SC-200 Practice Test 32 — 15 Questions

Question 1

A SOC analyst needs to create a custom alert in Microsoft Sentinel that triggers when a specific user logs in from an unusual geographic location, compared to a learned baseline of normal locations. Which type of analytics rule is best suited for this scenario?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Anomaly detection rule (machine learning). Anomaly detection rules in Microsoft Sentinel use machine learning to establish a baseline of normal user behavior, such as typical geographic login locations. When a login event deviates significantly from this learned baseline, the rule triggers an alert. This is the only rule type specifically designed for detecting behavioral anomalies without requiring static thresholds or predefined patterns.

Answer

Scheduled query

Answer

Near-real-time (NRT) rule

Answer

Fusion rule

Question 2

The KQL query above is used in a Microsoft Sentinel analytics rule. What is the purpose of this rule?

Accepted Answer

Detect brute force attempts against disabled user accounts.. The KQL query filters for sign-in events where the user account is disabled (e.g., StatusCode = 50057 or UserAccountControl flags indicate disabled) and then groups by source IP and user to count failed attempts over a short window. When the count exceeds a threshold, it signals a brute force attack targeting disabled accounts, which is a common post-exploitation or reconnaissance technique. Option C is correct because the rule specifically detects repeated authentication failures against disabled accounts, not just any sign-in attempt or inactivity.

Answer

Detect when a disabled user account attempts to sign in.

Answer

Identify users who have been disabled due to inactivity.

Answer

Monitor sign-in attempts from suspicious IP addresses.

Question 3

Your organization uses Microsoft Sentinel and Microsoft Defender for Cloud. You need to ensure that all cloud security alerts are automatically ingested into Sentinel. What should you configure?

Accepted Answer

Configure the Microsoft Defender for Cloud data connector (Legacy).. The Microsoft Defender for Cloud data connector (Legacy) is the correct choice because it specifically ingests security alerts from Microsoft Defender for Cloud into Microsoft Sentinel. This connector ensures that all alerts generated by Defender for Cloud's security policies and threat detection are automatically streamed into Sentinel for centralized monitoring and incident response.

Answer

Configure the Microsoft 365 Defender data connector.

Answer

Configure the Azure Activity data connector.

Answer

Create a custom log table and a PowerShell script to push alerts.

Question 4

A security analyst in Microsoft 365 Defender needs to review all actions that were automatically taken by an investigation (e.g., isolating a device, deleting a file) that occurred during an incident. Where should the analyst find this list of executed actions?

Accepted Answer

Action center. The Action center in Microsoft 365 Defender is the centralized location that records all manual and automated response actions taken during investigations, such as device isolation, file deletion, or process termination. This includes actions automatically executed by automated investigation and response (AIR) playbooks during an incident. The analyst can filter the Action center by 'Automated' to see only those actions taken without manual intervention.

Answer

Hunting queries

Answer

Incidents page

Answer

Alerts page

Question 5

The exhibit shows a Conditional Access policy configuration in Microsoft Entra ID. The policy is intended to require MFA and compliant device for all users accessing all applications from trusted locations. However, users are reporting that they are being prompted for MFA even when accessing from the office (which is a trusted location). What is the most likely issue?

Accepted Answer

The location condition should include 'All untrusted locations' and exclude 'All trusted locations'.. The policy is configured to require MFA and compliant device for 'All users' accessing 'All applications' from 'Trusted locations'. However, users are being prompted for MFA from the office, which is a trusted location. The most likely issue is that the location condition is inverted: the policy should target 'All untrusted locations' (i.e., require MFA when not in a trusted location) and exclude 'All trusted locations' to avoid prompting from trusted IPs. Option D correctly identifies this misconfiguration.

Answer

The policy should target specific applications instead of 'All applications'.

Answer

The grant controls should be 'Require MFA' only, not 'Require compliant device'.

Answer

The policy should exclude the 'All Users' group and instead assign specific users.

Question 6

A security analyst wants to configure a playbook in Microsoft Sentinel that runs automatically when a specific alert is generated. Which trigger concept is used to invoke the playbook?

Accepted Answer

Azure Logic Apps trigger. In Microsoft Sentinel, playbooks are built on Azure Logic Apps, and the correct trigger to invoke a playbook automatically when an alert is generated is the Azure Logic Apps trigger. This trigger listens for the Sentinel alert creation event and initiates the playbook workflow. The other options are not valid trigger concepts within Sentinel's architecture.

Answer

Sentinel trigger

Answer

Alert trigger

Answer

Automation rule trigger

Question 7

You are a security operations analyst at a company that uses Microsoft Sentinel. You have enabled User and Entity Behavior Analytics (UEBA) to detect anomalies. A new alert fires indicating a user is logging in from an unusual location. However, the user is a known traveler. How can you reduce false positives without disabling the UEBA rule?

Accepted Answer

Add the user to the entity behavior analytics exclusion list.. Microsoft Sentinel's UEBA allows you to add specific users to an entity behavior analytics exclusion list. This prevents the UEBA engine from generating alerts for that user's anomalous activities, such as logins from unusual locations, without disabling the underlying detection rule. This approach maintains detection coverage for other users while suppressing false positives for known travelers.

Answer

Disable the UEBA anomaly rule for unusual locations.

Answer

Change the alert severity to Informational.

Answer

Increase the lookback period for the anomaly detection.

Question 8

You are configuring a Microsoft Sentinel analytics rule to detect brute-force attacks on your Azure Virtual Machines. The rule uses the 'SecurityEvent' table. You notice that the rule is not generating incidents even though you see failed logon events in the logs. What should you check?

Accepted Answer

The analytics rule is enabled and the query is correctly filtering for event ID 4625.. The most immediate reason a rule fails to generate incidents despite seeing failed logon events is that the rule itself is either disabled or its query does not correctly filter for event ID 4625, which is the specific Windows security event ID for failed logon attempts. Even if logs are present, the analytics rule must be enabled and its KQL query must accurately target the right event ID to trigger an incident. Without this, the rule will not process the events into alerts.

Answer

An automation rule is suppressing incidents with the same name.

Answer

The workspace retention period is set to less than 90 days.

Answer

The Log Analytics agent is not installed on the VMs.

Question 9

During an incident investigation, you discover that an attacker used a legitimate account to access sensitive data in Microsoft Purview Information Protection. You need to identify what data was accessed and by whom. Which log source should you query?

Accepted Answer

Microsoft Purview data access logs. Microsoft Purview data access logs (option B) are the correct source because they specifically record when users access sensitive data labeled with Microsoft Purview Information Protection, including details about what data was accessed and by whom. Unlike other logs, these capture data-level access events such as viewing, downloading, or modifying protected documents, which is essential for investigating an attacker using a legitimate account to exfiltrate sensitive information.

Answer

Microsoft 365 Defender alerts

Answer

Microsoft Entra ID sign-in logs

Answer

Office 365 audit logs (unified audit log)

Question 10

A security administrator wants to ensure that all existing and future Azure virtual machines have Microsoft Defender for Cloud's built-in vulnerability assessment solution (Qualys or Microsoft) installed without manual intervention. Which feature should the administrator configure?

Accepted Answer

Auto-provisioning of the vulnerability assessment solution. Auto-provisioning of the vulnerability assessment solution ensures that Microsoft Defender for Cloud automatically installs either the Qualys or Microsoft built-in vulnerability assessment extension on all existing and future Azure VMs without manual intervention. This feature is specifically designed to enable continuous vulnerability scanning by deploying the agent at scale, covering both new and existing resources as they are provisioned or discovered.

Answer

Continuous export of security findings to Log Analytics

Answer

Just-in-time VM access

Answer

Regulatory compliance dashboard

Question 11

Your organization uses Microsoft Sentinel and Microsoft Defender XDR. A critical incident has been generated from Microsoft Defender for Cloud indicating that a Linux VM in Azure is running a cryptocurrency miner. The VM is part of a production application and cannot be shut down immediately. The incident severity is High. You need to contain the threat while maintaining application availability, investigate the root cause, and prevent recurrence. The environment includes Azure Policy, Microsoft Defender for Endpoint on the VM, and a Log Analytics workspace. You must minimize manual steps. What course of action should you take?

Accepted Answer

Use Microsoft Sentinel automation to apply a block rule on the VM's network security group (NSG) to block outbound traffic to known mining pools, initiate Live Response to collect evidence, and create an Azure Policy to automatically deploy Microsoft Defender for Endpoint on all VMs. It uses Microsoft Sentinel automation to apply a network security group (NSG) rule to block outbound traffic to known mining pools, which contains the threat without disrupting the VM's availability for production traffic. Initiating Live Response on the VM allows collection of forensic evidence for investigation. Creating an Azure Policy to enforce Microsoft Defender for Endpoint deployment on all VMs helps prevent recurrence by ensuring all VMs have endpoint detection and response (EDR) capabilities. Option A is incorrect because remotely connecting and killing the process is a manual step that does not block the miner from restarting or communicating outbound, and it may not be immediately effective. Option B is incorrect because removing the VM from the load balancer alone does not stop the miner from running locally or potentially communicating via other routes, and Azure Policy for antivirus is insufficient for modern threats like miners. Option C is incorrect because stopping the VM immediately would disrupt production, and taking a snapshot then redeploying from backup does not address the immediate containment of the threat on the current VM.

Answer

Remotely connect to the VM and run a script to kill the miner process, then update antivirus definitions

Answer

Remove the VM from the load balancer, then use Azure Policy to enforce that all VMs have antivirus enabled

Answer

Stop the VM immediately, take a snapshot for forensic analysis, and then redeploy a clean VM from a backup

Question 12

A security analyst is triaging security alerts in Microsoft Defender for Cloud. Which of the following are valid ways to suppress a specific alert type to reduce noise? (Choose all that apply.)

Accepted Answer

Create an alert suppression rule based on alert entity. Microsoft Defender for Cloud allows you to create suppression rules that automatically dismiss alerts based on specific alert entities (such as alert ID, title, or severity) to reduce noise. These rules are configured in the security alerts settings and can be scoped to a subscription or management group, ensuring that alerts matching the defined criteria are silently dismissed without generating incidents.

Answer

Modify the alert's severity

Answer

Set an automatic response action

Question 13

A SOC analyst wants to create a Microsoft Sentinel scheduled analytics rule that alerts when a user from a critical department (e.g., Finance) logs on from an IP address that is not in the company's approved IP address ranges. The analyst has an Azure Sentinel watchlist named 'FinanceApprovedIPs' containing the allowed IP ranges. Which KQL operator should be used in the rule's query to efficiently check if the IP address from SigninLogs falls within any of the watchlist ranges?

Accepted Answer

join kind=inner (watchlist) on $left.IPAddress $right.IPRange with condition using ipv4_is_in_range() or ipv4_lookup(). The `ipv4_lookup()` function (or `ipv4_is_in_range()` used with a join) is specifically designed to efficiently check whether an IP address falls within a range defined in a watchlist. In Microsoft Sentinel, watchlists store data as tables, and `ipv4_lookup()` performs a range-based lookup using CIDR notation, which is far more efficient than string-based or exact-match operators. This allows the query to match the `IPAddress` from `SigninLogs` against the `IPRange` column in the `FinanceApprovedIPs` watchlist without iterating over every possible address.

Answer

where IPAddress has any (watchlist)

Answer

where IPAddress in (watchlist)

Answer

where IPAddress startswith (watchlist)

Question 14

Your organization is using Microsoft Defender for Cloud Apps to protect cloud applications. The security team wants to be alerted when a user shares a sensitive file with an external user. What should you configure?

Accepted Answer

File policy. File policies in Microsoft Defender for Cloud Apps are specifically designed to monitor and respond to events involving files stored in connected cloud apps, such as when a sensitive file is shared with an external user. You can configure a file policy with a filter for 'External' sharing and apply a content inspection rule to detect sensitive information types, triggering an alert when the condition is met.

Answer

Activity policy

Answer

App discovery policy

Answer

Anomaly detection policy

Question 15

You are managing a Microsoft Sentinel environment. You need to ensure that only security analysts with specific roles can modify automation rules. The solution must use least privilege. What should you do?

Accepted Answer

Create a custom role with 'Microsoft Sentinel Automation Contributor' permission and assign it to the analysts.. Microsoft Sentinel provides a built-in 'Microsoft Sentinel Automation Contributor' role that grants granular permissions to manage automation rules without granting broader Contributor access. This adheres to the least privilege principle by limiting modifications to only the necessary automation-related actions, such as creating, editing, or deleting automation rules, while preventing changes to other Sentinel resources like analytics rules or data connectors.

Answer

Use Azure Policy to restrict access to automation rules.

Answer

Assign the 'Microsoft Sentinel Contributor' role to all security analysts.

Answer

Assign the 'Microsoft Sentinel Reader' role to the analysts and grant them 'Automation' permissions via a separate policy.