two tables based on a key, not used for counting occurrences within a single table.

Answer

project SourceIp, DestinationIp

Answer

extend Count = 1

Answer

join kind=inner (Syslog)

Question 13

Your incident response team uses Microsoft Sentinel with automation rules and playbooks. During an incident, you need to automatically collect a memory dump from an affected Windows server and upload it to an Azure storage account for analysis. Which type of playbook should you use?

Accepted Answer

A playbook triggered by an automation rule when the incident is created.. Automation rules in Microsoft Sentinel can be configured to trigger a playbook when an incident is created or updated. This allows automatic collection of a memory dump and upload to Azure storage. Option A is incorrect because installing a script on the server is not a playbook type; playbooks are automation workflows that can use various connectors, but the question asks about the trigger mechanism. Option B is incorrect because analytics rules generate alerts, but playbooks cannot be triggered directly from analytics rules; they must be triggered by automation rules or run manually. Option C is incorrect because the requirement is automation, not manual execution.

Answer

A playbook that installs a script on the server to collect the dump.

Answer

A playbook triggered directly from the analytics rule that generates the alert.

Answer

A playbook that must be run manually from the incident page.

Question 14

Your SOC team uses Microsoft Sentinel to manage incidents. You want to categorize incidents based on the MITRE ATT&CK technique. You notice that some incidents are not being tagged with the correct technique. What should you check first?

Accepted Answer

The analytics rule that generated the incident has the correct MITRE ATT&CK technique selected.. The MITRE ATT&CK technique tag on an incident is determined by the analytics rule that generated the incident. If the rule does not have the correct technique selected, the incident will not be tagged correctly. Therefore, the first thing to check is the analytics rule configuration (option D). Option A is incorrect because playbooks are used for automation and can modify tags after creation, but they are not the root cause if the technique was never set. Option B is incorrect because incident creation rules (automation rules) control incident creation and assignment, not the technique mapping. Option C is incorrect because data connectors ingest raw data and fields, but the technique mapping is done at the analytics rule level, not by the connector.

Answer

The playbook assigned to the incident is overriding the technique tag.

Answer

The incident creation rule in the automation section is misconfigured.

Answer

The data connector for the source service is not ingesting the required fields.

Question 15

You are a security analyst at a company that uses Microsoft Sentinel and Microsoft Defender for Identity (now part of Microsoft Defender XDR). During a threat hunt, you need to identify potential golden ticket attacks. You have Windows Security Events (Event ID 4672: Special Logon) and Kerberos service ticket events (Event ID 4769) ingested. A golden ticket attack often involves service ticket requests with unusual encryption types or ticket options. You want to find service ticket requests (4769) that have TicketOptions containing '0x40810000' (forwardable, renewable, canonicalize) and TicketEncryptionType == '0x17' (RC4), which are common in attacks. You need to write a KQL query that returns the top 10 accounts requesting such tickets in the last 7 days. Which query should you use?

Accepted Answer

SecurityEvent | where EventID == 4769 | where TicketOptions == "0x40810000" and TicketEncryptionType == "0x17" | summarize count() by AccountName | top 10 by count_. It filters for Event ID 4769 (Kerberos service ticket requests), applies both conditions (TicketOptions '0x40810000' and TicketEncryptionType '0x17' using equality comparisons), summarizes the count by AccountName, and returns the top 10. Option A is missing the encryption type filter, allowing false positives. Option C uses event ID 4672 (Special Logon) instead of 4769. Option D uses `contains` which is less precise and may match unwanted substrings.

Answer

SecurityEvent | where EventID == 4769 | where TicketOptions == "0x40810000" | summarize count() by AccountName | top 10 by count_

Answer

SecurityEvent | where EventID == 4672 | where TicketOptions == "0x40810000" and TicketEncryptionType == "0x17" | summarize count() by AccountName | top 10 by count_

Answer

SecurityEvent | where EventID == 4769 | where TicketOptions contains "0x40810000" and TicketEncryptionType contains "0x17" | summarize count() by AccountName | top 10 by count_

Question 16

You are the security operations lead for a multinational company using Microsoft Sentinel. You have deployed a custom analytics rule that uses a KQL query to detect anomalous outbound network traffic. The rule runs every hour and looks back 24 hours. Recently, the rule has been generating a high number of false positives. You need to tune the rule to reduce false positives without missing genuine threats. The rule currently triggers when the count of outbound connections to a single IP exceeds 100 in an hour. You analyze the data and find that legitimate cloud services often trigger the rule. What should you do?

Accepted Answer

Modify the KQL query to exclude traffic to known benign IP ranges.. Modifying the KQL query to exclude traffic to known benign IP ranges directly reduces false positives from legitimate cloud services while keeping the detection logic intact. Option A is incorrect because disabling the rule and creating a new one is not a tuning approach and may lead to missed threats. Option B is incorrect because increasing the threshold to 200 connections per hour may still allow some false positives or could miss genuine anomalies that exceed the lower threshold. Option C is incorrect because configuring a suppression rule only hides incidents from those IPs, which does not reduce the underlying false positives and can cause genuine threats from those IPs to be overlooked.

Answer

Disable the rule and create a new one with a different query.

Answer

Increase the threshold to 200 connections per hour.

Answer

Configure a suppression rule to automatically close incidents from those IPs.

Question 17

You are configuring Microsoft Sentinel to ingest syslog data from a network appliance. After configuring the data connector, you notice that no data is appearing in the CommonSecurityLog table. The syslog server is sending data to the Azure Monitor Agent (AMA) on the log collector. What should you verify first?

Accepted Answer

Verify that a Data Collection Rule is defined to collect the syslog facilities.. The Azure Monitor Agent (AMA) requires a Data Collection Rule (DCR) to specify which syslog facilities and severity levels to collect. Without a DCR, the AMA will not forward syslog data to the CommonSecurityLog table, even if the syslog server is sending data to the collector. This is the most common missing configuration step after setting up the data connector.

Answer

Check the Heartbeat table for the log collector.

Answer

Ensure the syslog appliance can reach the collector on UDP port 514.

Answer

Check the data connector health status in Sentinel.

Question 18

Which TWO actions should an analyst take when triaging a Microsoft Sentinel incident that involves a user who clicked a malicious link in a phishing email? (Choose two.)

Accepted Answer

Run a KQL query on EmailEvents to identify the email and recipient.. When triaging a Microsoft Sentinel incident involving a user who clicked a malicious link in a phishing email, the analyst should first identify the affected email and user to understand the scope. Option C is correct because running a KQL query on EmailEvents allows the analyst to pinpoint the specific email and recipient. Option E is correct because checking the email's status in Microsoft Defender for Office 365 Threat Explorer provides additional threat intelligence and confirms the email's disposition. Options A, B, and D are incorrect: resetting the password (A) is premature without evidence of compromise; blocking the sender's domain (B) may be done later but is not an immediate triage action; deleting the email (D) should not be done before investigation as it may be needed for evidence.

Answer

Reset the user's password immediately.

Answer

Block the sender's domain in the tenant's block list.

Answer

Delete the email from the user's mailbox immediately.

Question 19

The exhibit shows a partial playbook trigger configuration in Microsoft Sentinel. When will this playbook be triggered?

Accepted Answer

When an incident of severity High is created.. The playbook trigger configuration shown in the exhibit specifies that the playbook runs when an incident is created, and it includes a condition that filters for incidents with a severity of High. In Microsoft Sentinel, playbook triggers can be set on incident creation or alert creation, and conditions like severity are evaluated at the time of the trigger event. Here, the trigger is explicitly set to 'When an incident is created' with a severity condition of 'High', so the playbook only fires when a new incident with High severity is created.

Answer

When an incident is updated with severity High.

Answer

When an alert is generated with severity High.

Answer

When any incident is created.

Question 20

Refer to the exhibit. An analyst runs the command to install the Azure Monitor Agent on a VM. What is the primary purpose of installing this agent in the context of security incident response?

Accepted Answer

To collect security events and performance data for analysis in Microsoft Sentinel.. The Azure Monitor Agent collects logs and performance data from the VM, which can be ingested into Microsoft Sentinel for security analysis and incident response. Option B is incorrect because while the agent can be used with Microsoft Defender for Cloud, its primary purpose is data collection, not integration. Option C is incorrect because vulnerability scanning is performed by other services, such as Microsoft Defender for Cloud or third-party tools, not by the Azure Monitor Agent. Option D is incorrect because real-time malware protection is provided by endpoint protection solutions like Microsoft Defender Antivirus, not by the Azure Monitor Agent, which focuses on data collection.

Answer

To integrate the VM with Microsoft Defender for Cloud.

Answer

To scan the VM for vulnerabilities.

Answer

To enable real-time malware protection on the VM.