SC-200 Practice Test 43 — 15 Questions

Question 1

You are a security analyst at a company that uses Microsoft Sentinel. You need to create a custom analytics rule that detects failed logon attempts from multiple IP addresses within 5 minutes. Which two KQL operators should you use?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

bin. The `bin` operator is correct because it groups timestamps into fixed-size time buckets (e.g., 5-minute intervals), which is essential for detecting patterns like failed logon attempts from multiple IPs within a specific time window. The `summarize` operator is correct because it aggregates data (e.g., counting distinct IP addresses) per each time bucket, enabling the rule to identify when the count exceeds a threshold.

Answer

where

Answer

project

Answer

join

Question 2

Refer to the exhibit. An analyst runs Get-MpThreat on a device. Based on the output, what is the status of the threat?

Accepted Answer

The threat was blocked and did not execute.. The output of Get-MpThreat shows the threat's state as 'Blocked' and its execution status as 'Not Executed'. This indicates that Microsoft Defender Antivirus successfully prevented the threat from running on the device. Therefore, the threat was blocked and did not execute, making D the correct answer.

Answer

The threat executed and is now inactive.

Answer

The threat was quarantined and is still active.

Answer

The threat is currently active on the device.

Question 3

Refer to the exhibit. A security analyst runs this PowerShell script to query a Log Analytics workspace. What is the purpose of this query?

Accepted Answer

Detect suspicious PowerShell activity using encoded commands. The PowerShell script uses the `| where {$_ -match 'powershell.*-enc'} ` filter to search for command lines containing 'powershell' followed by '-enc', which is the alias for the `-EncodedCommand` parameter. This parameter is commonly used by attackers to obfuscate malicious PowerShell commands by passing them as a Base64-encoded string. The query is specifically designed to detect suspicious PowerShell executions that use encoded commands, making option D correct.

Answer

Count the number of unique devices

Answer

Identify all PowerShell executions in the last 7 days

Answer

List all processes run by a specific account

Answer

Find devices that have not run PowerShell recently

Question 4

Which TWO actions can be performed using Microsoft Sentinel automation rules? (Select TWO.)

Accepted Answer

Assign an incident to a specific SOC analyst. Automation rules in Microsoft Sentinel allow you to automate incident management tasks, such as assigning incidents to specific SOC analysts based on criteria like severity or type. This is a core capability of automation rules, which can set the owner of an incident to a specific user or group, enabling efficient triage and accountability.

Answer

Modify a data connector's configuration

Answer

Create a new analytics rule

Answer

Create a new watchlist

Question 5

Which THREE actions are appropriate when investigating a potential data exfiltration incident in Microsoft Defender for Cloud Apps?

Accepted Answer

Use the app dashboard to view unusual behavior alerts. Options B, D, and E are correct. Option B: Using the app dashboard to view unusual behavior alerts provides context about potential exfiltration. Option D: Checking file policy matches helps identify which files were flagged as suspicious. Option E: Reviewing the user's activity log in Defender for Cloud Apps helps determine the scope of the exfiltration. Option A is incorrect because checking device inventory is not a cloud app investigation action—it applies to endpoint devices. Option C is incorrect because suspending the user's account is a containment action, not an investigative step.

Answer

Check the device inventory for suspicious applications

Answer

Suspend the user's account immediately

Question 6

Which TWO of the following are required to enable Microsoft Sentinel UEBA (User and Entity Behavior Analytics)?

Accepted Answer

Enable UEBA in the Microsoft Sentinel workspace settings.. UEBA must be explicitly enabled in the Microsoft Sentinel workspace settings under the 'Entity behavior analytics' blade. This activation allows Sentinel to start profiling user and entity behaviors using built-in machine learning models. Without this toggle, UEBA remains disabled regardless of other configurations.

Answer

Integrate Microsoft Defender for Cloud Apps.

Answer

Purchase a separate UEBA license.

Answer

Configure Azure Key Vault to store UEBA data.

Question 7

Which THREE components are required to ingest Microsoft Entra ID (Azure AD) audit logs into Microsoft Sentinel?

Accepted Answer

A user account with Security Administrator or Global Administrator role to configure the connector.. Configuring the Microsoft Entra ID (Azure AD) data connector in Microsoft Sentinel requires a user account with at least the Security Administrator role (or Global Administrator) to grant the necessary permissions for the connector to read audit logs and sign-in logs from Microsoft Entra ID via the Microsoft Graph API. Without this role, the connector cannot authenticate and retrieve the required data.

Answer

A Log Analytics workspace in the same region as Microsoft Entra ID.

Answer

A playbook to parse the audit logs.

Question 8

Which THREE of the following are valid components of Microsoft Defender XDR? (Select three.)

Accepted Answer

Microsoft Defender for Endpoint. Microsoft Defender XDR is a unified security operations platform that integrates signals from multiple Microsoft security products. Microsoft Defender for Endpoint provides endpoint detection and response (EDR) capabilities, including behavioral-based detection and automated investigation. It is a core component of the XDR solution, enabling cross-domain correlation of alerts from endpoints.

Answer

Microsoft Purview

Answer

Microsoft Sentinel

Question 9

Which THREE of the following are valid incident management capabilities in Microsoft Sentinel? (Choose three.)

Accepted Answer

Assign incidents to analysts or teams. A is correct because Microsoft Sentinel allows incident owners to be assigned directly to an analyst or a team via the 'Owner' field in the incident details pane. This assignment is used for tracking responsibility, SLA enforcement, and escalation workflows within the Security Operations (SecOps) lifecycle.

Answer

Create playbooks to automate incident response

Answer

Create workbooks to visualize incident trends

Question 10

Your organization is implementing Microsoft Sentinel and needs to ensure that incident response activities are compliant with regulatory requirements. You need to track and document all changes made to analytics rules and playbooks. Which TWO features should you enable?

Accepted Answer

Activity logs (Azure Monitor). Activity logs (Azure Monitor) record all management-plane operations, including changes to analytics rules and playbooks, while Azure Resource Change History (Change tracking) captures resource-level modifications. Together they provide comprehensive audit trails for regulatory compliance. Workbooks (A) are for visualization, Automation rules (B) trigger responses but don't log changes themselves, and Microsoft Purview (E) is for broader data governance, not operational change tracking.

Answer

Sentinel workbooks

Answer

Automation rules

Answer

Microsoft Purview Compliance Manager

Question 11

Which TWO roles in Microsoft Entra ID can manage Microsoft Defender for Cloud Apps? (Select two.)

Accepted Answer

Security Administrator. The Security Administrator role in Microsoft Entra ID has the necessary permissions to manage Microsoft Defender for Cloud Apps, including configuring policies, investigating alerts, and managing app permissions. This role is specifically designed for security-related tasks within Microsoft 365 security products, making it a correct choice for managing Defender for Cloud Apps.

Answer

Compliance Administrator

Answer

Security Reader

Answer

Application Administrator

Question 12

Which TWO actions are valid ways to reduce the number of false positive incidents in Microsoft Sentinel without disabling analytics rules?

Accepted Answer

Modify the rule's query to include additional filters.. Modifying the rule's query to include additional filters directly reduces false positives by narrowing the conditions that trigger an alert. This approach refines the detection logic without disabling the rule, ensuring only events that more precisely match the intended threat pattern generate incidents.

Answer

Configure the rule to group all alerts into a single incident per entity.

Answer

Increase the rule run frequency.

Answer

Change the incident severity to Informational.

Question 13

During an incident response, you need to collect forensic evidence from a compromised Azure virtual machine that is currently offline. What is the most efficient method to acquire a disk snapshot for analysis while preserving the integrity of the evidence?

Accepted Answer

Create a snapshot of the OS disk from the Azure portal. Exporting a disk via AzCopy is not the most efficient forensic-sound method here because it requires first generating a SAS URL for the disk (e.g., via Grant-AzDiskAccess), which typically means the disk should not be attached to a running VM — the opposite of what this option implies. Even done correctly, going straight to an AzCopy export skips the read-only, platform-level point-in-time snapshot step, so any error or interruption during export risks touching the original disk. Taking a snapshot first (option B) is safer and is the standard first step; the snapshot can subsequently be exported with AzCopy for offline analysis if needed.

Answer

Attach a new data disk and copy the contents manually

Answer

Start the VM and use Azure Backup to take a backup

Answer

Export the disk to a storage account using AzCopy

Question 14

A threat hunter is investigating a potential malware outbreak in Microsoft Defender for Cloud Apps. The hunter notices that multiple users have installed a new app with high permissions that accesses their email. The app was not requested by IT. What is the most effective way to hunt for all instances of this app across the organization?

Accepted Answer

Use the Cloud App Security activity log to search for 'Install app' events and then review the 'App governance' dashboard for all instances. The activity log in Cloud App Security provides a comprehensive record of app installation events, and the App Governance dashboard aggregates all instances for review, making it the most effective hunting approach. Option A (conditional access policies) is reactive and not suitable for proactive hunting. Option B (Microsoft 365 Defender alerts) only surfaces known malicious apps, not all instances. Option C (CloudAppEvents table and AppGovernance) can be used, but the activity log is more direct and complete for hunting all installations, as CloudAppEvents may not capture every installation event or may require complex queries.

Answer

Review Conditional Access app control policies for any block rules

Answer

Check Microsoft 365 Defender alerts for malicious OAuth apps

Answer

Query the Microsoft 365 Defender advanced hunting table 'CloudAppEvents' for app installation events and then use 'AppGovernance' to list all apps

Question 15

Which TWO actions should you take to reduce the cost of Microsoft Sentinel while maintaining security coverage?

Accepted Answer

Reduce the retention period of tables that do not require long-term storage.. Reducing the retention period for tables that do not require long-term storage directly lowers the data storage costs in Microsoft Sentinel. Sentinel charges per GB of data stored, and by shortening retention (e.g., from 90 days to 30 days) for non-critical tables, you reduce the volume of data retained without affecting security monitoring or incident investigation for the shortened period.

Answer

Remove data connectors for non-critical sources.

Answer

Disable analytics rules that generate low-severity incidents.

Answer

Switch the workspace pricing tier from Capacity Reservations to Pay-as-you-Go.