SC-200 Practice Test 37 — 15 Questions

Question 1

You are performing a threat hunt in Microsoft Sentinel. You want to identify devices that have been communicating with known malicious IP addresses. Which data source should you query?

Accepted Answer

CommonSecurityLog. CommonSecurityLog is the correct data source because it aggregates logs from various security appliances (e.g., firewalls, proxies) using the Syslog or CEF format. These logs typically contain source and destination IP addresses, making them ideal for correlating internal devices with known malicious IPs during a threat hunt. SecurityEvent and DeviceNetworkEvents lack the necessary network-level IP communication data, while DnsEvents only logs DNS queries, not direct IP connections.

Answer

SecurityEvent

Answer

DnsEvents

Answer

DeviceNetworkEvents

Question 2

Your organization uses Microsoft Sentinel. You receive an alert for a suspicious sign-in from an unusual location. You want to automatically create an incident and assign it to the security team for investigation. What should you configure?

Accepted Answer

Configure an automation rule that runs when the alert is generated, creates an incident, and sets the owner to the security team.. Automation rules in Microsoft Sentinel allow you to automatically create incidents from alerts and assign them to specific teams or owners. This is the native, efficient method to handle the scenario without manual intervention or custom playbooks.

Answer

Add the user to a watchlist and configure a fusion rule.

Answer

Create a playbook that triggers on the alert and creates an incident manually.

Answer

Modify the analytics rule to set the incident creation setting to 'Create incident from alert'.

Question 3

Refer to the exhibit. You are configuring a Microsoft Sentinel Windows Security Events via AMA connector using an ARM template. After deployment, you notice that no Windows events are being ingested. The AMA agent is installed on the Windows servers. What is the most likely issue?

Accepted Answer

The data collection rule is not associated with the virtual machines.. The most likely issue is that the data collection rule (DCR) is not associated with the virtual machines. Even when the Azure Monitor Agent (AMA) is installed, it will not send any Windows security events to Microsoft Sentinel unless a DCR is linked to the VM. The DCR defines which events to collect and where to send them; without this association, the agent has no instructions and remains idle.

Answer

The WindowsEvent and SecurityEvent data types are disabled.

Answer

The Azure Monitor Agent is not installed on the servers.

Answer

The workspace ID is missing from the template.

Question 4

Your organization uses Microsoft Defender XDR. You need to ensure that when a user reports a phishing email in Outlook, it automatically triggers an investigation in Microsoft Defender XDR. What should you configure?

Accepted Answer

Enable user-reported message settings in Microsoft Defender for Office 365 and configure automated investigation.. Enabling user-reported message settings in Microsoft Defender for Office 365 allows users to report phishing emails directly from Outlook. When combined with automated investigation and response (AIR) policies, this triggers an automatic investigation in Microsoft Defender XDR, leveraging the unified incident and alerting pipeline to analyze the reported message and associated threats.

Answer

Create a playbook in Microsoft Sentinel triggered by a custom connector.

Answer

Configure a data loss prevention policy in Microsoft Purview.

Answer

Set up a session policy in Microsoft Defender for Cloud Apps.

Question 5

A security analyst receives an alert in Microsoft Defender for Cloud that an Azure virtual machine is running a process with a known indicator of compromise (IOC). The analyst wants to investigate the process details, including the command line and parent process. Which feature should the analyst use to gather this information from the VM?

Accepted Answer

Live response. Live Response in Microsoft Defender for Cloud provides a remote shell connection to the VM, allowing the analyst to run commands to inspect running processes, command-line arguments, and parent process details in real time. This is the correct feature for deep forensic investigation of an active IOC on the VM.

Answer

Vulnerability assessment

Answer

Inventory of resources

Answer

Secure score

Question 6

A security administrator needs to ensure that all newly provisioned Azure virtual machines automatically install the Microsoft Defender for Cloud agent (Log Analytics agent) to enable security monitoring. Which configuration should be enabled in Defender for Cloud?

Accepted Answer

Auto-provisioning of the Log Analytics agent. Auto-provisioning of the Log Analytics agent in Microsoft Defender for Cloud automatically installs the Log Analytics agent (Microsoft Monitoring Agent) on all new Azure VMs. This ensures that security monitoring data, such as security events and syslog, is collected and sent to the Log Analytics workspace without manual intervention. The setting is found under 'Environment settings' > 'Auto provisioning' and must be toggled to 'On' for the agent to be deployed on newly provisioned VMs.

Answer

Enable the Defender for Servers plan

Answer

Configure a vulnerability assessment solution

Answer

Enable just-in-time (JIT) VM access

Question 7

You are managing Microsoft Defender for Cloud Apps. You discover that a user is downloading large amounts of data from a sanctioned cloud app. You need to automatically suspend the user's access when the download exceeds 5 GB in 10 minutes. What should you create?

Accepted Answer

An anomaly detection policy with a mass download detection template.. An anomaly detection policy in Microsoft Defender for Cloud Apps can detect unusual user behavior, such as mass file downloads, using predefined templates like 'Mass download by a single user'. This policy can be configured to trigger automatic governance actions, including suspending the user, when the download exceeds a threshold like 5 GB in 10 minutes. It directly addresses the need to automatically suspend access based on volume and time.

Answer

A session policy to block downloads.

Answer

An app connector for the cloud app.

Answer

A data loss prevention (DLP) policy in Microsoft Purview.

Question 8

Your company uses Microsoft Sentinel and has a workspace in the East US region. You need to ingest logs from a non-Azure Windows server located in a branch office in Europe. You have limited bandwidth and need to ensure that log ingestion does not impact network performance. What should you use?

Accepted Answer

Install the Azure Monitor Agent on the server and create a data collection rule to filter and compress logs before sending.. The Azure Monitor Agent (AMA) supports data collection rules (DCRs) that can filter logs at the source and compress data before transmission, reducing bandwidth usage. This is critical for the limited bandwidth scenario, and AMA is the modern replacement for the Log Analytics agent, designed for efficient log ingestion across regions.

Answer

Use Microsoft Defender for Endpoint to collect logs from the server and forward them to Sentinel.

Answer

Install the Log Analytics agent (MMA) on the server and configure it to send logs directly to the workspace.

Answer

Configure the server to send logs to an Azure Event Hub, then stream to Sentinel.

Question 9

Your SOC uses Microsoft Defender for Office 365. You need to configure a policy that automatically moves malicious email attachments to quarantine before they reach user mailboxes. What should you configure?

Accepted Answer

Create a Safe Attachments policy in the Microsoft 365 Defender portal.. Safe Attachments is a Microsoft Defender for Office 365 feature specifically designed to detonate email attachments in a virtual sandbox environment before delivery. By creating a Safe Attachments policy in the Microsoft 365 Defender portal, you can automatically quarantine malicious attachments, preventing them from reaching user mailboxes. This directly addresses the requirement to handle malicious attachments, not phishing or spam.

Answer

Create an anti-phishing policy to detect phishing attempts.

Answer

Create an anti-spam policy with a high confidence spam filter.

Answer

Create an anti-malware policy in the Microsoft 365 Defender portal.

Question 10

You receive an incident in Microsoft Sentinel that is a low-confidence alert from Microsoft Defender for Identity. What should be your first step?

Accepted Answer

Investigate the alert by reviewing related entities and logs.. A low-confidence alert from Microsoft Defender for Identity indicates a potential but uncertain threat. The first step should always be to investigate the alert by reviewing related entities and logs to gather context and determine if the alert is a true positive or false positive. Prematurely closing, escalating, or isolating without investigation risks missing a real threat or causing unnecessary disruption.

Answer

Close the incident as a false positive.

Answer

Escalate to senior management.

Answer

Isolate the affected account immediately.

Question 11

You are investigating a security incident in Microsoft Sentinel. You need to preserve a snapshot of the investigation including comments, bookmarks, and entities for future reference. What should you do?

Accepted Answer

Create a bookmark with the relevant data. Bookmarks in Microsoft Sentinel allow you to preserve a snapshot of an investigation, including comments, bookmarks, and entities, for future reference. Bookmarks capture the state of an investigation at a specific point in time, enabling you to revisit and share the context later.

Answer

Create an automation rule to tag the incident

Answer

Add the entities to a watchlist

Answer

Close the incident as a false positive

Question 12

Your organization uses Microsoft Defender XDR. A user reports that their device is behaving erratically, with unexpected pop-ups and high CPU usage. You suspect malware infection. You need to collect forensic data from the device for analysis. What should you do?

Accepted Answer

Initiate a live response session on the device from the Microsoft 365 Defender portal.. Initiating a live response session from the Microsoft 365 Defender portal allows you to remotely connect to the device and perform real-time forensic data collection, such as running scripts, capturing memory dumps, and collecting files, without disrupting the device's state. This is the appropriate method for gathering forensic evidence when malware is suspected, as it provides deep, interactive access for analysis.

Answer

Create a custom detection rule in Microsoft Defender for Endpoint to capture the behavior.

Answer

Offboard the device and re-onboard it to trigger a fresh investigation.

Answer

Run a full antivirus scan using Microsoft Defender Antivirus.

Question 13

An incident in Microsoft Sentinel has been classified as a true positive. According to the incident response process, what should the analyst do next?

Accepted Answer

Contain the incident to prevent further damage.. After classifying an incident as a true positive in Microsoft Sentinel, the immediate next step in the incident response process is to contain the incident to prevent further damage or lateral movement. This aligns with the NIST SP 800-61 incident response lifecycle, where containment follows identification and classification. In Sentinel, containment actions might involve disabling compromised accounts, blocking IPs via Azure Firewall, or isolating affected resources using Microsoft Defender for Cloud or Azure policies.

Answer

Perform a root cause analysis.

Answer

Create a new analytic rule to detect similar activity.

Answer

Document the incident in a detailed report.

Question 14

You are a security operations analyst at a company that uses Microsoft Defender XDR and Microsoft Sentinel. You have configured a custom detection rule in Microsoft Defender XDR that uses a KQL query to detect suspicious PowerShell activity. The rule triggers an alert, but you want to automatically create an incident in Microsoft Sentinel and run a playbook that isolates the affected device. You have already set up the Microsoft Defender XDR connector in Sentinel and enabled incident creation from Defender XDR alerts. However, the playbook does not run automatically when a Defender XDR incident is created. You have verified that the playbook is properly configured and has the correct permissions. What should you do?

Accepted Answer

Create an automation rule in Microsoft Sentinel that triggers on incident creation and runs the playbook.. In Microsoft Sentinel, automation rules are the mechanism to trigger playbooks automatically when incidents are created or updated. Since the Defender XDR connector is already enabled and creating incidents in Sentinel, the missing piece is an automation rule in Sentinel that runs the playbook on incident creation. The playbook itself is properly configured, so the automation rule bridges the gap between incident creation and playbook execution.

Answer

Create an automation rule in Microsoft Defender XDR to run the playbook.

Answer

Modify the Microsoft Defender XDR data connector in Sentinel to enable playbook execution.

Answer

Modify the custom detection rule in Defender XDR to include a 'run playbook' action.

Question 15

Your organization has Microsoft Defender for Endpoint deployed. A security analyst receives an alert about a suspicious PowerShell command executed on a device. The analyst needs to investigate the process tree. Which feature should the analyst use?

Accepted Answer

Timeline (process timeline). The Timeline (process timeline) feature in Microsoft Defender for Endpoint allows analysts to view the full process tree, including parent-child relationships, command lines, and timestamps for events like PowerShell execution. This is the correct tool for investigating how a suspicious command was launched and what processes preceded it.

Answer

Device isolation

Answer

Live response

Answer

Advanced hunting