SC-200 Practice Test 29 — 15 Questions

Question 1

A security administrator wants to enable vulnerability assessment for all existing and future Azure virtual machines using the integrated Microsoft Defender Vulnerability Management solution. Which action should they take in Microsoft Defender for Cloud?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Enable 'Microsoft Defender for Servers' plan and check the 'Vulnerability assessment' option in the environment settings. To enable vulnerability assessment for all existing and future Azure VMs using the integrated Microsoft Defender Vulnerability Management solution, you must enable the 'Microsoft Defender for Servers' plan in Defender for Cloud and then check the 'Vulnerability assessment' option within the environment settings. This action activates the built-in, agentless vulnerability assessment engine that is part of Defender for Cloud, automatically scanning VMs without requiring additional agents or manual deployment.

Answer

Install the Log Analytics agent and configure the Qualys connector on each VM

Answer

Create a policy assignment from the built-in initiative 'Enable Azure Monitor for VMs'

Answer

Enable 'Servers' workload protection in Defender for Cloud and then manually deploy the VA agent to each existing VM using Azure Policy

Question 2

A security analyst uses Microsoft Defender for Cloud to monitor Azure SQL Databases. The analyst wants to generate alerts for SQL injection attempts but only for databases that contain sensitive data (e.g., credit card numbers). What is the most efficient way to configure alerting to focus on these databases?

Accepted Answer

Enable a custom alert rule in Microsoft Sentinel that queries Azure SQL audit logs and filters based on database classification tags.. The correct approach is to use an Azure Sentinel custom alert rule that queries Azure SQL audit logs and filters based on database classification tags. This ensures alerts are generated only for databases with sensitive data. Advanced Threat Protection (ATP) does not support filtering by classification labels and is enabled at the server level, making options B and C invalid.

Answer

Use Data Discovery & Classification in Azure SQL to label sensitive columns, then configure Advanced Threat Protection to alert only when a SQL injection event is detected against a database with those labels.

Answer

Disable Advanced Threat Protection for all databases except those that contain sensitive data by manually enabling ATP per database.

Answer

Create a workflow automation in Defender for Cloud that filters SQL injection alerts based on database name.

Question 3

A SOC team uses Microsoft Sentinel. They need to correlate syslog events from on-premises firewalls with Microsoft Entra ID sign-in logs to detect VPN-based intrusions. The correlation requires joining two tables (Syslog and SigninLogs) on a common field (IP address) and running on a 10-minute schedule. Which type of analytics rule should the analyst configure?

Accepted Answer

Scheduled query rule. A scheduled query rule is correct because the requirement involves joining two tables (Syslog and SigninLogs) on a common field (IP address) and running on a 10-minute schedule. Scheduled query rules are designed for complex, multi-table correlations that run at fixed intervals (e.g., every 10 minutes) and can aggregate or join data across tables, making them ideal for this VPN intrusion detection scenario.

Answer

Near-real-time (NRT) rule

Answer

Fusion rule

Answer

Anomaly rule

Question 4

Your SOC team uses Microsoft Defender XDR. You want to ensure that all incidents are automatically classified and determined by the built-in AI before any manual review. What should you configure?

Accepted Answer

Enable the incident summarization and classification feature in Microsoft Defender XDR.. Microsoft Defender XDR includes a built-in AI-driven incident summarization and classification feature that automatically assigns a classification (e.g., true positive, false positive) and determination (e.g., malicious, clean) to each incident before manual review. This feature leverages machine learning models trained on Microsoft's global threat intelligence to reduce alert fatigue and streamline SOC workflows.

Answer

Create a custom detection rule in Microsoft Defender XDR.

Answer

Enable automation rules in Microsoft Sentinel to classify incidents.

Answer

Configure a workbook in Microsoft Sentinel to analyze incidents.

Question 5

A security analyst wants to identify all users who received a phishing email that contained a known malicious URL. The analyst has the URL. Which advanced hunting table should the analyst query first to find the emails that contained this URL?

Accepted Answer

EmailUrlInfo. The EmailUrlInfo table in Microsoft Defender XDR contains records of URLs extracted from email messages, including the specific URL and the email's unique identifier (NetworkMessageId). By querying this table for the known malicious URL, the analyst can retrieve the NetworkMessageIds of all emails containing that URL, which can then be joined with the EmailEvents table to identify the recipients. This is the most direct and efficient first step because EmailUrlInfo is purpose-built to map URLs to email messages.

Answer

EmailEvents

Answer

EmailAttachmentInfo

Answer

EmailPostDeliveryEvents

Question 6

A company has enabled Microsoft Defender for Cloud on their subscription containing Azure SQL databases. They receive an alert about a potential SQL injection attack. The analyst wants to see the actual query that was executed. Where can the analyst find the query details associated with the alert?

Accepted Answer

In the alert's entity tab. When Microsoft Defender for Cloud detects a SQL injection attack, the alert details include an 'Entities' tab that contains the actual SQL query that was executed. This tab provides the raw query text, which is essential for the analyst to understand the exact payload used in the attack and to assess the impact on the database.

Answer

By opening the SQL database's threat detection logs

Answer

In the Azure Activity Log

Answer

In the alert's diagnostic data

Question 7

Refer to the exhibit. You are reviewing an analytics rule in Microsoft Sentinel. The rule is enabled but has not generated any alerts in the past 24 hours. What is the most likely cause?

Accepted Answer

The query uses 'Location == Unknown' but the actual sign-in location is not 'Unknown'. The rule has generated no alerts because the query condition 'Location == Unknown' does not match any actual sign-in locations. Suppression only suppresses alerts after an initial alert has been generated; it does not prevent the first alert. With zero alerts, the most likely cause is that the query returns no results, not suppression.

Answer

The triggerThreshold is set to 0, which means no alerts will be generated

Answer

Suppression is enabled with a duration of 6 hours, which may be suppressing new alerts after the first one

Answer

The queryFrequency is 1 hour and the queryPeriod is 7 days, which is a mismatch

Question 8

Order the steps to perform a threat hunting exercise using Microsoft 365 Defender advanced hunting.

Accepted Answer

Step 1: Hypothesis, Step 2: Query, Step 3: Analyze, Step 4: Document. Threat hunting starts with a hypothesis, then querying, analyzing, and documenting results.

Answer

Step 1: Query, Step 2: Hypothesis, Step 3: Analyze, Step 4: Document

Answer

Step 1: Hypothesis, Step 2: Analyze, Step 3: Query, Step 4: Document

Answer

Step 1: Query, Step 2: Analyze, Step 3: Hypothesis, Step 4: Document

Question 9

A SOC analyst is creating a new analytics rule in Microsoft Sentinel to detect when a user account is disabled. The analyst needs to select a rule template that uses Microsoft Entra ID audit logs. Which rule type should the analyst choose?

Accepted Answer

Scheduled. A scheduled query rule is the correct choice because it allows the analyst to define a KQL query that runs on a fixed interval against Microsoft Entra ID audit logs (AuditLogs table). This is the standard approach for built-in rule templates and provides full control over query logic and scheduling. While NRT rules also support AuditLogs, they are not used for standard rule templates and are more suited to custom high-frequency detections.

Answer

NRT (Near-Real-Time)

Answer

Anomaly

Answer

Fusion

Question 10

A SOC analyst creates a scheduled analytics rule in Microsoft Sentinel that uses the following KQL query to detect impossible travel: SigninLogs | where TimeGenerated > ago(1d) | summarize Countries = make_set(Location) by UserPrincipalName | where array_length(Countries) > 1 However, the analyst notices that the rule generates too many false positives for users who travel legitimately. What is the best way to refine the rule to reduce false positives without missing actual impossible travel?

Accepted Answer

Modify the query to include a time difference condition using the partition operator or a join to find sign-ins from different countries within a short time window.. Impossible travel detection requires correlating sign-ins from different geographic locations within a time window that is too short for physical travel. By using the partition operator or a join to compare timestamps between sign-ins from different countries, the query can distinguish between legitimate sequential travel (e.g., a user flying from New York to London over 8 hours) and truly impossible simultaneous sign-ins (e.g., sign-ins from New York and London within 30 minutes). This reduces false positives while still catching actual impossible travel.

Answer

Add a condition to filter out VPN IP addresses from the Log Analytics workspace.

Answer

Instead of using make_set, use the dcount() function to estimate distinct countries.

Answer

Use the time series anomaly detection function series_decompose() on the signin data.

Question 11

An analyst is investigating a ransomware outbreak using Microsoft 365 Defender Advanced Hunting. They need to find all devices where a file with the extension '.locked' was created within one hour after a known malicious process (e.g., 'ransomware.exe') was executed on the same device. Which two tables should be joined in the query? (Choose 2.)

Accepted Answer

DeviceProcessEvents. DeviceProcessEvents is correct because it logs process creation events, including the execution of 'ransomware.exe'. This table is essential to identify the timestamp and device where the malicious process ran, which serves as the starting point for the time-bound investigation.

Answer

DeviceNetworkEvents

Answer

DeviceRegistryEvents

Question 12

An analyst is investigating a file that was detected as malicious on several devices. In Microsoft 365 Defender, where can the analyst find information about the file's prevalence, global reputation, and related incidents?

Accepted Answer

File entity page. The File entity page in Microsoft 365 Defender aggregates file-level telemetry, including prevalence (number of devices/users), global reputation (Microsoft's cloud-based threat intelligence), and a timeline of related incidents. This page is the single pane of glass for file-centric investigations, pulling data from Microsoft Defender for Endpoint, Office 365, and other XDR sources.

Answer

Device entity page

Answer

User entity page

Answer

Email entity page

Question 13

A security team enables Microsoft Defender for Cloud on an Azure subscription and wants to ensure that all Azure SQL databases have threat detection enabled. Which plan must be enabled to receive alerts for SQL injection attempts?

Accepted Answer

Defender for SQL. Defender for SQL is the specific Microsoft Defender for Cloud plan that provides threat detection for Azure SQL databases, including alerts for SQL injection attacks. It monitors database activity for anomalous patterns, such as SQL injection attempts, and generates security alerts. Without this plan enabled, threat detection for SQL databases remains disabled, even if other Defender plans are active.

Answer

Defender for Servers

Answer

Defender for Storage

Answer

Defender for Key Vault

Question 14

Your team uses Microsoft Defender for Endpoint to hunt for signs of credential theft. You want to query for events where a process accesses the LSASS process memory. Which event type should you look for?

Accepted Answer

Process access (Event 4656). Credential theft via LSASS memory access is captured by Windows Security Event ID 4656 (and its companion 4663), which logs handle requests to objects including processes. Defender for Endpoint surfaces this as 'Process access' events, making it the correct event type to query for LSASS access.

Answer

Network connection (Event 5156)

Answer

Registry modification (Event 4657)

Answer

Process creation (Event 4688)

Question 15

You are handling an incident where a user's account was used to access sensitive data from an unusual location. Microsoft Entra ID Identity Protection flagged the sign-in as risky. You need to determine if the account is compromised. Which investigation step should you perform first?

Accepted Answer

Review the sign-in details and compare with the user's typical behavior. Before taking any remediation action, you should first review the sign-in details and compare them with the user's typical behavior to determine if the account is actually compromised. This investigation step provides context and helps avoid unnecessary disruptions. Only after confirming a compromise should you proceed with actions like blocking or password reset.

Answer

Block the user from signing in

Answer

Force a password reset for the user

Answer

Check if the device used is managed by Intune