SC-200 Practice Test 38 — 15 Questions

Question 1

You are configuring an automated investigation and response (AIR) playbook in Microsoft Sentinel. The playbook should automatically block a user in Microsoft Entra ID when a high-severity incident is created. Which action should you include in the playbook?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Call the Microsoft Graph API to update the user's accountEnabled property to false.. The 'Block user' action is not available in the Microsoft Entra ID connector for Azure Logic Apps; instead, you must call the Microsoft Graph API to update the user's `accountEnabled` property to `false`. This directly disables the user account in Microsoft Entra ID, effectively blocking their access. The playbook in Microsoft Sentinel uses Azure Logic Apps, and the Graph API is the appropriate method to perform this action programmatically.

Answer

Use the 'Block user' action from the Microsoft Entra ID connector in Azure Logic Apps.

Answer

Add a 'Block IP' action from the Azure Firewall connector.

Answer

Add a 'Change incident status' action to close the incident.

Question 2

Refer to the exhibit. A SOC analyst runs this KQL query in Microsoft Sentinel. What is the purpose of this query?

Accepted Answer

Find users with more than 5 failed sign-ins from an IP address in the last hour. The KQL query filters for events where the result type is 'Failure' (failed sign-ins), then groups by account and IP address, counting occurrences. The `where count_ > 5` clause ensures only accounts with more than 5 failed sign-ins from a single IP are returned, which is a classic indicator of a brute force attack. This directly matches option D.

Answer

Detect brute force attempts by finding users with many failed sign-ins from a single IP

Answer

List all successful sign-ins in the last hour

Answer

Identify users who successfully signed in from multiple IPs

Question 3

Your incident response team uses Microsoft Sentinel. You need to automatically assign incidents to the appropriate analyst based on the incident category. What should you configure?

Accepted Answer

Create an automation rule that runs a playbook to assign the incident.. Automation rules in Microsoft Sentinel can trigger a playbook when an incident is created or updated. By configuring an automation rule with a condition based on the incident category, you can invoke a playbook that uses the Microsoft Sentinel API or Logic Apps to set the incident's owner field, thereby assigning it to the appropriate analyst. This is the correct approach because automation rules are designed to run automated responses, including playbooks, on incidents.

Answer

Create an analytics rule that sets the owner field.

Answer

Create a custom incident label for each category.

Answer

Create a workbook that filters incidents by category.

Question 4

A security analyst is investigating a suspicious process on an endpoint and wants to see all changes made to the Windows Registry by that process. Which advanced hunting table should the analyst query to find registry modification events associated with the process?

Accepted Answer

DeviceRegistryEvents. DeviceRegistryEvents is the correct table because it specifically captures Windows Registry modification events, including create, modify, and delete operations. For a process-based investigation, this table includes the InitiatingProcessId and InitiatingProcessFileName columns, allowing the analyst to filter by the suspicious process's PID or name to see all registry changes it made.

Answer

DeviceProcessEvents

Answer

DeviceEvents

Answer

DeviceFileEvents

Question 5

A security operations center (SOC) uses Microsoft Sentinel for log management. The SOC manager wants to reduce storage costs by automatically archiving logs that are older than 90 days to long-term retention, but retains the ability to search them if needed. What should the manager configure?

Accepted Answer

Configure a data archiving policy in the Log Analytics workspace to archive logs after 90 days. Configuring a data archiving policy in the Log Analytics workspace automatically moves logs older than 90 days to long-term, low-cost storage while keeping them searchable via the search job or restore feature. This directly meets the SOC manager's requirement to reduce costs without losing the ability to query archived data.

Answer

Change the table plan to Basic Logs for logs older than 90 days

Answer

Create a retention policy that deletes logs older than 90 days

Answer

Export logs older than 90 days to an Azure Storage account

Question 6

Which THREE features are available in Microsoft Defender XDR to help automate incident response? (Choose three.)

Accepted Answer

Automated investigation and response (AIR). Automated investigation and response (AIR) in Microsoft Defender XDR automatically runs playbooks on alerts to investigate and remediate threats without manual intervention. It leverages machine learning and security signals across endpoints, email, and identities to contain malicious activity, such as isolating a compromised device or blocking a malicious file, directly within the incident response workflow.

Answer

Microsoft Power Automate

Answer

Microsoft Sentinel fusion rule

Question 7

Refer to the exhibit. You are creating a scheduled analytics rule in Microsoft Sentinel using the ARM template snippet. The rule runs every 5 minutes and queries the last 5 minutes of data. The rule is not generating alerts even though malware detections are occurring. What is the most likely issue?

Accepted Answer

The table DeviceEvents is not ingested into the Log Analytics workspace.. DeviceEvents is a table from Microsoft Defender for Endpoint, but it is not automatically available in Microsoft Sentinel's Log Analytics workspace. The data connector for Microsoft Defender for Endpoint must be configured and the table must be mapped to Sentinel's workspace. Without this, the query runs against an empty table, returning no results, so the rule never triggers (even with triggerThreshold of 0). Option A is incorrect: having queryPeriod and queryFrequency both set to 5 minutes is standard for a rule that runs every 5 minutes looking at the last 5 minutes; it does not cause overlapping windows. Option B is incorrect: triggerThreshold of 0 means any result should trigger an alert, but if there are no results due to missing data, the rule won't fire. Option C is incorrect: the ARM template snippet would include the required 'kind' property for a scheduled rule; its absence is not the issue here.

Answer

The queryPeriod and queryFrequency are the same, causing overlapping windows.

Answer

The triggerThreshold is set to 0, which should always trigger.

Answer

The ARM template is missing the required 'kind' property.

Question 8

A company wants to protect Azure virtual machines from brute force attacks by allowing remote desktop protocol (RDP) access only when explicitly requested and approved. Which Microsoft Defender for Cloud feature should they enable?

Accepted Answer

Just-in-time VM access. Just-in-time (JIT) VM access in Microsoft Defender for Cloud locks down inbound traffic to Azure VMs by default, opening RDP (port 3389) only when a user requests access and is approved via Microsoft Entra ID and Azure Policy. This directly addresses the requirement to allow RDP only on explicit request and approval, mitigating brute force attacks by reducing the attack surface.

Answer

Adaptive network hardening

Answer

File integrity monitoring

Answer

Security recommendations

Question 9

Your organization uses Microsoft Sentinel and you have a playbook that sends an email notification when a high-severity incident is created. You want to ensure that the playbook only runs for incidents that are not already assigned to a user. What should you configure?

Accepted Answer

Configure the automation rule trigger to include a condition for 'Incident owner equals null'. Automation rules in Microsoft Sentinel can include conditions that filter which incidents trigger a playbook. By configuring the automation rule with a condition for 'Incident owner equals null', the playbook will only run for incidents that are unassigned, ensuring that already assigned incidents are not processed. This approach is efficient and avoids unnecessary execution of the playbook.

Answer

Set the playbook trigger to 'When an incident is created' and add a condition inside

Answer

Add a condition in the playbook to check if the incident is assigned

Answer

Modify the analytics rule to only generate unassigned incidents

Question 10

An analyst writes an advanced hunting query to investigate a suspicious executable that initiated outbound connections. Which two Microsoft 365 Defender tables are most relevant? (Choose 2.)

Accepted Answer

DeviceProcessEvents.. DeviceProcessEvents is correct because it records process creation events, including the executable that initiated the outbound connection. By querying this table, you can identify the suspicious executable's name, command line, and parent process, which is essential for tracing the origin of the malicious activity.

Answer

EmailAttachmentInfo.

Answer

IdentityInfo.

Question 11

Your team uses Microsoft Sentinel workbooks to visualize security data. You want to allow team members to customize a workbook without affecting the original. What should you do?

Accepted Answer

Create a copy of the workbook and save it as a custom workbook. Creating a copy of the workbook and saving it as a custom workbook allows team members to modify their own version without altering the original. In Microsoft Sentinel, workbooks are based on Azure Monitor Workbooks, and saving a copy creates an independent resource with its own settings and queries. This preserves the original workbook for reference or reuse while enabling customization.

Answer

Edit the original workbook to add personalization

Answer

Assign the team the Microsoft Sentinel Reader role

Answer

Share the workbook directly with the team

Question 12

Your organization uses Microsoft Defender for Office 365. You want to automatically isolate a user's mailbox if a high-confidence phishing email is detected. Which Microsoft Sentinel automation should you use?

Accepted Answer

Create a playbook that uses the Microsoft Graph API to apply a mailbox litigation hold or block access.. Microsoft Sentinel playbooks, built on Azure Logic Apps, can use the Microsoft Graph API to perform automated remediation actions like applying a mailbox litigation hold or blocking user access. This enables automatic isolation of a user's mailbox when a high-confidence phishing email is detected, which is a key incident response capability in Defender for Office 365.

Answer

Configure a workbook to display the alert and manually isolate the mailbox.

Answer

Enable the Office 365 connector and configure automatic response in the data connector.

Answer

Create a scheduled analytics rule that isolates the mailbox when triggered.

Question 13

Your company uses Microsoft Defender for Cloud to monitor multi-cloud resources. You want to ensure that all critical security recommendations are automatically assigned to the appropriate team leads based on the resource's tags. Which feature should you configure?

Accepted Answer

Use the 'Assign ownership' feature in Microsoft Defender for Cloud to map tags to owners.. The 'Assign ownership' feature in Microsoft Defender for Cloud allows you to map resource tags to specific owners (e.g., team leads) via an automated rule. When a critical security recommendation is generated for a resource with a matching tag, the recommendation is automatically assigned to the designated owner, ensuring accountability without manual intervention.

Answer

Configure a regulatory compliance standard to send email notifications.

Answer

Create a workbook that lists recommendations and manually assign them.

Answer

Create a governance rule that automatically applies a compliance standard.

Question 14

Refer to the exhibit. You are configuring an automation rule in Microsoft Sentinel. The rule is enabled but never runs. The playbook exists and is in the same resource group. What is the most likely cause?

Accepted Answer

The trigger type is incorrect; it should be 'Microsoft.SecurityInsights/Alert'.. The exhibit shows the trigger type set to 'Microsoft.SecurityInsights/Incident', but the playbook is designed to run on alerts, not incidents. Automation rules in Microsoft Sentinel require the trigger type to match the data type the playbook expects; for alert-triggered playbooks, the trigger must be 'Microsoft.SecurityInsights/Alert'. Since the rule is enabled and the playbook exists in the same resource group, the mismatch in trigger type is the most likely reason the rule never runs.

Answer

The condition uses 'Contains' operator, but 'AlertProvider' requires 'Equals'.

Answer

The automation rule is in a 'Disabled' state.

Answer

The playbookId is missing the subscription ID.

Question 15

Your SOC uses Microsoft Sentinel and Microsoft Defender XDR. You need to ensure that all incidents from Defender XDR are automatically synchronized to Sentinel. You have enabled the Defender XDR connector. However, some incidents are not appearing. What should you check first?

Accepted Answer

Check the connector's data filter settings for severity or status.. The Defender XDR connector in Microsoft Sentinel allows filtering of incidents based on severity and status during configuration. If incidents are not appearing, the most common cause is that the connector's data filter settings are excluding them—for example, filtering out 'Informational' severity or 'Resolved' status incidents. This is the first thing to check because the connector is enabled and working, but the filter is preventing synchronization of certain incidents.

Answer

Confirm that the incident is displayed in a Sentinel workbook.

Answer

Ensure that alert grouping is enabled in Sentinel.

Answer

Verify that the Microsoft Defender XDR license is active.