SC-200 Practice Test 4 — 10 Questions

Question 1

Your organization uses Microsoft Defender XDR. You need to configure automatic attack disruption for identity-related threats. The solution should automatically contain a compromised user by disabling their account. Which setting should you enable?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Enable automatic attack disruption in the Microsoft Defender XDR settings.. Microsoft Defender XDR's automatic attack disruption feature is specifically designed to contain identity-related threats by automatically disabling compromised user accounts. This setting, found in the Microsoft Defender XDR settings under 'Automated investigation and response', triggers when high-confidence identity attacks (e.g., password spray, lateral movement) are detected, without requiring manual intervention or additional infrastructure.

Answer

Configure Conditional Access policies to block the user.

Answer

Use Microsoft Sentinel automation rules to disable the user.

Answer

Create a custom detection rule to alert on suspicious sign-ins.

Question 2

During a ransomware incident, you need to prevent the encryption of files in SharePoint Online and OneDrive for Business. You have already identified the compromised user account. What should you do?

Accepted Answer

Lock the compromised user account in Microsoft Entra ID. Locking the compromised user account in Microsoft Entra ID immediately revokes the attacker's access to SharePoint Online and OneDrive for Business, preventing further file encryption. Option A is incorrect because disabling external sharing does not stop an already authenticated user from encrypting files. Option C is incorrect because deleting the user's OneDrive files does not prevent the attacker from encrypting other files. Option D is incorrect because a retention policy only protects against deletion or modification, not encryption.

Answer

Disable external sharing for SharePoint Online

Answer

Delete the compromised user's OneDrive files

Answer

Apply a retention policy to all SharePoint sites

Question 3

Which THREE of the following are key components of a successful threat hunting program in a Microsoft Defender XDR environment?

Accepted Answer

Deep understanding of normal network behavior. A successful threat hunting program in Microsoft Defender XDR requires a deep understanding of normal network behavior (A), because establishing a baseline of legitimate activity lets hunters spot anomalies across endpoint, identity, email, and cloud telemetry that automated detections may miss. A clear hypothesis based on threat intelligence (B) is essential, since threat hunting is hypothesis-driven rather than alert-driven; hunters use intel to form testable assumptions about adversary behavior and then query Defender XDR advanced hunting (KQL) to validate or refute them. The use of the MITRE ATT&CK framework (C) is also a key component, as it maps observed techniques and tactics to a common taxonomy, helping hunters prioritize coverage gaps and structure hunts around known adversary TTPs. Automated incident response playbooks (D) belong to SOAR/automated investigation and response, not threat hunting, and reactive response to alerts (E) is the opposite of proactive hunting, so neither is a core component of a threat hunting program.

Answer

Automated incident response playbooks

Answer

Reactive response to alerts

Question 4

A threat hunter is using Microsoft Defender for Endpoint advanced hunting to find devices that have a specific file hash associated with a known malware variant. The analyst wants to include devices that have the file in any location, including quarantined items. Which table and column should be used?

Accepted Answer

DeviceFileEvents, SHA256. DeviceFileEvents tracks file creation, modification, and deletion events, including those that are quarantined, and it includes the SHA256 column for file hashes. Option A (DeviceImageLoadEvents) is for image (DLL) loads, not general file info. Option C (DeviceNetworkEvents) covers network connections, not files. Option D (DeviceProcessEvents) involves process execution, not file discovery, and its ProcessCommandLine column does not contain file hashes.

Answer

DeviceImageLoadEvents, SHA256

Answer

DeviceNetworkEvents, RemoteIP

Answer

DeviceProcessEvents, ProcessCommandLine

Question 5

Your organization uses Microsoft Purview Data Loss Prevention (DLP) policies. You need to investigate an incident where sensitive data was shared externally. You want to view the details in Microsoft Sentinel. What should you ensure is configured?

Accepted Answer

The Microsoft 365 data connector in Microsoft Sentinel is enabled and configured to collect DLP alerts.. Microsoft Sentinel's Microsoft 365 data connector ingests unified audit logs from Microsoft Purview, including DLP alerts. When this connector is enabled and configured to collect DLP alerts, Sentinel can receive and surface the incident details, allowing investigation of externally shared sensitive data. Without this connector, DLP events remain in the Purview compliance portal and are not forwarded to Sentinel.

Answer

The SharePoint site is configured for external sharing.

Answer

The DLP policy must be set to 'Audit only' mode.

Answer

The unified audit log is enabled and the DLP events are being generated.

Question 6

Your organization uses Microsoft Sentinel. An incident is created for a possible data exfiltration via an unapproved external IP address. Which type of Microsoft Sentinel automation should you use to automatically block the IP address in the firewall?

Accepted Answer

Playbook.. Playbooks in Microsoft Sentinel are automated workflows based on Azure Logic Apps that can perform response actions, such as blocking an IP address in a firewall. When an incident indicates data exfiltration via an unapproved external IP, a playbook can be triggered automatically or manually to execute the block action via integration with firewall APIs or management tools.

Answer

Data connector.

Answer

Analytics rule.

Answer

Watchlist.

Question 7

Your organization uses Microsoft Sentinel and has several analytics rules that generate incidents from various data sources. The SOC team is overwhelmed by the number of incidents. You need to implement a triage system that automatically assigns incidents to different analysts based on the incident's tactics and severity. You also want to send a notification to the assigned analyst via Teams. What should you do?

Accepted Answer

Create multiple automation rules that trigger on incident creation, each with conditions for specific tactics and severity, and then run a playbook that assigns the incident to an analyst and sends a Teams notification.. Automation rules in Microsoft Sentinel trigger on incident creation and support conditions based on incident properties such as tactics and severity, and they can invoke a playbook. Creating multiple automation rules with tactic/severity conditions that each run an assignment-and-notification playbook delivers the required automatic triage and Teams alerting. This is the native, supported pattern for conditional incident routing.

Answer

Use a workbook to create a triage dashboard and instruct analysts to manually claim incidents from the dashboard.

Answer

Modify each analytics rule to include a custom details field that specifies the analyst, and use a playbook to send Teams notification based on that field.

Answer

Create a single playbook that checks the incident's tactics and severity, assigns it to the appropriate analyst, and sends a Teams notification, then configure that playbook to run automatically on all new incidents.

Question 8

Your organization uses Microsoft Defender XDR. You need to configure automatic attack disruption for identity-related threats. The solution should automatically contain a compromised user by disabling their account. Which setting should you enable?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Add a condition to exclude processes signed by trusted certificates or from known IT admin accounts.. Adding a condition to exclude processes signed by trusted certificates or from known IT admin accounts directly reduces false positives by filtering out legitimate administrative activity. Custom detection rules in Microsoft Defender XDR allow you to refine queries with additional conditions, such as excluding specific signers or accounts, which preserves detection of malicious PowerShell commands while ignoring benign ones.

Answer

Disable the rule and create a new rule with a different MITRE technique.

Answer

Increase the lookback period from 7 to 30 days.

Answer

Modify the rule to set the severity to 'Informational'.

Question 9

Your Microsoft Sentinel workspace is ingesting data from multiple sources. You need to ensure that data from a specific source is retained for 2 years while other data remains at the default retention. What should you do?

Accepted Answer

Create a custom table for that source and set its retention to 2 years.. In Microsoft Sentinel, retention is set at the table level. By creating a custom table for the specific data source and configuring its retention period to 2 years, you can override the default workspace retention for that table only. This allows other tables to retain the default retention setting while the custom table retains data for the required duration.

Answer

Adjust the data ingestion settings for that source.

Answer

Set the workspace retention to 2 years.

Answer

Configure archiving for that source's data.

Question 10

Your organization uses Microsoft Sentinel. You need to design a solution to automatically respond to a specific type of incident by sending an email to the SOC manager and creating a ticket in ServiceNow. What should you use?

Accepted Answer

Create a playbook in Microsoft Sentinel and trigger it with an automation rule.. Microsoft Sentinel uses Azure Logic Apps-based playbooks to execute complex, multi-step automated responses, such as sending an email and creating a ServiceNow ticket. An automation rule is required to trigger the playbook when an incident meets specific criteria, as analytics rules alone cannot directly invoke external systems like ServiceNow.

Answer

Create an analytics rule that directly sends an email.

Answer

Create a workbook that triggers a webhook.

Answer

Create an automation rule that sends an email and creates a ticket.