SC-200 Practice Test 48 — 15 Questions

Question 1

You are managing a Microsoft Sentinel environment. You need to ensure that incidents are automatically assigned to the appropriate analyst based on the type of attack. The assignment must consider the current workload of each analyst. What should you use?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Use an automation rule with a playbook that queries the current incident assignments and assigns to the least busy analyst.. Automation rules in Microsoft Sentinel can trigger a playbook (Azure Logic App) that queries the current incident assignments and assigns the incident to the analyst with the fewest active incidents. This satisfies both the attack-type mapping (via the analytics rule that generates the incident) and the workload-balancing requirement, as the playbook can dynamically evaluate workload using Azure Resource Graph or Sentinel's API.

Answer

Configure multiple analytics rules, each with a different incident owner.

Answer

Create a watchlist that maps attack types to analyst names and use it in an analytics rule.

Answer

Create a workbook that shows analyst workload and manually assign.

Question 2

A security analyst is investigating a suspicious process on an endpoint and wants to see all changes made to the Windows Registry by that process. Which advanced hunting table should the analyst query to find registry modification events associated with the process?

Accepted Answer

DeviceRegistryEvents. DeviceRegistryEvents is the correct table because it specifically captures Windows Registry modification events, including create, modify, and delete operations. For a process-based investigation, this table includes the InitiatingProcessId and InitiatingProcessFileName columns, allowing the analyst to filter by the suspicious process's PID or name to see all registry changes it made.

Answer

DeviceProcessEvents

Answer

DeviceEvents

Answer

DeviceFileEvents

Question 3

Order the steps to configure a Microsoft Sentinel analytics rule using a scheduled query.

Accepted Answer

Define the query logic, then set the schedule, then set the alert threshold, then configure incident creation and automated responses.. Scheduled query rules run on a schedule and generate alerts based on query results meeting a threshold.

Answer

Define the query logic, then set the schedule, then configure incident creation and automated responses, then set the alert threshold.

Answer

Set the alert threshold, then define the query logic, then set the schedule, then configure incident creation and automated responses.

Answer

Configure incident creation and automated responses, then define the query logic, then set the schedule, then set the alert threshold.

Question 4

In Microsoft 365 Defender, an incident is created automatically. An analyst wants to see all related alerts for that incident. Which tab on the incident details page should the analyst select?

Accepted Answer

Alerts tab. The Alerts tab on the incident details page in Microsoft 365 Defender displays all alerts that have been automatically correlated into the incident. Since an incident is a collection of related alerts, selecting the Alerts tab is the correct way for an analyst to view every individual alert that contributed to the incident.

Answer

Devices tab

Answer

Users tab

Answer

Evidence tab

Question 5

Your Microsoft Sentinel workspace ingests logs from multiple sources but you notice that some custom logs are missing in the Log Analytics workspace. You've confirmed that the data connectors are healthy. What is the most likely cause?

Accepted Answer

The custom log table schema does not match the incoming log format.. When data connectors are healthy but custom logs are missing, the most common cause is a schema mismatch between the custom log table definition in the Log Analytics workspace and the actual log data being sent. Microsoft Sentinel requires the custom log table's schema (columns, data types, and delimiters) to exactly match the incoming log format; otherwise, the ingestion pipeline drops the records without error. This is because the Log Analytics agent or AMA uses the table schema to parse and transform the data, and any deviation results in silent failures.

Answer

There is a time gap between log generation and ingestion.

Answer

The workspace has exceeded its daily ingestion limit.

Answer

The data connectors are not properly configured for custom log ingestion.

Question 6

Refer to the exhibit. You have an analytics rule in Microsoft Sentinel that uses this KQL query. The rule is configured to run every hour and alert when the result count is greater than 0. Which type of attack is this rule most likely detecting?

Accepted Answer

Brute force attack on user accounts. The KQL query counts failed sign-in events (ResultType != 0) aggregated by User, IPAddress, and a 5-minute bin, then filters for users with more than 10 failures. This pattern of multiple rapid failed logins from the same IP against a single user is the classic signature of a brute force attack, where an attacker tries many passwords to guess credentials. The rule triggers when the count exceeds 10 within any 5-minute window, making it highly specific to brute force detection.

Answer

Privileged account misuse

Answer

Data exfiltration via sign-in

Answer

Account takeover from a new location

Question 7

You are responding to a data exfiltration incident in Microsoft Sentinel. The attacker used a PowerShell script to upload data to an external storage account. You need to identify the specific storage account used. Which KQL query should you use in the AzureActivity table?

Accepted Answer

OperationName == 'Storage Blob Upload'. The 'Storage Blob Upload' operation in the AzureActivity table specifically logs uploads to Azure Blob Storage, which is the exact action performed by a PowerShell script exfiltrating data to an external storage account. This operation captures the storage account name and blob details, directly identifying the target of the data exfiltration.

Answer

OperationName == 'Get Storage Account Properties'

Answer

OperationName == 'Create or Update Storage Account'

Answer

OperationName == 'List Storage Account Keys'

Question 8

Your organization uses Microsoft Sentinel and has multiple workspaces for different business units. You need to enable cross-workspace querying for the security operations center (SOC) analysts. What should you do?

Accepted Answer

Use the workspace() expression in KQL queries. The `workspace()` expression in KQL allows a query to reference tables from multiple Log Analytics workspaces within a single query. This enables SOC analysts to perform cross-workspace queries without moving data, which is the correct approach for a multi-workspace Sentinel deployment.

Answer

Configure a data connector for each workspace

Answer

Enable incident merging across workspaces

Answer

Create a single workspace and migrate all data

Question 9

Your organization uses Microsoft Defender for Cloud Apps to discover shadow IT. You notice that a new cloud app is being used by multiple users but has a risk score of 8. What should you do first to manage the risk?

Accepted Answer

Investigate the app's risk factors and user activity. A risk score of 8 indicates the app is high-risk, but immediate blocking or unsanctioning could disrupt business operations if the app is legitimate or used for approved purposes. The first step is to investigate the app's risk factors (e.g., data residency, encryption standards, compliance certifications) and user activity (e.g., volume of data uploaded, types of files shared) to understand the actual threat. This aligns with Microsoft's recommended incident response process: assess before acting.

Answer

Block the app at the proxy

Answer

Immediately unsanction the app in Defender for Cloud Apps

Answer

Create a policy to alert on use of this app

Question 10

A security operations center (SOC) uses Microsoft Sentinel. They want to automatically block a user's account when a high-severity incident is created. Which automation action should you use in a playbook?

Accepted Answer

Run a playbook that calls the Microsoft Graph API to disable the user account.. Disabling the user account via Microsoft Graph API is the most direct and effective way to prevent further access when a high-severity incident is created. This action immediately blocks the user from authenticating across all services, which aligns with the requirement to automatically block the account. Other options either do not block the account (e.g., revoking sessions or resetting password) or are indirect and less reliable (e.g., updating Conditional Access policies).

Answer

Run a playbook that revokes the user's current sessions using Microsoft Graph API.

Answer

Run a playbook that resets the user's password.

Answer

Run a playbook that updates a conditional access policy in Microsoft Entra ID.

Question 11

A security analyst is investigating a ransomware incident in Microsoft 365 Defender. The analyst wants to view all processes that initiated outbound network connections to known malicious IPs on a specific device. Which advanced hunting table should the analyst query?

Accepted Answer

DeviceNetworkEvents. The DeviceNetworkEvents table in Microsoft 365 Defender captures network connection events, including outbound connections to IP addresses, ports, and protocols. To investigate processes that initiated outbound connections to known malicious IPs on a specific device, this table provides the necessary data, such as the initiating process ID, remote IP, and port. The DeviceProcessEvents table only logs process creation events, not network activity, making it unsuitable for this query.

Answer

DeviceProcessEvents

Answer

DeviceFileEvents

Answer

DeviceRegistryEvents

Question 12

A security operations center (SOC) uses Microsoft Sentinel. You need to ensure that when a high-severity incident is created, an automated email notification is sent to the on-call security engineer. Which automation option should you use?

Accepted Answer

Create a playbook that sends an email and associate it with an automation rule that triggers on high-severity incidents.. Microsoft Sentinel uses automation rules to trigger playbooks (Azure Logic Apps) based on incident creation or update conditions. By associating a playbook that sends an email with an automation rule set to trigger on high-severity incidents, the SOC achieves fully automated, event-driven notification without manual intervention.

Answer

Set an analytics rule to run a KQL query and send email.

Answer

Create a workbook that emails the on-call engineer daily.

Answer

Configure a logic app manually triggered by the analyst.

Question 13

Your organization uses Microsoft Defender XDR (formerly Microsoft 365 Defender). You need to configure role-based access control (RBAC) for the security team. Which TWO built-in roles can be assigned in Microsoft 365 Defender to manage incidents and alerts?

Accepted Answer

Security Operator. Security Operator and Security Administrator are the two built-in roles in Microsoft 365 Defender that include permissions to manage incidents and alerts. Security Operator can view and respond to incidents and alerts, while Security Administrator has full access to all security features, including the ability to edit policies and manage incidents. These roles are specifically designed for security operations tasks within Defender XDR.

Answer

Global Administrator

Answer

Compliance Administrator

Answer

Security Reader

Question 14

Your company uses Microsoft Defender for Cloud Apps. You discover that a user is accessing sensitive data from an unfamiliar IP address. You need to immediately block the user's access to all cloud apps while preserving the session for investigation. What should you do?

Accepted Answer

Use the 'Block' governance action in Defender for Cloud Apps. The 'Block' governance action in Defender for Cloud Apps immediately blocks the user's access to all cloud apps while preserving the session for investigation. This action is applied directly within the Defender for Cloud Apps portal, allowing you to stop data exfiltration without disrupting the ability to analyze the session logs or alerts. It is the only option that meets the requirement of blocking access while keeping the session intact for forensic review.

Answer

Create a conditional access policy to block the IP

Answer

Add the IP to the blocked IP address range list

Answer

Suspend the user from Microsoft Entra ID

Question 15

Which TWO are valid methods to ingest syslog data into Microsoft Sentinel?

Accepted Answer

Use the Syslog data connector from the Content hub. The Syslog data connector available from the Content hub in Microsoft Sentinel provides a direct, built-in method to ingest syslog data from on-premises or cloud-based syslog sources. This connector uses the Log Analytics agent (or the newer Azure Monitor Agent with a Data Collection Rule) to collect syslog messages forwarded by a syslog daemon, typically over UDP port 514 or TCP, and maps them to the Syslog table in Log Analytics. It is the standard, supported approach for syslog ingestion without requiring third-party tools or custom parsers.

Answer

Configure a syslog forwarder with the Cisco ASIM parser

Answer

Deploy a Splunk Universal Forwarder to send syslog to Sentinel

Answer

Install a Windows-based syslog collector and forward to Sentinel using the Azure Monitor agent