SC-200 Practice Test 46 — 15 Questions

Question 1

A SOC team wants to automatically categorize incidents in Microsoft Sentinel with MITRE ATT&CK tactics (e.g., 'Initial Access', 'Execution') when an analytics rule triggers. How can they achieve this?

Accepted Answer

Map MITRE ATT&CK tactics in the analytics rule. Microsoft Sentinel analytics rules include a dedicated 'MITRE ATT&CK' configuration section where you can map specific tactics (e.g., Initial Access, Execution) to the rule. When the rule triggers and generates an incident, Sentinel automatically populates the incident's MITRE ATT&CK tactics field based on this mapping, enabling automated categorization without additional configuration.

Answer

Use the incident details custom fields

Answer

Use automation rule to set tactics

Answer

Use playbook to update incident

Question 2

A SOC analyst wants to automate a response in Microsoft Sentinel: whenever an incident is created that contains a compromised user entity (e.g., a user whose credentials were used in a breach), a playbook should run to disable that user in Microsoft Entra ID. Which condition should be configured in the automation rule to trigger this playbook?

Accepted Answer

Set the condition to 'When incident is created with entity type Account'.. The automation rule must trigger when an incident is created with an entity type of 'Account' to match the compromised user entity. In Microsoft Sentinel, a user whose credentials were used in a breach is represented as an 'Account' entity, not an 'IP' or 'Host'. The playbook to disable the user in Microsoft Entra ID requires this entity type to pass the user principal name (UPN) or object ID to the action.

Answer

Set the trigger to 'When incident is created' with no additional condition.

Answer

Set the condition to 'When incident is created with entity type IP'.

Answer

Set the condition to 'When incident is updated with entity type Host'.

Question 3

A security analyst receives an alert in Microsoft Defender for Cloud about a suspicious process on an Azure VM. The alert indicates a potential credential dumping tool. The analyst needs to see the full command line and parent process of the suspicious process. Which Defender for Cloud feature should the analyst use?

Accepted Answer

Live Response. Live Response in Microsoft Defender for Cloud provides the analyst with the ability to remotely investigate a live Azure VM. It allows the analyst to run commands, collect forensic artifacts, and view detailed process information, including the full command line and parent process of the suspicious process, which is essential for analyzing a potential credential dumping tool.

Answer

Fileless attack detection

Answer

Just-In-Time VM access

Answer

Adaptive application controls

Question 4

A company runs its critical workloads on Azure Kubernetes Service (AKS). The security team wants to use Microsoft Defender for Cloud to protect the AKS clusters. After enabling Defender for Cloud on the subscription, they also need to enable the Defender for Containers plan. Which of the following capabilities becomes available specifically after enabling the Defender for Containers plan (with the plan turned on)?

Accepted Answer

Security alerts for container runtime threats, such as privilege escalation in a container.. Enabling the Defender for Containers plan in Microsoft Defender for Cloud activates host-level and cluster-level threat detection for AKS, including runtime threat protection. This allows Defender for Cloud to generate security alerts for container-specific threats such as privilege escalation, container breakout, and suspicious process execution within containers, which are not available with just the basic Defender for Cloud enabled on the subscription.

Answer

Azure Policy for Kubernetes add-on installation to enforce pod security policies.

Answer

Kubernetes audit logs are automatically streamed to the Log Analytics workspace.

Answer

Integration with Microsoft Sentinel for monitoring AKS logs.

Question 5

A SOC analyst needs to create an analytics rule in Microsoft Sentinel that triggers when a user logs in from an IP address outside of the organization's typical geographic locations, based on a learned baseline. Which type of analytics rule is best suited for this scenario?

Accepted Answer

Anomaly rule. An Anomaly rule in Microsoft Sentinel uses machine learning to establish a baseline of normal user behavior, such as typical geographic login locations. When a login event deviates from that learned baseline (e.g., from an unusual IP address outside the expected regions), the rule triggers an alert. This is the only rule type specifically designed for behavior-based anomaly detection without requiring static thresholds or predefined patterns.

Answer

Scheduled rule

Answer

NRT (Near-Real-Time) rule

Answer

Fusion rule

Question 6

A security analyst is investigating a potential malware outbreak using Microsoft 365 Defender advanced hunting. The analyst wants to find all devices where a file with a specific SHA256 hash was first created and then later deleted, which may indicate a cleanup attempt. Which query pattern on the DeviceFileEvents table is appropriate?

Accepted Answer

DeviceFileEvents | where SHA256 == "<hash>" | summarize Actions = make_set(ActionType) by DeviceId | where Actions has_all ("FileCreated", "FileDeleted"). It first filters by the specific SHA256 hash, then uses `make_set(ActionType)` to collect all actions per device, and finally checks that both 'FileCreated' and 'FileDeleted' appear in the set. This precisely identifies devices where the file was both created and later deleted, indicating a potential cleanup attempt.

Answer

DeviceFileEvents | where SHA256 == "<hash>" and ActionType == "FileDeleted" | project DeviceId

Answer

DeviceFileEvents | where FileHash == "<hash>" | summarize Actions = make_set(ActionType) by DeviceId | where Actions has "FileCreated"

Answer

DeviceFileEvents | summarize by DeviceId, ActionType | where ActionType in ("FileCreated", "FileDeleted")

Question 7

An analyst is investigating a data exfiltration incident. They suspect that a user downloaded sensitive files from a SharePoint site and then uploaded them to a non-corporate cloud storage service (e.g., Dropbox) using the same device. Which combination of Advanced Hunting tables should the analyst query to correlate the SharePoint download activity with network connections to external IPs?

Accepted Answer

CloudAppEvents and DeviceNetworkEvents. CloudAppEvents logs user activities in cloud apps like SharePoint, including file downloads. DeviceNetworkEvents logs network connections from devices, including connections to external IPs. Combining these tables allows the analyst to correlate the SharePoint download event (from CloudAppEvents) with subsequent network connections to non-corporate cloud storage IPs (from DeviceNetworkEvents) on the same device, directly mapping the exfiltration path.

Answer

EmailEvents and DeviceNetworkEvents

Answer

DeviceFileEvents and DeviceNetworkEvents

Answer

CloudAppEvents and IdentityLogonEvents

Question 8

A security operations team has Microsoft Defender for Cloud enabled on all subscriptions and wants to forward security alerts and recommendations to Microsoft Sentinel for analysis and automation. Which configuration should the team implement to enable this integration?

Accepted Answer

In Microsoft Sentinel, add the 'Microsoft Defender for Cloud' data connector and select the subscriptions to stream alerts and recommendations.. The 'Microsoft Defender for Cloud' data connector in Microsoft Sentinel is the native integration point that allows you to stream security alerts and recommendations from Defender for Cloud into Sentinel. By adding this connector and selecting the subscriptions, you enable a direct, bi-directional connection that ingests Defender for Cloud data into Sentinel's Log Analytics workspace for analysis and automation.

Answer

In Microsoft Defender for Cloud, create a continuous export to a Log Analytics workspace that is already connected to Sentinel.

Answer

Create an Azure Policy that deploys Azure Monitor Agent to all VMs and configures data collection rules to send data to Sentinel.

Answer

Enable the 'Enable integration with Microsoft Sentinel' option in the Defender for Cloud pricing & settings blade.

Question 9

A security analyst is using Microsoft 365 Defender advanced hunting to investigate potential lateral movement. The analyst has identified a compromised device (DeviceA) and wants to find all other devices that initiated a remote desktop connection from DeviceA to other devices in the last 24 hours. Which table and query approach should the analyst use?

Accepted Answer

Query DeviceNetworkEvents for events from DeviceA with RemotePort 3389, then join with DeviceInfo to get target device names.. DeviceNetworkEvents logs network connections, including outbound RDP traffic (port 3389). By filtering for events from DeviceA with RemotePort 3389, the analyst captures all RDP connections initiated by DeviceA. Joining with DeviceInfo resolves the target IP addresses to device names, providing a complete list of devices that received an RDP connection from DeviceA in the last 24 hours.

Answer

Query DeviceLogonEvents for LogonType 10 (RemoteInteractive), filtering by initiating device.

Answer

Query IdentityLogonEvents to find logons associated with DeviceA.

Answer

Query EmailEvents to find emails sent from DeviceA that contain RDP configuration files.

Question 10

An analyst is investigating a sophisticated attack involving a compromised device. The analyst has identified a malicious process that spawned multiple child processes. The analyst wants to create a custom detection rule in Microsoft 365 Defender that alerts when a specific parent process creates a child process that makes an outbound network connection to any IP not in the organization's internal range. Which KQL query and rule type should the analyst use?

Accepted Answer

Create a custom detection rule (Advanced Hunting rule) with a query that joins DeviceProcessEvents and DeviceNetworkEvents, filtering for the parent process and external IP addresses. The analyst needs to correlate process creation events with network connection events across two separate tables (DeviceProcessEvents and DeviceNetworkEvents) in Advanced Hunting. A custom detection rule (Advanced Hunting rule) in Microsoft 365 Defender allows joining these tables to identify when a specific parent process spawns a child that makes an outbound connection to an external IP address, which is exactly the required detection logic.

Answer

Create a scheduled rule in Sentinel and export the data from M365 Defender

Answer

Use a custom detection rule with DeviceEvents only

Answer

Use a Microsoft Defender for Endpoint custom detection rule (built-in) that already detects child process connections

Question 11

A security analyst is using advanced hunting in Microsoft 365 Defender to detect lateral movement. The analyst wants to find all devices where a specific user account had an interactive logon, and then identify which of those devices subsequently initiated outbound Remote Desktop Protocol (RDP) connections to other internal IP addresses. Which KQL approach is most efficient for this investigation?

Accepted Answer

Use DeviceLogonEvents and DeviceNetworkEvents with a join on DeviceId and a time range. It uses DeviceLogonEvents to identify interactive logons for the specific user account on devices, then joins those results with DeviceNetworkEvents on DeviceId within a time range to find subsequent outbound RDP connections (destination port 3389) to internal IPs. This approach directly correlates the user's logon activity with network connections from the same device, which is the most efficient and precise method for detecting lateral movement via RDP.

Answer

Use IdentityLogonEvents and DeviceNetworkEvents with a join on IP address

Answer

Use DeviceProcessEvents and DeviceNetworkEvents with a join on DeviceId

Answer

Use EmailEvents and DeviceLogonEvents with a join on RecipientEmail

Question 12

A SOC team uses Microsoft Sentinel with multiple workspaces in a single region. They have deployed Azure Policy to send all Azure resource logs to a central Log Analytics workspace. Now they want to create a set of analytics rules that run across multiple workspaces to detect cross-workspace attacks. However, they note that the built-in analytics rules can only query data within the workspace they are defined. Which solution should the team implement to efficiently query data from multiple workspaces for detection?

Accepted Answer

Create a KQL function that unions the relevant tables from all workspaces using the workspace() expression, then use that function in the analytics rule query. KQL functions can encapsulate cross-workspace queries using the `workspace()` expression, allowing an analytics rule to query multiple Log Analytics workspaces from a single rule definition. This approach efficiently reuses the union logic across rules without modifying each rule individually, addressing the limitation that built-in rules can only query their own workspace.

Answer

Use Azure Lighthouse to delegate management and then create rules in the managing workspace that use workspace() expressions

Answer

Configure the analytics rule to run in Log Analytics workspace manager and use cross-workspace queries native to Copilot for Security

Answer

Enable cross-workspace incident view in Sentinel settings and define the rule in the central workspace to automatically query all linked workspaces

Question 13

A security analyst in Microsoft 365 Defender is investigating an incident that involves multiple devices. The analyst wants to see a visual representation of the attack, showing how the attacker moved from one device to another. Which feature provides this view?

Accepted Answer

Incident graph. The Incident graph in Microsoft 365 Defender provides a visual, interactive representation of an attack, showing how the attacker moved from one device to another, including lateral movement paths and related alerts. This feature is specifically designed to help analysts understand the full scope of an incident by mapping out the relationships between entities such as devices, users, and alerts.

Answer

Alert queue

Answer

Advanced hunting

Answer

Action center

Question 14

A security analyst is investigating a potential business email compromise (BEC) campaign. The analyst wants to find all emails that were sent to external recipients from an internal user's mailbox that also had a login from an unusual location shortly after the email was sent. Which advanced hunting tables should the analyst query to get the email metadata and the sign-in details?

Accepted Answer

EmailEvents and AADSignInEventsBeta. EmailEvents stores email metadata (sender, recipient, subject, etc.) and AADSignInEventsBeta captures Microsoft Entra ID sign-in logs, including location data. Joining these tables on the user's account object ID allows the analyst to correlate emails sent to external recipients with unusual sign-in locations shortly after the email was sent, directly addressing the BEC investigation scenario.

Answer

EmailPostDeliveryEvents and DeviceLogonEvents

Answer

EmailAttachmentInfo and IdentityLogonEvents

Answer

EmailUrlInfo and CloudAppEvents

Question 15

A security analyst reviews Microsoft Defender for Cloud recommendations for an Azure virtual machine. The VM has a recommendation titled 'Install endpoint protection solution on virtual machines'. The analyst clicks on the recommendation and sees affected resources. Which of the following best describes the purpose of this recommendation in the context of Defender for Cloud?

Accepted Answer

It advises deploying a supported endpoint protection solution, such as Microsoft Defender Antivirus, to protect the VM from malware and other threats.. The recommendation 'Install endpoint protection solution on virtual machines' in Microsoft Defender for Cloud specifically identifies VMs that lack a supported endpoint protection solution (e.g., Microsoft Defender Antivirus, Trend Micro, Symantec). Its purpose is to ensure that VMs are protected against malware, viruses, and other threats by deploying an endpoint protection solution, which is a core security control in the cloud security posture management (CSPM) framework.

Answer

It identifies VMs that have an open network security group inbound rule that should be closed.

Answer

It suggests enabling Azure Firewall on the virtual network to protect the VM from external threats.

Answer

It recommends enabling disk encryption for the VM's OS and data disks.