SC-200 Practice Test 2 — 30 Questions

Question 1

Your organization uses Microsoft Defender XDR. You need to configure automatic attack disruption for identity-related threats. The solution should automatically contain a compromised user by disabling their account. Which setting should you enable?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Enable automatic attack disruption in the Microsoft Defender XDR settings.. Microsoft Defender XDR's automatic attack disruption feature is specifically designed to contain identity-related threats by automatically disabling compromised user accounts. This setting, found in the Microsoft Defender XDR settings under 'Automated investigation and response', triggers when high-confidence identity attacks (e.g., password spray, lateral movement) are detected, without requiring manual intervention or additional infrastructure.

Answer

Configure Conditional Access policies to block the user.

Answer

Use Microsoft Sentinel automation rules to disable the user.

Answer

Create a custom detection rule to alert on suspicious sign-ins.

Question 2

During a ransomware incident, you need to prevent the encryption of files in SharePoint Online and OneDrive for Business. You have already identified the compromised user account. What should you do?

Accepted Answer

Lock the compromised user account in Microsoft Entra ID. Locking the compromised user account in Microsoft Entra ID immediately revokes the attacker's access to SharePoint Online and OneDrive for Business, preventing further file encryption. Option A is incorrect because disabling external sharing does not stop an already authenticated user from encrypting files. Option C is incorrect because deleting the user's OneDrive files does not prevent the attacker from encrypting other files. Option D is incorrect because a retention policy only protects against deletion or modification, not encryption.

Answer

Disable external sharing for SharePoint Online

Answer

Delete the compromised user's OneDrive files

Answer

Apply a retention policy to all SharePoint sites

Question 3

Which THREE of the following are key components of a successful threat hunting program in a Microsoft Defender XDR environment?

Accepted Answer

Deep understanding of normal network behavior. A successful threat hunting program in Microsoft Defender XDR requires a deep understanding of normal network behavior (A), because establishing a baseline of legitimate activity lets hunters spot anomalies across endpoint, identity, email, and cloud telemetry that automated detections may miss. A clear hypothesis based on threat intelligence (B) is essential, since threat hunting is hypothesis-driven rather than alert-driven; hunters use intel to form testable assumptions about adversary behavior and then query Defender XDR advanced hunting (KQL) to validate or refute them. The use of the MITRE ATT&CK framework (C) is also a key component, as it maps observed techniques and tactics to a common taxonomy, helping hunters prioritize coverage gaps and structure hunts around known adversary TTPs. Automated incident response playbooks (D) belong to SOAR/automated investigation and response, not threat hunting, and reactive response to alerts (E) is the opposite of proactive hunting, so neither is a core component of a threat hunting program.

Answer

Automated incident response playbooks

Answer

Reactive response to alerts

Question 4

A threat hunter is using Microsoft Defender for Endpoint advanced hunting to find devices that have a specific file hash associated with a known malware variant. The analyst wants to include devices that have the file in any location, including quarantined items. Which table and column should be used?

Accepted Answer

DeviceFileEvents, SHA256. DeviceFileEvents tracks file creation, modification, and deletion events, including those that are quarantined, and it includes the SHA256 column for file hashes. Option A (DeviceImageLoadEvents) is for image (DLL) loads, not general file info. Option C (DeviceNetworkEvents) covers network connections, not files. Option D (DeviceProcessEvents) involves process execution, not file discovery, and its ProcessCommandLine column does not contain file hashes.

Answer

DeviceImageLoadEvents, SHA256

Answer

DeviceNetworkEvents, RemoteIP

Answer

DeviceProcessEvents, ProcessCommandLine

Question 5

Your organization uses Microsoft Purview Data Loss Prevention (DLP) policies. You need to investigate an incident where sensitive data was shared externally. You want to view the details in Microsoft Sentinel. What should you ensure is configured?

Accepted Answer

The Microsoft 365 data connector in Microsoft Sentinel is enabled and configured to collect DLP alerts.. Microsoft Sentinel's Microsoft 365 data connector ingests unified audit logs from Microsoft Purview, including DLP alerts. When this connector is enabled and configured to collect DLP alerts, Sentinel can receive and surface the incident details, allowing investigation of externally shared sensitive data. Without this connector, DLP events remain in the Purview compliance portal and are not forwarded to Sentinel.

Answer

The SharePoint site is configured for external sharing.

Answer

The DLP policy must be set to 'Audit only' mode.

Answer

The unified audit log is enabled and the DLP events are being generated.

Question 6

Your organization uses Microsoft Sentinel. An incident is created for a possible data exfiltration via an unapproved external IP address. Which type of Microsoft Sentinel automation should you use to automatically block the IP address in the firewall?

Accepted Answer

Playbook.. Playbooks in Microsoft Sentinel are automated workflows based on Azure Logic Apps that can perform response actions, such as blocking an IP address in a firewall. When an incident indicates data exfiltration via an unapproved external IP, a playbook can be triggered automatically or manually to execute the block action via integration with firewall APIs or management tools.

Answer

Data connector.

Answer

Analytics rule.

Answer

Watchlist.

Question 7

Your organization uses Microsoft Sentinel and has several analytics rules that generate incidents from various data sources. The SOC team is overwhelmed by the number of incidents. You need to implement a triage system that automatically assigns incidents to different analysts based on the incident's tactics and severity. You also want to send a notification to the assigned analyst via Teams. What should you do?

Accepted Answer

Create multiple automation rules that trigger on incident creation, each with conditions for specific tactics and severity, and then run a playbook that assigns the incident to an analyst and sends a Teams notification.. Automation rules in Microsoft Sentinel trigger on incident creation and support conditions based on incident properties such as tactics and severity, and they can invoke a playbook. Creating multiple automation rules with tactic/severity conditions that each run an assignment-and-notification playbook delivers the required automatic triage and Teams alerting. This is the native, supported pattern for conditional incident routing.

Answer

Use a workbook to create a triage dashboard and instruct analysts to manually claim incidents from the dashboard.

Answer

Modify each analytics rule to include a custom details field that specifies the analyst, and use a playbook to send Teams notification based on that field.

Answer

Create a single playbook that checks the incident's tactics and severity, assigns it to the appropriate analyst, and sends a Teams notification, then configure that playbook to run automatically on all new incidents.

Question 8

Your organization uses Microsoft Defender XDR. You need to configure automatic attack disruption for identity-related threats. The solution should automatically contain a compromised user by disabling their account. Which setting should you enable?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Add a condition to exclude processes signed by trusted certificates or from known IT admin accounts.. Adding a condition to exclude processes signed by trusted certificates or from known IT admin accounts directly reduces false positives by filtering out legitimate administrative activity. Custom detection rules in Microsoft Defender XDR allow you to refine queries with additional conditions, such as excluding specific signers or accounts, which preserves detection of malicious PowerShell commands while ignoring benign ones.

Answer

Disable the rule and create a new rule with a different MITRE technique.

Answer

Increase the lookback period from 7 to 30 days.

Answer

Modify the rule to set the severity to 'Informational'.

Question 9

Your Microsoft Sentinel workspace is ingesting data from multiple sources. You need to ensure that data from a specific source is retained for 2 years while other data remains at the default retention. What should you do?

Accepted Answer

Create a custom table for that source and set its retention to 2 years.. In Microsoft Sentinel, retention is set at the table level. By creating a custom table for the specific data source and configuring its retention period to 2 years, you can override the default workspace retention for that table only. This allows other tables to retain the default retention setting while the custom table retains data for the required duration.

Answer

Adjust the data ingestion settings for that source.

Answer

Set the workspace retention to 2 years.

Answer

Configure archiving for that source's data.

Question 10

Your organization uses Microsoft Sentinel. You need to design a solution to automatically respond to a specific type of incident by sending an email to the SOC manager and creating a ticket in ServiceNow. What should you use?

Accepted Answer

Create a playbook in Microsoft Sentinel and trigger it with an automation rule.. Microsoft Sentinel uses Azure Logic Apps-based playbooks to execute complex, multi-step automated responses, such as sending an email and creating a ServiceNow ticket. An automation rule is required to trigger the playbook when an incident meets specific criteria, as analytics rules alone cannot directly invoke external systems like ServiceNow.

Answer

Create an analytics rule that directly sends an email.

Answer

Create a workbook that triggers a webhook.

Answer

Create an automation rule that sends an email and creates a ticket.

Question 11

Which TWO actions should you take when handling a confirmed ransomware incident in an environment protected by Microsoft Defender for Endpoint?

Accepted Answer

Block the ransomware file hash using threat intelligence indicators in Microsoft Defender.. Blocking the ransomware file hash via threat intelligence indicators in Microsoft Defender for Endpoint (MDE) immediately prevents further execution of that known malicious file across all endpoints in the environment, leveraging the built-in TI indicator feature. Option B is correct because initiating device isolation from the MDE console disconnects the affected device from the network while maintaining connectivity to the MDE service, containing the spread of ransomware without losing visibility or control.

Answer

Disable Windows Defender real-time protection.

Answer

Submit the ransomware sample to Microsoft for analysis.

Answer

Reimage all affected servers immediately.

Question 12

Match each Microsoft 365 Defender workload to its description.

Accepted Answer

Microsoft Defender for Endpoint: Provides enterprise-grade endpoint security, including antivirus, anti-malware, and advanced threat protection for devices.. Microsoft 365 Defender includes four main workloads: Defender for Endpoint (endpoint security), Defender for Office 365 (email & collaboration), Defender for Identity (on-premises AD security), and Defender for Cloud Apps (cloud app security). Common confusions involve mixing up definitions between these workloads.

Answer

Microsoft Defender for Endpoint: Safeguards email and collaboration tools (Exchange, SharePoint, Teams) against phishing, spam, malware, and other threats.

Answer

Microsoft Defender for Office 365: Uses on-premises Active Directory signals to identify, detect, and investigate advanced threats and identity compromises.

Question 13

You are a security operations analyst at a company that uses Microsoft Sentinel. You need to ensure that all incidents generated from Microsoft Defender for Cloud Apps are automatically assigned to the same SOC team. The team uses Microsoft Teams to collaborate. Which configuration should you implement?

Accepted Answer

Create an automation rule that sets the owner to the team entity.. Automation rules in Microsoft Sentinel can directly set the incident owner to a specific user or group (such as a SOC team) without requiring a playbook. This ensures all incidents from Microsoft Defender for Cloud Apps are automatically assigned to the designated team, streamlining ownership and collaboration via Microsoft Teams.

Answer

Create a playbook that assigns the incident to the team and configure an automation rule to run it.

Answer

Configure the Microsoft Defender for Cloud Apps connector to assign incidents to the team.

Answer

Use a logic app to automatically post incidents to a Teams channel and have the team claim them.

Question 14

Your organization is using Microsoft Sentinel and has deployed the Microsoft Entra ID (Azure AD) connector. You need to create an analytics rule that triggers an incident when a user from a specific IP address is assigned the Global Administrator role. The IP address is not in your trusted IP list. Which KQL query should you use as the rule logic?

Accepted Answer

AuditLogs | where ActivityDisplayName == 'Add member to role' and TargetResources[0].displayName == 'Global Administrator' and InitiatedBy.app.ipAddress !in (dynamic(['10.0.0.1', '10.0.0.2'])). It uses the `!in` operator to filter out specific IP addresses from the `InitiatedBy.app.ipAddress` field, ensuring that only events from IP addresses not in the trusted list trigger an incident. The query correctly targets `AuditLogs` with `ActivityDisplayName == 'Add member to role'` and checks that the role assigned is `Global Administrator` via `TargetResources[0].displayName`. This logic matches the requirement to alert when a user from a specific IP address (10.0.0.1) that is not in the trusted list is assigned the Global Administrator role.

Answer

AuditLogs | where ActivityDisplayName == 'Add member to role' and TargetResources[0].displayName == 'Global Administrator' and InitiatedBy.app.ipAddress == '10.0.0.1'

Answer

AuditLogs | where ActivityDisplayName == 'Add member to role' and TargetResources[0].displayName == 'Global Administrator' and InitiatedBy.app.ipAddress !has '10.0.'

Answer

AuditLogs | where ActivityDisplayName == 'Add member to role' and TargetResources[0].displayName == 'Global Administrator' and InitiatedBy.app.ipAddress !in ('trusted IP list')

Question 15

Your SOC team uses Microsoft Sentinel incident investigation. An analyst needs to quickly see all related entities (users, IPs, machines) for an incident. Which feature should the analyst use?

Accepted Answer

Incident investigation graph. The Incident investigation graph in Microsoft Sentinel provides a visual, interactive map of all entities (users, IPs, machines) linked to an incident, allowing analysts to quickly see relationships and pivot between entities. This is the dedicated feature for entity-centric incident exploration, unlike other options that serve different purposes.

Answer

Incident timeline

Answer

Hunting blade

Answer

Entity behavior analytics page

Question 16

You are reviewing the automation rule configuration shown in the exhibit. What is the purpose of this rule?

Accepted Answer

Run a playbook to isolate a device when an incident with 'Malware' in the alert title is created. The automation rule is configured to trigger when an incident is created with 'Malware' in the alert title. The action specified is to run a playbook, which in Microsoft Sentinel can perform complex remediation steps such as isolating a device. Option C correctly identifies this combination of trigger condition and action.

Answer

Automatically resolve incidents related to malware

Answer

Automatically close incidents with 'Malware' in the title

Answer

Create a playbook for malware alerts

Question 17

Which TWO are supported data sources for Microsoft Sentinel?

Accepted Answer

Microsoft Entra ID audit logs. Microsoft Entra ID audit logs (Option C) are a native data source for Microsoft Sentinel because Sentinel is built on Azure Monitor Logs and directly ingests Entra ID (formerly Azure AD) diagnostic settings via the Azure portal or API. This integration requires no additional connectors or agents, as Entra ID audit logs are automatically forwarded to a Log Analytics workspace when configured under 'Diagnostic settings' in the Entra ID blade.

Answer

Google Cloud VPC Flow Logs

Answer

Windows Server 2008 event logs

Answer

On-premises syslog-ng

Question 18

Your organization uses Microsoft Sentinel. An incident has been identified as a false positive. What is the recommended action to prevent similar false positives in the future?

Accepted Answer

Modify the analytics rule to reduce false positives. Modifying the analytics rule addresses the root cause of the false positive by adjusting the rule's query logic, thresholds, or entity mappings to reduce noise. In Microsoft Sentinel, analytics rules define the conditions that generate incidents; tuning these rules (e.g., changing frequency, lookback period, or adding exclusion filters) directly prevents similar false positives from recurring. Simply closing or classifying incidents does not prevent future occurrences, and deleting the rule would remove all detection capability.

Answer

Delete the analytics rule

Answer

Close the incident and set the classification to 'False positive'

Answer

Mark the incident as 'False positive' and add a comment

Question 19

Refer to the exhibit. You are reviewing a KQL query used in a Microsoft Sentinel scheduled analytics rule. What is the primary purpose of this query?

Accepted Answer

To detect accounts that have triggered a high number of suspicious process alerts within 7 days. The query uses `summarize` with `dcount(EventID)` to count distinct process creation events per account, then filters for accounts with a count greater than 10 using `where EventCount > 10`. The `where TimeGenerated > ago(7d)` restricts the time window to the last 7 days. This pattern is designed to detect accounts that have triggered a high number of suspicious process alerts (EventID 4688) within a week, making D correct.

Answer

To investigate a new type of attack pattern

Answer

To identify which accounts are associated with the most incidents

Answer

To find accounts that have generated false positive alerts

Question 20

Refer to the exhibit. You are reviewing an automation rule in Microsoft Sentinel. What is the effect of this rule?

Accepted Answer

It changes the status of newly created incidents from 'New' to 'Active'.. The automation rule is configured to run when an incident is created, and the action taken is to change the incident status from 'New' to 'Active'. This is a common initial triage step to indicate that the incident is being worked on, rather than leaving it in the default 'New' state. The rule does not assign ownership, suppress incidents, or create tasks.

Answer

It assigns the incident to the SOC team.

Answer

It suppresses the incident if it is a false positive.

Answer

It creates a task in the incident for investigation.