SC-200 Practice Test 36 — 15 Questions

Question 1

Your organization uses Microsoft Defender for Cloud Apps. You need to block downloads from unmanaged devices for a specific cloud app. What should you configure?

Accepted Answer

Create a session policy with device tag condition.. Session policies in Microsoft Defender for Cloud Apps allow you to control user activities in real time based on device tags. By configuring a session policy with a device tag condition (e.g., 'Device tag equals Unmanaged'), you can enforce actions like blocking downloads from unmanaged devices for a specific cloud app, leveraging reverse proxy architecture to inspect and control traffic.

Answer

Create a file policy with a governance action.

Answer

Create an app permissions policy.

Answer

Create an anomaly detection policy.

Question 2

Your organization uses Microsoft Defender XDR incident queue. You want to automatically assign incidents related to a specific campaign to a dedicated SOC group. What should you create?

Accepted Answer

A custom detection rule in Microsoft Defender XDR that includes an incident assignment action.. Microsoft Defender XDR allows you to create custom detection rules that can include automated incident assignment actions. This enables you to automatically assign incidents related to a specific campaign to a dedicated SOC group directly within the Defender XDR incident queue, without relying on external tools or manual processes.

Answer

A standard rule in Microsoft Defender for Endpoint.

Answer

An automation rule in Microsoft Sentinel.

Answer

A custom role in Microsoft Defender XDR.

Question 3

As a SOC analyst, you need to quickly identify if a specific user account has been involved in any incidents in the past week. Which feature in Microsoft Sentinel allows you to search for user-related incidents?

Accepted Answer

Entity behavior blade. The Entity behavior blade in Microsoft Sentinel provides a user-centric view that aggregates all incidents, alerts, and activities associated with a specific user account. By selecting a user entity and navigating to the 'Incidents' tab within the blade, you can quickly filter incidents involving that user over a defined time range, such as the past week. This feature is designed specifically for investigating user-related security events without needing to write custom queries.

Answer

Incidents blade with time range filter

Answer

Hunting blade with user query

Answer

Workbooks with KQL query

Question 4

You are configuring Microsoft Sentinel to send email notifications to the security team when high-severity incidents are created. Which feature should you use?

Accepted Answer

Automation rule. Automation rules in Microsoft Sentinel allow you to define automated responses to incidents, including sending email notifications to specified recipients when incidents meet certain criteria, such as high severity. This feature directly supports the requirement to notify the security team when high-severity incidents are created, without requiring additional logic or manual steps.

Answer

Watchlist

Answer

Analytics rule

Answer

Workbook

Question 5

A security analyst in your SOC receives an alert from Microsoft Defender for Cloud Apps indicating that a user downloaded a large number of files from SharePoint in a short time. What is the most likely classification of this activity?

Accepted Answer

Data exfiltration. A sudden, large-volume download of files from SharePoint within a short time window is a classic indicator of data exfiltration. Microsoft Defender for Cloud Apps uses anomaly detection policies to flag such activity based on user baseline behavior, download velocity, and the total number of files accessed, which aligns with the exfiltration phase of the cyber kill chain.

Answer

Ransomware

Answer

Lateral movement

Answer

Privilege escalation

Question 6

Your organization uses Microsoft Defender for Cloud. You need to recommend a solution to automatically remediate misconfigurations in Azure VMs without manual intervention. What should you use?

Accepted Answer

Enable 'Remediate' option in Defender for Cloud recommendations. Microsoft Defender for Cloud provides a 'Remediate' button on security recommendations that can automatically apply the necessary configuration changes to Azure resources, such as VMs, without manual intervention. This feature leverages Azure Policy's 'deployIfNotExists' effect to enforce compliance by running remediation tasks at scale, directly addressing misconfigurations like open management ports or missing disk encryption.

Answer

Use Azure Advisor recommendations

Answer

Configure Azure Backup

Answer

Set up Update Management in Azure Automation

Question 7

Your organization uses Microsoft Sentinel with the Microsoft 365 Defender connector. You receive an incident indicating that a user's account was used to sign in from an unusual location (Russia) while the user is in the United States. The sign-in was successful and no MFA challenge was prompted because the user had a valid session. The incident severity is High. You need to respond immediately. What should you do first?

Accepted Answer

Revoke the user's session in Microsoft Entra ID.. Revoking the user's session in Microsoft Entra ID immediately terminates all active tokens and sessions, preventing the attacker from continuing to use the authenticated session. This is the fastest way to stop the ongoing compromise because the sign-in succeeded without MFA due to a valid session, and the attacker is already inside. Other actions like blocking IP or resetting password are slower or less direct in this scenario.

Answer

Block the IP address in the Conditional Access policy.

Answer

Investigate the sign-in logs to determine if there are other compromised accounts.

Answer

Reset the user's password.

Question 8

An incident response playbook in Microsoft Sentinel has a step: 'Investigate the user's recent activities using Microsoft 365 Defender.' Which data source would provide the most relevant information for this step?

Accepted Answer

Microsoft 365 Defender's user investigation page. The Microsoft 365 Defender user investigation page is the correct data source because it provides a consolidated view of a user's activities across Microsoft 365 services, including email, Teams, and endpoint alerts. This directly supports the incident response step of investigating recent user activities within the Microsoft 365 Defender ecosystem, which is the explicit scope of the playbook step.

Answer

Azure Activity Log

Answer

Microsoft Purview Data Loss Prevention reports

Answer

Azure Resource Graph

Question 9

Your organization uses Microsoft Sentinel. You receive an incident for a potential malware outbreak. You need to quickly see which entities are involved (e.g., IPs, hosts, accounts). Where should you look?

Accepted Answer

Entities tab. The Entities tab in a Microsoft Sentinel incident provides a consolidated view of all related entities such as IP addresses, hosts, user accounts, and other resources that were identified during the alert investigation. This allows you to quickly assess the scope of a potential malware outbreak by seeing which systems and identities are involved, without needing to navigate through raw alerts or timeline events.

Answer

Incident timeline

Answer

Comments section

Answer

Alerts tab

Question 10

You manage a Microsoft Sentinel workspace that ingests logs from multiple sources. You notice that the workspace is approaching its daily ingestion quota, and some data sources are being dropped. You need to ensure that security-related logs are prioritized and that non-critical logs are not ingested. What should you configure?

Accepted Answer

Use data collection rules (DCRs) to filter log ingestion. Data collection rules (DCRs) allow you to define transformations that filter logs before they are ingested into a Log Analytics workspace. By configuring a DCR with a KQL-based transformation, you can drop non-critical logs while ensuring security-related logs are always ingested, preventing them from being dropped when the daily quota is approached.

Answer

Create analytic rules with entity mapping to prioritize alerts

Answer

Set a daily cap on the Log Analytics workspace

Answer

Configure diagnostic settings to exclude certain logs

Question 11

Your SOC team uses Microsoft Sentinel's UEBA to detect insider threats. You want to ensure that UEBA can correlate activities across multiple data sources. Which data source must be enabled for UEBA to function properly?

Accepted Answer

Microsoft Entra ID audit logs. Microsoft Sentinel's UEBA relies on Microsoft Entra ID (formerly Azure AD) audit logs as the primary identity source to establish a baseline of user behavior and correlate activities across different data sources. Without these logs, UEBA cannot map activities to specific user identities, which is essential for detecting anomalous behavior patterns indicative of insider threats.

Answer

Azure Activity logs

Answer

Office 365 audit logs

Answer

Windows Security Events

Question 12

Your organization uses Microsoft Sentinel. You need to implement a custom incident response process that requires approval before taking action on an incident. What should you use?

Accepted Answer

Playbook with Microsoft Teams connector for approval. A playbook with a Microsoft Teams connector is the correct choice because it enables an interactive approval workflow directly within Teams. When an incident is triggered, the playbook can send an adaptive card to a Teams channel or user, pause execution until an approval decision is made, and then continue with the next steps based on that decision. This satisfies the requirement for a custom approval process before taking action on an incident.

Answer

Automation rules with conditions

Answer

Watchlist for approval status

Answer

Analytics rule with custom details

Question 13

Refer to the exhibit. You deploy this ARM template to your subscription. After deployment, you cannot find the saved search 'Test Search' in the Microsoft Sentinel workspace. What is the most likely reason?

Accepted Answer

The resource type should be for analytics rules, not saved searches.. The ARM template deploys a resource of type 'Microsoft.OperationsManagement/solutions' with a saved search, but Microsoft Sentinel does not use saved searches for analytics rules. In Sentinel, detection rules are created as 'Microsoft.SecurityInsights/alertRules', not as saved searches under a Log Analytics workspace. The template's resource type is mismatched for the intended functionality, so the saved search 'Test Search' will not appear as a Sentinel analytics rule.

Answer

The query 'Heartbeat | summarize Count() by Computer' is invalid.

Answer

The apiVersion is incorrect.

Answer

The name concatenation is missing a parameter.

Question 14

Your organization's Microsoft Sentinel workspace ingests logs from multiple regions. During an incident, you need to search for a specific user's activity across all workspaces in a single query. What is the most efficient way to accomplish this?

Accepted Answer

Use a cross-workspace query with the workspace() expression.. The workspace() expression in Kusto Query Language (KQL) allows you to include data from multiple Log Analytics workspaces in a single query. By specifying the workspace ID or name within the expression, you can search across all relevant workspaces without needing to run separate queries or manually combine results. This is the most efficient method because it executes as a single query against the underlying Azure Data Explorer clusters, minimizing latency and administrative overhead.

Answer

Run separate queries in each workspace and combine results manually.

Answer

Create a new analytics rule that queries all workspaces.

Answer

Use the Microsoft Sentinel search feature with the workspace filter.

Question 15

Your organization uses Microsoft Sentinel. A security analyst receives an alert for a suspicious sign-in from an unfamiliar IP address. The analyst wants to quickly check if the same IP address has been associated with any other alerts in the past 30 days. Which action should the analyst take?

Accepted Answer

Run a KQL query in the Logs blade to search the Alert table for the IP.. The Alert table in Microsoft Sentinel logs contains historical alert data, including IP addresses associated with each alert. Running a KQL query against this table allows the analyst to quickly search for the same IP address across all alerts generated in the past 30 days, enabling efficient incident correlation without modifying detection or response configurations.

Answer

Create an automation rule to block the IP address.

Answer

Submit the IP address to Microsoft for threat intelligence.

Answer

Create a new analytics rule to detect the IP address.