SC-200 Practice Test 38 — 15 Questions

Question 1

The exhibit shows a KQL query used in a Microsoft 365 Defender custom detection rule. The query is intended to detect encoded PowerShell commands executed in the last hour. However, the detection rule is not generating any alerts even though the SOC knows that encoded PowerShell commands are being executed. Which modification would most likely fix the detection rule?

Accepted Answer

Add a condition to also look for `-EncodedCommand` in the command line.. The query uses `contains` which is case-insensitive, but the problem is that the rule might be running on a different time range or the query may not be scheduled to run frequently enough. However, the most likely issue is that the query uses `Project` instead of `project` (case sensitivity in KQL is not an issue), but actually KQL is case-insensitive for keywords. A common mistake is that the query uses `project` correctly. Actually, the issue might be that the detection rule is not including the right data source or the query is not scheduled. But given the options, the most plausible fix is to change `contains` to `has` because `contains` will match substrings like "-encodedcommand" but also "-enc" inside other words, but the real issue might be that the query is not using `has_any` for performance. However, among the options, the correct one is to add a condition to filter on `InitiatingProcessFileName` to ensure only powershell.exe is considered? No, the query already filters on FileName. Let's re-analyze: The query uses `DeviceProcessEvents` which is from Microsoft 365 Defender. The detection rule might not be triggering because the query uses `ago(1h)` which is relative to the time the query runs, but if the rule runs every hour, it might miss events that happen just after the query runs. However, the rule should include all events from the last hour. The more likely issue is that the query uses `contains "-enc"` which will match any string containing "-enc", but the encoded command flag in PowerShell is "-EncodedCommand". However, the query also checks for "-e" which would match many commands. But the real problem might be that the query is not filtering out legitimate uses. Option A is correct because the query should also look for the `-EncodedCommand` parameter explicitly. Option B is wrong because using `has` instead of `contains` would be more accurate but not the main issue. Option C is wrong because the query already filters on FileName. Option D is wrong because the query already uses Project.

Answer

Change `contains` to `has` for better performance and accuracy.

Answer

Modify the query to use `project-away` instead of `project`.

Answer

Replace `FileName == "powershell.exe"` with `InitiatingProcessFileName == "powershell.exe"`.

Question 2

Your organization uses Microsoft Defender XDR. You need to configure a custom detection rule that runs every hour and alerts when a specific process is executed on multiple devices within 10 minutes. Which type of rule should you create?

Accepted Answer

Custom detection rule. Custom detection rules in Microsoft Defender XDR allow you to create scheduled queries that run on a schedule (e.g., every hour) and can use aggregations like count of devices within a time window. Option A is correct. Option B is wrong because hunting queries are one-time or scheduled but not custom detection rules. Option C is wrong because advanced hunting is a query interface, not a rule type. Option D is wrong because behavioral rules are for specific behaviors, not scheduled queries.

Answer

Hunting query saved as a detection

Answer

Behavioral rule

Answer

Advanced hunting query

Question 3

Your organization uses Microsoft Sentinel. You need to ensure that an Azure function app can send custom logs to a Log Analytics workspace. What should you configure?

Accepted Answer

Data collection rule (DCR) with Azure Monitor Agent. The Log Analytics agent (now replaced by Azure Monitor Agent) is used to send custom logs from a function app to Log Analytics. Option A is correct. Option B is for automation, not ingestion. Option C is for threat intelligence, not custom logs. Option D is for exporting data, not ingestion.

Answer

Threat intelligence data connector

Answer

Diagnostic settings on the function app

Answer

Microsoft Sentinel automation rule

Question 4

Which THREE components are part of Microsoft Defender XDR? (Select three.)

Accepted Answer

Microsoft Defender for Endpoint. Defender XDR includes Defender for Endpoint, Defender for Office 365, and Defender for Identity. Option A, B, and D are correct. Option C is a cloud security solution, not part of Defender XDR. Option E is an identity management service.

Answer

Microsoft Entra ID

Answer

Microsoft Defender for Cloud

Question 5

You are configuring Microsoft Sentinel to send email notifications to the SOC manager when a high-severity incident is created. What should you use?

Accepted Answer

Create a playbook that sends an email and assign it to an automation rule.. Option B is correct because playbooks can be triggered by automation rules to send emails. Option A is wrong because alert rules do not send emails directly; they create alerts. Option C is wrong because workbooks are for visualization, not notifications. Option D is wrong because watchlists are for reference data.

Answer

Configure an analytics rule to send an email when an incident is created.

Answer

Use a workbook to track incidents and configure an alert for email.

Answer

Add the SOC manager's email to a watchlist and configure a scheduled query.

Question 6

Your organization uses Microsoft Defender for Cloud Apps. You need to ensure that alerts from Defender for Cloud Apps are forwarded to Microsoft Sentinel. Which connector should you use in Sentinel?

Accepted Answer

Microsoft Defender for Cloud Apps connector. The Microsoft Defender for Cloud Apps connector (built-in data connector) is the correct way to ingest alerts. Option A is wrong because Microsoft 365 Defender connector covers alerts from Defender for Identity, Defender for Office 365, etc., but not directly from Defender for Cloud Apps. Option C is wrong because Windows Security Events connector is for on-premises events. Option D is wrong because Azure Activity connector is for Azure resource logs.

Answer

Windows Security Events via AMA connector

Answer

Microsoft 365 Defender connector

Answer

Azure Activity connector

Question 7

Which THREE components are part of the Microsoft Sentinel SOAR capabilities? (Select THREE.)

Accepted Answer

Connectors. Options A, C, and E are correct because Automation rules, Playbooks, and Connectors are core SOAR components. Option B is wrong because Workbooks are for visualization. Option D is wrong because Analytics rules are for detection.

Answer

Workbooks

Answer

Analytics rules

Question 8

Refer to the exhibit. You are deploying this ARM template to create a saved search in Microsoft Sentinel. What is the purpose of this saved search?

Accepted Answer

Identify computers that are generating a high number of heartbeats, which may indicate a potential compromise.. Option B is correct because the query counts heartbeats per computer in the last day and filters for computers with more than 100 heartbeats, indicating high activity. Option A is incorrect because it does not check malicious IP addresses. Option C is incorrect because it does not check missing heartbeats. Option D is incorrect because it does not check unresponsive computers.

Answer

Identify computers that have not sent heartbeats in the last 24 hours.

Answer

Identify computers with low disk space.

Answer

Identify computers that have communicated with a malicious IP address.

Question 9

You are a SOC analyst investigating a high-severity incident. The incident involves a user who received a phishing email and clicked a link. Microsoft Defender for Office 365 detected the email as phishing and blocked the URL at time of click, but a follow-up investigation reveals that the user's mailbox has suspicious forwarding rules. You need to ensure that similar incidents are automatically remediated in the future. What should you configure in Microsoft Sentinel?

Accepted Answer

Create an automation rule that triggers a playbook to remove the forwarding rule when an incident with the 'Phishing' tactic is created.. Automation rules in Microsoft Sentinel allow you to automatically trigger playbooks (e.g., to remove forwarding rules) when incidents are created. Option A is correct because automation rules can invoke a playbook that removes the forwarding rule. Option B is wrong because analytics rules create alerts, not automated actions on incidents. Option C is wrong because watchlists are for reference data, not automation. Option D is wrong because entity behavior analytics is for detecting anomalies, not automated remediation.

Answer

Configure entity behavior analytics to automatically block the user.

Answer

Create an analytics rule that detects suspicious forwarding rules and automatically removes them.

Answer

Add the user to a watchlist that triggers an automated investigation.

Question 10

Your organization uses Microsoft Sentinel with User and Entity Behavior Analytics (UEBA) enabled. You notice that the UEBA is not generating any anomalies for a particular user who has been inactive for 30 days. You have verified that the user's data is being ingested into the workspace. What is the most likely reason?

Accepted Answer

UEBA requires a minimum of 14 days of activity to establish a baseline.. UEBA requires a baseline of at least 14 days of activity to establish normal behavior. If the user has been inactive for 30 days, there is no baseline to compare against, so no anomalies are generated. Option D is correct. Option A is wrong because UEBA can work with any data source if configured. Option B is wrong because UEBA is enabled by default when you enable UEBA. Option C is wrong because the user's data is being ingested, so it's not a licensing issue.

Answer

The user's license does not include UEBA.

Answer

UEBA only works with Active Directory data, not Microsoft Entra ID.

Answer

UEBA is not enabled for the workspace.

Question 11

Your organization uses Microsoft Defender for Cloud. You need to recommend a solution to automatically remediate misconfigurations in Azure VMs without manual intervention. What should you use?

Accepted Answer

Enable 'Remediate' option in Defender for Cloud recommendations. Microsoft Defender for Cloud's 'Remediate' option in security recommendations can automatically apply fixes via Azure Policy's 'deployIfNotExists' effect. Option A is correct. Option B is a manual tool. Option C is for backup, not remediation. Option D is for patching, not all misconfigurations.

Answer

Use Azure Advisor recommendations

Answer

Configure Azure Backup

Answer

Set up Update Management in Azure Automation

Question 12

Which TWO features in Microsoft Sentinel can help reduce alert fatigue by grouping related alerts into incidents? (Select two.)

Accepted Answer

Incident merging. Incident creation from analytics rules groups alerts, and incident merging combines related incidents. Option A and D are correct. Option B is for automation, not grouping. Option C is for threat intel. Option E is for data enrichment.

Answer

Entity behavior analytics

Answer

Automation rules that run playbooks

Answer

Threat intelligence indicators

Question 13

Your SOC team uses Microsoft Defender XDR. You want to ensure that all incidents are automatically classified and determined by the built-in AI before any manual review. What should you configure?

Accepted Answer

Enable the incident summarization and classification feature in Microsoft Defender XDR.. Option D is correct because Microsoft Defender XDR incident summarization and classification uses AI to automatically classify incidents. Option A is wrong because automation rules in Sentinel are for Sentinel incidents. Option B is wrong because custom detection rules do not apply AI classification. Option C is wrong because AI classification is not a workbook feature.

Answer

Create a custom detection rule in Microsoft Defender XDR.

Answer

Enable automation rules in Microsoft Sentinel to classify incidents.

Answer

Configure a workbook in Microsoft Sentinel to analyze incidents.

Question 14

Your SOC team uses Microsoft Sentinel. You receive a high volume of false positive incidents from a specific analytics rule. The rule uses a scheduled query that runs every 5 minutes. What is the most efficient way to reduce false positives without disabling the rule?

Accepted Answer

Modify the rule to use entity mapping and alert grouping. Option B is correct because entity mapping and alert grouping help reduce noise. Option A is wrong because increasing run frequency would generate more alerts. Option C is wrong because disabling the rule stops all detections. Option D is wrong because suppressing for 24 hours might miss real incidents.

Answer

Increase the query run frequency to every hour

Answer

Disable the rule and create a new one with a different query

Answer

Use a suppression rule to close incidents automatically for 24 hours

Question 15

Which TWO are valid methods to ingest logs into Microsoft Sentinel from a non-Azure virtual machine? (Select TWO.)

Accepted Answer

Azure Monitor Agent (AMA) with Azure Arc. Options A and C are correct because AMA and legacy MMA are valid agents. Option B is wrong because the Sentinel agent is not a separate agent; MMA is used. Option D is wrong because Azure Monitor Agent is not yet available for Linux? Actually AMA is available for both Windows and Linux. But D says 'Azure Monitor Agent' but we already have AMA. However, the question says 'non-Azure VM', and AMA works on non-Azure VMs via Azure Arc. So both A and C are correct. Option E is wrong because Log Analytics agent is the same as MMA, but it's deprecated.

Answer

Microsoft Sentinel agent (standalone)

Answer

Azure Monitor Agent (AMA) without Azure Arc

Answer

Log Analytics agent (OMS) – deprecated

SC-200 Practice Test 38 — 15 Questions

Exhibit

SC-200 Practice Test 38 — 15 Questions

Exhibit