SC-200 Practice Test 45 — 15 Questions

Question 1

A company has several Azure virtual machines running SQL Server (IaaS). The security team wants to enable Advanced Threat Protection for these SQL Server instances to detect threats like SQL injection. What should they do?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Deploy the SQL Server IaaS Agent extension on each VM and enable Azure Defender for SQL in Microsoft Defender for Cloud.. To enable Advanced Threat Protection for SQL Server IaaS, you must deploy the SQL Server IaaS Agent extension on each VM, which allows the VM to register with the SQL IaaS platform. Then, you enable Azure Defender for SQL in Microsoft Defender for Cloud, which provides threat detection for SQL injection and other anomalous activities. This combination ensures the SQL Server instances are monitored by Defender for Cloud's SQL-specific protections.

Answer

Enable Azure Defender for Servers on the subscription; it automatically protects SQL Server workloads.

Answer

Enable Azure Defender for SQL on the Log Analytics workspace used by the VMs.

Answer

Configure the Microsoft Sentinel SQL connector to ingest SQL audit logs.

Question 2

A security analyst is investigating an advanced persistent threat campaign that involves lateral movement using RDP. The analyst suspects that an attacker uses RDP from DeviceA to DeviceB, and then within a few minutes executes a malicious PowerShell script on DeviceB. The analyst wants to create a custom detection rule in Microsoft 365 Defender that triggers when this pattern occurs. Which KQL query pattern should be used to correlate these events across devices?

Accepted Answer

Use a self-join: query DeviceProcessEvents for mstsc.exe, extract the target device (e.g., from command line), and then join with another query on DeviceProcessEvents for PowerShell on the target device where the time difference between the events is less than 10 minutes.. It uses a self-join on DeviceProcessEvents to first detect the mstsc.exe process (RDP client) on DeviceA, extract the target device name from the command line, and then join with a second query on DeviceProcessEvents for PowerShell on DeviceB. The join condition includes a time difference of less than 10 minutes, which directly correlates the lateral movement (RDP) with the subsequent malicious script execution across devices, matching the described attack pattern.

Answer

Query DeviceNetworkEvents for RDP connections (port 3389) and then join with DeviceProcessEvents for PowerShell on the same device.

Answer

Use the 'union' operator to combine all mstsc.exe and PowerShell events, then summarize by device and time.

Answer

Query DeviceLogonEvents for RDP logon type and then join with DeviceProcessEvents for PowerShell on the same device.

Question 3

A security administrator wants to assess their Azure environment against the Azure Security Benchmark and also include custom security controls defined by their organization. They need a single, reusable policy initiative that can be assigned across multiple subscriptions and management groups. What should the administrator create in Microsoft Defender for Cloud?

Accepted Answer

A custom Azure Policy initiative. The administrator needs a single, reusable policy initiative that includes both Azure Security Benchmark controls and custom organizational controls. A custom Azure Policy initiative (also known as a policy set) allows combining multiple policy definitions, including built-in benchmark controls and custom definitions, into one assignable package across subscriptions and management groups. This is the correct approach because initiatives are designed for grouping related policies and can be assigned at scale in Microsoft Defender for Cloud.

Answer

A new regulatory compliance standard

Answer

A custom Azure Policy definition

Answer

A Secure Score recommendation override

Question 4

A company runs SQL Server on Azure Virtual Machines (IaaS). They want to enable Advanced Threat Protection (ATP) for these instances to detect SQL injection attempts. What must they do first?

Accepted Answer

Enable Azure Defender for SQL on the server. Azure Defender for SQL is the specific plan within Microsoft Defender for Cloud that provides Advanced Threat Protection (ATP) for Azure SQL resources, including SQL Server on Azure VMs. Enabling this plan activates threat detection capabilities such as SQL injection alerts, anomalous access patterns, and vulnerability assessments. Without this plan, the VM's SQL Server instance is not monitored by Defender for Cloud's SQL-specific threat detection engine.

Answer

Deploy the Azure Security Center agent on the VM

Answer

Enable Azure Defender for Servers

Answer

Configure SQL Server auditing manually

Question 5

A large organization manages multiple Azure subscriptions under a single management group. The security team wants to ensure that when new subscriptions are added to the management group, the Microsoft Defender for Cloud plans (e.g., Defender for Servers) are automatically enabled. What is the most efficient way to achieve this?

Accepted Answer

Assign the Azure Policy initiative 'Configure Azure Defender to be enabled on subscriptions' to the management group with appropriate policy parameters.. Assigning the built-in Azure Policy initiative 'Configure Azure Defender to be enabled on subscriptions' to the management group ensures that any new subscription added under that management group automatically inherits the policy. This initiative uses DeployIfNotExists effect to enable the specified Defender plans (e.g., Defender for Servers) on subscriptions that do not already have them enabled, providing a fully automated, scalable solution without manual intervention.

Answer

Enable all Microsoft Defender plans at the management group level in the Microsoft Defender for Cloud portal.

Answer

Manually enable the Defender plans on each new subscription as they are created.

Answer

Use an Azure Blueprint to assign the Defender plans to the subscription.

Question 6

An SOC analyst wants to quickly enable detection for when a user account is added to the Global Administrator role in Microsoft Entra ID using a built-in analytics rule template in Microsoft Sentinel. Which type of analytics rule template should the analyst use?

Accepted Answer

Scheduled. The analyst should use a Scheduled analytics rule template because the detection for when a user account is added to the Global Administrator role in Microsoft Entra ID requires querying the AuditLogs table at a regular interval. Scheduled rules allow you to define a KQL query that runs on a schedule (e.g., every 5 minutes) and generates alerts based on the results. This is the only built-in rule type that supports custom log queries for specific activities like role assignments.

Answer

Microsoft Security

Answer

Fusion

Answer

Machine Learning (ML)

Question 7

A SOC analyst is configuring a scheduled analytics rule in Microsoft Sentinel. The rule runs every hour and queries the SigninLogs table for failed sign-ins. The analyst wants to avoid generating multiple incidents for the same user and IP address within a 1-hour window. Which configuration should the analyst use in the 'Incident creation' section of the rule?

Accepted Answer

Set 'Alert per rule run' to 'Single alert per run' and enable 'Grouping' with 'Group all alerts into a single incident' and time window of 1 hour.. Setting 'Alert per rule run' to 'Single alert per run' ensures that all matching query results from a single run are bundled into one alert. Enabling 'Grouping' with 'Group all alerts into a single incident' and a 1-hour time window then merges alerts across multiple runs for the same user and IP into one incident, preventing duplicate incidents within that window. This directly meets the requirement to avoid multiple incidents for the same user and IP within an hour.

Answer

Set 'Alert per rule run' to 'Every event' and disable grouping.

Answer

Set 'Alert per rule run' to 'Single alert per run' and disable grouping.

Answer

Configure the rule to use 'Supply chain' analytics rule type.

Question 8

A security administrator wants to enable vulnerability assessment for all existing and future Azure virtual machines in a subscription using the integrated Microsoft Defender Vulnerability Management solution. What is the recommended action in Microsoft Defender for Cloud?

Accepted Answer

Enable the 'Vulnerability assessment for machines' component in the Defender for Servers plan settings within the subscription's pricing & settings page.. Enabling the 'Vulnerability assessment for machines' component in the Defender for Servers plan settings within the subscription's pricing & settings page automatically provisions the integrated Microsoft Defender Vulnerability Management (MDVM) solution to all existing and future Azure VMs without manual agent installation. This is the recommended and native method in Microsoft Defender for Cloud to enable vulnerability assessment at scale, leveraging the built-in Qualys or MDVM scanner that is managed by the platform.

Answer

Manually install the Microsoft Defender Vulnerability Management agent on each VM via an Azure Policy initiative.

Answer

Create an Azure Policy that assigns the 'Configure machines to receive a vulnerability assessment provider' built-in policy to the subscription.

Answer

Enable 'Vulnerability assessment for machines' in the Azure Security Benchmark compliance dashboard.

Question 9

A security administrator wants to ensure that all Azure virtual machines have Microsoft Defender for Cloud's vulnerability assessment (VA) solution enabled automatically. They need to deploy the VA solution to new and existing VMs without manual intervention. Which method should they use?

Accepted Answer

Assign an Azure Policy with DeployIfNotExists effect for the VA solution. Azure Policy with a DeployIfNotExists effect can automatically deploy the Microsoft Defender for Cloud integrated vulnerability assessment (VA) solution (Qualys or Microsoft) to both new and existing Azure VMs without manual intervention. This policy evaluates VMs that do not have the VA extension installed and triggers a remediation task to deploy it, ensuring continuous compliance across the subscription.

Answer

Configure 'Vulnerability assessment for machines' in Defender for Cloud settings

Answer

Enable the Defender for Servers plan on the subscription

Answer

Run a PowerShell script to install the VA solution on all VMs

Question 10

A SOC analyst wants to create a watchlist in Microsoft Sentinel from a CSV file that contains IP addresses. The analyst needs to configure the watchlist so that it can be efficiently queried using IP address comparison operators (e.g., IP prefix matching). Which data type should be set for the key column?

Accepted Answer

ipaddress. The 'ipaddress' data type is correct because it enables Microsoft Sentinel to parse and index the column values as IP addresses, allowing efficient use of IP-specific operators such as 'has_ip_prefix()' for prefix matching. Without this type, the watchlist would treat IPs as plain strings, preventing optimized IP comparison queries.

Answer

string

Answer

dynamic

Answer

guid

Question 11

A security analyst is configuring a playbook in Microsoft Sentinel to run automatically when a new incident of severity 'High' is created. The playbook should only run for incidents that are not already assigned to an analyst. How can the analyst configure this automation?

Accepted Answer

Create an automation rule with a condition on 'Owner' field equals 'Unassigned'. Microsoft Sentinel automation rules can evaluate incident properties at creation time, including the 'Owner' field. By setting a condition that 'Owner' equals 'Unassigned', the rule triggers the playbook only for high-severity incidents that have not yet been assigned to an analyst, meeting the requirement without requiring custom logic inside the playbook.

Answer

Use a playbook trigger 'When a Microsoft Sentinel incident is created' and add a condition in the playbook

Answer

Configure a watchlist to filter incidents

Answer

Use a Logic Apps trigger for all incidents and check owner within the playbook

Question 12

A SOC analyst in Microsoft Sentinel is creating a scheduled analytics rule to detect sign-ins from IP addresses known to be associated with a threat actor. The list of threat actor IPs is maintained in a custom Microsoft Sentinel watchlist and is updated daily. The analyst wants the rule to query the SigninLogs table and compare the IP address against this list. What is the most efficient way to reference the list in the KQL query?

Accepted Answer

Use the _GetWatchlist() function to retrieve the watchlist.. The `_GetWatchlist()` function is the built-in, optimized way to reference a Microsoft Sentinel watchlist within a KQL query. It retrieves the watchlist data directly from the Sentinel workspace, ensuring the query always uses the latest daily-updated list without manual maintenance or external dependencies. This approach is both efficient and aligns with Sentinel's intended design for dynamic threat intelligence.

Answer

Use the externaldata operator to read from a blob storage URL.

Answer

Use the let statement to define a static list inline.

Answer

Use the datatable operator to define the list directly in the query.

Question 13

A security analyst is using Microsoft 365 Defender and discovers that a legitimate business application has been incorrectly blocked as malicious by an automated investigation. The analyst needs to unblock this application immediately so it can run on all endpoints in the organization. What action should the analyst take from the file's entity page in Microsoft 365 Defender?

Accepted Answer

Add an indicator to allow the file. Adding an indicator to allow the file creates a custom indicator of compromise (IoC) in Microsoft 365 Defender that explicitly overrides the automated investigation's verdict. This action immediately permits the file to run on all endpoints in the organization by adding an 'allow' entry to the threat intelligence feed, which takes precedence over the automated detection logic.

Answer

Submit the file to Microsoft for analysis

Answer

Remove the existing indicator for the file

Answer

Restore the file from quarantine

Question 14

A company uses Microsoft Defender for Cloud to secure its Azure environment. The security team wants to receive notifications via email whenever a high-severity security alert is generated. What should they configure in Defender for Cloud?

Accepted Answer

Set up email notifications for high-severity alerts in the Defender for Cloud environment settings.. Defender for Cloud provides a built-in email notification configuration specifically for security alerts. By navigating to the 'Environment settings' for the subscription or management group, then selecting 'Email notifications', you can enable and configure alerts to be sent to specified recipients when high-severity alerts are generated. This is the direct, purpose-built method for email notification of Defender for Cloud alerts without requiring additional services.

Answer

Enable the 'Continuous Export' feature to send alerts to a Log Analytics workspace.

Answer

Configure an alert rule in Azure Monitor.

Answer

Create an automation rule in Microsoft Sentinel.

Question 15

A SOC analyst wants to detect when a user signs in from a device that has never been used by that user before. The analyst plans to use Microsoft Sentinel with the SigninLogs table. Which KQL approach correctly identifies sign-ins from devices not previously associated with the user within the last 30 days?

Accepted Answer

Join the SigninLogs table with itself to find the earliest sign-in per user and device, then filter for those that match the earliest timestamp. It uses a self-join on the SigninLogs table to identify the earliest sign-in per user-device pair within the last 30 days. By filtering for rows where the sign-in timestamp matches the earliest timestamp, the query isolates sign-ins from devices that have never been used by that user before, effectively detecting first-time device usage.

Answer

Use the _GetWatchlist function with a custom watchlist of known user-device pairs

Answer

Use the BehaviorAnalytics table which already identifies new devices

Answer

Apply the 'where DeviceId != '' and DeviceId startswith "device-"' filter to ensure the device is new