SC-200 Practice Test 35 — 15 Questions

Question 1

Your organization uses Microsoft Defender for Cloud Apps. During an incident, you discover that a user is downloading large amounts of data from SharePoint to an unmanaged device. You need to automatically block further downloads from that device. What should you configure?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Create a session policy in Microsoft Defender for Cloud Apps to block download.. A session policy in Microsoft Defender for Cloud Apps uses reverse proxy capabilities to monitor and control user activities in real time. By configuring a session policy with the 'block download' action, you can immediately stop further downloads from SharePoint to the unmanaged device during the incident, without affecting managed devices.

Answer

Create a Conditional Access policy to require a compliant device.

Answer

Configure Microsoft Intune device compliance policy.

Answer

Create a DLP policy in Microsoft Purview.

Question 2

Your organization uses Microsoft Sentinel with the UEBA (User and Entity Behavior Analytics) feature enabled. A security analyst notices that a user account has been flagged with an anomaly indicating a possible compromised credential. Which entity type in Microsoft Sentinel's UEBA is most relevant for this alert?

Accepted Answer

User account. The UEBA anomaly alert for a possible compromised credential is specifically tied to the User account entity because UEBA profiles user behavior over time and detects deviations from established baselines, such as unusual logon times, locations, or impossible travel. The alert directly reflects a risk to the user's identity, making the User account the most relevant entity type for this scenario.

Answer

Device

Answer

Application

Answer

IP address

Question 3

Which TWO of the following are key indicators of a potential DCSync attack that a threat hunter should look for in Microsoft Sentinel? (Select two.)

Accepted Answer

Event ID 4662 with access mask for DS-Replication-Get-Changes. Option C is correct because DCSync abuse is detected through Windows Security Event ID 4662, which records access to Active Directory objects; the telltale sign is an access mask containing the DS-Replication-Get-Changes (and often DS-Replication-Get-Changes-All) control access right on the domain object, indicating replication data was requested. Option E is correct because legitimate directory replication is performed only by domain controllers, so replication requests (the same 4662/DS-Replication rights, or DRSUAPI replication traffic) originating from non-domain-controller accounts or workstations strongly indicate a DCSync attack using tools like Mimikatz or Impacket's secretsdump. Option A does not belong because failed logons from one IP indicate brute-force or password-spray activity, not replication abuse. Option B does not belong because creating a domain-admin account is a persistence or privilege-escalation action, not the replication-rights access pattern characteristic of DCSync. Option D does not belong because multiple Kerberos ticket requests suggest Kerberoasting or ticket harvesting, which is unrelated to the DS-Replication-Get-Changes access that defines DCSync.

Answer

Failed logon attempts from a single IP

Answer

A new user account created with domain admin privileges

Answer

Multiple Kerberos ticket requests from a single user

Question 4

Which THREE actions should a threat hunter take when using Microsoft Defender XDR advanced hunting to investigate a potential ransomware outbreak? (Select THREE.)

Accepted Answer

Check for service installation events that mimic system services.. Option A is correct because ransomware operators frequently install malicious services with names that mimic legitimate system services (for example, svchost-like or Windows Update-like names) to achieve persistence and evade detection, so hunting service installation events in DeviceEvents (ActionType == 'ServiceInstalled') surfaces this masquerading behavior. Option C is correct because scheduled tasks are a common ransomware persistence mechanism; hunting TaskScheduler events such as TaskCreated/TaskUpdated in DeviceEvents reveals malicious tasks that re-launch the encryptor or payload after reboot. Option D is correct because correlating ProcessCreate events with FileModified/FileCreated events (for example, a process spawning and then rapidly modifying or renaming many files with extensions like .locked) exposes the encryption behavior that is the hallmark of a ransomware outbreak. Option B does not belong because mailbox audit logs and email forwarding rules are relevant to business email compromise or phishing investigations, not to endpoint ransomware encryption activity in advanced hunting. Option E does not belong because password change events for service accounts relate to credential abuse or account takeover detection, which is not the primary evidence of an active ransomware outbreak on endpoints.

Answer

Review mailbox audit logs for email forwarding rules.

Answer

Review password change events for service accounts.

Question 5

Which TWO actions should be taken to respond to a potential data exfiltration incident detected by Microsoft Defender for Cloud Apps?

Accepted Answer

Suspend the user account in Microsoft Entra ID.. Suspending the user account in Microsoft Entra ID immediately revokes the user's ability to authenticate, preventing further access to cloud resources and stopping potential data exfiltration. This is a direct containment action that aligns with incident response best practices for compromised accounts.

Answer

Block the IP address of the user's device at the firewall.

Answer

Report the user to Microsoft for investigation.

Answer

Run a full antivirus scan on the user's device.

Question 6

Refer to the exhibit. You have an analytics rule in Microsoft Sentinel that uses this KQL query. The rule is configured to run every hour and alert when the result count is greater than 0. Which type of attack is this rule most likely detecting?

Accepted Answer

Brute force attack on user accounts. The KQL query counts failed sign-in events (ResultType != 0) aggregated by User, IPAddress, and a 5-minute bin, then filters for users with more than 10 failures. This pattern of multiple rapid failed logins from the same IP against a single user is the classic signature of a brute force attack, where an attacker tries many passwords to guess credentials. The rule triggers when the count exceeds 10 within any 5-minute window, making it highly specific to brute force detection.

Answer

Privileged account misuse

Answer

Data exfiltration via sign-in

Answer

Account takeover from a new location

Question 7

An analyst wants to find all devices that have run a specific process named 'malware.exe' in the last 24 hours using Microsoft 365 Defender Advanced Hunting. Which table should be the primary source for this query?

Accepted Answer

DeviceProcessEvents. The DeviceProcessEvents table in Microsoft 365 Defender Advanced Hunting is the primary source for querying process creation events, including the execution of a specific process name like 'malware.exe'. This table captures process creation and termination events, making it the correct choice for finding devices that have run a specific process within a given time frame.

Answer

DeviceEvents

Answer

DeviceFileEvents

Answer

DeviceNetworkEvents

Question 8

Your company uses Microsoft Sentinel to monitor security events. You have configured a daily email report that summarizes the top 10 incidents from the past 24 hours. The report is sent using a Logic App playbook triggered by a scheduled query. Recently, the report has stopped being delivered. You check the Logic App run history and see that the last run failed with an HTTP 403 error when connecting to the Microsoft Sentinel API. The Logic App uses a managed identity for authentication. What is the most likely cause of the failure?

Accepted Answer

The managed identity does not have the required permissions on the Sentinel workspace.. The HTTP 403 error indicates a permissions failure when the Logic App attempted to call the Microsoft Sentinel API. Since the Logic App uses a managed identity for authentication, the most likely cause is that the managed identity lacks the necessary role assignments on the Sentinel workspace, such as 'Microsoft Sentinel Contributor' or 'Microsoft Sentinel Reader', which are required to query incidents via the API.

Answer

The managed identity's client ID has changed.

Answer

The Logic App is not connected to Microsoft Entra ID.

Answer

The scheduled query is no longer running.

Question 9

You are investigating repeated SQL injection alerts. The KQL query returns IP addresses with more than 5 alerts in the last 7 days. What is the purpose of the `summarize` and `where AlertCount > 5` lines?

Accepted Answer

To identify IPs with a high number of alerts, indicating a possible attack.. The `summarize` operator in KQL aggregates data by grouping on the IP address field and counting the number of alerts per IP. The `where AlertCount > 5` filter then retains only those IP addresses whose aggregated count exceeds 5. This combination directly serves to identify IPs that have triggered a high volume of SQL injection alerts within the 7-day window, which is a strong indicator of a sustained or automated attack attempt.

Answer

To correlate alerts with other data sources.

Answer

To remove duplicate alerts from the same IP.

Answer

To count the number of distinct IP addresses.

Question 10

During an incident response, you need to collect a forensic image of a Windows 10 device managed by Microsoft Intune. Which Microsoft Defender XDR feature should you use?

Accepted Answer

Microsoft Defender for Endpoint Live Response. Microsoft Defender for Endpoint Live Response (Option C) is the correct feature because it provides a remote shell connection to a Windows 10 device, allowing an incident responder to collect a forensic image by running commands such as `getfile` or `putfile` to acquire disk or memory artifacts. This capability is specifically designed for live incident response on Intune-managed endpoints, enabling acquisition of forensic data without requiring physical access or pre-staged imaging tools.

Answer

Microsoft Defender for Cloud Apps

Answer

Microsoft Purview eDiscovery

Answer

Microsoft Sentinel

Question 11

Your organization uses Microsoft Defender for Cloud Apps. During an incident, you discover that a user is downloading large amounts of data from SharePoint to an unmanaged device. You need to automatically block further downloads from that device. What should you configure?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Disable the account that initiated the suspicious replication request.. The DCSync attack abuses the Directory Replication Service Remote Protocol (MS-DRSR) to impersonate a domain controller and request replication of credentials. Disabling the compromised account that initiated the suspicious LDAP replication request immediately stops the attacker's ability to request further replication, effectively containing the attack at the source without disrupting the entire domain.

Answer

Block all LDAP traffic at the firewall.

Answer

Restart the domain controller to clear any malicious processes.

Answer

Reset the krbtgt account password twice.

Question 12

Your organization uses Microsoft Sentinel and has deployed the Microsoft Sentinel Solution for Microsoft Defender XDR. You need to correlate alerts from Microsoft Defender for Endpoint with Microsoft Defender for Office 365 in a single incident. What is the recommended approach?

Accepted Answer

Use the Microsoft 365 Defender connector to ingest unified incidents from Microsoft 365 Defender, which already correlates alerts from both products.. The Microsoft 365 Defender connector ingests unified incidents from Microsoft 365 Defender, which natively correlates alerts from Microsoft Defender for Endpoint and Microsoft Defender for Office 365 into a single incident. This is the recommended approach as it leverages the built-in correlation engine in Microsoft 365 Defender, eliminating the need for custom analytics rules or manual correlation.

Answer

Ingest alerts from both products separately and use a KQL query in an analytics rule to correlate them.

Answer

Create a workbook that displays alerts from both products side by side.

Answer

Use a Microsoft Sentinel fusion rule to correlate the alerts.

Question 13

Your organization uses Microsoft Defender for Cloud Apps. During an incident, you discover that a user is downloading large amounts of data from SharePoint to an unmanaged device. You need to automatically block further downloads from that device. What should you configure?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Review the alert details in the Microsoft Defender for Identity portal and analyze related events. The first step in investigating a golden ticket attack alert from Microsoft Defender for Identity is to review the alert details and analyze the related events within the Defender for Identity portal. This allows you to understand the scope of the suspicious Kerberos activity, identify the affected accounts, and correlate the alert with other security signals before taking any remediation actions.

Answer

Immediately reset the krbtgt account password twice

Answer

Export the Active Directory event logs to Microsoft Sentinel for analysis

Answer

Disable the user account that triggered the alert

Question 14

Your security team uses Microsoft Sentinel analytics rules to detect brute-force attacks. A rule triggers when more than 10 failed logins occur within 5 minutes from a single IP. An incident is generated. Which first step should the analyst take?

Accepted Answer

Investigate the incident details. The first step in incident response within Microsoft Sentinel is to investigate the incident details to validate the alert and understand the scope. This aligns with the NIST incident response lifecycle (identification and analysis) and Sentinel's built-in investigation graph, which allows analysts to correlate entities, timelines, and related events before taking any containment action.

Answer

Block the source IP address on the firewall

Answer

Notify the users of the failed login attempts

Answer

Reset passwords for all affected accounts

Question 15

You manage Microsoft Sentinel. You need to ensure that an automated response is triggered when a specific type of incident is created. The response should send an email to the on-call security engineer. What should you use?

Accepted Answer

Create an automation rule that runs a playbook when an incident is created.. Automation rules in Microsoft Sentinel can trigger a playbook (an Azure Logic Apps workflow) when an incident is created. The playbook can include an action to send an email to the on-call security engineer, providing the automated response required by the scenario.

Answer

Use a watchlist to map incident types to email addresses and configure a scheduled query.

Answer

Modify the analytics rule to include an email action in the rule settings.

Answer

Create a workbook that alerts via email when new incidents appear.