SC-200 Practice Test 43 — 15 Questions

Question 1

Your organization uses Microsoft Defender XDR for threat detection and response. The security team wants to automatically isolate a compromised device when a specific malware alert is triggered, but only if the device is not a critical server. What is the most efficient way to achieve this?

Accepted Answer

Configure an automation rule in Microsoft Defender XDR. Option D is correct because automation rules in Microsoft Defender XDR allow you to set conditions (e.g., device group, alert title) and trigger automated actions like device isolation. This is the most efficient method as it doesn't require custom scripting or playbooks. Option A is wrong because custom detection rules can generate alerts but not trigger isolation directly. Option B is wrong because you can't use PowerShell directly within Microsoft Defender XDR without a playbook. Option C is wrong because advanced hunting is a query tool, not for automated response.

Answer

Use advanced hunting to find devices and then manually isolate

Answer

Use PowerShell scripts in a playbook

Answer

Create a custom detection rule

Question 2

Your organization has Microsoft Sentinel deployed across multiple workspaces for different business units. The security team wants to view a unified incident queue across all workspaces. What should you implement?

Accepted Answer

Create cross-workspace queries and use the incident view with workspace references. Option C is correct because Microsoft Sentinel provides cross-workspace querying and incident management through the use of workspace references in analytics rules and the incidents blade. Option A is wrong because unified incident management is not natively supported in a single workspace; you need to configure cross-workspace views. Option B is wrong because Azure Lighthouse enables management across tenants but not necessarily unified incident queue. Option D is wrong because Microsoft Defender XDR is a separate portal.

Answer

Use Microsoft Defender XDR portal to view all incidents

Answer

Use Azure Lighthouse to manage multiple workspaces

Answer

Configure a single workspace to receive all incidents

Question 3

Your security team needs to assign a custom role in Microsoft Sentinel that allows read and write access to incidents but not to analytics rules. Which built-in role should you use as a base for the custom role?

Accepted Answer

Microsoft Sentinel Responder. The Microsoft Sentinel Responder role has read and write access to incidents and read access to other data, but not write access to analytics rules. Option A is wrong because Microsoft Sentinel Contributor has full access including analytics rules. Option C is wrong because Microsoft Sentinel Reader is read-only. Option D is wrong because Global Administrator is too broad.

Answer

Microsoft Sentinel Reader

Answer

Microsoft Sentinel Contributor

Answer

Global Administrator

Question 4

Your SOC team uses Microsoft Sentinel's UEBA to detect insider threats. You want to ensure that UEBA can correlate activities across multiple data sources. Which data source must be enabled for UEBA to function properly?

Accepted Answer

Microsoft Entra ID audit logs. Microsoft Entra ID (formerly Azure AD) audit logs provide identity context that is essential for UEBA to correlate user activities. Option B is wrong because Azure Activity logs provide resource-level operations. Option C is wrong because Windows Security Events alone lack identity correlation. Option D is wrong because Office 365 audit logs are useful but not the core requirement.

Answer

Azure Activity logs

Answer

Office 365 audit logs

Answer

Windows Security Events

Question 5

Your organization has deployed Microsoft Defender XDR and Microsoft Sentinel in a hybrid environment. You need to ensure that incidents from Microsoft Defender for Endpoint are synchronized to Microsoft Sentinel with full alert details. You have already connected the Microsoft Defender XDR connector. What additional step must you take?

Accepted Answer

In the Microsoft Defender XDR connector, enable 'Microsoft 365 Defender incident creation'.. Option D is correct because the Microsoft Defender XDR connector streams incidents but not all alert details; enabling Microsoft 365 Defender incident creation is required for full synchronization. Option A is wrong because the connector is already set up. Option B is wrong because data connectors don't need bi-directional sync for incidents. Option C is wrong because the API connector is unnecessary if the main connector is enabled.

Answer

Enable the Microsoft Defender for Endpoint API connector in Microsoft Sentinel.

Answer

Configure a bi-directional sync between Microsoft Sentinel and Microsoft Defender XDR.

Answer

No additional steps are required; the connector automatically syncs all incident details.

Question 6

You are reviewing an automation rule ARM template for Microsoft Sentinel. What is the result of deploying this automation rule?

Accepted Answer

When a High severity incident is created, the rule changes its severity to Medium and assigns it to SOC-Tier2.. Option C is correct because the trigger condition is 'Severity Equals High', and the action sets severity to 'Medium' and assigns to SOC-Tier2. So a high-severity incident is created, then changed to medium and assigned. Option A is wrong because it triggers on creation, not on update. Option B is wrong because the action modifies severity. Option D is wrong because the action does assign an owner.

Answer

The rule assigns the incident to SOC-Tier2 only if the severity is Medium.

Answer

The rule triggers when an incident is updated and resets the severity to High.

Answer

The rule triggers when a High severity incident is created but does not change the severity.

Question 7

You are configuring a Microsoft Sentinel analytics rule to detect brute-force attacks on your Azure Virtual Machines. The rule uses the 'SecurityEvent' table. You notice that the rule is not generating incidents even though you see failed logon events in the logs. What should you check?

Accepted Answer

The analytics rule is enabled and the query is correctly filtering for event ID 4625.. Option A is correct because the 'SecurityEvent' table collects Windows security events, but the event ID for failed logon (4625) must be included in the query and the rule must be enabled. If the rule is not enabled, it won't generate incidents. Option B is about data source configuration, but the table is already populated. Option C is about retention, not detection. Option D is about automation rules, not analytics rules.

Answer

An automation rule is suppressing incidents with the same name.

Answer

The workspace retention period is set to less than 90 days.

Answer

The Log Analytics agent is not installed on the VMs.

Question 8

You have a Microsoft Sentinel workspace that ingests logs from multiple sources. The log analytics workspace is in the East US region. You have a requirement to keep logs for 90 days for active investigation, then archive them to an Azure storage account for compliance for 5 years. What should you configure?

Accepted Answer

Set the retention period to 90 days and configure a data export rule to send logs older than 90 days to Azure Blob Storage. Option C is correct because Azure Log Analytics allows you to set a retention policy and then enable data archiving to Azure storage using a data export rule. Option A deletes logs after 90 days. Option B is for interactive retention only. Option D is for diagnostic settings, not for archiving after retention.

Answer

Set the retention period to 5 years and use purging for data older than 90 days

Answer

Set the retention period to 90 days and enable 'Archive' in the workspace retention settings

Answer

Configure diagnostic settings to send logs to storage with a retention of 90 days

Question 9

Your organization uses Microsoft Sentinel and has multiple workspaces for different regions. The security team wants to use a single workbook to display data from all workspaces. What is the correct approach?

Accepted Answer

Create a workbook with cross-workspace queries using the workspace() expression. Option D is correct because you can create a workbook with cross-workspace queries using the workspace() expression to query multiple workspaces. Option A is wrong because workbooks can query multiple workspaces without merging. Option B is wrong because you don't need to export data. Option C is wrong because a single workbook can handle multiple workspaces via cross-workspace queries.

Answer

Export data from all workspaces to a single Azure Data Lake

Answer

Create a workbook in one workspace and configure it to use Azure Lighthouse

Answer

Create a workbook in each workspace and merge them manually

Question 10

Your organization uses Microsoft Defender for Cloud to monitor hybrid workloads. You need to ensure that security alerts from on-premises servers are sent to Microsoft Sentinel. What should you configure?

Accepted Answer

Connect the on-premises servers to Azure Arc and deploy the Log Analytics agent.. Azure Arc enables on-premises servers to be managed as Azure resources and to install the Log Analytics agent, forwarding logs to Sentinel. Option A is wrong because Azure Policy can enforce configurations but does not directly send alerts. Option C is wrong because a third-party SIEM would bypass Sentinel. Option D is wrong because a VPN does not solve log ingestion.

Answer

Install a third-party SIEM connector on the servers and forward logs to Sentinel.

Answer

Deploy Azure Policy on the servers to audit security settings.

Answer

Configure a site-to-site VPN to Azure and enable network logging.

Question 11

Which TWO data connectors are available in Microsoft Sentinel to ingest data from Microsoft 365 services?

Accepted Answer

Microsoft Entra ID. Office 365 and Microsoft Entra ID connectors are native to Sentinel. Amazon Web Services is for AWS, Azure Active Directory is the old name, and Microsoft Defender for Cloud is a separate product.

Answer

Azure Active Directory

Answer

Microsoft Defender for Cloud

Answer

Amazon Web Services

Question 12

Your SOC team receives a high-priority incident related to a potential malware outbreak. You need to quickly identify all affected devices and users across the environment. What Microsoft Defender XDR feature should you use?

Accepted Answer

Incident graph. Option B is correct because the incident graph visually maps the relationships between alerts, devices, users, and entities. Option A is wrong because advanced hunting is query-based and slower for immediate triage. Option C is wrong because action center is for remediation actions. Option D is wrong because a workbook is for reporting.

Answer

Advanced hunting

Answer

Action center

Answer

Microsoft Sentinel workbook

Question 13

Your organization uses Microsoft Defender XDR. You need to ensure that when a user reports a phishing email using the built-in Outlook add-in, the incident is automatically created in Microsoft Sentinel with high severity and a custom tag 'Phishing-Reported'. What is the most efficient way to achieve this?

Accepted Answer

Configure the 'User-reported phishing' policy in Microsoft Defender XDR to create an incident in Microsoft Sentinel with high severity and the tag.. Option A is correct because Microsoft Defender XDR has a built-in automation for user-reported phishing that can create incidents. You can configure the policy to set severity and add tags. Option B requires custom development. Option C is an alternative but less integrated. Option D is wrong because automation rules in Sentinel trigger on existing incidents, not on email reports directly.

Answer

Set up an automation rule in Microsoft Sentinel to tag incidents from 'Microsoft Defender' connector with the tag when severity is high.

Answer

Create a Power Automate flow that reads from the unified audit log and creates a Sentinel incident via API.

Answer

Use a playbook triggered by a Microsoft Sentinel analytics rule that monitors for 'PhishDeliver' events.

Question 14

Your organization uses Microsoft Sentinel and Microsoft Defender for Cloud. You need to ensure that security incidents from Defender for Cloud are automatically sent to Sentinel. What should you configure?

Accepted Answer

Configure the Microsoft Defender for Cloud data connector. The data connector 'Microsoft Defender for Cloud' (formerly Azure Security Center) in Sentinel enables continuous ingestion of alerts and incidents. Option B is correct. Option A is a legacy connector for Azure Active Directory (now Entra ID). Option C is for Microsoft 365 Defender. Option D is a custom connector that requires extra setup.

Answer

Configure the Azure Active Directory data connector

Answer

Create an Azure Event Hub and push Defender for Cloud alerts to Sentinel via a custom connector

Answer

Configure the Microsoft 365 Defender data connector

Question 15

Which THREE actions can you perform using Microsoft Sentinel automation rules?

Accepted Answer

Run a playbook. Correct options are A, B, and D. Automation rules can change incident severity, assign incidents, and run playbooks. Option C is done by analytics rule templates, not automation rules. Option E is done by threat intelligence indicators.

Answer

Create a new analytics rule

Answer

Add threat intelligence indicators to Sentinel