SC-200 Practice Test 42 — 15 Questions

Question 1

Which THREE components are required to enable automation in Microsoft Sentinel? (Choose three.)

Accepted Answer

Playbooks based on Azure Logic Apps. Playbooks based on Azure Logic Apps are required because they provide the workflow automation engine that executes response actions in Microsoft Sentinel. Without a Logic Apps resource to define the steps (e.g., triggers, conditions, and actions), there is no executable automation to run when an incident or alert is generated.

Answer

Microsoft Power Automate license

Answer

Microsoft Entra ID P2 license

Question 2

You are a security operations analyst for a company that uses Microsoft Sentinel. You need to ensure that incidents are automatically assigned to the appropriate team based on the incident type. Which two actions should you take?

Accepted Answer

Define custom details in the analytics rule to include the team name, then use an automation rule to assign.. Custom details in an analytics rule allow you to extract and store the team name from the incident data, and then an automation rule can use that custom detail as a condition to automatically assign the incident to the appropriate owner. This approach ensures dynamic assignment based on the incident type without requiring a playbook or manual intervention.

Answer

Modify the analytics rule to set the incident owner directly.

Answer

Create a playbook that assigns incidents based on the incident type.

Answer

Create a workbook that filters incidents by type and assigns them manually.

Question 3

Your organization uses Microsoft Defender XDR. You need to delegate incident management tasks to a team of analysts without granting full global admin permissions. Which THREE roles in Microsoft 365 Defender should you assign?

Accepted Answer

Security Administrator. Security Administrator is correct because this role in Microsoft 365 Defender provides full access to incident management features, including the ability to investigate, respond to, and resolve incidents, while not granting full global admin permissions. It allows analysts to manage alerts, perform advanced hunting, and configure security settings within the Defender portal, making it suitable for delegated incident management tasks.

Answer

Security Analyst

Answer

Compliance Administrator

Question 4

Refer to the exhibit. You run the KQL query in Microsoft Sentinel to identify analysts with high incident assignments. The query returns no results, but you know incidents exist. What is the most likely reason?

Accepted Answer

Incidents are not assigned to any owner, so the Owner field is null. If incidents have no assigned owner, the Owner field is null. The KQL query likely filters or groups by Owner, and null values are excluded from results by default in aggregation operations like summarize. Since incidents exist but are unassigned, the query returns no results.

Answer

The summarize operator is incorrectly used

Answer

The SecurityIncident table does not exist

Answer

The query period is too short to capture incidents

Question 5

Your organization uses Microsoft Defender for Cloud Apps. You receive an alert about an impossible travel activity for a user. What is the best first step to validate if this is a true positive?

Accepted Answer

Review the user's sign-in logs in Microsoft Entra ID. Impossible travel alerts in Microsoft Defender for Cloud Apps are generated based on sign-in activity and user location data. The most direct way to validate whether the alert is a true positive is to review the user's sign-in logs in Microsoft Entra ID (formerly Azure AD), which provides detailed information about each sign-in attempt, including IP addresses, locations, timestamps, and authentication details. This allows you to confirm whether the two sign-ins occurred within an unrealistic time frame for the geographic distance, or if there are anomalies such as VPN usage or IP spoofing that indicate a false positive.

Answer

Block the user immediately

Answer

Run an advanced hunting query in Microsoft Sentinel

Answer

Contact the user's manager

Answer

Check the user's device compliance in Microsoft Intune

Question 6

In Microsoft 365 Defender, a security analyst wants to get a detailed report on a newly discovered malware campaign, including indicators of compromise, recommended actions, and impacted devices. Where should the analyst go to find this information?

Accepted Answer

Threat analytics. Threat analytics in Microsoft 365 Defender provides detailed reports on active malware campaigns, including indicators of compromise (IoCs), recommended actions, and impacted devices. This is the dedicated workspace for tracking and responding to emerging threats, offering curated intelligence from Microsoft security researchers.

Answer

Alerts queue

Answer

Incident page

Answer

Action center

Question 7

Which TWO actions should you take when responding to a confirmed ransomware incident in Microsoft Defender XDR?

Accepted Answer

Run a full antivirus scan. Running a full antivirus scan (Option A) is a critical containment and remediation step in a confirmed ransomware incident because it detects and removes malicious files, including ransomware binaries and associated artifacts, from affected devices. In Microsoft Defender XDR, a full scan leverages the Microsoft Defender Antivirus engine to inspect all files and running processes, ensuring that the ransomware payload is eliminated from the system. This action helps prevent further encryption or lateral movement by the malware.

Answer

Reset the user's password

Answer

Restore files from backup

Answer

Disable the user account

Question 8

Which TWO data connectors are available in Microsoft Sentinel to ingest data from Microsoft 365 services?

Accepted Answer

Microsoft Entra ID. Microsoft Entra ID (formerly Azure Active Directory) is a correct data connector because it ingests sign-in logs, audit logs, and provisioning events from Microsoft's identity service into Microsoft Sentinel. This connector uses the Microsoft Graph API to pull identity-related telemetry, which is essential for monitoring authentication anomalies and privilege escalation.

Answer

Azure Active Directory

Answer

Microsoft Defender for Cloud

Answer

Amazon Web Services

Question 9

Which TWO are legitimate sources of threat intelligence that can be ingested into Microsoft Sentinel?

Accepted Answer

STIX/TAXII threat intelligence feeds. A is correct because STIX/TAXII is an open-source standard for sharing cyber threat intelligence (CTI). Microsoft Sentinel can ingest threat indicators from any TAXII 2.0 or 2.1 server using the built-in Threat Intelligence - TAXII data connector, allowing organizations to consume structured threat feeds (e.g., from MITRE ATT&CK or third-party providers) directly into Sentinel for correlation and alerting.

Answer

Exchange Online Protection

Answer

Microsoft Intune

Answer

Microsoft Purview Compliance Manager

Question 10

You are investigating a security incident involving a compromised user account. The attacker used the account to access sensitive data in SharePoint Online. Which TWO actions should you take to remediate the incident? (Choose two.)

Accepted Answer

Revoke all refresh tokens for the user.. Option B is correct because revoking all refresh tokens for the compromised user immediately invalidates the OAuth 2.0 refresh tokens that the attacker could use to silently obtain new access tokens for SharePoint Online and other Microsoft 365 resources, cutting off their persistent access. Option C is correct because disabling the user account in Microsoft Entra ID blocks any further authentication attempts with that identity, preventing the attacker from signing in again while the incident is contained. Option A is not the best remediation action here because resetting the password alone does not invalidate existing refresh tokens, so the attacker could retain access until those tokens expire. Option D is a detection/investigation step rather than a remediation action, and Option E is a preventive control that does not immediately stop an active compromise.

Answer

Reset the user's password.

Answer

Review the sign-in logs to determine the extent of the breach.

Answer

Create a Conditional Access policy to require MFA for the user.

Question 11

Which TWO actions can a Microsoft Sentinel automation rule perform when an incident is created?

Accepted Answer

Run a playbook. Microsoft Sentinel automation rules can trigger actions when an incident is created, including running a playbook (Option C) and changing the incident severity (Option D). Playbooks are automated workflows based on Azure Logic Apps that can perform complex response actions, while severity changes allow dynamic triage based on incident properties.

Answer

Create a new analytics rule

Answer

Query Log Analytics workspaces

Answer

Ingest data from a new source

Question 12

Which TWO actions are appropriate when responding to a confirmed data exfiltration incident via email?

Accepted Answer

Block the recipient domain on the email gateway. Blocking the recipient domain on the email gateway (A) is appropriate because it immediately prevents further data exfiltration to that external domain by rejecting all outbound emails to that domain at the transport layer. Placing a legal hold on the user's mailbox (B) preserves all mailbox content, including deleted items, as an immutable copy for forensic investigation and potential legal proceedings, ensuring evidence is not lost during the incident response.

Answer

Disable the user's account immediately

Answer

Delete all sent items from the user's mailbox

Answer

Run a full antivirus scan on the user's device

Question 13

Your security operations team receives an alert from Microsoft Sentinel about a suspicious sign-in from an unfamiliar IP address. You need to investigate the alert by correlating it with user activity and device information. Which data sources should you query first?

Accepted Answer

Microsoft Entra ID sign-in logs and Microsoft Defender for Endpoint device events. Investigating a suspicious sign-in requires correlating the sign-in event with user activity and device context. Microsoft Entra ID sign-in logs provide the authentication details (IP address, timestamp, user), while Microsoft Defender for Endpoint device events supply device-level telemetry (processes, network connections, logged-on users). This combination directly enables the correlation needed to validate whether the sign-in was legitimate or malicious.

Answer

Microsoft Purview audit logs and Microsoft Intune device compliance

Answer

Microsoft 365 Defender alerts and Microsoft Sentinel incidents

Answer

Azure Activity Logs and Azure Firewall logs

Question 14

Which TWO actions should you take to improve the performance of Microsoft Sentinel analytics rules that query large datasets?

Accepted Answer

Use a time filter in the query to limit the data range.. Applying a time filter (e.g., using the `TimeGenerated` column) in a KQL query restricts the dataset to only the relevant time window, which significantly reduces the amount of data scanned by Microsoft Sentinel. This directly improves query performance by minimizing I/O and processing overhead, especially when analytics rules run against large log tables.

Answer

Use a watchlist to pre-filter results.

Answer

Change the data type of the columns to string.

Answer

Simplify the event by removing unused columns using project.

Question 15

A threat hunter is using Microsoft Sentinel to hunt for a potential advanced persistent threat (APT) that is using living-off-the-land binaries (LOLBins). The hunter creates a KQL query that lists all instances of certutil.exe making network connections. The query returns many legitimate results. What is the best way to reduce false positives while still detecting malicious use?

Accepted Answer

Add additional filters to the query to detect only certutil.exe processes with suspicious command-line arguments (e.g., '-urlcache' or '-split'). Malicious use of certutil.exe as a LOLBin often involves specific command-line arguments such as '-urlcache' or '-split' to download or encode data. By adding these filters to the KQL query, the hunter can reduce false positives from legitimate certutil.exe network connections while still capturing suspicious activity. Option A (Sysmon Event ID 3) still returns all network connections and does not filter on arguments, so it does not reduce false positives. Option B would miss potential threats. Option C expands the query to include all LOLBins, which increases noise and does not target the specific binary in question.

Answer

Replace the query with a Sysmon Event ID 3 (network connect) filter for certutil.exe

Answer

Remove certutil.exe from the hunting query and focus on other binaries

Answer

Expand the query to include all LOLBins that make network connections