SC-200 Practice Test 48 — 15 Questions

Question 1

A company uses Microsoft Defender for Cloud with Defender for Servers enabled. They also run SQL Server on Azure Virtual Machines (IaaS). The security team wants to enable Advanced Threat Protection (ATP) for these SQL Server IaaS instances to detect threats like SQL injection. What is the single most effective action to achieve this?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Enable the Defender for SQL plan on the management group or subscription. The Defender for SQL plan in Microsoft Defender for Cloud provides Advanced Threat Protection (ATP) for Azure SQL Database, Azure SQL Managed Instance, and SQL Server on Azure VMs. Enabling this plan at the management group or subscription level automatically protects all current and future SQL Server IaaS instances within that scope, including threat detection for SQL injection attacks, without requiring per-VM agent installation.

Answer

Install the SQL IaaS Agent extension on each VM

Answer

Configure a vulnerability assessment solution on each SQL Server

Answer

Enable Azure SQL Database Threat Detection policy

Question 2

A company uses Microsoft Sentinel with the Microsoft 365 Defender connector. The security team notices that alerts from Microsoft Defender for Endpoint (MDE) are not appearing in Sentinel. The MDE data connector status shows 'Connected'. Which step should you take to troubleshoot this issue?

Accepted Answer

Check the Microsoft 365 Defender portal to ensure MDE alerts are being generated and forwarded to Microsoft 365 Defender.. The Microsoft 365 Defender connector in Microsoft Sentinel ingests alerts that have already been generated and forwarded by Microsoft Defender for Endpoint (MDE) to the Microsoft 365 Defender portal. Even if the connector status shows 'Connected', if MDE alerts are not being generated or forwarded to Microsoft 365 Defender (e.g., due to a licensing issue, misconfigured alert policy, or service health problem), they will never reach Sentinel. Therefore, the first troubleshooting step is to verify alert generation and forwarding at the source in the Microsoft 365 Defender portal.

Answer

Verify that the Microsoft 365 Defender connector is configured to ingest MDE alerts.

Answer

Check if the Microsoft Defender for Endpoint data connector is added.

Answer

Verify that the ingestion rules in Sentinel are not filtering out MDE alerts.

Question 3

A company uses Microsoft Defender for Cloud with enhanced security features enabled. They recently deployed a new Azure Kubernetes Service (AKS) cluster and want to ensure it is protected by Defender for Containers. What must they do to enable protection?

Accepted Answer

Enable the Defender for Containers plan for the subscription in Defender for Cloud.. Defender for Containers is a plan-level feature in Microsoft Defender for Cloud that must be enabled at the subscription level. Once enabled, it automatically discovers and protects AKS clusters without requiring any manual agent installation on nodes, as it uses the Defender sensor deployed by AKS itself. This is the only action needed to enable protection for the new AKS cluster.

Answer

Install the Microsoft Defender for Cloud agent on the AKS nodes.

Answer

Create a Log Analytics workspace and connect AKS to it.

Answer

Enable Azure Policy for AKS.

Question 4

An organization uses Microsoft 365 Defender. An automated investigation on a device identifies a malicious file and blocks it. The analyst now wants to allow a specific trusted application that was incorrectly blocked, while keeping other malicious files blocked. Which action should the analyst take from the device's entity page?

Accepted Answer

Use the 'Add indicator' feature to create a custom IOC for the file hash with action 'Allow'.. The 'Add indicator' feature in Microsoft Defender XDR allows analysts to create custom indicators of compromise (IOCs) based on file hashes, IPs, or domains. By setting the action to 'Allow' for the specific file hash, the analyst can override the automated block for that trusted application while keeping other malicious files blocked. This is the correct approach because it provides granular control without affecting the overall automated investigation settings.

Answer

Initiate a live response session and delete the file manually.

Answer

Change the automated investigation settings to 'No action' and rerun investigation.

Answer

Collect the file for analysis; the allow decision must be made by Microsoft after analysis.

Question 5

An organization uses Microsoft Defender for Office 365. A security analyst wants to configure automated investigation and response (AIR) for email threats. When a user reports a phishing email using the Report Message add-in, which automated action can be triggered by an AIR playbook?

Accepted Answer

Soft-delete the email from the user's mailbox and other mailboxes that received the same message.. When a user reports a phishing email via the Report Message add-in, the automated investigation and response (AIR) playbook in Microsoft Defender for Office 365 can automatically soft-delete the email from the user's mailbox and from all other mailboxes that received the same message. This action is part of the built-in remediation steps that AIR can take after confirming the threat, leveraging the email entity's hash or message ID to perform tenant-wide removal via the threat protection pipeline.

Answer

Trigger a training campaign for the user who reported the email.

Answer

Move the email to the tenant's shared mailbox for review.

Answer

Remove the Report Message add-in from Outlook to prevent false reports.

Question 6

A large enterprise uses Microsoft Defender for Cloud with all enhanced security plans (e.g., Defender for Servers, Defender for SQL) enabled on a management group. The security team wants to automatically enable these plans on new Azure subscriptions that are created under this management group. Which approach is the most efficient and scalable?

Accepted Answer

Use an Azure Policy definition that enforces the Microsoft Defender for Cloud pricing tier (Standard) at the management group scope.. Azure Policy can be assigned at the management group scope to enforce the 'Standard' pricing tier for Microsoft Defender for Cloud on all current and future subscriptions. This ensures that when a new subscription is created under that management group, the policy automatically evaluates and remediates the subscription to enable the required Defender plans, providing a fully automated, scalable, and governance-driven approach without manual intervention or custom scripting.

Answer

Manually enable the plans for each new subscription when it is created.

Answer

Create an Azure Automation runbook that runs on a schedule and enables plans for all subscriptions under the management group.

Answer

Use Azure Blueprints to define the Defender for Cloud settings in the blueprint definition.

Question 7

A company wants to be alerted when a virtual machine is exposed to the internet through a permissive network security group rule. Which Microsoft Defender for Cloud feature provides recommendations and alerts for such misconfigurations?

Accepted Answer

Adaptive network hardening. Adaptive network hardening (ANH) in Microsoft Defender for Cloud analyzes actual traffic patterns, NSG rules, and internet-facing endpoints to identify overly permissive rules that expose VMs to the internet. It then provides actionable recommendations to tighten those rules and can generate security alerts when such misconfigurations are detected. This directly matches the requirement for alerts on internet exposure via permissive NSG rules.

Answer

Just-in-time VM access

Answer

File integrity monitoring

Answer

Application controls

Question 8

A security administrator wants to view the overall security posture of all Azure subscriptions in a single numerical score. Which dashboard in Microsoft Defender for Cloud provides this score based on implemented security controls?

Accepted Answer

Secure Score dashboard. The Secure Score dashboard in Microsoft Defender for Cloud aggregates the security posture across all Azure subscriptions into a single numerical score. This score is calculated based on the implementation of security controls and recommendations, providing a quantifiable measure of your overall security hygiene.

Answer

Regulatory compliance dashboard

Answer

Inventory dashboard

Answer

Recommendations dashboard

Question 9

A SOC analyst is creating a scheduled analytics rule in Microsoft Sentinel to detect potential account compromise. The rule should trigger when a user account is created in Microsoft Entra ID and, within one hour, that same account is used to sign in from an unfamiliar location. The queries use the AuditLogs table for account creation and the SigninLogs table for sign-ins. Which KQL operator should be used to correlate these two events from different tables within a specific time window?

Accepted Answer

join. (join) because the scenario requires correlating two events from different tables (AuditLogs and SigninLogs) based on a common field (e.g., UserPrincipalName) and within a specific time window (one hour). The join operator in KQL allows you to combine rows from two tables by matching keys, and you can use the 'where' clause on the time fields to enforce the one-hour window. This is the only operator that supports row-wise correlation across tables with a time constraint.

Answer

where

Answer

union

Answer

summarize

Question 10

Your organization uses Microsoft Sentinel and Microsoft Defender for Cloud. You need to ensure that security incidents from Defender for Cloud are automatically sent to Sentinel. What should you configure?

Accepted Answer

Configure the Microsoft Defender for Cloud data connector. The Microsoft Defender for Cloud data connector is the correct choice because it is specifically designed to ingest security alerts and incidents from Defender for Cloud into Microsoft Sentinel. This connector enables automatic synchronization of Defender for Cloud's security findings, ensuring that incidents are created in Sentinel without manual intervention or custom infrastructure.

Answer

Configure the Azure Active Directory data connector

Answer

Create an Azure Event Hub and push Defender for Cloud alerts to Sentinel via a custom connector

Answer

Configure the Microsoft 365 Defender data connector

Question 11

An organization uses Microsoft Defender for Cloud and has enabled enhanced security features. They want to receive alerts when a user attempts to connect to an Azure VM via RDP from a public IP address that is not in a predefined list of trusted IP ranges. Which Defender for Cloud plan or feature provides this capability?

Accepted Answer

Just-In-Time (JIT) VM access. Just-In-Time (JIT) VM access in Microsoft Defender for Cloud allows you to lock down inbound traffic to Azure VMs, reducing exposure to attacks while providing easy access when needed. When enabled, JIT creates rules in the network security group (NSG) that permit RDP (TCP 3389) or SSH (TCP 22) traffic only from specific IP addresses or ranges that you define, and only during a requested time window. If a user attempts an RDP connection from a public IP not in the trusted list, Defender for Cloud generates an alert, as the traffic is blocked by the JIT policy.

Answer

Adaptive network hardening

Answer

Network security groups (NSG) flow logs

Answer

File Integrity Monitoring (FIM)

Question 12

Which of the following resource types are supported by Microsoft Defender for Cloud's workload protection plans? (Select all that apply.) (Choose 3.)

Accepted Answer

Azure virtual machines. Microsoft Defender for Cloud's workload protection plans support Azure virtual machines by providing integrated threat detection and advanced security features like just-in-time VM access, file integrity monitoring, and vulnerability assessments. These capabilities leverage the Microsoft Monitoring Agent or Azure Monitor Agent to analyze security events and detect suspicious activities within the VM's operating system and network traffic.

Answer

Azure Logic Apps

Question 13

In Microsoft Defender for Cloud, what does the Secure Score represent?

Accepted Answer

The overall security posture of your resources, based on implemented security controls and recommendations.. The Secure Score in Microsoft Defender for Cloud is a numeric representation of your overall security posture, calculated based on the implementation of security controls and the remediation of recommendations. It aggregates the status of all assessed resources against security best practices, providing a single score that reflects how well you are protecting your workloads. This score helps prioritize actions to improve security, as each recommendation contributes a specific number of points toward the total possible score.

Answer

The number of currently active security alerts.

Answer

The percentage of compliance with the Azure Security Benchmark.

Answer

The number of VMs that have been assessed for vulnerabilities.

Question 14

A company wants to enable Microsoft Defender for Cloud's enhanced security features for all Azure virtual machines in a subscription. What is the first action they should take in the Defender for Cloud pricing & settings page?

Accepted Answer

Turn on the 'Servers' plan for the subscription. To enable Microsoft Defender for Cloud's enhanced security features for Azure VMs, the first step is to turn on the 'Servers' plan at the subscription level in the Defender for Cloud pricing & settings page. This activates Defender for Servers, which provides threat detection, vulnerability assessment, and just-in-time access. Without enabling this plan, no enhanced security features are available, regardless of other configurations.

Answer

Install the Log Analytics agent on each VM

Answer

Enable vulnerability assessment

Answer

Assign a regulatory compliance policy

Question 15

A SOC analyst needs to ingest firewall logs from an on-premises Cisco ASA into Microsoft Sentinel. The logs are sent via syslog to a Linux server. Which data connector should the analyst use to properly parse and collect these logs?

Accepted Answer

Common Event Format (CEF). The Common Event Format (CEF) connector is the correct choice because Cisco ASA firewalls send syslog messages that can be forwarded to a Linux log collector (rsyslog or syslog-ng), which then formats them into CEF (a normalized syslog format) before forwarding to the Sentinel Log Analytics workspace. This connector parses the CEF headers and maps the fields into the CommonSecurityLog table, enabling proper parsing and correlation of firewall events.

Answer

Syslog

Answer

Windows Firewall

Answer

Cisco ASA via API