SC-200 Practice Test 5 — 10 Questions

Question 1

Your organization uses Microsoft Defender for Cloud to monitor hybrid workloads. You need to ensure that security alerts from on-premises servers running Windows Server 2022 are forwarded to Microsoft Sentinel. The servers are not yet onboarded to Azure Arc. What should you do first?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Onboard the servers to Azure Arc and enable Defender for Cloud.. On-premises servers must first be onboarded to Azure Arc to establish a management identity and connectivity with Azure. Without Azure Arc, Defender for Cloud cannot apply its security policies or forward alerts to Microsoft Sentinel. Enabling Defender for Cloud on the servers after Arc onboarding allows security alerts to be collected and forwarded to Sentinel.

Answer

Install the Azure Monitor Agent on the servers.

Answer

Deploy Azure Policy to enable Defender for Cloud on the servers.

Answer

Install Microsoft Defender for Endpoint on the servers.

Question 2

A SOC team uses Microsoft Sentinel with multiple workspaces distributed across different regions. They need to create a single analytics rule that can query data from multiple workspaces to detect cross-tenant attacks. What is the recommended approach?

Accepted Answer

Use cross-workspace queries in a single analytics rule with the workspace() function. The recommended approach is to use cross-workspace queries in a single analytics rule with the workspace() function. This allows the rule to query data from multiple Sentinel workspaces in different regions without duplicating rules or ingesting data centrally. The workspace() function enables a single KQL query to reference tables from up to 100 workspaces, making it ideal for detecting cross-tenant attacks across distributed environments.

Answer

Create separate analytics rules for each workspace

Answer

Create a union workspace that ingests data from all workspaces

Answer

Use Azure Lighthouse to manage multiple workspaces and create rules on each

Question 3

A SOC analyst creates a scheduled analytics rule in Microsoft Sentinel that uses the following KQL query to detect impossible travel: SigninLogs | where TimeGenerated > ago(1d) | summarize Countries = make_set(Location) by UserPrincipalName | where array_length(Countries) > 1 However, the analyst notices that the rule generates too many false positives for users who travel legitimately. What is the best way to refine the rule to reduce false positives without missing actual impossible travel?

Accepted Answer

Modify the query to include a time difference condition using the partition operator or a join to find sign-ins from different countries within a short time window.. Impossible travel detection requires correlating sign-ins from different geographic locations within a time window that is too short for physical travel. By using the partition operator or a join to compare timestamps between sign-ins from different countries, the query can distinguish between legitimate sequential travel (e.g., a user flying from New York to London over 8 hours) and truly impossible simultaneous sign-ins (e.g., sign-ins from New York and London within 30 minutes). This reduces false positives while still catching actual impossible travel.

Answer

Add a condition to filter out VPN IP addresses from the Log Analytics workspace.

Answer

Instead of using make_set, use the dcount() function to estimate distinct countries.

Answer

Use the time series anomaly detection function series_decompose() on the signin data.

Question 4

A security analyst is investigating a ransomware incident and needs to find all files that were written to a specific device within a 5-minute window before the ransomware process started. The analyst knows the device name and the ransomware process start time. Which advanced hunting table and KQL operator combination would be most efficient to find the file creation events?

Accepted Answer

DeviceFileEvents with where. DeviceFileEvents is the correct table because it specifically captures file creation, modification, and deletion events on devices. Using the `where` operator to filter by device name and a timestamp range (5 minutes before the ransomware process start time) is the most efficient way to retrieve the exact file creation events needed for the investigation.

Answer

DeviceProcessEvents with join

Answer

DeviceEvents with where

Answer

DeviceImageLoadEvents with where

Question 5

Your organization uses Microsoft Sentinel with Microsoft Defender XDR integrated. A critical incident has been raised involving a user account that was used to access a confidential SharePoint site from an unusual location at 2:00 AM. The incident includes alerts from Microsoft Defender for Cloud Apps, Microsoft Defender for Identity, and Microsoft Defender for Office 365. The analyst needs to contain the incident, investigate the scope, and begin remediation. The environment has the following: Microsoft Entra ID with conditional access policies, Microsoft Intune for device management, and Microsoft Defender for Endpoint on all devices. The analyst has identified the user account and the device used. Which course of action should the analyst take first?

Accepted Answer

Disable the user account in Microsoft Entra ID and revoke all sessions.. Disabling the user account in Microsoft Entra ID and revoking all sessions is the immediate containment step because it stops the compromised account from being used for any further access, including the suspicious SharePoint access and any lateral movement. This action directly addresses the core of the incident—the user account—and is the fastest way to cut off the attacker's current authentication tokens and sessions, preventing further damage while the investigation proceeds.

Answer

Create a conditional access policy to block the user.

Answer

Isolate the user's device using Microsoft Defender for Endpoint.

Answer

Run a KQL query to find all resources accessed by the user.

Question 6

Your Microsoft Sentinel environment is not generating incidents from a custom KQL detection rule. The rule runs successfully in the Log Analytics query editor but no incidents appear. What is the most likely cause?

Accepted Answer

The rule is set to create alerts but not incidents. The most likely cause is that the rule is set to create alerts but not incidents. In Microsoft Sentinel, analytics rules have a toggle to 'Create incidents' from alerts. If this toggle is disabled, alerts are generated but not grouped into incidents. The query running successfully in Log Analytics confirms the rule logic works, but incidents will not appear unless the incident creation toggle is enabled. Entity mapping is not required for incident creation; it enhances correlation but is not a prerequisite.

Answer

The rule's alert grouping settings are misconfigured

Answer

The rule's query schedule is too long

Answer

The rule does not have entity mapping configured

Question 7

During a threat hunt, a security analyst uses Microsoft Sentinel and identifies a series of failed logon attempts from a single IP address targeting multiple user accounts. The analyst wants to create a scheduled analytics rule that generates an alert when the same IP address fails to logon to more than 10 different accounts within 5 minutes. Which KQL operator should be used to count distinct accounts per IP?

Accepted Answer

dcount(Account). Dcount(Account). The dcount() function performs an approximate distinct count, which is efficient for large datasets and suitable for counting distinct accounts per IP. Option A (count()) counts all events, not distinct accounts. Option B (summarize count() by Account) counts events per account, not distinct accounts per IP. Option C (distinct Account) returns unique account values but does not provide a count.

Answer

count()

Answer

summarize count() by Account

Answer

distinct Account

Question 8

Your organization uses Microsoft Sentinel with multiple workspaces. You need to create a unified incident queue across all workspaces. Which TWO solutions should you consider?

Accepted Answer

Consolidate all data into a single Log Analytics workspace.. Consolidating all data into a single Log Analytics workspace is the most straightforward and supported method to create a unified incident queue in Microsoft Sentinel. With a single workspace, all alerts and incidents are naturally aggregated, eliminating the need for cross-workspace synchronization. This approach simplifies management, ensures consistent analytics rules, and avoids the complexity of stitching incidents across multiple workspaces.

Answer

Use cross-workspace queries in workbooks.

Answer

Use Azure Policy to enforce workspace configuration.

Answer

Deploy multiple playbooks to synchronize incidents.

Question 9

A security analyst is building a custom detection rule in Microsoft 365 Defender to identify ransomware activity. The rule should trigger when files with specific extensions (e.g., .encrypted, .locked) are created on multiple devices within a short time frame, suggesting a widespread attack. Which combination of advanced hunting tables should be used to obtain both file creation events and device information?

Accepted Answer

DeviceFileEvents and DeviceInfo. DeviceFileEvents captures file creation events, including the specific extensions like .encrypted and .locked, while DeviceInfo provides device metadata such as device name, OS platform, and device group. Joining these tables on DeviceId allows the analyst to correlate file creation events across multiple devices, enabling detection of widespread ransomware activity within a short time frame.

Answer

DeviceProcessEvents and DeviceInfo

Answer

DeviceFileEvents and DeviceNetworkEvents

Answer

DeviceFileEvents and DeviceLogonEvents

Question 10

A company has several Azure virtual machines running SQL Server (IaaS). The security team wants to enable Advanced Threat Protection for these SQL Server instances to detect threats like SQL injection. What should they do?

Accepted Answer

Deploy the SQL Server IaaS Agent extension on each VM and enable Azure Defender for SQL in Microsoft Defender for Cloud.. To enable Advanced Threat Protection for SQL Server IaaS, you must deploy the SQL Server IaaS Agent extension on each VM, which allows the VM to register with the SQL IaaS platform. Then, you enable Azure Defender for SQL in Microsoft Defender for Cloud, which provides threat detection for SQL injection and other anomalous activities. This combination ensures the SQL Server instances are monitored by Defender for Cloud's SQL-specific protections.

Answer

Enable Azure Defender for Servers on the subscription; it automatically protects SQL Server workloads.

Answer

Enable Azure Defender for SQL on the Log Analytics workspace used by the VMs.

Answer

Configure the Microsoft Sentinel SQL connector to ingest SQL audit logs.