SC-200 Practice Test 30 — 15 Questions

Question 1

Which TWO techniques are commonly used in threat hunting with Microsoft Sentinel to identify lateral movement? (Choose two.)

Accepted Answer

Correlating service account usage with anomalous network connections.. Option D is correct because correlating service account usage with anomalous network connections surfaces lateral movement: attackers frequently reuse service accounts (often over SMB/RPC or WinRM) to pivot between hosts, and Microsoft Sentinel can join identity logs (SecurityEvent 4624 logon type 3/9, Microsoft Entra ID sign-in logs) with network telemetry (Syslog, CEF, or NSG flow logs) in KQL to flag a service account authenticating to hosts it never normally touches. Option E is correct because remote PowerShell execution across multiple machines is a classic lateral movement technique; Sentinel detects it via Event ID 4104 (PowerShell script block logging), 4688 process creation showing powershell.exe with -Command/-EncodedCommand, and WinRM operational logs (e.g., Microsoft-Windows-WinRM/Operational), especially when the same account spawns sessions on many hosts in a short window. Option A is not the best fit because port scanning is typically reconnaissance or discovery activity that precedes movement rather than lateral movement itself. Option B describes brute-force or password-spray credential access, which is an earlier attack phase, not lateral movement. Option C, mass file deletion, indicates impact or ransomware behavior rather than host-to-host pivoting.

Answer

Detecting port scanning activity from internal IPs.

Answer

Searching for multiple failed logon attempts from a single IP.

Answer

Looking for mass file deletion events on file servers.

Question 2

An organization has enabled Microsoft Defender for Cloud's enhanced security features. They want to ensure that newly provisioned Azure virtual machines automatically have the built-in vulnerability assessment solution installed. Which configuration should they enable in Defender for Cloud?

Accepted Answer

Auto-provisioning of the vulnerability assessment solution. Microsoft Defender for Cloud's enhanced security features include a dedicated auto-provisioning setting specifically for the built-in vulnerability assessment solution (powered by Qualys). When enabled, this setting automatically deploys the vulnerability assessment extension to all new and existing Azure VMs, ensuring continuous vulnerability scanning without manual intervention.

Answer

Auto-provisioning of the Log Analytics agent

Answer

Automatic provisioning of all security agents

Answer

Azure Policy assignment for Update Management

Question 3

A company wants to continuously assess the compliance of their Azure resources against the CIS (Center for Internet Security) benchmark. Which Microsoft Defender for Cloud feature should they use?

Accepted Answer

Regulatory compliance dashboard. The Regulatory compliance dashboard in Microsoft Defender for Cloud provides pre-built assessments and continuous monitoring against specific compliance standards, including the CIS benchmark. It automatically evaluates Azure resources against CIS controls and displays compliance status, making it the correct feature for this requirement.

Answer

Secure score

Answer

Azure Policy

Answer

Workload protections

Question 4

A security team uses Microsoft Defender for Cloud to protect Azure virtual machines. They notice that a VM is generating alerts for unusual outbound connections. The team wants to use a Defender for Cloud feature that learns the VM's typical network behavior and provides recommendations to tighten network security group rules, while also alerting on suspicious deviations. Which feature should they enable?

Accepted Answer

Adaptive network hardening. Adaptive network hardening (ANH) is the correct feature because it uses machine learning to learn a VM's typical traffic patterns (including outbound connections), then analyzes the current Network Security Group (NSG) rules against those learned patterns. It provides recommendations to tighten NSG rules to allow only the traffic that is actually used, and it generates security alerts when it detects deviations from the learned baseline, such as unusual outbound connections.

Answer

Just-In-Time VM access

Answer

File integrity monitoring

Answer

Vulnerability scanning

Question 5

Your organization uses Microsoft Defender for Cloud Apps. You need to ensure that alerts from Defender for Cloud Apps are forwarded to Microsoft Sentinel. Which connector should you use in Sentinel?

Accepted Answer

Microsoft Defender for Cloud Apps connector. The Microsoft Defender for Cloud Apps connector in Microsoft Sentinel is specifically designed to ingest alerts and logs from Defender for Cloud Apps, including anomaly detection, policy violations, and threat intelligence alerts. This connector uses the Microsoft Graph API to pull data directly from the Defender for Cloud Apps service, ensuring that all relevant security alerts are forwarded to Sentinel for centralized monitoring and incident response.

Answer

Windows Security Events via AMA connector

Answer

Microsoft 365 Defender connector

Answer

Azure Activity connector

Question 6

A SOC analyst receives an alert from Microsoft Defender for Cloud Apps indicating that a user downloaded 500 GB of data from SharePoint to an unmanaged device. The user has no history of such behavior. What is the best first step in the incident response process?

Accepted Answer

Disable the user account in Microsoft Entra ID.. The immediate priority in an incident response process for a potential data exfiltration scenario is to contain the threat. Disabling the user account in Microsoft Entra ID (formerly Azure AD) is the fastest way to revoke access to SharePoint and other cloud resources, preventing further unauthorized data transfer. This aligns with the 'containment' phase of the NIST incident response lifecycle, before any investigation or remediation steps.

Answer

Run a full antivirus scan on the unmanaged device.

Answer

Contact the user to verify if the download was intentional.

Answer

Create a detection rule for similar behavior in Microsoft Sentinel.

Question 7

Your company uses Microsoft Defender for Cloud to assess the security posture of hybrid workloads. You are configuring a governance rule to automatically remediate a specific recommendation that is out of compliance. The recommendation is 'Virtual machines should be migrated to new Azure Resource Manager resources'. You need to ensure that the remediation is applied at scale across all subscriptions in the management group. What should you do?

Accepted Answer

Create a governance rule in Microsoft Defender for Cloud with scope set to the management group, condition on the recommendation, and action set to 'Automatic'.. Governance rules in Microsoft Defender for Cloud allow you to define automatic remediation actions for specific recommendations at scale. By setting the scope to the management group, the rule applies to all subscriptions within that group, and the 'Automatic' action triggers the built-in remediation script for the 'Virtual machines should be migrated to new Azure Resource Manager resources' recommendation without requiring custom scripting or policy assignments.

Answer

Create a PowerShell script that runs on each VM to migrate it, and execute it via Azure Automation.

Answer

Create an Azure Policy initiative that includes the recommendation and assign it with a remediation task at the management group level.

Answer

Create a governance rule in Microsoft Defender for Cloud with scope set to a single subscription and action set to 'Automatic'.

Question 8

Your company uses Microsoft Sentinel. A security analyst receives an incident that includes a large number of alerts from a single data source. The analyst needs to identify which alerts are duplicates or related so they can focus on unique threats. Which feature should the analyst use?

Accepted Answer

Alert grouping. Alert grouping in Microsoft Sentinel automatically combines related alerts into a single incident, reducing noise so analysts can focus on unique threats. It uses machine learning to correlate alerts that share entities, timing, or patterns, directly addressing the need to identify duplicates or related alerts.

Answer

Investigation graph

Answer

Entity mapping

Answer

Automation rules

Question 9

Your organization uses Microsoft Sentinel and Microsoft Defender for Cloud. You need to ensure that all security alerts from Defender for Cloud are automatically ingested into Sentinel with the least latency. What should you configure?

Accepted Answer

Use the Microsoft Defender for Cloud data connector in Sentinel to stream alerts.. The Microsoft Defender for Cloud data connector in Microsoft Sentinel provides a native, direct integration that streams security alerts from Defender for Cloud into Sentinel with near-real-time latency. This connector uses the underlying Azure Resource Graph and alert APIs to push alerts automatically, eliminating the need for custom polling or additional orchestration, which ensures the least possible ingestion delay.

Answer

Configure a custom API connector in Sentinel to pull alerts from Defender for Cloud REST API every 5 minutes.

Answer

Enable continuous export in Defender for Cloud to send alerts to a Log Analytics workspace and then create a scheduled query in Sentinel.

Answer

Create a Logic App that triggers on Defender for Cloud alerts and sends them to Sentinel via the Azure Monitor HTTP Data Collector API.

Question 10

While threat hunting in Microsoft Sentinel, you want to create a hunting query that identifies all attempts to disable security controls. Which data table would be most appropriate to query for such activity?

Accepted Answer

SecurityEvent. The SecurityEvent table in Microsoft Sentinel contains Windows security events forwarded from agents, including Event ID 4688 (process creation) and events related to disabling security controls such as Windows Defender or audit policies. Threat hunting queries for control-disabling activity typically target SecurityEvent because it captures native Windows security log data. Other tables cover different log sources and would not contain these Windows security events.

Answer

Syslog

Answer

CommonSecurityLog

Answer

OfficeActivity

Question 11

A SOC analyst in Microsoft Sentinel is creating a scheduled analytics rule to detect anomalous Microsoft Entra ID sign-ins. The rule runs every 5 minutes and queries the SigninLogs table for sign-ins from IP addresses outside the organization's known country codes. To avoid duplicates, the rule should generate an incident only once for a particular user-IP combination until the combination is not seen for 60 minutes. Which configuration should the analyst use in the analytics rule wizard?

Accepted Answer

Incident settings tab - Grouping configuration. The Incident settings tab's Grouping configuration allows you to group alerts into a single incident based on specific criteria, such as user-IP combination, and to suppress re-creation of an incident for a defined time window (e.g., 60 minutes) after the last occurrence. This directly addresses the requirement to avoid duplicate incidents for the same user-IP pair until it is not seen for 60 minutes.

Answer

Alert details section

Answer

Query scheduling section

Answer

Entity mapping section

Question 12

You are a security administrator for a multinational company using Microsoft Sentinel. You need to ensure that critical incidents are automatically escalated to the on-call team via email and SMS. The on-call schedule uses Microsoft Teams channel. What is the most efficient way to achieve this?

Accepted Answer

Build a playbook using Microsoft Teams connector to post a message in the on-call channel with an adaptive card that allows acknowledge and escalate.. It uses a Microsoft Teams connector playbook triggered by an automation rule to post an adaptive card in the on-call channel. This allows the on-call team to acknowledge or escalate the incident directly from Teams, fulfilling the requirement for email and SMS escalation through the Teams channel schedule. Automation rules in Sentinel can trigger playbooks based on incident creation or update, making this the most efficient integrated approach.

Answer

Create an automation rule that sends email directly to the on-call team.

Answer

Configure the analytics rule to send an email when the incident is created.

Answer

Use a workbook to display critical incidents and expect the team to monitor it.

Question 13

Refer to the exhibit. You are deploying a Microsoft Sentinel workspace using an ARM template. After deployment, you notice the workspace is in a disabled state for ingesting data. Which parameter is most likely causing this?

Accepted Answer

The dailyQuotaInGB parameter sets a daily cap that may have been exceeded. The dailyQuotaInGB parameter sets a daily ingestion cap for the Log Analytics workspace. If this cap is reached, data ingestion is disabled until the next day, causing the workspace to appear in a disabled state for ingesting data. This is the most likely cause because the question explicitly states the workspace is disabled for data ingestion, which aligns with the behavior of the daily cap being exceeded.

Answer

The location parameter is set to 'eastus' but Sentinel is not available in that region

Answer

The retentionInDays parameter is set to 90, which is less than the default 30 days

Answer

The workspaceName parameter is set to 'SentinelWorkspace' but the name must be globally unique

Question 14

During an incident investigation in Microsoft 365 Defender, an analyst examines an email that was reported as phishing. The analyst opens the email entity page and looks at the 'Detection details' section. Which piece of information would the analyst find there?

Accepted Answer

The detection technology (e.g., Advanced ML, Reputation) and if the email was part of a phish simulation or a campaign.. The 'Detection details' section on the email entity page in Microsoft 365 Defender specifically shows the detection technology used (e.g., Advanced ML, Reputation, Bulk) and whether the email was part of a phishing simulation or a campaign. This information helps analysts understand how the email was identified as malicious and its context within broader threat activity.

Answer

The delivery location and whether the email was delivered to Inbox, Junk, or Quarantine.

Answer

The authentication statuses (SPF, DKIM, DMARC) for the sender domain.

Answer

The sender IP address and the recipient email address.

Question 15

You are a SOC analyst at Contoso. The environment includes Microsoft Sentinel in a single workspace, Microsoft Defender XDR (including Defender for Endpoint, Defender for Office 365, Defender for Identity, and Defender for Cloud Apps), Microsoft Entra ID, and Microsoft Intune. You need to design a solution to automatically triage and respond to phishing incidents detected by Defender for Office 365. The requirements are: 1) When a phishing alert is generated with high confidence, an incident should be automatically created in Sentinel. 2) The incident should be assigned to the 'Phishing' team and have a severity of High. 3) A playbook should run that will send a Teams message to the Phishing team and also block the sender in Exchange Online. 4) The incident should be automatically closed if the playbook successfully executes. What should you do?

Accepted Answer

Enable the Microsoft 365 Defender connector to synchronize incidents, create an automation rule triggered on incident creation with conditions for 'Phishing' and high confidence, assigning to 'Phishing' team, running a playbook, and enabling auto-closure.. It leverages the Microsoft 365 Defender connector to synchronize incidents from Defender for Office 365 into Microsoft Sentinel, which is the recommended approach for ingesting high-confidence phishing alerts. An automation rule triggered on incident creation with conditions for 'Phishing' and high confidence can assign the incident to the 'Phishing' team, run a playbook to send a Teams message and block the sender in Exchange Online, and enable auto-closure upon successful playbook execution.

Answer

Use the Office 365 connector to ingest alerts, then create an analytics rule to generate incidents, and use automation rules to assign and run playbooks.

Answer

Use a Logic App to continuously poll Defender for Office 365 APIs for alerts, create incidents via the Sentinel API, and assign them.

Answer

Create a custom analytics rule with KQL to detect phishing in Defender for Office 365 logs, generate incidents, and use automation rules.