SC-200 Practice Test 31 — 15 Questions

Question 1

An incident in Microsoft Defender XDR involves a device that is suspected to be infected with ransomware. The device is online and actively encrypting files. Which action should you take to contain the threat?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Isolate the device from the network. Isolating the device from the network (Option A) is the correct immediate action because it stops the ransomware from communicating with its command-and-control (C2) server and prevents further lateral movement or encryption of network shares. In Microsoft Defender for Endpoint, device isolation blocks all inbound and outbound traffic at the OS kernel level, while still allowing the device to remain online for forensic analysis and remediation. This containment strategy is critical when the device is actively encrypting files, as it halts the attack's spread without losing the ability to investigate or remediate.

Answer

Disable the user's account

Answer

Run a full antivirus scan on the device

Answer

Collect a memory dump from the device

Question 2

A security analyst is investigating a phishing incident and needs to find the specific email message that was delivered to a user. The analyst knows the subject line and the sender domain. Which advanced hunting table should the analyst query?

Accepted Answer

EmailEvents. The EmailEvents table in Microsoft Defender XDR's advanced hunting schema contains the core properties of email messages, including subject line, sender domain, recipient details, and delivery status. Since the analyst needs to find a specific email by subject and sender domain, this table is the correct starting point for querying delivered messages.

Answer

EmailAttachmentInfo

Answer

EmailUrlInfo

Answer

EmailPostDeliveryEvents

Question 3

You are reviewing an analytics rule in Microsoft Sentinel. The rule is supposed to alert when a Confidential sensitivity label file is accessed. However, no alerts have been generated despite known accesses. What is the most likely reason?

Accepted Answer

The required data connector for Microsoft Purview Information Protection is not connected.. Microsoft Sentinel relies on data connectors to ingest logs from external sources. For alerts based on sensitivity labels (e.g., Confidential), the required data source is Microsoft Purview Information Protection (formerly Azure Information Protection). If this connector is not connected, Sentinel has no way to receive the label-related events, so no alerts can be generated regardless of the rule logic.

Answer

The suppression duration is set to 5 hours, which suppresses alerts.

Answer

The query frequency and period are too short to capture the events.

Answer

The trigger condition is set to 'GreaterThan' 0, which should fire on any event.

Question 4

You manage a Microsoft Sentinel workspace that ingests logs from multiple sources. You notice that the workspace is approaching its daily ingestion quota, and some data sources are being dropped. You need to ensure that security-related logs are prioritized and that non-critical logs are not ingested. What should you configure?

Accepted Answer

Use data collection rules (DCRs) to filter log ingestion. Data collection rules (DCRs) allow you to define transformations that filter logs before they are ingested into a Log Analytics workspace. By configuring a DCR with a KQL-based transformation, you can drop non-critical logs while ensuring security-related logs are always ingested, preventing them from being dropped when the daily quota is approached.

Answer

Create analytic rules with entity mapping to prioritize alerts

Answer

Set a daily cap on the Log Analytics workspace

Answer

Configure diagnostic settings to exclude certain logs

Question 5

Your organization uses Microsoft Defender for Identity and Microsoft Defender XDR. You receive an alert about a suspicious LDAP query originating from a domain controller. The alert indicates potential use of the DCSync attack technique. What is the most effective immediate action to contain the attack?

Accepted Answer

Disable the account that initiated the suspicious replication request.. The DCSync attack abuses the Directory Replication Service Remote Protocol (MS-DRSR) to impersonate a domain controller and request replication of credentials. Disabling the compromised account that initiated the suspicious LDAP replication request immediately stops the attacker's ability to request further replication, effectively containing the attack at the source without disrupting the entire domain.

Answer

Block all LDAP traffic at the firewall.

Answer

Restart the domain controller to clear any malicious processes.

Answer

Reset the krbtgt account password twice.

Question 6

You are reviewing a threat hunting KQL query in Microsoft Sentinel. The query references an external CSV containing malicious IPs. The query returns no results despite known malicious activity. What is the most likely issue?

Accepted Answer

The external CSV file is not accessible or the URL is malformed.. The query uses the externaldata operator to load an external CSV file. If the file URL is malformed or inaccessible, the query will not load any IPs, resulting in no matches. Option A is incorrect because externaldata is supported in Microsoft Sentinel. Option B is incorrect because the HuntingTimeRange variable is likely used correctly to filter by time, but time filtering is not the cause of zero results. Option C is incorrect because the project clause selects the RemoteIP column; it does not remove it.

Answer

The externaldata function is not supported in Microsoft Sentinel.

Answer

The HuntingTimeRange variable is not being used correctly.

Answer

The project clause removes the RemoteIP column.

Question 7

A threat hunter wants to correlate alerts from multiple Microsoft security products in Microsoft Sentinel. Which feature should be used to create a unified incident?

Accepted Answer

Analytics Rules. Analytics Rules in Microsoft Sentinel can be configured to create incidents from alerts across multiple security products, enabling unified incident creation for threat hunting. Option A (Threat Intelligence) is used to import and use threat intelligence feeds, not to create incidents. Option B (Jupyter Notebooks) provides a platform for security analysis and automation using Python, not for incident creation. Option D (Investigation Graph) is a visual tool for exploring connections between entities in an investigation, not for creating incidents.

Answer

Threat Intelligence

Answer

Jupyter Notebooks

Answer

Investigation Graph

Question 8

During a threat hunting exercise, you need to pivot from a suspicious IP address to find all related alerts and incidents in Microsoft Sentinel. Which feature should you use?

Accepted Answer

Investigation graph. The investigation graph in Microsoft Sentinel allows visual pivoting and exploration of entities, making it the correct tool for pivoting from a suspicious IP to find related alerts and incidents. Option A (Workbooks) is incorrect because workbooks are for creating dashboards and reports. Option B (Incidents blade) is incorrect because it shows incidents but does not provide entity relationship visualization. Option D (Playbook) is incorrect because playbooks automate responses, not pivot investigations.

Answer

Workbook

Answer

Incidents blade

Answer

Playbook

Question 9

Which THREE techniques would you use in Microsoft Sentinel to hunt for data exfiltration over DNS?

Accepted Answer

Analyze DNS query logs for high volume or long subdomains. Correct options: A, C, E. DNS query analysis (A) helps identify unusual domain patterns like long subdomains indicative of exfiltration. Correlating DNS with process creation (C) pinpoints the source process, aiding attribution. ASIM DNS parsers (E) normalize logs for advanced anomaly detection. Option B is incorrect because large data transfers to known cloud storage IPs are not specific to DNS exfiltration—DNS exfiltration typically uses small payloads in DNS queries. Option D is unrelated as email forwarding rules are about email, not DNS.

Answer

Examine network traffic logs for large data transfers to known cloud storage IPs

Answer

Review email forwarding rules for external domains

Question 10

Refer to the exhibit. You are reviewing a custom hunting query in Microsoft Defender XDR. The query aims to identify devices with more than 100 outbound connections in the last 30 days to IPs that appear in active threat intelligence indicators. However, the query returns no results. What is the most likely cause?

Accepted Answer

The ThreatIntelligenceIndicator table does not contain any indicators with an Active status that match the remote IPs.. The most likely cause is that the ThreatIntelligenceIndicator table does not contain any active indicators that match the remote IPs from the DeviceNetworkEvents. The query uses an inner join between DeviceNetworkEvents and ThreatIntelligenceIndicator on RemoteIP and NetworkIP. If there are no matching indicators, the join produces zero results. Option A is incorrect because filtering for public IPs is correct for outbound connections to the internet. Option B is incorrect because IP version mismatch would cause a join failure, but the query would still return results if the version matched. Option D is incorrect because the threshold of 100 connections may be high, but if there were matching indicators, some devices would return results.

Answer

The RemoteIPType filter for 'Public' excludes all internal IPs, but devices connect to internal IPs mostly.

Answer

The join on RemoteIP and NetworkIP is mismatched because one is IPv4 and the other IPv6.

Answer

The ConnectionCount threshold of 100 is too high; most devices do not exceed this.

Question 11

Your security operations center uses Microsoft Sentinel and Microsoft Defender XDR. A new type of attack involves a user receiving a malicious email that triggers a macro, which then executes PowerShell to download a payload. You need to create a detection that correlates email, process creation, and network connection events from multiple Microsoft 365 Defender sources. What should you use?

Accepted Answer

Advanced hunting in Microsoft 365 Defender. Advanced hunting in Microsoft 365 Defender is the correct choice because it allows you to write Kusto Query Language (KQL) queries that can join data across multiple tables from different Microsoft 365 Defender sources, such as EmailEvents, DeviceProcessEvents, and DeviceNetworkEvents. This enables correlation of the email receipt, macro-triggered PowerShell process creation, and subsequent network connection to a malicious IP or domain in a single query, which is exactly what the scenario requires.

Answer

Scheduled query rule in Microsoft Sentinel

Answer

Custom detection rule in Microsoft 365 Defender

Answer

Fusion rule in Microsoft Sentinel

Question 12

Refer to the exhibit. You are deploying this analytics rule in Microsoft Sentinel. Which activity will trigger an alert?

Accepted Answer

Word launching cmd.exe. The analytics rule is configured to trigger an alert when a process creation event (Event ID 4688) has a parent process of 'winword.exe' and a child process of 'cmd.exe'. This specific parent-child relationship indicates that Microsoft Word is launching a command prompt, which is a common technique used in malicious documents to execute commands. The rule's query filters for 'ParentImage' containing 'winword.exe' and 'Image' containing 'cmd.exe', so only when Word launches cmd.exe will the alert fire.

Answer

cmd.exe launching winword.exe

Answer

Any process creation event

Answer

Winword.exe execution

Answer

Any cmd.exe execution

Question 13

Your team uses Microsoft Sentinel workbooks to visualize security data. You want to allow team members to customize a workbook without affecting the original. What should you do?

Accepted Answer

Create a copy of the workbook and save it as a custom workbook. Creating a copy of the workbook and saving it as a custom workbook allows team members to modify their own version without altering the original. In Microsoft Sentinel, workbooks are based on Azure Monitor Workbooks, and saving a copy creates an independent resource with its own settings and queries. This preserves the original workbook for reference or reuse while enabling customization.

Answer

Edit the original workbook to add personalization

Answer

Assign the team the Microsoft Sentinel Reader role

Answer

Share the workbook directly with the team

Question 14

Refer to the exhibit. You are reviewing an Azure Security Center automation (now Microsoft Defender for Cloud) that should automatically trigger a Logic App when an alert is generated. However, the automation is not triggering. What is the most likely cause?

Accepted Answer

The automation is missing the 'triggers' property to filter on specific alert types. Microsoft Defender for Cloud automation requires a 'triggers' property to define which alert types should invoke the Logic App. Without this property, the automation is created but never fires, as it has no conditions to match incoming alerts. The exhibit shows the automation resource is configured, but missing the triggers array means no alerts will trigger the Logic App.

Answer

The action type is incorrect; it should be 'EventHub'

Answer

The logicAppResourceId is missing

Answer

The apiVersion is invalid

Question 15

Refer to the exhibit. A security analyst creates a scheduled analytics rule in Microsoft Sentinel based on the JSON shown. After enabling the rule, the analyst notices that the rule generates alerts every hour for the same user accounts even after the incidents are resolved. What is the most likely cause?

Accepted Answer

Suppression is disabled, so the rule fires every hour with overlapping results. Suppression is disabled, so the rule fires every hour regardless of previous alerts. Option A is wrong because severity being set to High does not cause multiple alerts; it only affects the severity level of the generated alert. Option B is wrong because the query period is 1 day, which is appropriate and does not cause the rule to refetch old data every hour; the issue is with suppression, not query period. Option D is wrong because the trigger threshold of 10 controls when an alert is generated, but it does not prevent duplicate alerts from being created for the same resolved incidents; suppression is needed for that.

Answer

The severity is set to High, causing multiple alerts

Answer

The query period is too short, causing the rule to refetch old data

Answer

The trigger threshold is too low, causing the rule to fire too often