SC-200 Practice Test 27 — 15 Questions

Question 1

You are responsible for Microsoft Defender for Cloud Apps. The security team reports that they are not receiving alerts for suspicious activities from a specific connected app (Salesforce). You verify that the app is connected and the log collection is working. What should you check next?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Ensure that the anomaly detection policy for Salesforce is enabled in Defender for Cloud Apps.. Since the app is connected and log collection is verified, the issue is likely that the anomaly detection policy for Salesforce is disabled. Defender for Cloud Apps uses built-in anomaly detection policies to generate alerts for suspicious activities; if the policy is turned off, no alerts will be raised even though data flows correctly. Enabling the policy ensures that behavioral baselines and threat detection are applied to the Salesforce logs.

Answer

Review the IP address ranges configured for the Salesforce app.

Answer

Check if the Salesforce app connector is properly configured in Microsoft Entra ID.

Answer

Verify that the Salesforce tenant is licensed for Microsoft Entra ID P2.

Question 2

Your SOC is implementing a Microsoft Sentinel workspace with multiple content hub solutions. You need to ensure that only approved analytics rules are enabled and that any custom rules are reviewed before activation. Which THREE actions should you take?

Accepted Answer

Use Microsoft Sentinel Repositories (CI/CD) to manage analytics rules via Azure DevOps or GitHub.. Option C is correct because Microsoft Sentinel Repositories enable CI/CD-based deployment of analytics rules from Azure DevOps or GitHub, so every rule change goes through a pull request and review before activation, enforcing the approval workflow. Option D is correct because installing only Content hub solutions that contain approved analytics rules ensures that only vetted, Microsoft-published or approved rule templates are deployed into the workspace, preventing unapproved content from being enabled. Option E is correct because an automation rule triggered on analytics rule creation can immediately disable any rule not present in the approved list, providing a runtime guardrail that catches rules created outside the governed pipeline. Option A is not correct because the Threat Intelligence - TAXII connector imports threat indicators, not analytics rules, so it does not govern rule enablement. Option B is not correct because hunting queries are separate from analytics rules and do not satisfy the requirement to control which analytics rules are enabled or reviewed.

Answer

Configure Threat Intelligence - Taxii connector to import rules from an external feed.

Answer

Use the Hunting blade to create custom hunting queries instead of analytics rules.

Question 3

You are a security analyst for a company that uses Microsoft Defender for Office 365. You receive an incident indicating that a user reported a phishing email. You need to investigate the email and determine if it was delivered to other users. You also need to ensure that similar emails are blocked in the future. What should you do?

Accepted Answer

Use Threat Explorer to search for similar emails and delete them.. Threat Explorer in Microsoft Defender for Office 365 allows you to search for and take bulk action on emails matching specific criteria, such as sender, subject, or URL. By using Threat Explorer, you can identify all instances of the reported phishing email across your tenant and delete them from user mailboxes, which directly addresses the need to determine if the email was delivered to other users and to remediate it. This tool is designed for hunting and remediation, making it the correct choice for this investigation.

Answer

Submit the email to Microsoft for analysis and quarantine it.

Answer

Create a Safe Links policy to block URLs in the email.

Answer

Run a simulated phishing attack to test user awareness.

Question 4

Which THREE are valid ways to ingest data into Microsoft Sentinel? (Select three.)

Accepted Answer

Configuring Syslog using Azure Monitor Agent (AMA). The Azure Monitor Agent (AMA) can collect Syslog events from Linux-based sources and forward them to a Log Analytics workspace, which is the underlying data store for Microsoft Sentinel. By configuring a Data Collection Rule (DCR) that specifies the Syslog facility and severity levels, AMA streams these logs into the Syslog table in the workspace, making them available for detection and analysis within Sentinel.

Answer

Connecting to Azure DevOps directly

Answer

Importing from Power BI datasets

Question 5

You are configuring Microsoft Sentinel to use Microsoft Copilot for Security. Which TWO prerequisites must be met?

Accepted Answer

Ensure that the Microsoft Defender XDR tenant is integrated with Copilot for Security.. Microsoft Copilot for Security must be integrated with the Microsoft Defender XDR tenant to access and correlate security data across the Microsoft security ecosystem. This integration enables Copilot to leverage signals from Defender XDR, Microsoft Sentinel, and other sources for incident response and investigation. Without this tenant-level integration, Copilot cannot authenticate or retrieve the necessary security context from Defender XDR.

Answer

Enable Copilot for Security in the Microsoft Sentinel workspace settings.

Answer

Deploy Copilot for Security in the same Azure region as the Sentinel workspace.

Answer

Purchase a Microsoft Sentinel premium license.

Question 6

A SOC analyst is reviewing an incident in Microsoft Sentinel that involves a user receiving a phishing email with a malicious attachment. The attachment was opened on a device managed by Microsoft Intune. Which Microsoft Defender XDR component would have provided the earliest detection of the malicious file?

Accepted Answer

Microsoft Defender for Endpoint. Microsoft Defender for Endpoint (MDE) provides the earliest detection of malicious files at the endpoint level. When the user opens the malicious attachment on an Intune-managed device, MDE's real-time protection (antivirus and behavior monitoring) scans the file immediately upon execution or write, blocking the threat before it can execute further. This is faster than cloud-based or email-level detections because the file is already on the device.

Answer

Microsoft Defender for Cloud Apps

Answer

Microsoft Defender for Office 365

Answer

Microsoft Purview Data Loss Prevention

Question 7

A security analyst wants to create a custom detection rule in Microsoft 365 Defender that alerts when a user receives more than 5 emails with the same attachment name within 1 hour, indicating a possible malware campaign. Which advanced hunting tables should be joined to achieve this detection?

Accepted Answer

Join EmailEvents and EmailAttachmentInfo on NetworkMessageId. To detect when a user receives more than 5 emails with the same attachment name within 1 hour, you need to correlate email metadata with attachment details. The EmailEvents table contains email-level information (e.g., recipient, timestamp), while the EmailAttachmentInfo table stores attachment-level data (e.g., file name). Joining these on NetworkMessageId allows you to count occurrences of the same attachment name per recipient within a time window, enabling the custom detection rule.

Answer

Join EmailEvents and EmailUrlInfo on NetworkMessageId

Answer

Use only EmailAttachmentInfo table with a filter on file name

Answer

Join EmailEvents and DeviceFileEvents on SHA1 hash

Question 8

Which TWO of the following are valid ways to automate incident response in Microsoft Sentinel?

Accepted Answer

Create a playbook using Azure Logic Apps.. Azure Logic Apps is the native workflow engine for Microsoft Sentinel playbooks, allowing security analysts to automate incident response actions such as blocking IPs, resetting passwords, or enriching alerts. Playbooks are triggered by automation rules or directly from incidents, and they leverage hundreds of connectors to integrate with external systems. This is the primary and recommended method for building automated response workflows in Sentinel.

Answer

Use Azure Functions to run a script.

Answer

Use PowerShell to modify incidents via API.

Answer

Use Microsoft Power Automate to create a flow.

Question 9

A security analyst detects a suspicious sign-in from an unfamiliar IP address for a user with high privileges. The analyst wants to immediately contain the threat while preserving the user's ability to work with proper approvals. What is the most effective first step?

Accepted Answer

Initiate a user risk remediation in Microsoft Entra ID Protection by confirming compromise and resetting password with session revocation.. It directly addresses the immediate threat by confirming compromise in Microsoft Entra ID Protection, which triggers a password reset and revokes all existing sessions, effectively terminating the attacker's access. This approach preserves the user's ability to work after re-authentication with proper approvals, as the account remains enabled and can be restored once the risk is mitigated. It is the most effective first step because it combines containment (session revocation) with remediation (password reset) while maintaining operational continuity.

Answer

Block the IP address in the firewall.

Answer

Disable the user account in Microsoft Entra ID.

Answer

Reset the user's password without revoking sessions.

Question 10

Which THREE resources can be used as data sources for Microsoft Sentinel to detect security incidents? (Choose three.)

Accepted Answer

Microsoft 365 Defender. Options A, B, and C are correct. Microsoft 365 Defender provides integrated threat signals across endpoints, email, and identities. Microsoft Defender for Cloud delivers security alerts and posture assessments for cloud workloads. Azure Activity Log captures subscription-level operational events, which can be streamed to Sentinel. Option D is incorrect because Azure Cost Management focuses on cost tracking and budgeting, not security events. Option E is incorrect because Azure Advisor provides optimization recommendations, not security incident data.

Answer

Azure Cost Management

Answer

Azure Advisor

Question 11

Which TWO data sources are most relevant for threat hunting for lateral movement using remote service creation (e.g., WMI, PsExec)?

Accepted Answer

DeviceNetworkEvents. Correct options: C and E. DeviceProcessEvents captures process creation on remote machines (e.g., services.exe, cmd.exe) which is indicative of remote service creation via WMI or PsExec. DeviceNetworkEvents captures outbound network connections to high ports (e.g., 135, 445) on remote machines. Option A (DeviceRegistryEvents) captures registry modifications, not directly relevant. Option B (DeviceEvents) is less specific for this scenario. Option D (DeviceFileEvents) captures file writes, not process execution.

Answer

DeviceRegistryEvents

Answer

DeviceEvents

Answer

DeviceFileEvents

Question 12

Which THREE approaches are effective for hunting threats in Microsoft Defender XDR using advanced hunting? (Choose three.)

Accepted Answer

Using known indicators of compromise (IOCs) from threat intelligence feeds.. Effective hunting in Microsoft Defender XDR using advanced hunting involves proactive approaches: using known IOCs from threat intelligence (A) helps identify known threats; establishing a baseline of normal behavior and hunting for deviations (B) detects anomalies; applying machine learning models (E) leverages automated anomaly detection. Option C is incorrect because reviewing all alerts is reactive and not a hunting technique. Option D is incorrect because hunting looks for patterns, not isolated unusual events.

Answer

Reviewing all alerts generated by automated detection rules.

Answer

Searching for any single event that appears unusual.

Question 13

Your organization uses Microsoft Sentinel and Microsoft Defender XDR. You want to create a hunting query that finds users who have accessed a high number of distinct Azure resources within a short time frame, which may indicate credential theft. Which KQL query would be most effective?

Accepted Answer

AzureActivity | where TimeGenerated > ago(1d) | summarize dcount(Resource) by Caller, bin(TimeGenerated, 1h) | where dcount_Resource > 20. It uses the AzureActivity table to count distinct resources per user per hour, filtering for those with more than 20 resources. Option A is wrong because it uses a 1-minute bucket, too granular for meaningful hunting. Option B is wrong because it counts operations, not distinct resources. Option C is wrong because it counts distinct operation names, not resources.

Answer

AzureActivity | summarize dcount(Resource) by bin(TimeGenerated, 1m), Caller

Answer

AzureActivity | summarize count() by Caller | where count_ > 20

Answer

AzureActivity | summarize dcount(OperationName) by Caller, bin(TimeGenerated, 1h) | where dcount_OperationName > 20

Question 14

You are conducting a threat hunt in Microsoft Defender XDR and want to identify devices that have recently communicated with a known C2 server IP address. Which advanced hunting table should you query?

Accepted Answer

DeviceNetworkEvents. EviceNetworkEvents (Option A) because this table contains network connection events including destination IP addresses, ports, and protocols. It is used to identify network communications with suspicious IPs such as C2 servers. DeviceProcessEvents (Option D) is for process creation events, DeviceLogonEvents (Option C) is for authentication events, and DeviceFileEvents (Option B) is for file system events. Only DeviceNetworkEvents provides the necessary network traffic information for threat hunting in Microsoft Defender XDR.

Answer

DeviceFileEvents

Answer

DeviceLogonEvents

Answer

DeviceProcessEvents

Question 15

Which TWO data sources are essential for threat hunting in Microsoft Sentinel to detect lateral movement?

Accepted Answer

DeviceNetworkEvents (Microsoft Defender for Endpoint). DeviceNetworkEvents (Microsoft Defender for Endpoint) provides network connections between devices, which can reveal lateral movement attempts. SecurityEvent (Windows Event Logs) provides security-related events such as remote logons (Event ID 4624) and service creation (Event ID 7045), which are key indicators of lateral movement. Option A (Microsoft Entra ID sign-in logs) focuses on cloud identity and is not directly relevant for on-premises lateral movement. Option D (CommonSecurityLog) typically comes from network perimeter devices and is not essential for internal lateral movement. Option E (DnsEvents) can provide insight into DNS queries but is less essential than the other two data sources for detecting lateral movement.

Answer

Microsoft Entra ID sign-in logs

Answer

CommonSecurityLog (Syslog)

Answer

DnsEvents