SC-200 Practice Test 38 — 15 Questions

Question 1

During a threat hunting exercise in Microsoft Sentinel, you want to identify all cloud application events where a user accessed a resource from an IP address not previously associated with that user. Which KQL operator should you use to compare current access patterns with a baseline of known IPs?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

join. The `join` operator allows combining two tables based on a key, such as UserId, and then filtering for rows where the IP does not match the baseline.

Answer

lookup

Answer

summarize

Answer

union

Question 2

Refer to the exhibit. You run the KQL query in Microsoft Sentinel to identify analysts with high incident assignments. The query returns no results, but you know incidents exist. What is the most likely reason?

Accepted Answer

Incidents are not assigned to any owner, so the Owner field is null. If incidents have no assigned owner, the Owner field is null. The KQL query likely filters or groups by Owner, and null values are excluded from results by default in aggregation operations like summarize. Since incidents exist but are unassigned, the query returns no results.

Answer

The summarize operator is incorrectly used

Answer

The SecurityIncident table does not exist

Answer

The query period is too short to capture incidents

Question 3

You are configuring Microsoft Sentinel to detect potential ransomware activity. The security team wants to be alerted when a single host contacts multiple suspicious domains within a short time. Which analytic rule type should you create?

Accepted Answer

NRT (Near-Real-Time) rule. A NRT (Near-Real-Time) rule is the correct choice because it continuously processes events with a minimum latency of about 1 minute, making it ideal for detecting patterns like a single host contacting multiple suspicious domains within a short time window. Unlike scheduled rules that run on a fixed interval (e.g., every 5 minutes), NRT rules evaluate data as it arrives, enabling rapid detection of multi-event sequences such as DNS queries to known malicious domains.

Answer

Scheduled query rule

Answer

Anomaly rule

Answer

Microsoft security rule

Question 4

You are a security operations analyst. You need to review all incidents from the past 24 hours that have a high severity and involve multiple users. In Microsoft Sentinel, which blade should you use?

Accepted Answer

Incidents. The Incidents blade in Microsoft Sentinel is the correct place to review all security incidents, including filtering by severity and the number of users involved. It provides a centralized view where you can apply filters for 'High' severity and 'Multiple users' to meet the requirement of reviewing incidents from the past 24 hours. The Hunting, Workbooks, and Analytics blades serve different purposes and do not offer the same incident review and filtering capabilities.

Answer

Hunting

Answer

Workbooks

Answer

Analytics

Question 5

Arrange the steps to configure an Azure Sentinel data connector for Windows Security Events via Azure Monitor Agent in the correct order.

Accepted Answer

Install the Azure Monitor Agent on the Windows machine -> Create a Data Collection Rule (DCR) with Windows Security Events source -> Associate the DCR with the Log Analytics workspace -> Verify data ingestion in Azure Sentinel. The Azure Monitor Agent uses DCRs to define data sources; the agent must be installed, then a DCR is created with the security events source, associated with the workspace, and finally verified.

Answer

Create a Data Collection Rule (DCR) with Windows Security Events source -> Associate the DCR with the Log Analytics workspace -> Install the Azure Monitor Agent on the Windows machine -> Verify data ingestion in Azure Sentinel

Answer

Install the Azure Monitor Agent on the Windows machine -> Associate the DCR with the Log Analytics workspace -> Create a Data Collection Rule (DCR) with Windows Security Events source -> Verify data ingestion in Azure Sentinel

Answer

Create a Data Collection Rule (DCR) with Windows Security Events source -> Install the Azure Monitor Agent on the Windows machine -> Associate the DCR with the Log Analytics workspace -> Verify data ingestion in Azure Sentinel

Question 6

An organization uses Microsoft Defender XDR. During an incident investigation, the security team needs to determine if a specific file was executed on any devices in the organization over the past 30 days. They have the file hash. What is the most efficient way to get this information?

Accepted Answer

Use advanced hunting to query for file execution events. Advanced hunting in Microsoft Defender XDR allows querying for file execution events across all devices using the file hash. Option A is wrong because the action center is for response actions, not queries. Option C is wrong because the incident timeline is for a specific incident, not a file search across devices. Option D is wrong because the device inventory does not show execution history.

Answer

Use the action center to search for the file

Answer

Review the incident timeline for the file

Answer

Check the device inventory for the file

Question 7

Your organization uses Microsoft Sentinel. An analyst reports that a scheduled analytics rule is not firing. You verify that the rule is enabled and the query returns results when run manually. What is the most likely cause?

Accepted Answer

The alert threshold is set too high. The most likely cause is that the alert threshold is set too high. Even though the query returns results when run manually, the rule's threshold condition (e.g., 'Number of results greater than X') may not be met by the volume of results returned during each scheduled run. If the threshold is higher than the typical result count, the rule will not trigger an alert despite the query being valid.

Answer

The data connector is disconnected

Answer

The workspace is in a different region

Answer

The query uses unsupported KQL functions

Question 8

In a threat hunt, you discover that a non-admin user account created a scheduled task that executes a PowerShell script to connect to an external IP on port 4444. Which of the following is the most likely interpretation of this activity?

Accepted Answer

The scheduled task is likely a reverse shell for persistence and remote access. PowerShell connecting to an external IP on a non-standard port like 4444 is indicative of a reverse shell. Option A is incorrect because standard admin tasks typically use RDP or WinRM. Option B is incorrect because port 4444 is not typically used for updates. Option C is incorrect because remote assistance uses different ports and protocols.

Answer

The user is performing legitimate remote administration

Answer

The PowerShell script is a remote assistance tool

Answer

The scheduled task is part of a software update mechanism

Question 9

You are the security analyst for a company that uses Microsoft Sentinel. You notice that a critical analytics rule has not generated any incidents in the past week, but you know that relevant logs are being ingested. You need to troubleshoot why the rule is not firing. What is the first step you should take?

Accepted Answer

Run the analytics rule's query directly in Log Analytics to see if it returns results.. The first step in troubleshooting a Sentinel analytics rule that is not generating incidents despite relevant logs being ingested is to run the rule's query directly in Log Analytics. This isolates whether the issue is with the query logic itself (e.g., syntax errors, time range misconfiguration, or data not matching the KQL conditions) rather than with data ingestion or rule settings. If the query returns results in Log Analytics, the problem lies elsewhere; if it returns no results, the query needs adjustment.

Answer

Check the incident creation rule configuration.

Answer

Verify that the log sources are connected and sending data to the workspace.

Answer

Disable and re-enable the analytics rule.

Question 10

Your organization uses Microsoft Sentinel. You have a custom analytics rule that generates incidents based on a KQL query. The rule is configured to run every 5 minutes. You notice that the rule is generating duplicate incidents for the same event. What should you do to prevent duplicates?

Accepted Answer

Enable entity mapping in the analytics rule and set appropriate entities.. To prevent duplicate incidents in Microsoft Sentinel, you should enable entity mapping in the analytics rule and set appropriate entities (option D). Entity mapping allows Sentinel to group alerts into a single incident based on common entities (e.g., user, host, IP address). Option A is wrong because automation rules can delete incidents post-creation but do not prevent duplicates at source. Option B is wrong because grouping alerts by time only (within 5 minutes) may still miss duplicates if events are spaced beyond that window; entity mapping provides more precise deduplication. Option C is wrong because playbooks run after incident creation and cannot prevent duplicates from being generated in the first place.

Answer

Create an automation rule that deletes duplicate incidents.

Answer

Set the rule to group alerts into a single incident if they occur within 5 minutes.

Answer

Create a playbook that checks for duplicates before incident creation.

Question 11

Your organization uses Microsoft Defender XDR and Microsoft Sentinel. The security operations center (SOC) team frequently receives false positive alerts for a specific user login pattern from a legacy application. You need to reduce alert fatigue without disabling the underlying detection rule. What should you configure?

Accepted Answer

Configure an automated investigation and remediation rule in Microsoft Defender XDR to suppress alerts matching the legacy application pattern.. Configuring an automated investigation and remediation rule in Microsoft Defender XDR allows you to suppress alerts that match a specific pattern (e.g., legacy application login behavior) without disabling the underlying detection rule. This directly reduces alert fatigue by automatically closing or ignoring false positive alerts while keeping the rule active for genuine threats.

Answer

Use Microsoft Sentinel bookmarks to mark the alerts as false positives.

Answer

Create a watchlist in Microsoft Sentinel containing the legacy application's user accounts and use it in the rule.

Answer

Modify the analytics rule in Microsoft Sentinel to exclude the legacy application IP range.

Question 12

Your SOC team needs to ensure that all incidents in Microsoft Sentinel are assigned to an analyst within 30 minutes of creation. Which TWO configurations should you implement?

Accepted Answer

Create a playbook that uses the Update Incident action to set the owner field.. A playbook (an Azure Logic Apps workflow) can use the 'Update Incident' action to programmatically set the owner field on an incident. This allows you to implement custom assignment logic, such as round-robin or based on analyst skill set, triggered by an automation rule or manually. Option C is correct because an automation rule can directly set the owner field when an incident is created, without needing a playbook, by using the 'Update incident' action within the rule itself. Both configurations ensure incidents are assigned within the required 30-minute window.

Answer

Set up a playbook that sends an email to the SOC manager when an incident is created.

Answer

Configure a Microsoft Teams connector to post incidents to a channel.

Answer

Modify the analytics rule to include a custom details field for analyst name.

Question 13

Which TWO are valid incident classification categories in Microsoft Sentinel?

Accepted Answer

True positive. In Microsoft Sentinel, incident classification categories are used to determine the disposition of an alert. 'True positive' (Option C) is a valid classification indicating that the alert correctly identified a real security threat, and 'False positive' (Option E) is also valid, meaning the alert was triggered incorrectly. These two are part of the standard classification options in Sentinel's incident management.

Answer

Benign positive

Answer

Unknown

Answer

Informational

Question 14

Your organization has deployed Microsoft Sentinel in multiple regions. You need to ensure that incidents created in one workspace are available for correlation in a central workspace. What should you implement?

Accepted Answer

Sentinel workspace manager (incident replication). Sentinel Workspace Manager (incident replication) is the correct choice because it provides native, built-in replication of incidents from multiple workspaces to a central workspace without requiring custom code or external automation. This feature ensures that incidents created in regional workspaces are automatically synchronized to a designated central workspace, enabling unified correlation and investigation across regions.

Answer

Cross-workspace queries in KQL

Answer

Automated export of incidents to central workspace using Logic Apps

Answer

Azure Lighthouse

Question 15

You are configuring Microsoft Defender for Cloud Apps. You need to create a policy that alerts when a user downloads more than 100 files in 10 minutes from SharePoint. Which policy type should you use?

Accepted Answer

Activity policy. An Activity policy in Microsoft Defender for Cloud Apps monitors specific user activities (e.g., file downloads) and can trigger alerts based on thresholds like 'more than 100 downloads in 10 minutes'. This policy type is designed for granular, behavior-based detection of suspicious actions, making it the correct choice for this scenario.

Answer

Anomaly detection policy

Answer

File policy

Answer

Cloud discovery policy