SC-200 Practice Test 34 — 15 Questions

Question 1

Your organization uses Microsoft Sentinel. A security analyst reports a high number of false positives from a scheduled analytics rule that detects anomalous sign-ins. The rule uses the 'UserAgent' field in the SigninLogs table. What is the best practice to reduce false positives while maintaining detection coverage?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Add a condition to the rule query to filter out known legitimate user agents.. The high number of false positives is caused by legitimate user agents triggering the anomaly detection. By adding a condition to the KQL query that filters out known legitimate user agents (e.g., 'Mozilla/5.0' for standard browsers), you reduce noise without losing detection of truly anomalous sign-ins. This preserves the rule's coverage for unknown or malicious user agents while eliminating predictable false positives.

Answer

Increase the alert threshold to require more than one anomalous sign-in per hour.

Answer

Create a watchlist of legitimate IP addresses and reference it in the rule.

Answer

Disable the analytics rule and create a new one with different MITRE tactics.

Question 2

Your organization is using Microsoft Defender for Cloud to protect Azure workloads. A critical vulnerability was discovered in a virtual machine that is part of a production application. The vulnerability has a high severity score and is actively being exploited in the wild. You need to respond quickly to mitigate the risk. What is the most effective immediate action?

Accepted Answer

Enable just-in-time (JIT) VM access in Microsoft Defender for Cloud to lock down inbound traffic.. Enabling just-in-time (JIT) VM access in Microsoft Defender for Cloud immediately reduces the attack surface by locking down inbound traffic to the VM, except for approved connections from specific IP addresses and ports. This is the most effective immediate action when a critical, actively exploited vulnerability exists, as it buys time to apply a patch without exposing the VM to further exploitation. Unlike patching, which may require a reboot or cause downtime, JIT access can be enabled in minutes and does not disrupt production traffic for authorized users.

Answer

Apply the vendor patch immediately during business hours.

Answer

Modify the network security group (NSG) to block all inbound traffic to the VM.

Answer

Use the 'Remediate' option in Defender for Cloud to automatically apply the patch.

Question 3

Your organization uses Microsoft Sentinel. A security analyst reports a high number of false positives from a scheduled analytics rule that detects anomalous sign-ins. The rule uses the 'UserAgent' field in the SigninLogs table. What is the best practice to reduce false positives while maintaining detection coverage?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Review the UEBA insights for the user to understand the anomaly.. Before taking any disruptive action like disabling an account or resetting a password, the analyst must review the UEBA insights to validate whether the anomaly is a true compromise or a false positive (e.g., VPN usage, travel, or shared credentials). UEBA in Microsoft Sentinel correlates sign-in logs, Azure Activity, and other sources to surface risk scores and anomalous entities, giving the context needed for an informed decision.

Answer

Disable the user account in Microsoft Entra ID.

Answer

Create a custom automation rule in Sentinel to disable the account on similar alerts.

Answer

Reset the user's password immediately.

Question 4

You are investigating a Microsoft Sentinel incident involving a user who clicked a phishing link. The incident includes alerts from Microsoft Defender for Office 365. You need to identify if any other users received the same phishing email. What should you do?

Accepted Answer

Use the Threat Explorer in Microsoft Defender for Office 365. Threat Explorer in Microsoft Defender for Office 365 is the purpose-built tool for investigating email threats at scale — it lets you pivot on the phishing campaign's sender, URL, or message ID and see every recipient who received the same message. This is exactly the 'who else got this email' question. Sentinel's incident graph and timeline show correlated alerts but do not provide the email-centric recipient enumeration that Threat Explorer does.

Answer

Check the incident timeline for related alerts

Answer

Review the incident graph in Microsoft Sentinel

Answer

Run a KQL query in Advanced Hunting

Question 5

Which THREE data sources should be included in a Microsoft Sentinel workspace to comprehensively monitor for lateral movement within an Azure environment?

Accepted Answer

Azure AD sign-in logs. Microsoft Entra ID sign-in logs (A) are correct because they record authentication events, including risky sign-ins, IP addresses, and conditional access results, which are essential for detecting credential-based lateral movement across Azure resources. Azure Network Security Group flow logs (C) are correct because they capture allowed and denied IP traffic flows through NSGs, enabling detection of east-west movement between subnets and VMs. Azure Activity logs (E) are correct because they record control-plane operations such as role assignments, resource creation, and management actions that attackers use to pivot and escalate privileges. Power BI audit logs (B) and Azure DevOps audit logs (D) are not included because they focus on BI and DevOps activities, not on authentication, network, or Azure control-plane events relevant to lateral movement monitoring.

Answer

Power BI audit logs

Answer

Azure DevOps audit logs

Question 6

During an incident investigation, you find that a compromised account was used to log into a virtual machine via RDP from an IP address in a sanctioned country. The VM has Microsoft Defender for Endpoint installed. Which data source in Microsoft Sentinel would you query to see the RDP connection events?

Accepted Answer

SecurityEvent. The SecurityEvent table in Microsoft Sentinel collects Windows security events from machines with the Log Analytics agent or Azure Monitor Agent, including Event ID 4625 (failed logon) and Event ID 4624 (successful logon). Since the compromised account used RDP to log into a VM with Defender for Endpoint installed, the RDP connection events are captured as Windows security log events and stored in the SecurityEvent table. This is the correct data source for querying local authentication events on the VM itself.

Answer

DeviceLogonEvents (Microsoft Defender XDR)

Answer

CommonSecurityLog

Answer

SigninLogs (Microsoft Entra ID)

Question 7

A security analyst receives an alert from Microsoft Defender for Cloud Apps indicating that a user has signed in from a banned country. The analyst needs to block further access from that country for all users. What should the analyst configure?

Accepted Answer

Create an IP range group for the country and configure a session policy to block it.. Microsoft Defender for Cloud Apps session policies can block access based on IP address geolocation. By creating an IP range group for the banned country and configuring a session policy to block traffic from that group, the analyst can enforce real-time blocking of all user sessions originating from that country, leveraging the reverse proxy architecture of Defender for Cloud Apps.

Answer

Modify the device compliance policy in Microsoft Intune.

Answer

Configure a data loss prevention (DLP) policy in Microsoft Purview.

Answer

Create a conditional access policy in Microsoft Entra ID to block the country.

Question 8

An analyst creates a playbook in Microsoft Sentinel to automatically block an IP address when an alert fires. However, the playbook fails to block the IP. What is the most likely cause?

Accepted Answer

The IP address is being extracted from an incorrect field in the alert. The most likely cause is that the playbook is extracting the IP address from an incorrect field in the alert. In Microsoft Sentinel, playbooks use the SecurityAlert schema, where the IP address may be stored in different fields (e.g., 'RemoteIP', 'SourceIP', 'DestinationIP') depending on the alert provider. If the playbook references the wrong field, it will pass a null or incorrect value to the block action, causing the automation to fail silently or target the wrong entity.

Answer

The block duration is set to one day, which is too short

Answer

The playbook actions array has only one action, which is insufficient

Answer

The playbook is using the wrong trigger type; it should be on incident creation

Question 9

A SOC team wants to automate response to incidents detected by Microsoft Sentinel. When a new incident is created with severity "High" and contains a specific tag "malware", they want to run a playbook that isolates the affected device. What is the correct way to configure this automation?

Accepted Answer

Create an automation rule that triggers on "When incident is created" and set conditions for severity equals High and tag contains "malware", then set a playbook action.. Automation rules in Microsoft Sentinel are specifically designed to trigger playbooks based on incident creation events and conditions like severity and tag. By setting the trigger to 'When incident is created' and conditions for severity equals 'High' and tag contains 'malware', the rule will invoke the playbook to isolate the affected device automatically, without manual intervention.

Answer

Create a custom analytics rule that runs the playbook directly when triggered.

Answer

Configure a logic app with a trigger on "When a Microsoft Sentinel incident is created" and use conditions inside the logic app.

Answer

Use the Microsoft Sentinel API to create a webhook that triggers the playbook.

Question 10

You are reviewing an alert rule in Microsoft Sentinel created via ARM template. What is the primary purpose of this rule?

Accepted Answer

To send an alert when a sign-in with high risk level is detected.. The primary purpose of an alert rule in Microsoft Sentinel created via ARM template is to generate an alert when a specific condition is met, such as a sign-in with a high risk level detected by Microsoft Entra ID Protection. This alert can then be used to trigger automated responses or create incidents, but the rule itself is designed to detect and alert on the defined condition, not to perform remediation actions like isolation or blocking.

Answer

To isolate the user's device from the network.

Answer

To automatically block the user from signing in.

Answer

To create an incident in Microsoft Sentinel.

Question 11

Your organization uses Microsoft Defender for Identity. You need to receive alerts when suspicious LDAP queries are detected. What should you configure?

Accepted Answer

Configure alert rules in Microsoft Defender for Identity.. Microsoft Defender for Identity (MDI) detects suspicious LDAP queries, such as LDAP reconnaissance or directory traversal attacks, by analyzing domain controller traffic. To receive alerts for these detections, you must configure alert rules directly within the MDI portal, which allows you to set thresholds and notification preferences for specific LDAP-related activities. Option B is correct because MDI's built-in alert rules are the mechanism for generating and delivering these security alerts.

Answer

Set up an anomaly detection policy in Microsoft Defender for Cloud Apps.

Answer

Assign the Security Administrator role in Microsoft Entra ID.

Answer

Create a custom sensitivity label in Microsoft Purview.

Question 12

You are a Microsoft Security Operations Analyst. Your organization recently deployed Microsoft Defender for Cloud Apps. You need to ensure that alerts generated by Defender for Cloud Apps are automatically forwarded to Microsoft Sentinel. What should you configure?

Accepted Answer

In Microsoft Sentinel, add the Microsoft Defender for Cloud Apps data connector.. The Microsoft Defender for Cloud Apps data connector in Microsoft Sentinel is the native integration that automatically forwards alerts and cloud discovery logs from Defender for Cloud Apps into Sentinel. This connector uses the Microsoft Graph Security API to ingest alerts without requiring additional configuration in Defender for Cloud Apps, enabling seamless correlation and investigation within Sentinel.

Answer

In Microsoft Sentinel, create an analytics rule with a query that pulls data from Defender for Cloud Apps API.

Answer

In Microsoft Defender for Cloud Apps, configure SIEM integration.

Answer

In Microsoft Sentinel, configure a playbook to retrieve alerts from Defender for Cloud Apps.

Question 13

Arrange the steps to configure a Microsoft Sentinel playbook (automation) using Azure Logic Apps.

Accepted Answer

Step 1: Create a Logic App in Azure. Step 2: Configure the Sentinel trigger (e.g., "When a response to an Azure Sentinel incident is triggered"). Step 3: Add actions (e.g., send email, create ticket). Step 4: Save the playbook and link it to a Microsoft Sentinel automation rule.. Playbooks are Logic Apps that automate responses; they must be created and then linked to Sentinel automation rules.

Answer

Step 1: Create a Microsoft Sentinel automation rule. Step 2: Create a Logic App. Step 3: Add actions. Step 4: Save and test.

Answer

Step 1: Create a Logic App. Step 2: Add actions. Step 3: Configure the Sentinel trigger. Step 4: Link to automation rule.

Answer

Step 1: Configure Sentinel trigger. Step 2: Create a Logic App. Step 3: Add actions. Step 4: Link to automation rule.

Question 14

A SOC analyst in Microsoft Sentinel needs to create an automation rule that triggers a playbook when a new incident is created and the incident severity is 'High'. Additionally, the playbook should only run if the incident is not already assigned to an analyst. Which two conditions must the analyst include in the automation rule? (Select all that apply.) (Choose 2.)

Accepted Answer

Condition: 'Severity' equals 'High'. The automation rule must trigger only when the incident severity is 'High'. In Microsoft Sentinel, automation rules evaluate conditions against incident properties, and the 'Severity' condition filters incidents by their assigned severity level. This ensures the playbook runs exclusively for high-severity incidents, aligning with the SOC's requirement to prioritize critical alerts.

Answer

Condition: 'Status' equals 'New'

Answer

Condition: 'Provider' contains 'Microsoft Sentinel'

Question 15

Your SOC uses Microsoft Sentinel with multiple workspaces for different business units. You want to create a single dashboard that shows key performance indicators (KPIs) across all workspaces. Which approach minimizes complexity and query latency?

Accepted Answer

Use cross-workspace queries in a single dashboard that references all workspaces.. Cross-workspace queries in Microsoft Sentinel allow you to query multiple workspaces in a single KQL query using the `workspace()` expression, enabling a unified dashboard without data duplication or additional infrastructure. This minimizes complexity by avoiding data movement and reduces query latency by leveraging the existing indexing and caching within each workspace.

Answer

Export data to Azure Data Explorer and build the dashboard there.

Answer

Ingest all logs into a single workspace and create the dashboard there.

Answer

Use Power BI to query each workspace separately and combine data.