SC-200 Practice Test 48 — 15 Questions

Question 1

Your organization uses Microsoft Sentinel and you are designing a data retention strategy. You have a Log Analytics workspace with the following tables: SecurityEvent, SigninLogs, and CommonSecurityLog. The compliance team requires that SigninLogs be retained for 7 years, while other tables can be retained for 1 year. Which THREE steps must you take to meet this requirement?

Accepted Answer

Set the workspace retention to 7 years.. Option A, B, and D are correct. Option A is required to set workspace retention to the maximum (7 years) to allow for table-level retention. Option B is required to configure table-level retention for SigninLogs. Option D is required because the compliance team needs to retain for 7 years. Option C is wrong because archiving is not needed if retention is set to 7 years. Option E is wrong because interactive retention can be set to 7 years without archiving.

Answer

Set an archiving policy to move SigninLogs to cold storage after 1 year.

Answer

Enable Azure Data Explorer (ADX) for long-term storage.

Question 2

You are responsible for Microsoft Defender for Cloud Apps. The security team reports that they are not receiving alerts for suspicious activities from a specific connected app (Salesforce). You verify that the app is connected and the log collection is working. What should you check next?

Accepted Answer

Ensure that the anomaly detection policy for Salesforce is enabled in Defender for Cloud Apps.. Option B is correct because Defender for Cloud Apps has anomaly detection policies that need to be enabled for each app. If the policy is not enabled, alerts will not be generated. Option A is wrong because the app is already connected. Option C is wrong because Microsoft Entra ID is not directly involved in alert generation. Option D is wrong because IP address ranges are for categorization, not alert generation.

Answer

Review the IP address ranges configured for the Salesforce app.

Answer

Check if the Salesforce app connector is properly configured in Microsoft Entra ID.

Answer

Verify that the Salesforce tenant is licensed for Microsoft Entra ID P2.

Question 3

You are a Microsoft Security Operations Analyst. Your organization recently deployed Microsoft Defender for Cloud Apps. You need to ensure that alerts generated by Defender for Cloud Apps are automatically forwarded to Microsoft Sentinel. What should you configure?

Accepted Answer

In Microsoft Sentinel, add the Microsoft Defender for Cloud Apps data connector.. Option A is correct because the data connector in Microsoft Sentinel for Microsoft Defender for Cloud Apps enables ingestion of alerts. The other options do not forward alerts to Sentinel.

Answer

In Microsoft Sentinel, create an analytics rule with a query that pulls data from Defender for Cloud Apps API.

Answer

In Microsoft Defender for Cloud Apps, configure SIEM integration.

Answer

In Microsoft Sentinel, configure a playbook to retrieve alerts from Defender for Cloud Apps.

Question 4

You are configuring Microsoft Sentinel analytics rules. Which THREE of the following are valid types of analytics rules in Microsoft Sentinel?

Accepted Answer

Fusion rule. Option A, B, and C are correct. Scheduled query rules (A) run on a schedule, Microsoft Security (B) rules create incidents from security alerts, and Fusion (C) rules use machine learning to detect multi-stage attacks. Option D is wrong because Watchlist rules are not a rule type; watchlists are used for enrichment. Option E is wrong because Playbook rules are not a rule type; playbooks are automated responses.

Answer

Watchlist rule

Answer

Playbook rule

Question 5

A security operations center (SOC) uses Microsoft Sentinel. You need to ensure that when a high-severity incident is created, an automated email notification is sent to the on-call security engineer. Which automation option should you use?

Accepted Answer

Create a playbook that sends an email and associate it with an automation rule that triggers on high-severity incidents.. Option D is correct because playbooks can be triggered by incidents and include actions like sending emails. Automation rules can trigger playbooks. The other options do not directly send emails.

Answer

Set an analytics rule to run a KQL query and send email.

Answer

Create a workbook that emails the on-call engineer daily.

Answer

Configure a logic app manually triggered by the analyst.

Question 6

Your organization uses Microsoft Defender XDR. You need to investigate a potential ransomware incident that has affected multiple devices. The security team wants to identify the initial access vector. Which advanced hunting table should you query to find the process that initiated the encryption?

Accepted Answer

DeviceProcessEvents. Option A is correct because DeviceProcessEvents contains process creation events, which can show which process started the ransomware. Option B has file creation, not process; Option C has network connections; Option D has registry events.

Answer

DeviceRegistryEvents

Answer

DeviceFileEvents

Answer

DeviceNetworkEvents

Question 7

You are investigating a phishing incident in Microsoft Defender for Office 365. Which THREE pieces of information are available in the Threat Explorer?

Accepted Answer

Sender IP address. Options A, B, and C are correct. Threat Explorer provides email details, delivery actions, and sender IP. Option D is available in a different tool; Option E is not available.

Answer

Email body content

Answer

User's mailbox audit log

Question 8

Your Microsoft Defender XDR environment has an advanced hunting query that returns devices potentially affected by a known vulnerability. You want to create a custom detection rule that triggers an alert when more than 10 devices are affected. Which THREE steps are required?

Accepted Answer

Set the rule frequency and threshold to trigger when the query returns more than 10 results.. Options A, C, and D are correct. You need to save the query as a custom detection rule, configure the threshold, and set the action to generate an alert. Option B is not required because the rule runs on a scheduled basis; Option E is for Power Automate flows, not necessary.

Answer

Assign the rule to a severity level.

Answer

Create a Power Automate flow to send an email when the rule triggers.

Question 9

Your company has a hybrid environment with Microsoft Sentinel and Microsoft Defender for Cloud. You notice that the 'Priority' field in Sentinel incidents is not being populated correctly. You need to ensure that Sentinel incidents inherit the priority from Microsoft Defender for Cloud alerts. What should you configure?

Accepted Answer

Configure the Microsoft Defender for Cloud data connector to map severity and use an automation rule to set priority based on severity.. Option D is correct because the data connector for Microsoft Defender for Cloud maps the alert's severity to Sentinel's severity, and priority can be set via an automation rule. Option A is wrong because analytics rules don't inherit from external alerts. Option B is wrong because Sentinel doesn't sync priority from Microsoft Defender for Cloud directly. Option C is wrong because workbooks don't modify incident fields.

Answer

Enable the 'Sync incidents and alerts' setting in Microsoft Defender XDR.

Answer

Use a workbook to display priority and manually update incidents.

Answer

Create an analytics rule that queries Microsoft Defender for Cloud alerts and sets the priority in the incident creation.

Question 10

Your organization uses Microsoft Sentinel and Microsoft Defender for Cloud. You need to implement a solution that automatically suppresses low-severity incidents from specific IP addresses that are known internal scanners. Which THREE configurations should you make?

Accepted Answer

Add the IP addresses to a watchlist and reference it in analytics rules.. Options A, C, and D are correct. Analytics rules can be set to suppress, automation rules can close incidents, and watchlists can be used for known IPs. Option B is wrong because Microsoft Defender for Cloud doesn't suppress Sentinel incidents. Option E is wrong because playbooks cannot suppress incidents before creation.

Answer

Create a suppression rule in Microsoft Defender for Cloud.

Answer

Create a playbook that deletes incidents from those IP addresses.

Question 11

Your organization uses Microsoft Defender XDR and Microsoft Sentinel in a hybrid deployment. You need to ensure that all incidents from Defender XDR are synchronized to Sentinel and that any changes to incident status in Sentinel are reflected back in Defender XDR. Which THREE components or configurations are required?

Accepted Answer

Automation rules that trigger on incident status change and call a playbook to update the other platform.. Option A (Microsoft Defender XDR connector) enables incident ingestion. Option C (Bi-directional sync setting) ensures status changes are reflected both ways. Option D (Automation rules) can update status in both platforms. Option B is for alerts, not incidents. Option E is for email, not sync.

Answer

Microsoft Defender for Cloud Apps connector.

Answer

Configure a mail flow rule in Exchange Online.

Question 12

Which THREE steps should be included in a Microsoft Sentinel playbook for automatic incident response when a high-severity alert fires?

Accepted Answer

Investigate the alert by enriching with threat intelligence. The playbook should investigate, contain, and notify. Pausing the incident is not standard; the playbook should run immediately. Creating a new Azure resource is not typically part of incident response.

Answer

Pause the incident for 24 hours before taking action

Answer

Create a new Azure resource for logging

Question 13

Which THREE conditions must be met for Microsoft Sentinel to automatically run a playbook on an incident?

Accepted Answer

The playbook must have the Sentinel Responder role assigned. The playbook must be enabled for automatic triggers, the incident must be created by an analytics rule, and the playbook must have the correct permissions. The user does not need to be signed in, and the incident does not need to be of a specific severity.

Answer

The incident severity must be set to High or Critical

Answer

The user must be signed in to the Azure portal

Question 14

Which TWO actions should an analyst take when triaging a Microsoft Sentinel incident that involves a user who clicked a malicious link in a phishing email? (Choose two.)

Accepted Answer

Run a KQL query on EmailEvents to identify the email and recipient.. Options A and D are correct. A: Running a KQL query on EmailEvents identifies the email and user. D: Checking Microsoft Defender for Office 365 shows the threat status. Option B is wrong because the analyst should not delete the email yet (investigation first). Option C is wrong because resetting password is premature without evidence of compromise.

Answer

Reset the user's password immediately.

Answer

Block the sender's domain in the tenant's block list.

Answer

Delete the email from the user's mailbox immediately.

Question 15

You are investigating a security incident in Microsoft Sentinel where a user received a phishing email containing a link to a malicious domain. The link was clicked, but no further actions were observed. Which playbook action should you take immediately to prevent potential lateral movement?

Accepted Answer

Block the malicious domain on the firewall. The correct action is to block the malicious domain at the firewall or proxy to prevent further access. Disabling the user account might be premature if no compromise is confirmed. Resetting password and revoking sessions are post-compromise steps. Blocking the domain is immediate containment.

Answer

Disable the user's account

Answer

Revoke the user's active sessions

Answer

Reset the user's password