SC-200 Practice Test 44 — 15 Questions

Question 1

During a ransomware incident, the security team needs to prevent the encryption of files while allowing the investigation to continue. Which feature in Microsoft Defender for Endpoint should be used to achieve this?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Controlled folder access.. Controlled folder access (CFA) blocks unauthorized applications from modifying files in protected folders, which is exactly what ransomware does. ASR rules are broader and may not target file encryption specifically. Device isolation disconnects the device from the network but stops the investigation. Custom detection rules are reactive.

Answer

Device isolation.

Answer

Attack surface reduction (ASR) rules.

Answer

Custom detection rules.

Question 2

A security operations center (SOC) analyst is investigating an incident involving a user who received a phishing email with a malicious macro. The analyst needs to determine if any other users received the same email. Which Microsoft 365 Defender feature should the analyst use?

Accepted Answer

Threat Explorer (Investigation). Threat Explorer in Microsoft 365 Defender allows hunting for email messages by sender, subject, or other attributes. Advanced Hunting is for raw queries; Email entity page shows one email; Alert queue filters by alert not email.

Answer

Advanced Hunting

Answer

Alert queue filtering

Answer

Email entity page

Question 3

A security analyst is performing threat hunting in Microsoft Sentinel and wants to identify anomalous outbound network connections from a compromised workstation. The analyst suspects that a beaconing pattern is present. Which KQL function is most appropriate to detect periodic beaconing behavior over time?

Accepted Answer

startofday(TimeGenerated). `startofday` groups timestamps by day, enabling analysts to count events per day and identify regular intervals characteristic of beaconing (e.g., daily connections). Option A is incorrect: `series_decompose` is used for time series decomposition (trend, seasonal, residual) but is not the most direct method for detecting periodic beaconing; it is more complex and typically used after aggregation. Option B is incorrect: `make_list` creates a list of values, not useful for periodicity detection. Option D is incorrect: `bin(TimeGenerated, 1h)` bins events into hourly buckets, which could detect beaconing at finer granularity, but daily beaconing is better suited to `startofday`; `bin` is not specifically for periodic pattern detection.

Answer

series_decompose(TimeGenerated)

Answer

make_list(TimeGenerated)

Answer

bin(TimeGenerated, 1h)

Question 4

A security analyst is using KQL in Microsoft Sentinel to hunt for potential data exfiltration by a user who has been sending unusually large amounts of data to an external IP address. Which KQL operator should the analyst use to identify the top source IP addresses and total bytes sent over the last 7 days?

Accepted Answer

... | summarize TotalBytes=sum(SentBytes) by SourceIP | top 10 by TotalBytes desc. To identify the top source IPs by total bytes sent over 7 days, the analyst needs to aggregate bytes per source IP and then rank them. `summarize TotalBytes=sum(SentBytes) by SourceIP | top 10 by TotalBytes desc` does exactly that: it sums SentBytes grouped by SourceIP and returns the top 10 by total bytes, which is the correct KQL pattern for this hunt.

Answer

... | where SentBytes > 1000000 | project SourceIP, SentBytes

Answer

... | extend TotalBytes=SentBytes | summarize count() by SourceIP

Answer

... | project SourceIP, SentBytes | sort by SentBytes desc

Question 5

Which TWO are valid incident classification categories in Microsoft Sentinel?

Accepted Answer

True positive. Microsoft Sentinel incidents are closed with one of THREE classification categories, not two: True Positive (reason: Suspicious activity), False Positive (reasons: Inaccurate data or Inaccurate alert logic), and Benign Positive (reason: Suspicious but expected — used when the detected activity is real but was expected/authorized, e.g., an approved penetration test or a known admin script). 'Unknown' and 'Informational' are not valid classification values; they are respectively an alert-severity-adjacent concept and a severity level, not part of the incident-closing classification field. Because 3 of the 5 options (A, C, E) are actually valid, the stem must also be changed from 'Select TWO' to 'Select THREE' when this question is corrected.

Answer

Benign positive

Answer

Unknown

Answer

Informational

Question 6

Your organization uses Microsoft Sentinel to monitor a hybrid environment consisting of on-premises servers and cloud workloads in Azure. As a threat hunter, you have been tasked with identifying potential lateral movement using pass-the-hash (PtH) attacks. You have enabled UEBA and connected Windows Event Logs, including Event ID 4624 (logon) and 4648 (explicit credentials). You need to create a hunting query that surfaces anomalous remote logons where the same account logon from a non-domain joined machine using NTLM authentication. Which KQL query should you use to start your hunt?

Accepted Answer

SecurityEvent | where EventID == 4624 and LogonType == 3 and LogonProcessName contains 'NTLM' | where TargetUserName !endswith '$' | where Computer !in (list of domain controllers) | project TimeGenerated, Account=TargetUserName, SourceWorkstation=WorkstationName, LogonProcessName. Filters for logon type 3 (network), NTLM authentication (LogonProcessName contains NTLM), and non-domain joined workstations (WorkstationName not in list of domain controllers). Option A misses PtH indicators; Option C incorrectly uses RDP logon type 10; Option D focuses on interactive logons.

Answer

SecurityEvent | where EventID == 4624 and AccountType == 'User' and LogonType == 3 | where IpAddress != '' | summarize count() by Account, IpAddress

Answer

SecurityEvent | where EventID == 4624 and LogonType == 2 and LogonProcessName contains 'NTLM' | project TimeGenerated, Account=TargetUserName

Answer

SecurityEvent | where EventID == 4624 and LogonType == 10 and AuthenticationPackageName == 'NTLM' | project TimeGenerated, Account=TargetUserName, SourceIP=IpAddress

Question 7

Refer to the exhibit. You have a Logic Apps playbook that triggers on Microsoft Sentinel alerts. The playbook is not posting messages to Teams. What is the most likely cause?

Accepted Answer

The playbook is using the wrong trigger type.. The playbook is triggered on Microsoft Sentinel alerts, but Logic Apps requires a specific trigger type to process these alerts correctly. The most likely cause is that the playbook uses a generic HTTP trigger instead of the 'Microsoft Sentinel Incident' or 'Microsoft Sentinel Alert' trigger, which is designed to parse the alert payload and provide the necessary context for downstream actions like posting to Teams. Without the correct trigger, the playbook may not receive the alert data or may fail to execute the Teams connector properly.

Answer

The Teams connector is not authenticated.

Answer

The trigger body is not referencing the correct alert ID.

Answer

The JSON syntax is invalid.

Question 8

A security analyst in your company uses Microsoft Defender XDR to investigate an incident involving a user who received a malicious email. The analyst needs to block the sender's email address across all tenants in the organization. What is the most efficient way to achieve this?

Accepted Answer

In the Microsoft 365 Defender portal, use the action center to block the sender's email address across all tenants.. Microsoft Defender XDR allows you to take action on entities like email senders. Using the action center, you can block the sender's email address globally, which applies to all tenants. Option C is correct. Option A is wrong because Exchange admin center works per tenant and is not as efficient for cross-tenant blocking. Option B is wrong because Microsoft Entra ID admin center manages identities, not email blocking. Option D is wrong because Microsoft Purview is for compliance, not email threat protection.

Answer

From the Microsoft 365 Defender portal, go to Email & collaboration > Exchange admin center and block the sender.

Answer

In Microsoft Purview, create a data loss prevention policy to block the sender.

Answer

In Microsoft Entra ID admin center, create a conditional access policy to block the sender.

Question 9

A security analyst is building a custom detection rule in Microsoft 365 Defender to identify ransomware activity. The rule should trigger when files with specific extensions (e.g., .encrypted, .locked) are created on multiple devices within a short time frame, suggesting a widespread attack. Which combination of advanced hunting tables should be used to obtain both file creation events and device information?

Accepted Answer

DeviceFileEvents and DeviceInfo. DeviceFileEvents captures file creation events, including the specific extensions like .encrypted and .locked, while DeviceInfo provides device metadata such as device name, OS platform, and device group. Joining these tables on DeviceId allows the analyst to correlate file creation events across multiple devices, enabling detection of widespread ransomware activity within a short time frame.

Answer

DeviceProcessEvents and DeviceInfo

Answer

DeviceFileEvents and DeviceNetworkEvents

Answer

DeviceFileEvents and DeviceLogonEvents

Question 10

Match each incident severity level to its description in Microsoft 365 Defender.

Accepted Answer

Informational: Not considered malicious but may provide visibility into the environment.. Severity levels in Microsoft 365 Defender help prioritize incident response. Informational provides visibility, Low indicates minor issues, Medium requires investigation, High denotes significant threats, and Critical demands immediate action. The distractors swap or misrepresent these definitions.

Answer

High: Minimal impact; no investigation needed.

Answer

Critical: Significant threat that requires investigation; may cause damage.

Question 11

Match each threat intelligence indicator type to its description.

Accepted Answer

IP Address: A numerical label assigned to each device connected to a computer network.. These are common STIX indicator types used in threat intelligence. Correct matches: IP Address is a numerical label, Domain Name is an identification string, File Hash is a hash of file content. Common confusions involve swapping definitions between IP and Domain, or IP and File Hash.

Answer

IP Address: An identification string that defines a realm of administrative autonomy on the Internet.

Answer

File Hash: A numerical label assigned to each device connected to a computer network.

Question 12

Which TWO actions are appropriate when handling a confirmed ransomware incident in Microsoft 365?

Accepted Answer

Isolate affected devices from the network.. Option D is correct because isolating affected devices from the network is a standard containment step that prevents the ransomware from spreading laterally to other endpoints and limits further encryption or exfiltration within the Microsoft 365 environment. Option E is correct because changing passwords for all potentially compromised accounts revokes the attackers' access, invalidates stolen credentials, and is essential when identity compromise (e.g., via phishing or token theft) is a common ransomware entry vector in Microsoft 365. Option A is not appropriate as a primary incident response action because a full antivirus scan is a remediation/detection step that does not contain an active ransomware incident and may be ineffective against fileless or cloud-based attacks. Option B is wrong because restoring from backup immediately without investigation can reintroduce the threat or restore already-compromised data, and the root cause must be identified first. Option C is wrong because paying the ransom is discouraged by Microsoft and law enforcement, does not guarantee data recovery, and may fund further criminal activity.

Answer

Run a full antivirus scan on all devices.

Answer

Restore encrypted files from backup immediately without investigation.

Answer

Pay the ransom to regain access.

Question 13

Match each Microsoft Defender for Cloud security alert to its description.

Accepted Answer

SQL Injection: Detects attempts to inject malicious SQL code into application queries.. Correct matches: SQL Injection detects SQL code injection, Brute Force detects multiple failed logins, Malware Alert detects known malware. Common confusions include swapping definitions between these alerts.

Answer

SQL Injection: Detects multiple failed login attempts from a single source.

Answer

Malware Alert: Detects attempts to inject malicious SQL code.

Question 14

Match each Microsoft Sentinel feature to its purpose.

Accepted Answer

Analytics rules: Automatically create security incidents based on data queries and alerts.. Analytics rules generate incidents, Workbooks visualize data, Hunting queries search for threats, and Playbooks automate response. Common confusions include mixing visualization with rule generation and automation with proactive search.

Answer

Analytics rules: Visualize security data on custom dashboards.

Answer

Playbooks: Proactively search for unknown threats in logs.

Question 15

Your security team needs to assign a custom role in Microsoft Sentinel that allows read and write access to incidents but not to analytics rules. Which built-in role should you use as a base for the custom role?

Accepted Answer

Microsoft Sentinel Responder. The Microsoft Sentinel Responder role is the correct base because it grants read and write access to incidents while explicitly excluding write permissions to analytics rules. This aligns with the requirement for incident management without allowing modifications to detection logic.

Answer

Microsoft Sentinel Reader

Answer

Microsoft Sentinel Contributor

Answer

Global Administrator