SC-200 Practice Test 42 — 15 Questions

Question 1

You are a security analyst. You notice that Microsoft Sentinel is not receiving logs from Microsoft 365 Defender incidents. The diagnostic settings in Microsoft 365 Defender are configured to send data to the Sentinel workspace. What should you check first?

Accepted Answer

Ensure the Microsoft 365 Defender data connector in Microsoft Sentinel is enabled.. Option C is correct because the Microsoft Sentinel data connector for Microsoft 365 Defender must be enabled to ingest the incidents. Options A and B are irrelevant for data ingestion. Option D is for table schema, not ingestion.

Answer

Check if the Microsoft Sentinel solution is installed.

Answer

Verify that the Log Analytics workspace is in the same region as the Sentinel workspace.

Answer

Check the 'SecurityIncident' table schema for missing columns.

Question 2

A junior security analyst reports that they cannot create a new analytics rule in Microsoft Sentinel. They have the 'Microsoft Sentinel Contributor' role on the workspace. What could be the issue?

Accepted Answer

The workspace is in a locked resource group preventing modifications.. Option B is correct because custom roles can be restrictive. Option A is not a common requirement. Option C is incorrect because Contributor can create rules. Option D is incorrect because the role is assigned on the workspace.

Answer

They need the 'Owner' role to create analytics rules.

Answer

They do not have the 'Microsoft Sentinel Responder' role.

Answer

They are assigned the role at the subscription level but not at the workspace level.

Question 3

The exhibit shows a Conditional Access policy configuration in Microsoft Entra ID. The policy is intended to require MFA and compliant device for all users accessing all applications from trusted locations. However, users are reporting that they are being prompted for MFA even when accessing from the office (which is a trusted location). What is the most likely issue?

Accepted Answer

The location condition should include 'All untrusted locations' and exclude 'All trusted locations'.. The policy includes 'All trusted locations' but the condition 'exclude' is set to 'All untrusted locations', which is redundant and may not be the issue. Actually, the problem might be that the condition 'locations' is misconfigured: 'include' should be 'All trusted locations' and 'exclude' should be left empty or set to something else. However, the correct answer is that the policy does not have a condition to 'Exclude' trusted locations? Wait, the policy is supposed to apply to trusted locations, but it includes 'All trusted locations' and excludes 'All untrusted locations', which means it applies only to trusted locations (since untrusted are excluded). The issue is that the policy is set to apply to all users and all applications, but the grant controls require MFA and compliant device. If the policy applies to trusted locations, users at the office (trusted) will get prompted. But the intent is to require MFA only from untrusted locations. So the policy should include untrusted locations, not trusted. Option A is correct because the location condition is inverted: it should include untrusted locations and exclude trusted ones. Option B is wrong because the grant controls are correct. Option C is wrong because the policy applies to all apps. Option D is wrong because the assignments seem fine.

Answer

The policy should target specific applications instead of 'All applications'.

Answer

The grant controls should be 'Require MFA' only, not 'Require compliant device'.

Answer

The policy should exclude the 'All Users' group and instead assign specific users.

Question 4

Your organization is using Microsoft Defender for Identity (MDI) and Microsoft Sentinel. The security team wants to correlate alerts from MDI with other data sources in Sentinel. What is the recommended approach?

Accepted Answer

Enable the Microsoft Defender for Identity data connector in Sentinel. Option B is correct because the MDI data connector ingests alerts into Sentinel for correlation with other data sources. Option A is wrong because manual export is not scalable. Option C is wrong because MDI does not directly integrate with Sentinel via API without a connector. Option D is wrong because playbooks are for response, not data ingestion.

Answer

Export MDI logs manually to Sentinel

Answer

Configure MDI to send syslog to Sentinel

Answer

Create a playbook to pull MDI alerts

Question 5

You are reviewing the ARM template snippet shown in the exhibit. What is the purpose of this template?

Accepted Answer

Create a saved search in a Log Analytics workspace. Option A is correct because the template creates a saved search (which is a query) in a Log Analytics workspace. Option B is wrong because it creates a saved search, not a workbook. Option C is wrong because it creates a saved search, not an analytics rule. Option D is wrong because it creates a saved search, not a data connector.

Answer

Create a workbook in Azure Monitor

Answer

Create an analytics rule in Microsoft Sentinel

Answer

Create a data connector in Microsoft Sentinel

Question 6

Your organization uses Microsoft Sentinel with multiple workspaces across different regions. You need to centrally manage all security incidents from a single pane of glass. The solution must allow analysts to investigate incidents across workspaces without switching contexts. What should you configure?

Accepted Answer

Use Azure Lighthouse to manage multiple workspaces and enable cross-workspace incident view in Microsoft Sentinel.. Option C is correct because Microsoft Sentinel's incident management supports cross-workspace views via Azure Lighthouse or unified incident management. Option A is for queries, not incident management. Option B is for data collection. Option D is for event management, not Sentinel.

Answer

Deploy Microsoft Sentinel in a single region and use Azure Arc to connect other workspaces.

Answer

Create a union query across workspaces using the workspace() expression.

Answer

Configure a single workspace and use diagnostic settings to send all logs to it.

Question 7

You are a SOC analyst investigating an incident where a user's credentials were used to access a sensitive SharePoint site from an unusual location. Microsoft Defender for Cloud Apps detected the activity as a suspicious sign-in. You need to create a detection rule that alerts whenever a user accesses SharePoint from a location not in the allowed list. What type of rule should you create in Microsoft Defender for Cloud Apps?

Accepted Answer

Activity policy.. Activity policies in Defender for Cloud Apps allow you to detect specific user activities that match criteria. Option B is correct. Option A is wrong because anomaly detection policies use machine learning to detect unusual patterns, not specific location-based checks. Option C is wrong because app discovery policies are for discovering shadow IT. Option D is wrong because session policies are for real-time session control, not detection.

Answer

App discovery policy.

Answer

Session policy.

Answer

Anomaly detection policy.

Question 8

You are reviewing the KQL query shown in the exhibit. What is the purpose of this query?

Accepted Answer

Identify high-severity alert names that occurred more than 10 times in the last 24 hours. Option C is correct because the query filters high-severity alerts in the last 24 hours, groups by AlertName, and returns names with more than 10 alerts. Option A is wrong because it counts alerts, not incidents. Option B is wrong because it counts by AlertName, not by time. Option D is wrong because it returns AlertName and AlertCount, not timestamps.

Answer

Count the number of high-severity alerts per hour

Answer

Return the timestamp of each high-severity alert

Answer

List all high-severity incidents in the last 24 hours

Question 9

Your organization uses Microsoft Defender for Cloud Apps. You need to create a policy that alerts when a user downloads more than 10 files from SharePoint in 5 minutes. What type of policy should you create?

Accepted Answer

Activity policy. An activity policy in Defender for Cloud Apps monitors specific user activities and can trigger alerts based on frequency thresholds. Option A is wrong because Anomaly detection policies use machine learning. Option C is wrong because Session policies control activities in real-time via proxy. Option D is wrong because App permissions policies manage OAuth apps.

Answer

App permissions policy

Answer

Session policy

Answer

Anomaly detection policy

Question 10

You are a security operations analyst. You need to ensure that when a suspicious sign-in is detected by Microsoft Entra ID Protection, an incident is automatically created in Microsoft Sentinel and assigned to the Tier 1 SOC team. What should you configure in Microsoft Sentinel?

Accepted Answer

Create an automation rule that triggers when an incident is created and sets the owner to the Tier 1 SOC group.. Option A is correct because automation rules trigger on incident creation and can assign ownership. Option B is wrong because playbooks are for complex automation, not simple assignment. Option C is wrong because analytics rules create incidents from raw data, not from existing alerts. Option D is wrong because UEBA is a behavioral detection feature, not incident assignment.

Answer

Create a playbook that is triggered by the Microsoft Entra ID Protection data connector.

Answer

Enable UEBA and configure role-based access control (RBAC).

Answer

Configure an analytics rule with a corresponding automation rule to assign the incident.

Question 11

Which TWO steps are necessary to configure Microsoft Sentinel to automatically disable a compromised user account in Microsoft Entra ID when a high-severity incident is created?

Accepted Answer

Create a playbook that uses the Microsoft Entra ID 'Disable user' action.. Option B is correct because a playbook with a Microsoft Entra ID action can disable the user. Option D is correct because an automation rule triggers the playbook when an incident is created. Option A is wrong because analytics rules create incidents but don't trigger remediation. Option C is wrong because the Microsoft Entra ID Protection connector is not required; the playbook can connect directly. Option E is wrong because the Microsoft Defender XDR connector is not needed for this scenario.

Answer

Enable the Microsoft Defender XDR connector.

Answer

Enable the Microsoft Entra ID Protection data connector.

Answer

Create an analytics rule that detects compromised user accounts.

Question 12

Your organization uses Microsoft Purview Data Loss Prevention (DLP) policies. You need to investigate an incident where sensitive data was shared externally. You want to view the details in Microsoft Sentinel. What should you ensure is configured?

Accepted Answer

The Microsoft 365 data connector in Microsoft Sentinel is enabled and configured to collect DLP alerts.. Option B is correct because Microsoft Purview DLP alerts can be ingested into Microsoft Sentinel via the Microsoft 365 connector (now part of Microsoft Defender XDR connector). Option A is for DLP policy management, not ingestion. Option C is for auditing. Option D is for internal sharing.

Answer

The SharePoint site is configured for external sharing.

Answer

The DLP policy must be set to 'Audit only' mode.

Answer

The unified audit log is enabled and the DLP events are being generated.

Question 13

Your organization uses Microsoft Sentinel and Microsoft Defender XDR. You want to use a Microsoft Copilot for Security to summarize an incident in Microsoft Defender XDR. What is the minimum role required?

Accepted Answer

Security Reader. Option A is correct because the Security Reader role can view incidents but not edit; Copilot for Security requires at least Security Reader to access incident data. Option B is overly permissive for just viewing summaries. Option C is for managing security settings. Option D is an Azure role, not a Microsoft 365 role.

Answer

Security Administrator

Answer

Reader

Answer

Global Administrator

Question 14

Your organization uses Microsoft Sentinel in a hybrid environment with on-premises servers and Azure VMs. You need to ensure that all Windows servers forward their security events to Sentinel. The security team wants to use Windows Security Events via AMA connector. Windows servers are not domain-joined and are managed by a third-party RMM tool. What is the most efficient way to deploy the AMA agent?

Accepted Answer

Onboard the servers to Azure Arc and deploy the AMA agent via policy or script.. Option B is correct because deploying via Azure Arc allows centralized management using Azure policies or scripts for non-domain-joined servers. Option A is wrong because GPO requires domain membership. Option C is wrong because Microsoft Intune typically manages Azure VMs, not on-premises non-domain-joined servers. Option D is wrong because manual installation is not efficient for multiple servers.

Answer

Use Group Policy Objects (GPO) to push the agent installation.

Answer

Use Microsoft Intune to deploy the AMA agent to all servers.

Answer

Manually install the agent on each server using the setup wizard.

Question 15

The exhibit shows a KQL query used in a Microsoft Sentinel analytics rule. The rule is intended to detect brute-force attacks by identifying IP addresses that have more than 10 failed sign-ins (result code 50057) followed by a successful sign-in (result code 0) within an hour. However, the rule is not triggering alerts even though you are confident such patterns exist. What is the most likely issue?

Accepted Answer

The query does not ensure the successful sign-in occurred after the failed attempts.. The query uses an inner join, which only returns IP addresses that have both failed and successful sign-ins. However, the join condition uses both UserPrincipalName and IPAddress. If the same IP address is used by multiple users, the join might still work. The more likely issue is that the query does not account for the fact that the successful sign-in might occur after the failed attempts, but the join does not enforce temporal order. However, the biggest problem is that the query uses `join kind=inner` which could be correct. Actually, the issue might be that the query uses `where ResultType == "0"` which is a string, but the actual value might be an integer. But in KQL, it should work. Another common issue is that the query might not be scheduled to run frequently enough to capture the pattern. But among the options, the most plausible is that the query does not ensure the successful sign-in happened after the failed attempts. Option D is correct. Option A is wrong because the time window is defined. Option B is wrong because the threshold is defined. Option C is wrong because the query does consider the same IP address.

Answer

The threshold is too high.

Answer

The time window is too short to capture the pattern.

Answer

The query does not consider the same IP address across different users.