SC-200 Practice Test 39 — 15 Questions

Question 1

Your SOC team uses Microsoft Sentinel incident management. You need to ensure that when an incident is created, it automatically runs a playbook to gather additional context from threat intelligence sources. What should you create?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Automation rule with a trigger on incident creation.. Microsoft Sentinel automation rules can be configured with a trigger on incident creation to automatically run a playbook. This allows the SOC team to gather additional context from threat intelligence sources without manual intervention, directly addressing the requirement to execute a playbook when an incident is created.

Answer

Workbook that queries threat intelligence.

Answer

Watchlist that maps to the incident.

Answer

Analytics rule that generates an alert.

Question 2

You are configuring Microsoft Sentinel to ingest data from multiple sources. Which TWO of the following are valid data connectors that can be used to ingest AWS CloudTrail logs?

Accepted Answer

Azure Functions connector. The AWS S3 connector (Option C) is a valid data connector for ingesting AWS CloudTrail logs into Microsoft Sentinel by reading the logs directly from an S3 bucket. The Azure Functions connector (Option A) is also valid because it can be configured to trigger on CloudTrail log delivery to S3, using a function app to parse and forward the logs to Sentinel via the Log Analytics HTTP Data Collector API.

Answer

Office 365 connector

Answer

Microsoft Defender for Cloud connector

Answer

Syslog connector

Question 3

A SOC analyst is configuring a multi-region deployment of Microsoft Sentinel. The requirement is to ingest security logs from Azure resources located in three different Azure regions. The analyst needs to create the workspace in one region and then use cross-workspace queries to view data from all regions. What is the correct sequence of steps?

Accepted Answer

Step 1: Create Log Analytics workspaces in each region. Step 2: Enable Sentinel on each workspace. Step 3: Connect data sources. Step 4: Configure cross-workspace queries.. To use cross-workspace queries in Microsoft Sentinel, you must first create a Log Analytics workspace in each region, enable Sentinel on each workspace, connect the data sources to their respective regional workspaces, and then configure cross-workspace queries to unify the data. This sequence ensures that each region's logs are ingested locally, which is required for cross-workspace queries to reference them via the `workspace()` expression.

Answer

Step 1: Enable Sentinel in one region. Step 2: Create workspaces in other regions. Step 3: Connect data sources. Step 4: Configure cross-workspace queries.

Answer

Step 1: Connect data sources. Step 2: Create workspaces. Step 3: Enable Sentinel. Step 4: Configure cross-workspace queries.

Answer

Step 1: Create a central workspace. Step 2: Enable Sentinel on it. Step 3: Connect data sources from all regions to the central workspace. Step 4: Configure cross-workspace queries.

Question 4

You are conducting a threat hunt for possible credential dumping using Mimikatz. Which Windows Security Event ID should you focus on in Microsoft Sentinel to detect potential use of Mimikatz?

Accepted Answer

Event ID 10 (Process accessed). Event ID 10 (Lsass process access) is a common indicator of Mimikatz usage. Option B is wrong because Event ID 4688 is process creation, too broad. Option C is wrong because Event ID 4625 is failed logon, unrelated. Option D is wrong because Event ID 5156 is for Windows Filtering Platform connections, not credential dumping.

Answer

Event ID 4688 (Process creation)

Answer

Event ID 4625 (Failed logon)

Answer

Event ID 5156 (WFP connection)

Question 5

You are reviewing an automation rule ARM template for Microsoft Sentinel. What is the result of deploying this automation rule?

Accepted Answer

When a High severity incident is created, the rule changes its severity to Medium and assigns it to SOC-Tier2.. The ARM template defines an automation rule that triggers when an incident is created with a severity of High. The rule's actions change the severity to Medium and assign the incident to the SOC-Tier2 owner. This matches option C exactly.

Answer

The rule assigns the incident to SOC-Tier2 only if the severity is Medium.

Answer

The rule triggers when an incident is updated and resets the severity to High.

Answer

The rule triggers when a High severity incident is created but does not change the severity.

Question 6

A security analyst is investigating lateral movement in Microsoft 365 Defender. They have identified a compromised device (DeviceA) and want to find all other devices that have been accessed from DeviceA via RDP in the last 24 hours. Which advanced hunting table contains RDP connection events?

Accepted Answer

DeviceNetworkEvents. DeviceNetworkEvents is the correct table because it captures network-level connection events, including outbound RDP (TCP port 3389) connections. When a compromised device initiates an RDP session to another device, the network event is logged here, allowing the analyst to trace lateral movement by filtering for `RemotePort == 3389` and `RemoteIP` of the target.

Answer

DeviceLogonEvents

Answer

DeviceProcessEvents

Answer

IdentityLogonEvents

Question 7

A security analyst in your SOC receives an alert from Microsoft Defender for Cloud Apps indicating that a user downloaded a large number of files from SharePoint in a short time. What is the most likely classification of this activity?

Accepted Answer

Data exfiltration. A sudden, large-volume download of files from SharePoint within a short time window is a classic indicator of data exfiltration. Microsoft Defender for Cloud Apps uses anomaly detection policies to flag such activity based on user baseline behavior, download velocity, and the total number of files accessed, which aligns with the exfiltration phase of the cyber kill chain.

Answer

Ransomware

Answer

Lateral movement

Answer

Privilege escalation

Question 8

Your organization has Microsoft Sentinel with UEBA enabled. An incident is generated for a user with high risk score. You need to identify if the user's recent behavior deviates from their baseline. Which Sentinel feature should you use?

Accepted Answer

The UEBA timeline in the entity page.. The UEBA timeline in the entity page is the correct feature because it provides a chronological view of a user's activities, including deviations from their established behavioral baseline. When UEBA is enabled, Sentinel profiles normal behavior for each user and flags anomalies; the timeline directly visualizes these deviations, such as unusual login times, locations, or resource access, which aligns with the need to identify if recent behavior deviates from the baseline.

Answer

A custom hunting query using the BehaviorAnalytics table.

Answer

The user's Azure AD sign-in logs.

Answer

The incident investigation graph.

Question 9

An analyst creates a playbook in Microsoft Sentinel to automatically block an IP address when an alert fires. However, the playbook fails to block the IP. What is the most likely cause?

Accepted Answer

The IP address is being extracted from an incorrect field in the alert. The most likely cause is that the playbook is extracting the IP address from an incorrect field in the alert. In Microsoft Sentinel, playbooks use the SecurityAlert schema, where the IP address may be stored in different fields (e.g., 'RemoteIP', 'SourceIP', 'DestinationIP') depending on the alert provider. If the playbook references the wrong field, it will pass a null or incorrect value to the block action, causing the automation to fail silently or target the wrong entity.

Answer

The block duration is set to one day, which is too short

Answer

The playbook actions array has only one action, which is insufficient

Answer

The playbook is using the wrong trigger type; it should be on incident creation

Question 10

During a security incident, your team needs to preserve evidence from a Microsoft Defender for Endpoint onboarded device for forensic analysis. The device is still running and connected to the network. Which action should be taken to collect a forensic image while minimizing disruption?

Accepted Answer

Use the Microsoft Defender for Endpoint Live Response capability to acquire a disk image.. Live response allows collection of a forensic image (via disk acquisition) without shutting down the device, preserving volatile data. Option A is wrong because collecting from Microsoft Sentinel is not a forensic imaging method. Option C is wrong because isolating the device stops communication but does not collect an image. Option D is wrong because it is not a built-in feature of Microsoft Purview.

Answer

Enable Microsoft Purview eDiscovery to preserve the device content.

Answer

Isolate the device from the network using Microsoft Defender for Endpoint.

Answer

Initiate a Microsoft Sentinel data collection rule to export the device logs.

Question 11

Your organization uses Microsoft Sentinel with the Microsoft 365 Defender connector. You are hunting for a threat that uses 'process hollowing' to evade detection. Which advanced hunting query in Microsoft Defender for Endpoint would be most effective?

Accepted Answer

DeviceProcessEvents | where InitiatingProcessFileName != ImageFileName | where ParentProcessFileName != ImageFileName. Process hollowing often involves a child process with a different parent image; DeviceProcessEvents can show such anomalies. Option B is wrong because it looks for specific image names. Option C is wrong because file events are less direct. Option D is wrong because it waits for alerts.

Answer

DeviceProcessEvents | where FileName in~ ('rundll32.exe', 'regsvr32.exe', 'mshta.exe')

Answer

DeviceFileEvents | where FileName contains 'hollow'

Answer

AlertInfo | where Title contains 'Process hollowing'

Question 12

Which TWO actions can be performed using Microsoft Sentinel automation rules? (Choose two.)

Accepted Answer

Change the severity of an incident. Automation rules in Microsoft Sentinel allow you to automate incident management tasks, including changing the severity of an incident and adding tags. These actions are part of the incident-handling workflow and can be triggered when an incident is created or updated, enabling consistent triage and enrichment without manual intervention.

Answer

Deploy a data connector

Answer

Modify a watchlist

Answer

Create a scheduled query rule

Question 13

Your SOC uses Microsoft Sentinel and Microsoft Defender XDR. An incident is generated from a Microsoft Defender for Identity alert about a suspicious Kerberos ticket request. The incident is assigned the 'Medium' severity. You want to automatically increase the severity to 'High' if the user is in a privileged role, based on data from Microsoft Entra ID. What is the most efficient way to achieve this?

Accepted Answer

Create an automation rule in Microsoft Sentinel triggered on incident creation, which runs a playbook that checks Microsoft Entra ID roles and updates the severity accordingly.. Automation rules in Microsoft Sentinel can trigger a playbook on incident creation, and that playbook can use the Microsoft Graph API to query Microsoft Entra ID for the user's role assignments. If the user holds a privileged role (e.g., Global Administrator), the playbook can programmatically update the incident's severity to 'High'. This approach is event-driven, efficient, and does not require modifying existing analytics rules or creating additional scheduled queries.

Answer

Enable automatic attack disruption in Microsoft Defender XDR to handle the incident.

Answer

Modify the analytics rule that generates the incident to check user roles during query execution.

Answer

Create a scheduled analytics rule that queries Microsoft Entra ID audit logs and updates incident severity via a watchlist.

Question 14

You are managing a Microsoft Sentinel environment. You need to ensure that incidents are automatically assigned to the appropriate analyst based on the type of attack. The assignment must consider the current workload of each analyst. What should you use?

Accepted Answer

Use an automation rule with a playbook that queries the current incident assignments and assigns to the least busy analyst.. Automation rules in Microsoft Sentinel can trigger a playbook (Azure Logic App) that queries the current incident assignments and assigns the incident to the analyst with the fewest active incidents. This satisfies both the attack-type mapping (via the analytics rule that generates the incident) and the workload-balancing requirement, as the playbook can dynamically evaluate workload using Azure Resource Graph or Sentinel's API.

Answer

Configure multiple analytics rules, each with a different incident owner.

Answer

Create a watchlist that maps attack types to analyst names and use it in an analytics rule.

Answer

Create a workbook that shows analyst workload and manually assign.

Question 15

A security analyst is investigating a suspicious process on an endpoint and wants to see all changes made to the Windows Registry by that process. Which advanced hunting table should the analyst query to find registry modification events associated with the process?

Accepted Answer

DeviceRegistryEvents. DeviceRegistryEvents is the correct table because it specifically captures Windows Registry modification events, including create, modify, and delete operations. For a process-based investigation, this table includes the InitiatingProcessId and InitiatingProcessFileName columns, allowing the analyst to filter by the suspicious process's PID or name to see all registry changes it made.

Answer

DeviceProcessEvents

Answer

DeviceEvents

Answer

DeviceFileEvents