SC-200 Practice Test 26 — 15 Questions

Question 1

You need to create a custom detection rule in Microsoft Sentinel that alerts when an anomalous number of failed logons occur from a single IP address within 5 minutes. Which KQL operator should you use to count failed logons per IP?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

summarize. 'summarize' is used to aggregate counts per key (IP). Option B (project) only selects columns. Option C (where) filters rows. Option D (extend) adds calculated columns.

Answer

project

Answer

where

Answer

extend

Question 2

You are hunting for possible data exfiltration via email in Microsoft 365. Which data source in Microsoft Sentinel provides the most relevant telemetry for email forwarding rules?

Accepted Answer

Office 365 audit logs (Exchange). Office 365 audit logs (Exchange) capture mailbox-level activity including the New-InboxRule, Set-InboxRule, and Set-Mailbox operations that create or modify forwarding rules (ForwardTo, RedirectTo, ForwardAsAttachmentTo). This is the authoritative telemetry source for detecting email-based exfiltration via auto-forwarding in Microsoft 365. Defender for Cloud Apps can surface anomalies but relies on the same underlying audit stream, making the native Office 365 audit log the most direct and complete source.

Answer

Microsoft Defender for Cloud Apps logs

Answer

Windows Security Events

Answer

Azure AD sign-in logs

Question 3

Your organization uses Microsoft Sentinel. You are responsible for responding to incidents. A new 'MFA Denied' incident is created from Microsoft Entra ID sign-in logs, indicating that a user in your organization had multiple MFA denials from a suspicious IP address (203.0.113.5). The user is a sales representative who frequently travels. The incident severity is Medium. The incident contains entities: user 'jsmith@contoso.com', IP address 203.0.113.5, and a device running Windows 11. You need to investigate and determine if this is a true positive. The user is currently on a business trip in Europe, but the sign-in attempts originated from an IP address in a different region. What should you do first?

Accepted Answer

Contact the user to confirm if they attempted to sign in at the time of the alerts.. The first step in investigating a potential true positive is to contact the user to confirm if they attempted to sign in. This helps determine if the MFA denials were legitimate (e.g., user error) or malicious. It is a non-destructive action that gathers critical context.

Answer

Immediately reset the user's password and revoke sessions.

Answer

Block the suspicious IP address in the Conditional Access policy.

Answer

Isolate the user's device using Microsoft Defender for Endpoint.

Question 4

Your organization uses Microsoft Sentinel and Microsoft Defender XDR. You are responsible for managing the security operations environment. Recently, the SOC team reported that incidents from Microsoft Defender for Endpoint are not appearing in Microsoft Sentinel. You have already configured the data connector for Microsoft Defender XDR and verified that logs are flowing into the 'SecurityAlert' table. However, incidents are not being created in Sentinel. What should you do?

Accepted Answer

Enable 'Create incidents from Microsoft 365 Defender' in the Microsoft Defender XDR data connector.. Enabling 'Create incidents from Microsoft 365 Defender' in the Microsoft Defender XDR data connector (A) is the correct action. This setting allows Microsoft Sentinel to automatically create incidents from alerts generated by Microsoft Defender XDR, including those from Defender for Endpoint. Even though alerts are flowing into the SecurityAlert table, incident creation requires this specific toggle to be enabled.

Answer

Create an analytics rule that queries the SecurityAlert table and generates incidents.

Answer

Verify the Azure Sentinel solution is installed and enable the streaming of incidents.

Answer

Configure the Microsoft Defender for Endpoint data connector.

Question 5

Your company uses Microsoft Defender for Cloud Apps. You discover that a user's account is compromised and used to access a sensitive SharePoint site from an unfamiliar IP. You need to immediately revoke the user's session and force them to re-authenticate. Which action should you take?

Accepted Answer

Apply a policy with the 'Revoke session' action.. The 'Revoke session' governance action in Defender for Cloud Apps invalidates the user's active sessions across connected SaaS apps (SharePoint, Exchange, Teams, etc.) and forces re-authentication, which is the correct immediate response to an active session hijack. It is applied via an access or session policy and works with Conditional Access App Control to terminate the session in real time.

Answer

Add the IP to the blocked IP addresses list.

Answer

Create a governance action to suspend the user.

Answer

Send a notification to the user to change their password.

Question 6

A security analyst in Microsoft 365 Defender is investigating an email-based threat. The analyst needs to find all emails that were initially delivered to user inboxes but were later remediated (e.g., moved to junk, deleted, or quarantined) by Zero-Hour Auto Purge (ZAP). Which advanced hunting tables should the analyst query to get both the original email metadata and the post-delivery remediation events?

Accepted Answer

EmailEvents and EmailPostDeliveryEvents. To investigate emails that were initially delivered but later remediated by Zero-Hour Auto Purge (ZAP), you need both the original email metadata (from EmailEvents) and the post-delivery remediation actions (from EmailPostDeliveryEvents). EmailEvents provides details like sender, recipient, subject, and delivery status, while EmailPostDeliveryEvents records ZAP actions such as moving to junk, deleting, or quarantining. Querying these two tables together allows you to correlate the initial delivery with the subsequent remediation event.

Answer

EmailEvents and EmailAttachmentInfo

Answer

EmailPostDeliveryEvents and EmailUrlInfo

Answer

EmailEvents and CloudAppEvents

Question 7

You deploy this ARM template to a Microsoft Sentinel workspace. After deployment, you notice that the saved search does not appear as an analytics rule. What is the most likely reason?

Accepted Answer

The resource type is 'savedSearches', not 'scheduledQueryRules' or 'alertRules'.. In Azure Resource Manager, the resource type determines what kind of object is created. A 'savedSearches' resource creates a saved search query in Log Analytics/Sentinel, which is a reusable query definition — not an analytics rule. Analytics rules in Microsoft Sentinel are created using the 'scheduledQueryRules' resource type (or the older 'alertRules' type). Therefore, even though the template deployed successfully, the saved search will never appear as an analytics rule because it is a fundamentally different resource type.

Answer

The tags are incorrectly formatted.

Answer

The API version is incorrect.

Answer

The KQL query syntax is invalid.

Question 8

You are designing a Microsoft Sentinel deployment. You need to minimize ingestion costs while ensuring that all security-relevant events are collected. Which strategy should you use?

Accepted Answer

Use Basic Logs for verbose data sources like Windows firewall logs, and Analytic Logs for high-value security logs. Microsoft Sentinel offers two log plan tiers: Analytic Logs (full KQL, alerts, workbooks) and Basic Logs (cheaper ingestion, limited query, 30-day retention). Placing high-volume, low-value sources like Windows firewall logs in Basic Logs and reserving Analytic Logs for high-value security events minimizes cost while still collecting all relevant data. This is the documented cost-optimization pattern.

Answer

Use Analytic Logs for all data sources to ensure full query capabilities

Answer

Set short retention periods for all logs and export to storage

Answer

Collect only logs from Microsoft 365 Defender and ignore other sources

Question 9

Which THREE components are required to collect syslog messages from a network appliance into Microsoft Sentinel using the Azure Monitor Agent?

Accepted Answer

A syslog daemon (e.g., rsyslog) on the log collector server to receive messages.. Syslog messages are sent over UDP (or TCP) by network appliances, and a syslog daemon like rsyslog must be running on the log collector server to listen on port 514 (or a custom port) and receive those messages. Without this daemon, the Azure Monitor Agent cannot ingest the raw syslog data, as the agent relies on the local syslog daemon to capture and forward the logs to its event pipeline.

Answer

The Log Analytics agent (MMA) installed on the appliance.

Answer

The Syslog data connector in Microsoft Sentinel.

Question 10

During a threat hunt, you identify a user account that has been logging in from multiple geographic regions within a short time. Which Microsoft Defender for Cloud Apps feature should you use to investigate this anomaly?

Accepted Answer

Activity log. The Activity log in Microsoft Defender for Cloud Apps provides detailed records of user activities, including login locations and times, making it ideal for investigating anomalies like logins from multiple geographic regions. Option A (Cloud Discovery) is used to identify shadow IT and cloud app usage, not user login anomalies. Option B (App permissions) focuses on permissions granted to OAuth apps, not user activity. Option C (File policy) is for monitoring and protecting files, not login events.

Answer

Cloud Discovery

Answer

App permissions

Answer

File policy

Question 11

Which TWO of the following are required to enable user and entity behavior analytics (UEBA) in Microsoft Sentinel?

Accepted Answer

Windows Security Events via AMA must be ingested.. Windows Security Events ingested via the Azure Monitor Agent (AMA) provide the necessary user and entity activity data (e.g., logon events, process creation) that UEBA analyzes to establish behavioral baselines and detect anomalies. Without this data source, UEBA lacks the raw security events required for user and entity profiling.

Answer

Microsoft Entra ID diagnostic logs must be streamed.

Answer

Azure subscription diagnostic logs must be enabled.

Answer

Microsoft Defender XDR connector must be configured.

Question 12

A security analyst receives an alert in Microsoft Defender XDR indicating that a user account was compromised. The analyst needs to isolate the affected device to prevent lateral movement. Which action should the analyst take first?

Accepted Answer

Initiate device isolation from Microsoft Defender for Endpoint. Initiating device isolation in Microsoft Defender for Endpoint immediately contains the compromised device, preventing lateral movement. Option A is wrong because a full antimalware scan does not isolate the device and may not stop ongoing malicious activity. Option C is wrong because resetting the user's password does not isolate the device; it only revokes access to cloud resources. Option D is wrong because creating a custom detection rule in Microsoft Sentinel does not take immediate action to contain the threat.

Answer

Run a full antimalware scan on the device

Answer

Reset the user's password in Microsoft Entra ID

Answer

Create a custom detection rule in Microsoft Sentinel

Question 13

Your Microsoft Sentinel workspace is experiencing high ingestion costs. Which of the following actions will most effectively reduce costs while maintaining security visibility?

Accepted Answer

Configure Basic Logs for verbose logs like Windows events from non-critical servers.. Configuring Basic Logs for verbose logs (e.g., Windows Event ID 4688 from non-critical servers) reduces ingestion costs by storing them in a lower-cost tier while still retaining them for security investigations. Basic Logs are charged at a lower ingestion rate and support simple queries and search jobs, preserving visibility for incident response without the full cost of Analytics Logs.

Answer

Delete unused analytics rules to reduce log ingestion.

Answer

Disable collection of all informational logs.

Answer

Reduce the data retention period to 30 days.

Question 14

Your organization uses Microsoft Sentinel to manage security incidents. You need to ensure that critical incidents are automatically assigned to the senior security analyst on duty. What should you configure?

Accepted Answer

Configure an automation rule with an 'Assign incident' action. Automation rules in Microsoft Sentinel allow you to automatically assign incidents to a specific owner based on conditions such as severity or title. Configuring an automation rule with the 'Assign incident' action ensures critical incidents are routed to the senior analyst on duty without manual intervention. This is the native, no-code method for incident assignment.

Answer

Modify the analytics rule to set the owner in the incident creation

Answer

Create a playbook that assigns incidents

Answer

Use a workbook to filter incidents by severity and assign manually

Question 15

Refer to the exhibit. You are using a hunting query in Microsoft Defender XDR to find devices generating excessive DNS queries. The query returns many results, but you want to exclude legitimate DNS servers. What is the best approach to refine the query?

Accepted Answer

Add a `where` clause to exclude known internal DNS server IPs.. Correct answer: A. Adding a `where` clause to exclude known internal DNS server IPs reduces false positives by filtering out legitimate DNS traffic from your own DNS servers, which generate high DNS query volumes by design. Options B, C, and D are incorrect: B – Changing the RemotePort filter to UDP 53 only is already implied in a DNS query hunt and does not exclude internal servers; C – Joining with DeviceInfo may not effectively filter out DNS servers and could add complexity; D – Increasing the threshold risks missing true excessive queries that are still below the new threshold but above normal.

Answer

Join with DeviceInfo to filter by device type.

Answer

Change the RemotePort filter to UDP 53 only instead of all DNS.

Answer

Increase the count threshold to 5000.