SC-200 Practice Test 45 — 15 Questions

Question 1

Refer to the exhibit. You are deploying a Microsoft Sentinel workspace using an ARM template. After deployment, you notice the workspace is in a disabled state for ingesting data. Which parameter is most likely causing this?

Accepted Answer

The dailyQuotaInGB parameter sets a daily cap that may have been exceeded. Option D is correct because the 'dailyQuotaInGB' parameter sets a daily cap on data ingestion. If the cap is reached, ingestion stops until the next day. The workspace will be in a disabled state. Option A is the workspace name, not an issue. Option B is location, irrelevant. Option C is retention, not ingestion.

Answer

The location parameter is set to 'eastus' but Sentinel is not available in that region

Answer

The retentionInDays parameter is set to 90, which is less than the default 30 days

Answer

The workspaceName parameter is set to 'SentinelWorkspace' but the name must be globally unique

Question 2

Your organization is implementing Microsoft Sentinel and needs to ensure that incident response activities are compliant with regulatory requirements. You need to track and document all changes made to analytics rules and playbooks. Which TWO features should you enable?

Accepted Answer

Activity logs (Azure Monitor). Option B and E are correct because Change tracking tracks resource modifications, and audit logs record user actions. Option A is wrong because Microsoft Purview is for data governance, not Sentinel changes. Option C is wrong because workbooks are for visualization. Option D is wrong because automation rules do not log changes themselves.

Answer

Sentinel workbooks

Answer

Automation rules

Answer

Microsoft Purview Compliance Manager

Question 3

You are managing a Microsoft Defender XDR environment. The security team wants to receive email notifications when a new incident is created with severity 'High' or 'Medium'. They also want to ensure that notifications are sent only for incidents that are not automatically resolved by AIR. What should you configure?

Accepted Answer

Create an email notification rule in Microsoft Defender XDR with conditions for severity and status set to 'Active'.. Option A is correct because email notification rules in Microsoft Defender XDR allow you to filter by severity and status, including 'Active' status (not resolved). Option B is wrong because playbooks are for automated response, not notification. Option C is wrong because automation rules in Sentinel are for incident management, but this is Defender XDR. Option D is wrong because alert service settings in Microsoft 365 Defender are for email notifications, but the correct name is 'Email notification rules'.

Answer

Create a playbook in Microsoft Sentinel that sends an email when an incident is created.

Answer

Configure an automation rule in Microsoft Sentinel to send email notifications.

Answer

Configure alert service settings in the Microsoft 365 Defender portal to send emails for high and medium severity alerts.

Question 4

A security incident in Microsoft Sentinel has been classified as a true positive and remediated. According to your SOC playbook, the incident should be closed with a classification of 'True Positive' and a sub-classification of 'Confirmed activity'. What is the correct way to close the incident in Microsoft Sentinel?

Accepted Answer

In the Microsoft Sentinel incident, set Status to 'Closed', Classification to 'True Positive', and Sub-classification to 'Confirmed activity'.. Option A is correct because closing the incident in the Microsoft Sentinel incident blade allows setting classification and sub-classification. Option B is wrong because changing status to 'Closed' without classification doesn't meet requirements. Option C is wrong because the API requires the correct parameters. Option D is wrong because closing in Microsoft Defender XDR may not carry the same classification options.

Answer

Close the incident in Microsoft Defender XDR and let it sync to Microsoft Sentinel.

Answer

Change the incident status to 'Closed' without adding a classification.

Answer

Use the Microsoft Security Graph API to close the incident with the appropriate classification.

Question 5

You run the above KQL query in Microsoft Sentinel. The query returns no results. What is the most likely reason?

Accepted Answer

The query does not specify a time range, so it may be querying data older than the default 24-hour lookback.. Option A is correct because the 'SecurityAlert' table is not a standard table in Microsoft Sentinel; the correct table is 'SecurityAlert' (no hyphen) but actually the table is 'SecurityAlert'? Wait, the table is 'SecurityAlert' indeed in Microsoft Sentinel. However, the query uses 'has' operator which is case-insensitive but the column name 'AlertName' might be 'AlertName'? Actually, the column is 'AlertName' (capital N). But the most common reason for no results is that the 'SecurityAlert' table may not be populated if no alerts have been generated, or the time range is not specified. However, the exhibit shows no time filter, so the query runs on the default 24-hour range. Option A is plausible. Option B is wrong because 'has' works on strings. Option C is wrong because 'AlertSeverity' is a valid column. Option D is wrong because 'summarize' works fine.

Answer

The column 'AlertSeverity' does not exist in the SecurityAlert table.

Answer

The 'summarize' operator is misspelled.

Answer

The 'has' operator is case-sensitive and the alert names are capitalized differently.

Question 6

Which TWO of the following are valid methods to ingest custom logs into Microsoft Sentinel? (Choose two.)

Accepted Answer

Use the Azure Monitor Agent to collect custom logs via data collection rules.. Options A and D are correct. Custom logs can be ingested via Log Analytics agent using custom log collection (A) or via Azure Monitor Agent with custom log upload (D). Option B is for Windows events, not custom logs. Option C is for Linux syslog. Option E is for Application Insights, not custom logs.

Answer

Use Windows Event Forwarding to send custom logs to Sentinel.

Answer

Use the Application Insights connector to ingest custom logs.

Answer

Configure the syslog daemon to forward custom application logs.

Question 7

Your security team uses Microsoft Defender for Cloud to assess the security posture of Azure resources. You need to ensure that all virtual machines have endpoint protection enabled. Which policy initiative should you assign?

Accepted Answer

Deploy Microsoft Defender for Endpoint. Option B is correct because the 'Deploy Microsoft Defender for Endpoint' policy initiative includes policies to install and configure endpoint protection on VMs. Option A is about monitoring logs. Option C is about security configuration baselines. Option D is about storage encryption.

Answer

Enable encryption on Azure VMs

Answer

Deploy Windows Defender Exploit Guard

Answer

Azure Security Benchmark

Question 8

You are configuring Microsoft Defender for Cloud Apps to enhance visibility into your organization's SaaS app usage. You need to ensure that risky user activities are automatically suspended. What should you configure?

Accepted Answer

Create a session policy to block or limit activities based on risk.. Option B is correct because session policies allow real-time control of user sessions based on risk level. Option A is wrong because app discovery only identifies apps used. Option C is wrong because file policies govern data protection. Option D is wrong because IP address ranges are used for location-based policies, not activity control.

Answer

Set up IP address range policies.

Answer

Configure app discovery policies.

Answer

Define file policies to protect sensitive data.

Question 9

Your organization uses Microsoft Defender for Identity. The security team wants to monitor for suspected DCSync attacks. Which Windows Event ID should you monitor to detect DCSync activity?

Accepted Answer

Event ID 4662: An operation was performed on an object.. Option C is correct because Event ID 4662 (An operation was performed on an object) is used to detect directory replication requests, which are part of DCSync attacks. Option A is wrong because 4624 is logon. Option B is wrong because 4648 is logon with explicit credentials. Option D is wrong because 4776 is credential validation.

Answer

Event ID 4776: The domain controller attempted to validate the credentials for an account.

Answer

Event ID 4648: A logon was attempted using explicit credentials.

Answer

Event ID 4624: An account was successfully logged on.

Question 10

A company uses Microsoft Sentinel with the Microsoft 365 Defender connector. The security team notices that alerts from Microsoft Defender for Endpoint (MDE) are not appearing in Sentinel. The MDE data connector status shows 'Connected'. Which step should you take to troubleshoot this issue?

Accepted Answer

Check the Microsoft 365 Defender portal to ensure MDE alerts are being generated and forwarded to Microsoft 365 Defender.. Option D is correct because the Microsoft 365 Defender connector brings in alerts from all Defender products, including MDE. If the connector is connected but alerts are missing, the issue is likely that the alerts are not being forwarded to Microsoft 365 Defender. Option A is not correct because MDE alerts are not a separate connector; Option B is not correct because the connector is already 'Connected'; Option C is not correct because ingestion rules filter after ingestion.

Answer

Verify that the Microsoft 365 Defender connector is configured to ingest MDE alerts.

Answer

Check if the Microsoft Defender for Endpoint data connector is added.

Answer

Verify that the ingestion rules in Sentinel are not filtering out MDE alerts.

Question 11

Your SOC team uses Microsoft Sentinel and Microsoft Defender XDR. You have configured automated responses using playbooks. However, some playbooks fail to execute when triggered from Microsoft Defender XDR incidents. You need to ensure that the playbooks run successfully. What should you verify?

Accepted Answer

Ensure that the automation rule that triggers the playbook has the correct 'incident provider' set to 'Microsoft Defender XDR'.. Option C is correct because Microsoft Defender XDR requires that automation rules are configured to run in the context of the incident from Microsoft Sentinel. Option A is wrong because the connection is not always required. Option B is wrong because RBAC is not the typical issue. Option D is wrong because the playbook path is not the primary concern.

Answer

Confirm that the playbook is stored in the same resource group as Microsoft Sentinel.

Answer

Verify that the playbook is connected to Microsoft Teams for approval.

Answer

Check that the service principal has global administrator role in Microsoft Entra ID.

Question 12

You are reviewing a PowerShell script used for automated response on a Windows 10 device managed by Microsoft Defender for Endpoint. What is the intended outcome of this script?

Accepted Answer

It triggers a quick scan if any Trojan detection exists.. Option D is correct because the script retrieves threat detections containing 'Trojan' and if found, initiates a quick scan. Option A is wrong because the script doesn't remove threats, only scans. Option B is wrong because it doesn't exclude anything. Option C is wrong because it doesn't update signatures.

Answer

It removes all Trojan threats from the device.

Answer

It updates the antimalware signatures and then performs a scan.

Answer

It configures Windows Defender to exclude Trojan files.

Question 13

Which THREE of the following are capabilities of Microsoft Defender XDR's automated investigation and response (AIR) that can be enabled or configured by a security operations analyst? (Choose three.)

Accepted Answer

Automatically block an email message or attachment.. Options A, C, and D are correct. AIR can automatically take remediation actions like isolating devices (A), suspend users (C), and block email messages (D). Option B is wrong because AIR does not automatically create analytics rules; that's a Sentinel feature. Option E is wrong because AIR does not modify DLP policies; that's Purview.

Answer

Automatically modify Data Loss Prevention policies.

Answer

Automatically create new analytics rules based on incident patterns.

Question 14

You are a security analyst. An incident in Microsoft Sentinel is assigned to you. The incident contains multiple alerts. You want to group related alerts into a single incident to reduce noise. What feature should you use?

Accepted Answer

Incident grouping settings in the analytics rule. Option C is correct because incident grouping settings in analytics rules allow you to group alerts into a single incident based on criteria like entities or time window. Option A is for incident management, not grouping. Option B is for automating actions. Option D is for enriching alerts with threat intelligence.

Answer

Automation rules

Answer

Threat intelligence indicators

Answer

Incident details tab

Question 15

Your organization uses Microsoft Sentinel with a Log Analytics workspace in the East US region. You have deployed the Microsoft Defender for Cloud connector. You notice that security alerts from Defender for Cloud are not appearing as incidents in Sentinel. You have confirmed that the connector is enabled and data is flowing. What is the most likely cause?

Accepted Answer

You need to create an analytics rule with a rule template that uses the SecurityAlert table.. Option C is correct because analytics rules must be created to generate incidents from alerts. Option A is wrong because the connector is working. Option B is wrong because incident creation is not automatic from the connector alone. Option D is wrong because permissions are not the issue if data is flowing.

Answer

The Sentinel workspace does not have required permissions to create incidents.

Answer

There is a delay in incident creation; wait for 24 hours.

Answer

The Microsoft Defender for Cloud connector is not properly configured.

SC-200 Practice Test 45 — 15 Questions

Exhibit

SC-200 Practice Test 45 — 15 Questions

Exhibit