SC-200 Practice Test 47 — 15 Questions

Question 1

A security analyst is investigating a phishing incident in Microsoft 365 Defender. They need to view the original email's sender, delivery action, and any automated remediation steps taken. Which entity page should the analyst open?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Email entity page. The Email entity page in Microsoft 365 Defender (part of Microsoft Defender XDR) is specifically designed to provide a comprehensive view of an email message, including the original sender, delivery action (e.g., delivered, quarantined, blocked), and any automated remediation steps (e.g., zero-hour auto purge, soft delete). This page aggregates data from Exchange Online Protection (EOP) and Microsoft Defender for Office 365, making it the correct choice for investigating phishing incidents.

Answer

User entity page

Answer

Device entity page

Answer

IP entity page

Question 2

A SOC analyst creates a watchlist in Microsoft Sentinel from a CSV file containing IP ranges (10.0.0.0/16) and a tag. The analyst wants to use this watchlist in a KQL query to check if a sign-in IP is within the ranges. Which KQL function should be used?

Accepted Answer

_GetWatchlist('name') and use the ipv4_is_in_range function with the watchlist as a parameter. The `ipv4_is_in_range` function is designed to check whether an IPv4 address falls within a specified CIDR range. When combined with `_GetWatchlist('name')`, you can iterate over the watchlist entries and use `ipv4_is_in_range` to compare the sign-in IP against each range. This is the only approach that correctly handles CIDR notation (e.g., 10.0.0.0/16) rather than performing string matching or exact value comparison.

Answer

_GetWatchlist('name') and use the has operator

Answer

_GetWatchlist('name') and use the in operator

Answer

_GetWatchlist('name') and use the contains operator

Question 3

In Microsoft 365 Defender, after an automated investigation completes, where can an analyst review the specific remediation actions that were taken (e.g., file quarantine, device isolation)?

Accepted Answer

Action center. The Action center in Microsoft 365 Defender is the centralized location where all manual and automated remediation actions (such as file quarantine, device isolation, and process termination) are tracked and can be reviewed or approved. After an automated investigation completes, the specific actions taken are recorded in the Action center's history tab, allowing analysts to see exactly what was executed and the outcome. This is distinct from the Incident timeline, which shows alerts and events but not the detailed remediation action records.

Answer

Incident timeline

Answer

Threat analytics

Answer

Device inventory

Question 4

Your organization uses Microsoft Defender for Cloud Apps to monitor SaaS applications. You discover that a user is downloading a large number of files from SharePoint Online to an unmanaged device. You need to automatically block the download and require the user to acknowledge a policy violation. Which action should you configure in a session policy?

Accepted Answer

Set the action to 'Block' and enable 'Notify user' with a customized message.. A session policy in Microsoft Defender for Cloud Apps can enforce real-time controls on SaaS app traffic. Setting the action to 'Block' stops the download immediately, and enabling 'Notify user' with a customized message both blocks the action and requires the user to acknowledge the policy violation, satisfying the requirement to automatically block and obtain acknowledgment.

Answer

Set the action to 'Monitor only'.

Answer

Set the action to 'Redirect to Microsoft Entra ID conditional access'.

Answer

Set the action to 'Block' and enable 'Custom block message'.

Question 5

Your company is deploying Microsoft Sentinel in a multi-tenant environment using Azure Lighthouse. You need to ensure that SOC analysts can triage incidents across all tenants from a single workspace. What is the minimum configuration required?

Accepted Answer

Onboard each tenant as a delegated resource under Azure Lighthouse, then route all logs to a single Sentinel workspace in the managing tenant.. Azure Lighthouse enables multi-tenant management by delegating subscriptions or resource groups from each tenant as delegated resources to the managing tenant. Once delegated, you can configure a single Microsoft Sentinel workspace in the managing tenant to ingest logs from all delegated tenants via diagnostic settings, allowing SOC analysts to triage incidents centrally without needing separate workspaces or cross-workspace queries.

Answer

Create a second Sentinel workspace in the managing tenant and configure cross-workspace queries.

Answer

Configure Azure AD B2B collaboration to grant external users access to each tenant's Sentinel workspace.

Answer

Use Azure Policy to enforce a standard analytics rule across all tenants.

Question 6

A security analyst is using Microsoft Defender for Cloud's adaptive application controls (AAC) to allowlist trusted applications on Azure VMs. After enabling AAC and running in 'Audit' mode for a week, the analyst wants to switch to 'Enforce' mode. Which pre-requisite must be met before enforcement can be applied?

Accepted Answer

The VM must have a baseline of allowed applications generated from at least two weeks of audit data.. Adaptive application controls require a minimum of two weeks of audit data to establish a reliable baseline of allowed applications before enforcement can be applied. This baseline ensures that legitimate applications are not blocked when switching from Audit to Enforce mode, reducing false positives and operational disruptions.

Answer

The VM must have the Guest Configuration extension installed.

Answer

A valid Microsoft Defender for Servers Plan 2 license must be assigned to the VM.

Answer

The VM must be running on a supported operating system like Windows Server 2016 or later.

Question 7

Refer to the exhibit. A security analyst creates a scheduled analytics rule in Microsoft Sentinel based on the JSON shown. After enabling the rule, the analyst notices that the rule generates alerts every hour for the same user accounts even after the incidents are resolved. What is the most likely cause?

Accepted Answer

Suppression is disabled, so the rule fires every hour with overlapping results. In Microsoft Sentinel, an analytics rule with suppression disabled will fire every time its query period elapses and the query returns results, even if those results overlap with previously generated incidents. Since the rule runs hourly and the query period likely covers a window that includes the same user accounts, it repeatedly generates alerts for the same entities. Enabling suppression (or configuring the rule to group and suppress duplicate alerts) prevents this repetitive firing.

Answer

The severity is set to High, causing multiple alerts

Answer

The query period is too short, causing the rule to refetch old data

Answer

The trigger threshold is too low, causing the rule to fire too often

Question 8

A SOC analyst wants to create a scheduled analytics rule in Microsoft Sentinel that runs every 5 minutes and alerts when a single IP address fails to authenticate more than 10 times in that time window using the Microsoft Entra ID SigninLogs table. Which KQL function should be used to group the results into 5-minute intervals?

Accepted Answer

bin(). The `bin()` function is the correct choice because it is specifically designed to group time-series data into fixed-size buckets (e.g., 5-minute intervals) for aggregation. In this scenario, you need to align each authentication event to its corresponding 5-minute window so that you can count failures per IP address per window. Without `bin()`, the `summarize` operator would not automatically create these fixed intervals; it would group by the raw timestamp values, which would not produce the required 5-minute buckets.

Answer

summarize

Answer

count

Answer

where

Question 9

An organization uses Microsoft Defender for Office 365. The security team wants to automatically remove from all user mailboxes any messages that were already delivered but are later identified as malicious. Which feature should they enable?

Accepted Answer

Zero-hour auto purge (ZAP). Zero-hour auto purge (ZAP) is the correct feature because it automatically detects and removes malicious messages that have already been delivered to user mailboxes, including messages retroactively identified as threats after delivery. ZAP acts on phishing, malware, and spam verdicts by querying the mailbox for the original message and moving it to the Junk Email folder or deleting it, based on the configured policy. This directly meets the requirement to remove already-delivered malicious messages without manual intervention.

Answer

Automated investigation and response (AIR)

Answer

Safe Attachments

Answer

Safe Links

Question 10

A security analyst is investigating an incident in Microsoft 365 Defender where a device is detected as infected with a trojan. The analyst wants to use automated investigation to contain the threat. Which action can be automatically taken on the affected device as part of a standard AIR playbook for endpoint detection and response?

Accepted Answer

Initiate a device isolation.. In Microsoft Defender for Endpoint, the Automated Investigation and Response (AIR) playbook for endpoint detection and response includes the ability to isolate a device from the network. This action stops the device from communicating with other devices or the internet, containing the threat while allowing the investigation to continue. Option D is correct because device isolation is a standard containment action in the AIR playbook for trojan infections.

Answer

Remove the user account from the device.

Answer

Execute a full antivirus scan on the device.

Answer

Disable the network adapter.

Question 11

A security analyst is hunting for a targeted phishing attack in Microsoft 365 Defender. They have identified a phishing email delivered to a user and want to find all devices where the user clicked the link in the email, and any processes that were spawned from the browser on those devices. Which advanced hunting strategy is most effective to correlate the email, network, and process data?

Accepted Answer

Query EmailUrlInfo for the URL, then DeviceNetworkEvents for devices that connected to that URL, then DeviceProcessEvents for processes on those devices that started shortly after the connection.. It directly correlates the malicious URL from the email (via EmailUrlInfo) with devices that connected to that URL (via DeviceNetworkEvents), then identifies any processes spawned on those devices shortly after the connection (via DeviceProcessEvents). This sequence maps the attack chain from email delivery to network connection to post-click process execution, which is exactly what the analyst needs to find devices where the link was clicked and any resulting processes.

Answer

Query EmailEvents for the email, then DeviceLogonEvents for user logons, then DeviceProcessEvents for process creations after logon.

Answer

Query EmailAttachmentInfo, then DeviceFileEvents for files dropped.

Answer

Query IdentityLogonEvents, then DeviceEvents from the device where the logon occurred.

Question 12

A security analyst wants to identify all devices in the organization that have a specific software vulnerability (CVE-2023-1234) installed using Microsoft 365 Defender Advanced Hunting. Which table should be queried?

Accepted Answer

DeviceTvmSoftwareVulnerabilities. The DeviceTvmSoftwareVulnerabilities table in Microsoft 365 Defender Advanced Hunting contains records of software vulnerabilities discovered on devices, including specific CVE identifiers like CVE-2023-1234. This table is designed to answer questions about which devices have a particular vulnerability installed, as it links device IDs to vulnerability details such as CVE ID, severity, and exploitability.

Answer

DeviceInfo

Answer

DeviceTvmSoftwareInventory

Answer

DeviceNetworkInfo

Question 13

A SOC analyst needs to create a scheduled analytics rule in Microsoft Sentinel that detects when a user logs in from an IP address that is not in a predefined list of known corporate IP ranges. The list is maintained as a custom Sentinel watchlist and frequently updated. Which KQL function should the analyst use to reference the watchlist within the rule's query?

Accepted Answer

_GetWatchlist(). The _GetWatchlist() function is the correct KQL function to reference a custom Sentinel watchlist within an analytics rule query. It retrieves the watchlist content as a table, allowing the analyst to join or filter login events against the known corporate IP ranges. This function is specifically designed for Sentinel watchlists and supports frequent updates without modifying the rule query.

Answer

externaldata()

Answer

lookup()

Answer

invoke()

Question 14

An organization uses Microsoft 365 Defender. During an incident, the analyst wants to automatically isolate a compromised device from the network while allowing communication with a specific list of trusted IP addresses (e.g., for patching). Which action in an automated investigation and response (AIR) playbook for endpoints can achieve this?

Accepted Answer

Isolate device. The 'Isolate device' action in Microsoft Defender for Endpoint's automated investigation and response (AIR) playbook can be configured to isolate a device from the network while allowing communication with a specified list of trusted IP addresses (e.g., for patching or compliance). This is achieved through the 'selective isolation' capability, which uses Windows Filtering Platform (WFP) to block all inbound/outbound traffic except to the defined IPs. Option B is correct because it directly matches the requirement to maintain connectivity to trusted endpoints during isolation.

Answer

Run antivirus scan

Answer

Contain device

Answer

Restrict app execution

Question 15

A SOC analyst wants to leverage Microsoft Sentinel's User and Entity Behavior Analytics (UEBA) to detect anomalous sign-in attempts where a user signs in from a country outside their typical pattern. The analyst needs to create an analytics rule that queries the necessary UEBA data. Which Sentinel table should the rule's KQL query primarily reference to evaluate geographic anomalies?

Accepted Answer

BehaviorAnalytics. The BehaviorAnalytics table in Microsoft Sentinel is specifically designed to store UEBA output, including normalized user behavior data such as historical geo-location patterns and anomaly scores. By querying this table, the analyst can directly access pre-computed anomalies for sign-in location deviations without needing to perform complex baseline calculations on raw SigninLogs.

Answer

SigninLogs

Answer

IdentityInfo

Answer

AADUserRiskEvents