SC-200 Practice Test 37 — 15 Questions

Question 1

Your company uses Microsoft Defender for Office 365. A user reports receiving a phishing email that bypassed the default policy. The email contains an external link to a credential harvesting site. You need to block similar emails in the future. What should you do?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Create a Safe Links policy and add the malicious domain to the blocked URLs list.. The phishing email contains a link to a credential harvesting site, so the most direct way to block similar emails in the future is to use a Safe Links policy. Safe Links proactively scans and blocks URLs at time of click, and you can add the malicious domain to the blocked URLs list to prevent users from accessing that site. This addresses the specific threat vector (malicious URL) rather than the sender's domain or attachment type.

Answer

Create an anti-spam policy to block the sender's domain.

Answer

Create an anti-malware policy to block the attachment type.

Answer

Add the sender's domain to the Tenant Allow/Block List.

Question 2

Which TWO tasks can you perform using Microsoft Sentinel automation rules?

Accepted Answer

Assign an incident to an analyst.. Automation rules in Microsoft Sentinel can directly assign incidents to specific analysts or groups without requiring a playbook. This is a native action within the automation rule configuration, enabling immediate ownership and accountability for incident response.

Answer

Send an email notification without a playbook.

Answer

Delete an incident.

Answer

Create a new analytics rule.

Question 3

Your organization uses Microsoft Sentinel and Microsoft Defender for Cloud. During an incident, you need to automatically disable a compromised Azure VM from the network. Which playbook action should you use?

Accepted Answer

Add a rule to the VM's network security group to deny all traffic.. Adding a rule to the VM's network security group (NSG) to deny all traffic is the most direct and immediate way to isolate a compromised Azure VM at the network level. NSG rules are evaluated in order of priority, and a deny-all rule (e.g., denying any inbound and outbound traffic) effectively cuts off all network communication to and from the VM, which is a common containment step during incident response. This action can be automated via a Microsoft Sentinel playbook using the Azure Network Security Group connector.

Answer

Apply an Azure Policy to deny network changes.

Answer

Create an Azure Firewall rule to block the VM's IP.

Answer

Remove the VM's role assignment from Azure RBAC.

Question 4

Your organization uses Microsoft Sentinel with the Microsoft Defender XDR connector. You have a critical incident that involves multiple alerts across different services. The incident is being updated with new alerts. You need to ensure that a specific playbook runs only when the incident severity is updated to High. How should you configure the automation rule?

Accepted Answer

Set the trigger to 'When incident is updated' and add a condition on severity equals High.. Automation rules can trigger on incident update and filter by severity. Option A is wrong because condition 'when incident is created' would not trigger on update. Option C is wrong because the trigger condition should be on incident update, not alert creation. Option D is wrong because automation rules are not configured inside playbooks.

Answer

Set the trigger to 'When an alert is created' and filter for alerts with High severity.

Answer

Set the trigger to 'When incident is created' and add a condition on severity equals High.

Answer

Configure the condition inside the playbook to check severity and exit if not High.

Question 5

A SOC team uses Microsoft Sentinel and wants to automatically enrich incidents with threat intelligence from a third-party feed. Which feature should they configure to ingest the threat intelligence and correlate it with alerts?

Accepted Answer

Threat intelligence connectors. Threat intelligence connectors in Microsoft Sentinel allow ingestion of TI feeds and enable correlation with alerts. The other options do not provide this capability.

Answer

Analytics rules

Answer

Data connectors

Answer

Watchlists

Question 6

A SOC analyst wants to create a scheduled analytics rule in Microsoft Sentinel that runs every hour and detects multiple failed user login attempts from a single IP address within a 5-minute window. Which KQL function should be used in the query to group the failed events by 5-minute time intervals?

Accepted Answer

summarize count() by IPAddress, bin(TimeGenerated, 5m). The `bin()` function in KQL is specifically designed to group data into fixed-size time buckets, such as 5-minute intervals. By using `summarize count() by IPAddress, bin(TimeGenerated, 5m)`, the query counts failed login attempts per IP address within each 5-minute window, which directly meets the requirement for a scheduled rule that detects multiple failures from a single IP in a 5-minute period.

Answer

summarize count() by IPAddress, TimeGenerated

Answer

extend interval = datetime_diff('minute', TimeGenerated, ago(5m))

Answer

scan with (match all events within 5m by IPAddress)

Question 7

Your organization uses Microsoft Defender XDR. You receive an automated investigation that found a malicious file on a device. The investigation recommends 'Block the file'. What does this action do?

Accepted Answer

Adds the file hash to the block list in Microsoft Defender for Endpoint.. Blocking the file adds it to the global indicator of compromise (IOC) list, preventing future execution. Option B is wrong because it does not delete the file from all devices. Option C is wrong because it does not isolate the device. Option D is wrong because it does not scan other devices automatically.

Answer

Isolates the device where the file was found.

Answer

Initiates a full antivirus scan on all devices.

Answer

Deletes the file from all devices in the organization.

Question 8

Which TWO actions should be taken to respond to a potential data exfiltration incident detected by Microsoft Defender for Cloud Apps?

Accepted Answer

Suspend the user account in Microsoft Entra ID.. Suspending the user account in Microsoft Entra ID immediately revokes the user's ability to authenticate, preventing further access to cloud resources and stopping potential data exfiltration. This is a direct containment action that aligns with incident response best practices for compromised accounts.

Answer

Block the IP address of the user's device at the firewall.

Answer

Report the user to Microsoft for investigation.

Answer

Run a full antivirus scan on the user's device.

Question 9

An incident in Microsoft Defender XDR shows a device with high severity alert: 'Suspicious PowerShell command line.' The device is currently isolated from the network. What is the best next step to investigate the alert?

Accepted Answer

Run a live response session on the device.. Running a live response session allows the analyst to remotely investigate the isolated device, collect artifacts, or execute commands without risking lateral movement. Full scan is reactive; reviewing timeline is passive; restoring connectivity prematurely could spread the threat.

Answer

Review the device timeline for related alerts.

Answer

Restore network connectivity to allow the device to communicate with the cloud for analysis.

Answer

Initiate a full antivirus scan on the device.

Question 10

Your organization uses Microsoft Sentinel and you are designing a data retention strategy. You have a Log Analytics workspace with the following tables: SecurityEvent, SigninLogs, and CommonSecurityLog. The compliance team requires that SigninLogs be retained for 7 years, while other tables can be retained for 1 year. Which THREE steps must you take to meet this requirement?

Accepted Answer

Set the workspace retention to 7 years.. Setting the workspace retention to 7 years ensures that all tables in the workspace, including SigninLogs, are retained for the maximum required period. However, this alone would also retain other tables longer than needed, so you must combine it with table-level retention to override the workspace setting for specific tables. This approach allows you to meet the 7-year compliance requirement for SigninLogs while keeping other tables at 1 year.

Answer

Set an archiving policy to move SigninLogs to cold storage after 1 year.

Answer

Enable Azure Data Explorer (ADX) for long-term storage.

Question 11

During an incident response, a security analyst identifies that a user's account was used to access sensitive data from an anomalous location. The analyst needs to immediately prevent further access from that account while preserving forensic data. Which action should the analyst take?

Accepted Answer

Disable the user account in Microsoft Entra ID.. Disabling the user account in Microsoft Entra ID immediately prevents any further authentication or access to resources, including sensitive data, while preserving the account's forensic data (e.g., sign-in logs, audit events) for investigation. This action stops all current and future sessions without deleting the account or its associated data, which is critical for incident response.

Answer

Revoke the user's current sessions in Microsoft Entra ID.

Answer

Block the IP address of the anomalous location in the firewall.

Answer

Enable multi-factor authentication (MFA) for the user.

Question 12

Your organization uses Microsoft Sentinel and has enabled UEBA (User and Entity Behavior Analytics). You notice a series of incidents involving anomalous logon times for a privileged user. You want to automate the response to disable the user's account in Microsoft Entra ID when such incidents are created. What should you configure?

Accepted Answer

Create an automation rule that runs a playbook when an incident from the UEBA analytics rule is created, and configure the playbook to disable the user in Microsoft Entra ID.. Microsoft Sentinel automation rules can trigger a playbook when an incident is created by a specific analytics rule (e.g., a UEBA-based rule). The playbook, built in Azure Logic Apps, can then use the Microsoft Graph API to disable the user's account in Microsoft Entra ID. This provides a fully automated, event-driven response to anomalous logon time incidents without manual intervention.

Answer

Create an analytics rule that triggers on UEBA anomalies and directly disables the user.

Answer

Add the user to a watchlist and create a playbook that runs on a schedule.

Answer

Configure UEBA to automatically disable the user when anomalous behavior is detected.

Question 13

A threat hunter wants to identify all devices that have communicated with a known malicious IP address in the last 7 days. Which table in Microsoft Defender for Endpoint advanced hunting should be queried?

Accepted Answer

DeviceNetworkEvents. DeviceNetworkEvents records network connections, including destination IP addresses.

Answer

DeviceFileEvents

Answer

DeviceProcessEvents

Answer

DeviceRegistryEvents

Question 14

A threat hunter wants to identify possible data exfiltration over DNS in Microsoft Sentinel. Which KQL function should the analyst use to extract domain names from DNS queries?

Accepted Answer

parse_url. Parse_url extracts URL components, including hostname, from a string. Option A is wrong because extract_all is more general for regex. Option C is wrong because split is for splitting strings, not parsing URLs. Option D is wrong because substring is for simple substring extraction.

Answer

split

Answer

extract_all

Answer

substring

Question 15

During a threat hunting exercise, an analyst discovers a suspicious PowerShell process that executed encoded commands and made outbound connections to an unknown IP address. The process tree shows it was spawned by a Microsoft Word instance. What is the most likely attack technique being observed?

Accepted Answer

Phishing with malicious macro. The scenario describes a malicious document (Word) executing PowerShell with encoded commands, which is classic phishing with macro-based payload. Option A is wrong because execution via rundll32 is not indicated. Option C is wrong because the attack originates from a document, not a service. Option D is wrong because there is no evidence of lateral movement.

Answer

Service Execution

Answer

Execution via Rundll32

Answer

Lateral Movement via WMI