SC-200 Practice Test 37 — 15 Questions

Question 1

Your SOC team uses Microsoft Sentinel and Microsoft Defender XDR. A junior analyst creates a custom analytics rule in Sentinel that generates an excessive number of incidents. The rule appears to be running but not producing any results. What is the most likely cause?

Accepted Answer

The rule's query syntax is invalid.. Option C is correct because if the query syntax is incorrect, the rule may run but return no results, thus no incidents. Option A is wrong because a disabled rule would not run. Option B is wrong because insufficient permissions would cause an error, not silent failure. Option D is wrong because low severity does not prevent incident creation.

Answer

The analyst does not have permissions to create incidents.

Answer

The rule is set to a low severity.

Answer

The rule is disabled.

Question 2

Your company uses Microsoft Sentinel and has enabled the Microsoft Defender XDR connector. You notice that incidents from Microsoft Defender for Cloud Apps are not appearing in Microsoft Sentinel. All other Defender XDR incidents appear correctly. What is the most likely cause?

Accepted Answer

The Microsoft Defender for Cloud Apps data connector is not enabled in Microsoft Sentinel.. Microsoft Defender for Cloud Apps incidents are ingested into Microsoft Sentinel via the Microsoft Defender XDR connector, but only if the data connector for Microsoft Defender for Cloud Apps is also enabled separately in Sentinel. Option A is correct. Option B is wrong because license requirements are for other connectors. Option C is wrong because roles are not the issue. Option D is wrong because the connector is for Defender XDR, not for Cloud Apps specifically.

Answer

The security operations team does not have the appropriate permissions.

Answer

The Microsoft Defender XDR connector only ingests incidents from Microsoft Defender for Endpoint.

Answer

The Microsoft 365 E5 license is not assigned to the users.

Question 3

Your organization uses Microsoft Sentinel with multiple watchlists. You need to create a KQL query that joins log data with a watchlist to enrich alerts. Which KQL operator should you use?

Accepted Answer

_GetWatchlist. The '_GetWatchlist' function is the recommended way to access watchlists in KQL. Option C is correct. Option A and B are for static tables. Option D is for time series.

Answer

lookup

Answer

union

Answer

join

Question 4

Your Microsoft Sentinel workspace is ingesting logs from multiple sources. You notice that the data ingestion cost is higher than expected. You want to reduce costs without losing security value. Which action should you take?

Accepted Answer

Configure basic logs ingestion for verbose data sources such as firewall logs.. Option C is correct because using basic logs for high-volume, low-value data reduces costs while retaining the ability to search it. Option A is wrong because reducing retention for all tables might cause loss of important data. Option B is wrong because disabling analytics rules reduces detection capabilities. Option D is wrong because changing to Pay-as-you-go might increase costs if volume is high.

Answer

Reduce the retention period for all data to 30 days.

Answer

Switch the pricing tier from Capacity Reservations to Pay-as-you-go.

Answer

Disable analytics rules that generate high volume of alerts.

Question 5

Refer to the exhibit. You are using this KQL query in a Microsoft Sentinel scheduled analytics rule to detect brute-force attacks. The rule has been running for a week but has never triggered an alert. What is the most likely reason?

Accepted Answer

The SecurityEvent table is not being populated because Windows event collection is not configured.. Option B is correct because the query filters EventID 4625 (failed logon) and groups by Account. If the data source (SecurityEvent) is not being ingested, the query returns no results. Option A is wrong because the query is correct syntax. Option C is wrong because the query uses a 24-hour lookback, which is fine. Option D is wrong because the query is a simple aggregation, not complex.

Answer

The query uses a 24-hour lookback and the rule runs every 5 minutes, so it misses data.

Answer

The query syntax is incorrect.

Answer

The query uses 'summarize' which is not allowed in analytics rules.

Question 6

Your SOC uses Microsoft Defender XDR. You need to create a custom detection rule that triggers when a specific process is executed on multiple devices within an hour. Which feature should you use?

Accepted Answer

Microsoft Defender XDR custom detection rule. Option B is correct because Custom detection rules in Microsoft Defender XDR allow KQL-based detection across devices. Option A is wrong because Scheduled analytics rules are in Sentinel. Option C is wrong because Hunting queries don't create alerts. Option D is wrong because Attack simulation is for testing.

Answer

Advanced hunting query

Answer

Microsoft Sentinel scheduled analytics rule

Answer

Attack simulation training

Question 7

Your organization uses Microsoft Defender XDR and Microsoft Sentinel. You need to configure a solution that automatically blocks a user's account when a high-severity incident is generated. The solution must use built-in capabilities without custom code. What should you do?

Accepted Answer

Create an automation rule that triggers on incident creation with severity high, and runs a playbook that uses the 'Update user' action to disable the account.. Option A is correct because Microsoft Sentinel's automation rules can trigger a playbook that uses the Microsoft Graph Security API to disable a user account. Option B is incorrect because it disables the device, not the user. Option C is incorrect because it creates a conditional access policy, not immediate blocking. Option D is incorrect because it runs a query but does not automatically block.

Answer

Use a scheduled analytics rule that runs every hour and disables accounts found in the results.

Answer

Configure Microsoft Entra ID to automatically apply a conditional access policy blocking sign-ins when a high-severity alert is raised.

Answer

Create a playbook that uses the 'Run a query' action to find the device and then uses Microsoft Defender for Endpoint to isolate the device.

Question 8

Which TWO are supported data sources for Microsoft Sentinel?

Accepted Answer

Microsoft Entra ID audit logs. Options A and D are correct. Microsoft Sentinel supports AWS CloudTrail via the Amazon Web Services connector and Microsoft Entra ID audit logs via the Azure Active Directory connector (now Microsoft Entra ID). Option B is wrong because on-premises syslog-ng is not directly supported; syslog is supported via a connector. Option C is wrong because Google Cloud VPC Flow Logs are not natively supported. Option E is wrong because Windows Server 2008 is out of support and not recommended.

Answer

Google Cloud VPC Flow Logs

Answer

Windows Server 2008 event logs

Answer

On-premises syslog-ng

Question 9

Your organization uses Microsoft Defender for Cloud Apps and Microsoft Sentinel. You need to ensure that anomalous behavior alerts from Defender for Cloud Apps are automatically converted to incidents in Sentinel. What should you configure?

Accepted Answer

Enable the Microsoft Defender for Cloud Apps data connector in Microsoft Sentinel.. The Microsoft Defender for Cloud Apps connector in Microsoft Sentinel allows you to ingest alerts and convert them to incidents. Option B is correct. Option A is wrong because the Microsoft 365 connector does not include Cloud Apps alerts. Option C is wrong because a playbook would be an extra step. Option D is wrong because the Defender for Identity connector is for identity alerts.

Answer

Enable the Microsoft Defender for Identity data connector in Microsoft Sentinel.

Answer

Enable the Microsoft 365 data connector in Microsoft Sentinel.

Answer

Create a playbook that triggers on Defender for Cloud Apps alerts and creates incidents in Sentinel.

Question 10

Your organization uses Microsoft Defender XDR. You need to ensure that alerts from Microsoft Defender for Identity are automatically correlated with alerts from Microsoft Defender for Endpoint in the unified incidents queue. What should you verify?

Accepted Answer

Microsoft Defender XDR incident correlation is enabled. Automatic correlation requires that both workloads are integrated and the unified incident feature is enabled. Option B is correct. Option A is for MDO, not correlation. Option C is for Sentinel, not Defender XDR. Option D is for custom detections, not correlation.

Answer

Microsoft Defender for Office 365 is enabled

Answer

Microsoft Sentinel is connected to Microsoft Defender XDR

Answer

Custom detection rules are created in Microsoft 365 Defender

Question 11

Refer to the exhibit. You run a PowerShell command to retrieve incidents from Microsoft Sentinel. How many active incidents are there?

Accepted Answer

2. The output shows statuses: Active (1001, 1003), Closed (1002), New (1004). Active incidents are those with status 'Active'. Option B is correct. Option A counts all except closed. Option C counts only high severity. Option D counts all.

Answer

3

Answer

2

Answer

1

Question 12

You are managing a Microsoft Sentinel environment. An analyst reports that a scheduled analytics rule is not generating alerts. The rule has been enabled for a week. What is the most likely cause?

Accepted Answer

The rule's query does not match any events in the workspace.. Option A is correct because if the rule's query is not returning results, no alerts are generated. Option B is wrong because the rule is enabled. Option C is wrong because the rule is scheduled, not real-time. Option D is wrong because the rule has been enabled for a week.

Answer

The rule is disabled due to a cost threshold.

Answer

The rule has a short lookback period that misses data.

Answer

The rule is configured as a real-time rule instead of scheduled.

Question 13

Your organization has Microsoft Defender for Office 365. You need to review a user's reported phishing email in Microsoft Defender XDR. Which section of the Microsoft Defender portal should you check?

Accepted Answer

Submissions. Option A is correct because User-reported messages are in the Submissions page. Option B is wrong because Threat Explorer is for hunting, not user reports. Option C is wrong because Action center shows remediation actions. Option D is wrong because Alerts shows alerts, not submissions.

Answer

Threat Explorer

Answer

Alerts

Answer

Action center

Question 14

Refer to the exhibit. You are reviewing a KQL query used in a Microsoft Sentinel scheduled analytics rule. What is the primary purpose of this query?

Accepted Answer

To detect accounts that have triggered a high number of suspicious process alerts within 7 days. Option C is correct because the query counts alerts per account and filters for >5, indicating a threshold for multiple alerts. Option A is wrong because it's not associating with incidents. Option B is wrong because it's not about false positives. Option D is wrong because it's not about detecting a new attack.

Answer

To investigate a new type of attack pattern

Answer

To identify which accounts are associated with the most incidents

Answer

To find accounts that have generated false positive alerts

Question 15

Your organization uses Microsoft Sentinel with a workspace in the East US region. You need to ingest security logs from Azure resources in the West Europe region. The solution must minimize data transfer costs. What should you configure?

Accepted Answer

Configure diagnostic settings on the West Europe resources to send logs to a Log Analytics workspace in West Europe, and then use a cross-workspace query from the East US workspace.. Option A is correct because using a diagnostic setting to send logs to a Log Analytics workspace in the same region as the resources minimizes cross-region data transfer costs. Option B would increase costs. Option C is for storage, not real-time ingestion. Option D is an alternative but not minimal cost.

Answer

Configure diagnostic settings to send logs directly to the East US workspace.

Answer

Use Azure Monitor Agent to collect logs and send them to the East US workspace.

Answer

Export logs to a storage account in West Europe and then import them to the East US workspace using Azure Data Factory.