SC-200 Practice Test 39 — 15 Questions

Question 1

You are responsible for Microsoft Defender for Identity. The security team reports that some high-confidence alerts are not triggering any automated response. You need to automate the response for these alerts. What should you configure?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

In Microsoft Defender XDR, configure automated investigation and response for Identity alerts.. Microsoft Defender for Identity alerts are natively integrated into Microsoft Defender XDR (formerly Microsoft 365 Defender), which provides automated investigation and response (AIR) capabilities. By configuring AIR for Identity alerts in Defender XDR, you can automatically trigger remediation actions such as suspending compromised accounts or blocking suspicious activities without additional scripting or third-party tools.

Answer

Use Microsoft Intune to trigger a script on domain controllers when an alert fires.

Answer

Create an automation rule in Microsoft Sentinel to respond to Identity alerts.

Answer

Configure Microsoft Purview compliance policies to respond to Identity alerts.

Question 2

Which TWO of the following are required to enable Microsoft Sentinel to receive alerts from Microsoft Defender for Cloud? (Choose two.)

Accepted Answer

Install the 'Microsoft Defender for Cloud' data connector in Microsoft Sentinel.. The 'Microsoft Defender for Cloud' data connector in Microsoft Sentinel is the specific integration point that ingests security alerts from Defender for Cloud into Sentinel. Without installing and configuring this connector, Sentinel cannot receive the alerts, even if Defender for Cloud is enabled on the subscription.

Answer

Deploy the Log Analytics agent on all VMs.

Answer

Connect a non-Azure machine using Azure Arc.

Answer

Assign an Azure Policy to enable Defender for Cloud.

Question 3

Order the steps to set up a Microsoft Sentinel workspace and connect Microsoft 365 Defender data.

Accepted Answer

1. Create a Log Analytics workspace. 2. Enable Microsoft Sentinel on the workspace. 3. Configure the Microsoft 365 Defender data connector. 4. Verify data ingestion and alerts.. Sentinel is enabled on a Log Analytics workspace, then data connectors like M365 Defender are configured to ingest data.

Answer

1. Create a Log Analytics workspace. 2. Configure the Microsoft 365 Defender data connector. 3. Enable Microsoft Sentinel on the workspace. 4. Verify data ingestion and alerts.

Answer

1. Enable Microsoft Sentinel on the workspace. 2. Create a Log Analytics workspace. 3. Configure the Microsoft 365 Defender data connector. 4. Verify data ingestion and alerts.

Answer

1. Configure the Microsoft 365 Defender data connector. 2. Create a Log Analytics workspace. 3. Enable Microsoft Sentinel on the workspace. 4. Verify data ingestion and alerts.

Question 4

You are reviewing a scheduled analytics rule in Microsoft Sentinel. What does the suppressionDuration setting affect?

Accepted Answer

It stops the rule from creating new alerts for that duration after an alert is generated.. The suppressionDuration setting in a Microsoft Sentinel scheduled analytics rule stops the rule from creating new alerts for a specified period after an alert is generated. This prevents alert fatigue by suppressing duplicate alerts from the same rule when the same conditions persist, allowing analysts to focus on unique incidents.

Answer

It groups alerts into a single incident within that time window.

Answer

It delays the execution of the query by that amount of time.

Answer

It determines how often the query runs.

Question 5

A security analyst in Microsoft Sentinel receives an incident with a high severity alert from Microsoft Defender for Identity. The incident description mentions a suspected lateral movement pass-the-hash attack. What should the analyst do first?

Accepted Answer

Isolate the affected device from the network.. The immediate priority in a suspected lateral movement pass-the-hash attack is to contain the threat by isolating the affected device from the network. This prevents the attacker from using the compromised account's NTLM hash to authenticate to other systems, stopping the lateral spread while preserving forensic evidence for further investigation.

Answer

Reset the password of the compromised account.

Answer

Review the Microsoft Defender for Cloud Apps logs.

Answer

Create a new analytics rule to detect pass-the-hash attacks.

Question 6

Your organization uses Microsoft Defender for Identity. The security team wants to monitor for suspected DCSync attacks. Which Windows Event ID should you monitor to detect DCSync activity?

Accepted Answer

Event ID 4662: An operation was performed on an object.. Event ID 4662 logs any operation performed on an Active Directory object, including the directory service access control entry for the DS-Replication-Get-Changes-All extended right (control access right 1131f6aa-9c07-11d1-f79f-00c04fc2dcd2). A DCSync attack uses this right to replicate domain credentials from a domain controller, so monitoring 4662 with the specific object type and access mask for replication is the correct detection method.

Answer

Event ID 4776: The domain controller attempted to validate the credentials for an account.

Answer

Event ID 4648: A logon was attempted using explicit credentials.

Answer

Event ID 4624: An account was successfully logged on.

Question 7

Which TWO actions can be performed using automation rules in Microsoft Sentinel?

Accepted Answer

Run a playbook. Automation rules in Microsoft Sentinel can trigger a playbook as an action when an incident is created or updated. Playbooks are automated workflows based on Azure Logic Apps, allowing for complex response actions such as threat containment, notification, or enrichment. This enables security teams to automate incident response without manual intervention.

Answer

Create an incident

Answer

Modify an analytics rule

Answer

Delete an incident

Question 8

Refer to the exhibit. You are configuring an automation rule in Microsoft Sentinel. The JSON snippet defines an automation rule. What is the expected behavior of this rule?

Accepted Answer

It runs a playbook to quarantine an email when a specific alert is generated. The automation rule is triggered when a specific alert is generated (as defined by the trigger condition), and it runs a playbook that contains logic to quarantine an email. In Microsoft Sentinel, automation rules can be configured to trigger on alert creation and execute a playbook, which in this case performs the quarantine action.

Answer

It creates an incident when a phishing email is detected

Answer

It sends an email to the security team when an incident is created

Answer

It modifies the incident severity when a playbook runs

Question 9

Your organization uses Microsoft Defender for Cloud to monitor hybrid workloads. You receive an alert that a fileless malware attack was detected on an on-premises server connected via Azure Arc. The server is running Windows Server 2019. What is the BEST action to contain the threat?

Accepted Answer

Run a script via Azure Arc to disable the network interfaces on the server.. Disabling the network interfaces via Azure Arc immediately cuts off the compromised server's network connectivity, preventing lateral movement or data exfiltration by the fileless malware. Since fileless malware operates in memory and may not leave persistent artifacts, containment via network isolation is the fastest and most effective initial response.

Answer

Apply a security update using Azure Update Manager.

Answer

Use Azure Automation runbook to restart the server.

Answer

Uninstall the Azure Arc agent from the server to isolate it.

Question 10

Which THREE steps are part of the incident response process when using Microsoft Sentinel?

Accepted Answer

Investigate the incident using hunting queries and entity timelines.. Investigating an incident using hunting queries and entity timelines is a core step in the Microsoft Sentinel incident response process. After an incident is created, analysts use KQL-based hunting queries to proactively search for related threats and leverage entity timelines to visualize the sequence of events and entity interactions, which is essential for understanding the scope and impact of the incident.

Answer

Identify the incident by creating an analytics rule.

Answer

Report the incident to the security team via email.

Question 11

You need to ensure that critical incidents in Microsoft Sentinel are automatically assigned to a senior security analyst. What should you configure?

Accepted Answer

Create an automation rule that assigns the incident to the analyst.. Automation rules in Microsoft Sentinel allow you to automatically assign incidents to specific users or groups based on conditions like severity or title. By creating an automation rule that triggers on incident creation and sets the owner to the senior security analyst, you ensure critical incidents are assigned without manual intervention.

Answer

Create an analytics rule with a custom schedule.

Answer

Configure a workbook to filter incidents by owner.

Answer

Add the analyst to a watchlist used in analytics rules.

Question 12

Which TWO are common techniques used during threat hunting to identify suspicious behavior in Microsoft Defender XDR?

Accepted Answer

Searching for known indicators of compromise (IOCs).. Option B is correct because threat hunting in Microsoft Defender XDR commonly begins with searching for known indicators of compromise (IOCs) such as malicious file hashes, IP addresses, domains, or URLs using advanced hunting queries (KQL) against tables like DeviceNetworkEvents and DeviceFileEvents. Option C is correct because applying anomaly detection models to user behavior — for example, identifying unusual sign-in patterns or atypical activity via Microsoft Defender for Identity and Microsoft Sentinel UEBA — is a core proactive hunting technique for uncovering threats that signature-based detection misses. Option A is not a hunting technique; updating antivirus signatures is a routine preventive maintenance task performed by Defender Antivirus, not an investigative method. Option D is incorrect because configuring mail flow rules in Exchange Online is an administrative mail-handling action, not a threat-hunting technique. Option E is incorrect because vulnerability scans identify unpatched weaknesses rather than actively hunting for suspicious or malicious behavior in Defender XDR telemetry.

Answer

Updating antivirus signatures.

Answer

Configuring mail flow rules in Exchange Online.

Answer

Performing vulnerability scans on endpoints.

Question 13

A SOC analyst is using Microsoft Sentinel to respond to an incident involving multiple compromised user accounts. The analyst needs to quickly see the timeline of all related events. Which feature should the analyst use?

Accepted Answer

Incident timeline.. The Incident timeline (option D) is the correct feature because it provides a chronological view of all events, alerts, and actions associated with a specific incident in Microsoft Sentinel. This allows the SOC analyst to quickly see the sequence of events related to the compromised user accounts without navigating away from the incident investigation page.

Answer

Entity behavior page.

Answer

Analytics rule page.

Answer

Workbook.

Question 14

You are reviewing an analytics rule configuration in Microsoft Sentinel using ARM template JSON. The rule is enabled and incident creation is set to true. However, when alerts are generated, they are not being grouped into a single incident. What is the most likely reason?

Accepted Answer

The groupingConfiguration is disabled.. The groupingConfiguration in Microsoft Sentinel analytics rules controls whether alerts are grouped into a single incident. When this configuration is disabled, each alert generates its own separate incident, even if the rule is enabled and incident creation is set to true. Therefore, the most likely reason alerts are not being grouped is that the groupingConfiguration is disabled.

Answer

The lookbackDuration is set to 5 hours which is too short.

Answer

The matchingMethod is set to 'AllEntities' which is not supported.

Answer

The rule is not enabled properly.

Question 15

You are the security operations lead for a multinational company using Microsoft Sentinel. You have deployed a custom analytics rule that uses a KQL query to detect anomalous outbound network traffic. The rule runs every hour and looks back 24 hours. Recently, the rule has been generating a high number of false positives. You need to tune the rule to reduce false positives without missing genuine threats. The rule currently triggers when the count of outbound connections to a single IP exceeds 100 in an hour. You analyze the data and find that legitimate cloud services often trigger the rule. What should you do?

Accepted Answer

Modify the KQL query to exclude traffic to known benign IP ranges.. The most effective way to reduce false positives without missing genuine threats is to refine the KQL query to exclude traffic to known benign IP ranges, such as those belonging to legitimate cloud services. This preserves the detection logic for suspicious IPs while eliminating noise from trusted sources. It is a targeted tuning approach that maintains threat coverage.

Answer

Disable the rule and create a new one with a different query.

Answer

Increase the threshold to 200 connections per hour.

Answer

Configure a suppression rule to automatically close incidents from those IPs.