SC-200 Practice Test 30 — 15 Questions

Question 1

During a ransomware incident, the security team needs to prevent the encryption of files while allowing the investigation to continue. Which feature in Microsoft Defender for Endpoint should be used to achieve this?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Controlled folder access.. Controlled folder access (CFA) blocks unauthorized applications from modifying files in protected folders, which is exactly what ransomware does. ASR rules are broader and may not target file encryption specifically. Device isolation disconnects the device from the network but stops the investigation. Custom detection rules are reactive.

Answer

Device isolation.

Answer

Attack surface reduction (ASR) rules.

Answer

Custom detection rules.

Question 2

A SOC analyst is using Microsoft Sentinel to investigate an incident involving a user who accessed a sensitive database from an unusual location. The analyst wants to find all activities performed by this user within the last 24 hours from multiple data sources. Which KQL operator should the analyst use to combine the results of two queries that return different schemas?

Accepted Answer

union. The union operator combines tables or query results with different schemas by adding columns. Join requires a common column. The other operators are not appropriate.

Answer

summarize

Answer

join

Answer

where

Question 3

During an incident response, you need to collect forensic evidence from a compromised Azure virtual machine that is currently offline. What is the most efficient method to acquire a disk snapshot for analysis while preserving the integrity of the evidence?

Accepted Answer

Create a snapshot of the OS disk from the Azure portal. Creating a snapshot from the Azure portal creates a point-in-time copy without affecting the original disk. Option A is wrong because starting the VM changes the state. Option C is wrong because attaching a new disk is for adding storage, not forensic acquisition. Option D is wrong because exporting the disk to a storage account is a valid method but snapshot is faster and more efficient for preservation.

Answer

Attach a new data disk and copy the contents manually

Answer

Start the VM and use Azure Backup to take a backup

Answer

Export the disk to a storage account using AzCopy

Question 4

Your organization uses Microsoft Sentinel and has deployed the Microsoft Sentinel Solution for Microsoft Defender XDR. You need to correlate alerts from Microsoft Defender for Endpoint with Microsoft Defender for Office 365 in a single incident. What is the recommended approach?

Accepted Answer

Use the Microsoft 365 Defender connector to ingest unified incidents from Microsoft 365 Defender, which already correlates alerts from both products.. The Microsoft 365 Defender connector ingests unified incidents from Microsoft 365 Defender, which natively correlates alerts from Microsoft Defender for Endpoint and Microsoft Defender for Office 365 into a single incident. This is the recommended approach as it leverages the built-in correlation engine in Microsoft 365 Defender, eliminating the need for custom analytics rules or manual correlation.

Answer

Ingest alerts from both products separately and use a KQL query in an analytics rule to correlate them.

Answer

Create a workbook that displays alerts from both products side by side.

Answer

Use a Microsoft Sentinel fusion rule to correlate the alerts.

Question 5

You deploy this ARM template to a Microsoft Sentinel workspace. After deployment, you notice that the saved search does not appear as an analytics rule. What is the most likely reason?

Accepted Answer

The resource type is 'savedSearches', not 'scheduledQueryRules' or 'alertRules'.. Saved searches in Microsoft Sentinel are created under the 'Microsoft.OperationalInsights/workspaces/savedSearches' resource type, not as analytics rules. Analytics rules require a different resource type such as 'Microsoft.SecurityInsights/alertRules'. Therefore, deploying a saved search template will not create an analytics rule. Option A is incorrect: tags are metadata and do not affect whether the resource appears as an analytics rule. Option C is incorrect: the API version used is valid for saved searches; an invalid API version would cause a deployment error, but the issue is the resource type, not the API version. Option D is incorrect: even if the KQL query syntax is invalid, the saved search would still be deployed as a saved search, but it would not become an analytics rule.

Answer

The tags are incorrectly formatted.

Answer

The API version is incorrect.

Answer

The KQL query syntax is invalid.

Question 6

Refer to the exhibit. You deploy this ARM template to your subscription. After deployment, you cannot find the saved search 'Test Search' in the Microsoft Sentinel workspace. What is the most likely reason?

Accepted Answer

The resource type should be for analytics rules, not saved searches.. The ARM template deploys a resource of type 'Microsoft.OperationsManagement/solutions' with a saved search, but Microsoft Sentinel does not use saved searches for analytics rules. In Sentinel, detection rules are created as 'Microsoft.SecurityInsights/alertRules', not as saved searches under a Log Analytics workspace. The template's resource type is mismatched for the intended functionality, so the saved search 'Test Search' will not appear as a Sentinel analytics rule.

Answer

The query 'Heartbeat | summarize Count() by Computer' is invalid.

Answer

The apiVersion is incorrect.

Answer

The name concatenation is missing a parameter.

Question 7

Your organization uses Microsoft Defender for Identity. You need to receive alerts when suspicious LDAP queries are detected. What should you configure?

Accepted Answer

Configure alert rules in Microsoft Defender for Identity.. Microsoft Defender for Identity (MDI) detects suspicious LDAP queries, such as LDAP reconnaissance or directory traversal attacks, by analyzing domain controller traffic. To receive alerts for these detections, you must configure alert rules directly within the MDI portal, which allows you to set thresholds and notification preferences for specific LDAP-related activities. Option B is correct because MDI's built-in alert rules are the mechanism for generating and delivering these security alerts.

Answer

Set up an anomaly detection policy in Microsoft Defender for Cloud Apps.

Answer

Assign the Security Administrator role in Microsoft Entra ID.

Answer

Create a custom sensitivity label in Microsoft Purview.

Question 8

You are managing Microsoft Defender for Cloud Apps. You discover that a user is downloading large amounts of data from a sanctioned cloud app. You need to automatically suspend the user's access when the download exceeds 5 GB in 10 minutes. What should you create?

Accepted Answer

An anomaly detection policy with a mass download detection template.. An anomaly detection policy in Microsoft Defender for Cloud Apps can detect unusual user behavior, such as mass file downloads, using predefined templates like 'Mass download by a single user'. This policy can be configured to trigger automatic governance actions, including suspending the user, when the download exceeds a threshold like 5 GB in 10 minutes. It directly addresses the need to automatically suspend access based on volume and time.

Answer

A session policy to block downloads.

Answer

An app connector for the cloud app.

Answer

A data loss prevention (DLP) policy in Microsoft Purview.

Question 9

A SOC analyst in Microsoft Sentinel needs to create an automation rule that triggers a playbook when a new incident is created and the incident severity is 'High'. Additionally, the playbook should only run if the incident is not already assigned to an analyst. Which two conditions must the analyst include in the automation rule? (Select all that apply.) (Choose 2.)

Accepted Answer

Condition: 'Severity' equals 'High'. The automation rule must trigger only when the incident severity is 'High'. In Microsoft Sentinel, automation rules evaluate conditions against incident properties, and the 'Severity' condition filters incidents by their assigned severity level. This ensures the playbook runs exclusively for high-severity incidents, aligning with the SOC's requirement to prioritize critical alerts.

Answer

Condition: 'Status' equals 'New'

Answer

Condition: 'Provider' contains 'Microsoft Sentinel'

Question 10

A security analyst is performing threat hunting in Microsoft Sentinel and wants to identify anomalous outbound network connections from a compromised workstation. The analyst suspects that a beaconing pattern is present. Which KQL function is most appropriate to detect periodic beaconing behavior over time?

Accepted Answer

startofday(TimeGenerated). `startofday` groups timestamps by day, enabling analysts to count events per day and identify regular intervals characteristic of beaconing (e.g., daily connections). Option A is incorrect: `series_decompose` is used for time series decomposition (trend, seasonal, residual) but is not the most direct method for detecting periodic beaconing; it is more complex and typically used after aggregation. Option B is incorrect: `make_list` creates a list of values, not useful for periodicity detection. Option D is incorrect: `bin(TimeGenerated, 1h)` bins events into hourly buckets, which could detect beaconing at finer granularity, but daily beaconing is better suited to `startofday`; `bin` is not specifically for periodic pattern detection.

Answer

series_decompose(TimeGenerated)

Answer

make_list(TimeGenerated)

Answer

bin(TimeGenerated, 1h)

Question 11

Your organization uses Microsoft Defender for Cloud to manage security posture. You need to assign a custom initiative to a specific management group to track compliance. Which two components must you create?

Accepted Answer

A policy definition and an initiative definition.. To track compliance for a custom initiative in Microsoft Defender for Cloud, you must first create a custom policy definition that specifies the rules or effects to enforce. Then, you must create an initiative definition (a group of policy definitions) that can be assigned to a management group. This assignment enables Defender for Cloud to evaluate resources against the custom initiative and report compliance.

Answer

An Azure Blueprint and a role assignment.

Answer

An Azure RBAC role and a Log Analytics workspace.

Answer

An Azure Monitor workbook and an alert rule.

Question 12

Your organization has Microsoft Sentinel deployed in a central Log Analytics workspace. You have a custom analytics rule that detects brute-force attacks against Azure AD by counting failed sign-ins from the same IP address within 5 minutes. The rule currently generates an incident for every 10 failed attempts. During a recent incident, a single IP address generated over 200 failed sign-ins in 10 minutes, resulting in 20 separate incidents. The SOC team is overwhelmed and wants to reduce the number of incidents without lowering the detection threshold. You need to modify the rule to generate only one incident per IP address within a 1-hour window. What should you do?

Accepted Answer

Modify the analytics rule to group alerts by IP address with a 1-hour window. Grouping alerts by IP address with a 1-hour window consolidates all alerts from that IP into a single incident, reducing the number of incidents without lowering the detection threshold. Option A is wrong; alert suppression only suppresses alerts after an incident is created but does not group them. Option C is wrong; raising the threshold would still generate multiple incidents if exceeded multiple times. Option D is wrong; automation rules cannot retroactively group already-created incidents.

Answer

Enable alert suppression in the analytics rule for 1 hour

Answer

Create a new analytics rule that triggers only when failed sign-ins exceed 200 in 5 minutes

Answer

Create an automation rule that closes duplicate incidents from the same IP

Question 13

Your organization uses Microsoft Defender for Cloud Apps and Microsoft Sentinel. You notice that a large number of log entries from Defender for Cloud Apps are being dropped at ingestion due to 'malformed data' errors. The data connector shows a healthy status. What is the most likely cause?

Accepted Answer

The data volume exceeds the workspace's ingestion capacity, causing data truncation.. When the data volume exceeds the Log Analytics workspace's ingestion capacity, Defender for Cloud Apps log entries can be truncated mid-record, causing them to be malformed and dropped. The connector status remains healthy because the connector itself is still connected and receiving data, but the workspace's ingestion rate limit (typically 500 MB/min per workspace or 2 GB/min per workspace depending on pricing tier) causes truncation, not a connectivity or authentication failure.

Answer

The log type is not supported by Sentinel.

Answer

The Log Analytics workspace key has expired.

Answer

The Defender for Cloud Apps connector is blocked by a firewall.

Question 14

During a threat hunt, a security analyst uses Microsoft Sentinel and identifies a series of failed logon attempts from a single IP address targeting multiple user accounts. The analyst wants to create a scheduled analytics rule that generates an alert when the same IP address fails to logon to more than 10 different accounts within 5 minutes. Which KQL operator should be used to count distinct accounts per IP?

Accepted Answer

dcount(Account). Dcount(Account). The dcount() function performs an approximate distinct count, which is efficient for large datasets and suitable for counting distinct accounts per IP. Option A (count()) counts all events, not distinct accounts. Option B (summarize count() by Account) counts events per account, not distinct accounts per IP. Option C (distinct Account) returns unique account values but does not provide a count.

Answer

count()

Answer

summarize count() by Account

Answer

distinct Account

Question 15

A security analyst is investigating a compromised user account using Microsoft 365 Defender. The analyst wants to see all the sign-in attempts made by this user in the last 24 hours, including the IP addresses and locations. Which advanced hunting table should the analyst query?

Accepted Answer

IdentityLogonEvents. The IdentityLogonEvents table in Microsoft 365 Defender advanced hunting captures authentication events from Azure Active Directory, including sign-in attempts, IP addresses, and geographic locations. This makes it the correct table for an analyst investigating a compromised user account to review all sign-in activity over the last 24 hours.

Answer

AlertInfo

Answer

EmailAttachmentInfo

Answer

DeviceLogonEvents