SC-200 Practice Test 46 — 15 Questions

Question 1

You are configuring Microsoft Sentinel to ingest data from multiple sources. Which TWO of the following are valid data connectors that can be used to ingest AWS CloudTrail logs?

Accepted Answer

Azure Functions connector. Option A and D are correct. AWS S3 connector (A) is a standard way to ingest CloudTrail logs. Azure Functions (D) can be used to run custom code to pull logs. Option B is wrong because Microsoft Defender for Cloud is for Azure, not AWS. Option C is wrong because Syslog is for on-premises Linux systems, not AWS. Option E is wrong because Office 365 connector is for Office 365, not AWS.

Answer

Office 365 connector

Answer

Microsoft Defender for Cloud connector

Answer

Syslog connector

Question 2

Your organization is using Microsoft Sentinel and has deployed the Microsoft Entra ID (Azure AD) connector. You need to create an analytics rule that triggers an incident when a user from a specific IP address is assigned the Global Administrator role. The IP address is not in your trusted IP list. Which KQL query should you use as the rule logic?

Accepted Answer

AuditLogs | where ActivityDisplayName == 'Add member to role' and TargetResources[0].displayName == 'Global Administrator' and InitiatedBy.app.ipAddress !in (dynamic(['10.0.0.1', '10.0.0.2'])). Option C is correct because it filters AuditLogs for 'Add member to role' activity for the Global Administrator role and checks that the IP address is not in the trusted IP list. The other options have incorrect logic or syntax.

Answer

AuditLogs | where ActivityDisplayName == 'Add member to role' and TargetResources[0].displayName == 'Global Administrator' and InitiatedBy.app.ipAddress == '10.0.0.1'

Answer

AuditLogs | where ActivityDisplayName == 'Add member to role' and TargetResources[0].displayName == 'Global Administrator' and InitiatedBy.app.ipAddress !has '10.0.'

Answer

AuditLogs | where ActivityDisplayName == 'Add member to role' and TargetResources[0].displayName == 'Global Administrator' and InitiatedBy.app.ipAddress !in ('trusted IP list')

Question 3

Your organization uses Microsoft Sentinel and has deployed multiple analytics rules. You need to evaluate the effectiveness of these rules by identifying which rules generate the most incidents and have the highest false positive rate. What should you use?

Accepted Answer

Incidents view in Microsoft Sentinel filtered by analytics rule. Option C is correct because the Incident view in Microsoft Sentinel allows filtering and grouping by analytics rule to see incident counts and classifications. Option A is wrong because the MITRE ATT&CK view maps incidents to techniques, not rule performance. Option B is wrong because the Entity behavior analytics view is for UEBA. Option D is wrong because the Hunting view is for proactive threat hunting.

Answer

Hunting view in Microsoft Sentinel

Answer

MITRE ATT&CK view in Microsoft Sentinel

Answer

Entity behavior analytics view in Microsoft Sentinel

Question 4

You are configuring Microsoft Sentinel to ingest logs from a third-party firewall via Syslog. After configuring the data connector, you notice that no logs are appearing. You verify that the firewall is sending logs to the Syslog collector. What is the most likely cause?

Accepted Answer

The syslog daemon on the collector is not configured to forward logs to the Log Analytics workspace.. Option A is correct because a common issue is that the Syslog collector (e.g., Linux VM) does not have the required syslog daemon (rsyslog) properly configured to forward logs to Log Analytics. Option B is less likely because connectors are usually enabled by default. Option C is wrong because KQL is for querying, not ingestion. Option D is wrong because the data connector for Syslog uses the Log Analytics agent, not AMA by default.

Answer

The firewall is sending logs in a format incompatible with the Azure Monitor Agent.

Answer

The ingestion cost is too high and Sentinel throttled the connection.

Answer

The data connector is disabled in the Log Analytics workspace.

Question 5

Your company is deploying Microsoft Defender for Endpoint. You need to ensure that all devices report their security baseline compliance to Microsoft Intune. Which configuration should you use?

Accepted Answer

Assign a Security Baseline policy in Microsoft Intune to the device groups. Option A is correct because Security Baselines in Intune allow you to assess and enforce compliance. Option B is for device-level configuration, but not specifically for baseline compliance. Option C is for Defender for Cloud Apps, not endpoints. Option D is for Windows Update, not baseline compliance.

Answer

Configure a device configuration profile in Microsoft Intune

Answer

Deploy Windows Update for Business reports

Answer

Enable Microsoft Defender for Cloud Apps session controls

Question 6

Refer to the exhibit. You are reviewing an analytics rule in Microsoft Sentinel. The rule is enabled but has not generated any alerts in the past 24 hours. What is the most likely cause?

Accepted Answer

Suppression is enabled with a duration of 6 hours, which may be suppressing new alerts after the first one. Option C is correct. The suppression is enabled with a duration of 6 hours, meaning after an alert is generated, no new alerts are created for the same rule for 6 hours. If an alert was generated yesterday, suppression could prevent new alerts. Option A is possible but less likely because the query uses 'unknown' location which may still match. Option B is not an issue; the rule will run every hour. Option D is not a problem.

Answer

The triggerThreshold is set to 0, which means no alerts will be generated

Answer

The queryFrequency is 1 hour and the queryPeriod is 7 days, which is a mismatch

Answer

The query uses 'Location == Unknown' but the actual sign-in location is not 'Unknown'

Question 7

Your organization uses Microsoft Sentinel and has enabled UEBA (User and Entity Behavior Analytics). You notice that the UEBA timeline is not populating for some users. You have verified that the data sources are connected and the UEBA feature is enabled. What could be the issue?

Accepted Answer

There is insufficient data to build baselines for those users; UEBA needs at least 14 days of data.. Option C is correct because UEBA requires a minimum amount of data over time to establish baselines. Option A is wrong because UEBA does not require user consent. Option B is wrong because data is flowing. Option D is wrong because UEBA uses existing data.

Answer

Users must opt in to UEBA tracking.

Answer

UEBA only works with Azure Active Directory (now Microsoft Entra ID) audit logs.

Answer

The data sources are not sending logs for those users.

Question 8

Refer to the exhibit. You are reviewing a playbook configuration in Microsoft Sentinel. The playbook is supposed to create a task to generate a ServiceNow ticket and notify the SOC manager when a high-severity alert is triggered. However, when a high-severity alert occurs, only the notification task is created, and the ticket creation task is missing. What is the most likely cause?

Accepted Answer

The alertRuleId is a placeholder and does not correspond to a real analytics rule in the environment.. Option D is correct because the playbook JSON shows that the alertRuleId is a placeholder 'a8144c0a-...' which is incomplete and likely invalid. If the playbook cannot resolve the alert rule, it may fail partially. Option A is wrong because the structure is valid. Option B is wrong because only one trigger type is supported. Option C is wrong because there is no condition on severity; the trigger has severity filter but it's correct.

Answer

The playbook uses an unsupported trigger type.

Answer

The playbook JSON has an invalid structure for the trigger.

Answer

The severity filter is incorrectly specified; it should be an array of strings.

Question 9

You are a security operations analyst at a company that uses Microsoft Sentinel. You need to ensure that all incidents generated from Microsoft Defender for Cloud Apps are automatically assigned to the same SOC team. The team uses Microsoft Teams to collaborate. Which configuration should you implement?

Accepted Answer

Create an automation rule that sets the owner to the team entity.. Option B is correct because automation rules in Microsoft Sentinel can be configured to automatically assign incidents to a specific owner (team) based on conditions like provider. Microsoft Teams integration for collaboration is done via the Teams connector or custom solutions, not directly through automation rules. Automation rules handle assignment, not direct Teams messaging. Playbooks can post to Teams but assignment is done by automation rules. So B is the most direct and correct answer.

Answer

Create a playbook that assigns the incident to the team and configure an automation rule to run it.

Answer

Configure the Microsoft Defender for Cloud Apps connector to assign incidents to the team.

Answer

Use a logic app to automatically post incidents to a Teams channel and have the team claim them.

Question 10

Which TWO of the following are required to enable Microsoft Sentinel to receive alerts from Microsoft Defender for Cloud? (Choose two.)

Accepted Answer

Install the 'Microsoft Defender for Cloud' data connector in Microsoft Sentinel.. Options A and B are correct. You need to enable the connector in Sentinel (A) and ensure Defender for Cloud is enabled on the subscription (B). Option C is optional for multi-cloud, not required. Option D is wrong because Defender for Cloud generates alerts without Azure Policy. Option E is wrong because the Log Analytics agent is not needed for Defender for Cloud alerts.

Answer

Deploy the Log Analytics agent on all VMs.

Answer

Connect a non-Azure machine using Azure Arc.

Answer

Assign an Azure Policy to enable Defender for Cloud.

Question 11

Which TWO actions require the Global Administrator role in Microsoft 365?

Accepted Answer

Configure tenant-wide settings in Microsoft 365. Correct options are A and B because managing roles in Azure AD (Entra ID) and configuring Microsoft 365 tenant-level settings both require Global Administrator. Option C can be done by Security Administrator. Option D can be done by Security Reader. Option E can be done by Compliance Administrator.

Answer

Create a data loss prevention (DLP) policy in Microsoft Purview

Answer

Create a custom role in Microsoft Defender XDR

Answer

View the Microsoft 365 Defender incident queue

Question 12

Your organization uses Microsoft Defender for Office 365. You need to ensure that when a user reports a phishing email via the built-in Outlook add-in, an automated investigation is triggered in Microsoft 365 Defender. What should you configure?

Accepted Answer

Enable user-reported message settings in the Microsoft 365 Defender portal.. Option D is correct because the user-reported message settings define how reported emails trigger automated actions. Option A is wrong because anti-phishing policies protect against phishing, not handling user reports. Option B is wrong because safe attachments policies handle attachments. Option C is wrong because safe links policies handle URLs.

Answer

Define a safe links policy.

Answer

Configure an anti-phishing policy.

Answer

Set up a safe attachments policy.

Question 13

You are configuring Microsoft Sentinel automation rules to handle incidents generated from Microsoft Defender for Cloud. You need to ensure that when a high-severity security alert is triggered, an automated response runs a playbook that creates a support ticket in ServiceNow. However, the playbook fails to execute for some alerts. Upon investigation, you find that the automation rule is triggered only when the incident is created. What is the most likely cause of the failure?

Accepted Answer

The automation rule is configured to trigger only on incident creation, but the playbook requires the incident to be in an updated state.. Option B is correct because automation rules can run when incidents are created or updated, but the condition 'incident creation' will not trigger again on subsequent updates. If the playbook requires an updated incident (e.g., after alert grouping), it won't run. Option A is wrong because automation rules in Sentinel can trigger on incident creation. Option C is wrong because playbooks can be called by automation rules. Option D is wrong because the issue is not related to Microsoft Entra ID permissions.

Answer

The automation rule lacks permissions to the ServiceNow connector because of Microsoft Entra ID conditional access policies.

Answer

Playbooks cannot be called by automation rules in Microsoft Sentinel.

Answer

Automation rules cannot be triggered on incident creation from Microsoft Defender for Cloud.

Question 14

You are managing Microsoft Defender for Endpoint. Which TWO actions can be taken directly from the Microsoft 365 Defender portal to respond to a compromised device?

Accepted Answer

Run a full antivirus scan on the device.. Option A and C are correct. From the Defender for Endpoint portal, you can isolate a device (A) and run a full antivirus scan (C). Option B is wrong because you cannot reset a device's password from Defender for Endpoint; that is done via Microsoft Entra ID. Option D is wrong because you cannot remotely wipe a device (Intune). Option E is wrong because you cannot block a user's sign-in from Defender for Endpoint (Entra ID).

Answer

Block the user's sign-in from Microsoft Entra ID.

Answer

Remotely wipe the device.

Answer

Reset the device's local administrator password.

Question 15

Your organization uses Microsoft Defender for Office 365. You need to configure a policy that automatically moves emails detected as 'Bulk' to the user's Junk Email folder. However, users must be able to override this by adding the sender to their Safe Senders list. What should you configure?

Accepted Answer

Anti-spam policy with Bulk email threshold set to a value that triggers junk action. Option B is correct because the anti-spam policy in Defender for Office 365 has a 'Bulk email threshold' that can be set, and users can override via Safe Senders. Option A is for phishing, not bulk; Option C is for malware; Option D is for connection filtering.

Answer

Anti-phishing policy

Answer

Malware filter policy

Answer

Connection filter policy