SC-200 Practice Test 50 — 15 Questions

Question 1

A company uses Microsoft Defender XDR and has enabled automatic attack disruption for human-operated ransomware. During an incident, the system automatically contains a compromised account. However, the SOC team wants to ensure that the containment action is reversible and that the account can be restored after investigation. What should the team do before restoring the account?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Change the account's password and enable multi-factor authentication.. After automatic containment disables a compromised account, the SOC team must change its password and enable multi-factor authentication before restoring it. This ensures the attacker cannot regain access with stolen credentials. Option B is a good practice but not a prerequisite for restoring this specific account. Option C is unnecessary if the account was not an administrator. Option D is irrelevant because containment applies to the account, not devices.

Answer

Verify that no other accounts were compromised.

Answer

Remove the account from all administrative roles.

Answer

Run a full antivirus scan on the account's devices.

Question 2

Your organization uses Microsoft Sentinel. A security incident is created, and the assigned analyst needs to perform initial triage. What is the first step the analyst should take according to Microsoft best practices for incident response?

Accepted Answer

Review the incident details and verify the alert is a true positive.. The first step in the Microsoft incident response process is to verify the alert and determine its validity. Option A is wrong because containment should follow after verification. Option B is wrong because escalating before verification bypasses triage. Option D is wrong because detailed investigation comes after initial triage.

Answer

Contain the affected resources immediately to prevent further damage.

Answer

Run a full investigation using Microsoft 365 Defender hunting queries.

Answer

Escalate the incident to the senior security team.

Question 3

A security team needs to enforce that all Azure virtual machines have a specific custom script execution baseline (e.g., block PowerShell from executing scripts from the internet). They want to use Microsoft Defender for Cloud to continuously monitor and alert when a VM deviates from this baseline. Which feature should they use?

Accepted Answer

Adaptive application controls. Adaptive application controls (AAC) in Microsoft Defender for Cloud allow you to define allowlists for applications and scripts that can run on your Azure VMs. By configuring AAC to block PowerShell scripts from the internet, the service uses machine learning to establish a baseline of allowed executables and scripts, then continuously monitors for deviations—such as an unauthorized PowerShell script execution—and generates security alerts. This directly meets the requirement for continuous monitoring and alerting on custom script execution baselines.

Answer

Just-In-Time VM Access (JIT)

Answer

Regulatory compliance dashboard

Answer

File Integrity Monitoring (FIM)

Question 4

You are investigating a detection in Microsoft Defender for Endpoint. The PowerShell output shows a threat with ID 2147723152. Which type of threat does this ID represent?

Accepted Answer

HackTool. Threat ID 2147723152 corresponds to a hacktool (specifically, a tool used for penetration testing), often detected as 'HackTool:MSIL/Mimikatz!dha'.

Answer

Ransomware

Answer

Worm

Answer

Trojan

Question 5

Which Microsoft Sentinel feature allows you to query data across multiple workspaces in a single KQL query?

Accepted Answer

The workspace() function in KQL. The workspace() function in KQL is specifically designed to reference a workspace by its identifier, allowing a single query to pull tables from multiple Microsoft Sentinel workspaces (or Log Analytics workspaces) without leaving the current query context. It is the documented cross-workspace query mechanism in Sentinel, and it can be combined with union to aggregate results across workspaces.

Answer

The union operator with workspace names

Answer

The externaldata operator with workspace URLs

Answer

The join operator with workspace identifiers

Question 6

An organization needs to meet PCI DSS compliance requirements and also enforce a custom policy requiring that encryption keys be stored in a specific Azure Key Vault. The security administrator wants to view a unified compliance score that includes both the built-in PCI DSS standard and the custom policy. What should the administrator do in Microsoft Defender for Cloud?

Accepted Answer

Create a custom initiative that includes the PCI DSS built-in policy set and the custom key vault policy, then assign it to the scope. Microsoft Defender for Cloud's regulatory compliance dashboard can only display a unified compliance score when all relevant standards and custom policies are grouped into a single initiative. By creating a custom initiative that includes both the built-in PCI DSS policy set and the custom Key Vault policy, then assigning that initiative to the scope, the administrator ensures the compliance score reflects both requirements in one view.

Answer

Assign the built-in PCI DSS regulatory compliance standard and add a custom policy through Azure Policy

Answer

Use Azure Blueprints to deploy the PCI DSS standard and custom policies

Answer

Enable the Secure Score dashboard to measure compliance

Question 7

You are the security operations lead for a multinational company that uses Microsoft Sentinel in a single workspace. You have recently onboarded 10 new business units, each with their own analytics rules and automation. The security team is overwhelmed by the number of low-fidelity incidents generated. You need to reduce noise without disabling critical detections. You must ensure that each business unit retains ownership of their incidents and can customize their own suppression rules. You also need centralized reporting on incident trends across all business units. You have identified that many low-fidelity alerts come from a common set of data sources. What should you do?

Accepted Answer

Create a separate analytics rule for low-fidelity alerts that uses alert suppression to group similar alerts.. Creating a separate analytics rule for low-fidelity alerts with alert suppression enabled allows you to group similar alerts into a single incident, reducing noise without disabling the underlying data connectors or critical detections. This approach preserves each business unit's ownership of their incidents and enables them to customize suppression rules via automation rules or analytics rule settings, while centralized reporting on incident trends remains intact because the workspace still ingests all alerts.

Answer

Disable the data connectors that produce the most noise.

Answer

Create an automation rule that automatically closes low-severity incidents.

Answer

Create a workbook that filters out low-severity incidents from the dashboard.

Question 8

Your organization uses Microsoft Sentinel and wants to reduce alert fatigue. Which TWO actions should you take to improve the quality of incidents?

Accepted Answer

Configure alert grouping in analytics rules to combine related alerts into one incident.. Configuring alert grouping in analytics rules consolidates multiple related alerts into a single incident, reducing noise and helping analysts focus on the root cause rather than triaging individual alerts. This directly improves incident quality by providing a richer context and reducing alert fatigue.

Answer

Create separate incidents for each alert.

Answer

Create automation rules to close all low-severity incidents automatically.

Answer

Increase the severity of all low-severity alerts to high.

Question 9

Your organization uses Microsoft Sentinel. You receive an incident that involves a potential lateral movement detected by Microsoft Defender for Identity. You need to investigate the timeline of the attack. Which Microsoft Sentinel feature should you use?

Accepted Answer

Investigation graph. The Investigation graph in Microsoft Sentinel is specifically designed to explore the scope and timeline of an attack by visually mapping entities (e.g., users, devices, IPs) and their connections. For a lateral movement incident detected by Defender for Identity, the graph automatically surfaces related alerts, entities, and activities in a chronological view, enabling you to trace the attacker's path across resources. This makes it the correct tool for investigating the attack timeline.

Answer

Workbooks

Answer

Automation rules

Answer

Analytics rules

Question 10

A SOC analyst receives a phishing alert in Microsoft Defender for Office 365. The analyst needs to quickly determine if any users clicked the malicious link. Which action should the analyst take first?

Accepted Answer

Open the email entity page to view click details. The email entity page in Microsoft Defender for Office 365 provides detailed information about a specific email, including click verdicts for any URLs contained within. This allows the analyst to quickly see if any users clicked the malicious link. Option A (Threat Explorer) can also be used, but it requires more steps to filter for the specific email and then view click details. Option B (user entity page) shows user-specific activities and alerts, but not email-specific click details. Option D (hunting query in Microsoft Sentinel) is effective but slower than directly viewing the email entity page in Defender for Office 365.

Answer

Use Threat Explorer to search for the email subject

Answer

Open the user entity page for each recipient

Answer

Run a hunting query in Microsoft Sentinel

Question 11

Contoso uses Microsoft Sentinel with Microsoft Defender XDR connector. You receive an incident titled 'Malware detected on endpoint' from Microsoft Defender for Endpoint. The incident includes a detailed timeline showing that the malware was downloaded from a malicious URL. You need to respond to the incident using Microsoft Sentinel and Microsoft Defender XDR capabilities. The affected device is a Windows 10 workstation used by a standard user. You have been asked to contain the threat and prevent recurrence. The organization has a policy to preserve evidence for 90 days. Which action should you take FIRST?

Accepted Answer

Isolate the device using Microsoft Defender for Endpoint device isolation.. Isolating the device using Microsoft Defender for Endpoint immediately contains the threat by disconnecting the device from the network, preventing the malware from spreading or communicating with command-and-control servers. This is the priority first step in incident response. Option A is incorrect because resetting the password does not remove malware from the device. Option B is incorrect creating a custom detection rule is a proactive step but not an immediate containment action. Option C is incorrect because blocking the URL at the firewall prevents further downloads but does not contain the already infected device.

Answer

Reset the user's password and revoke sessions in Microsoft Entra ID.

Answer

Create a custom detection rule in Microsoft Sentinel for the malicious URL.

Answer

Block the malicious URL at the firewall using Microsoft Defender for Cloud Apps.

Question 12

Your organization uses Microsoft Defender for Cloud to assess security posture. You need to ensure that any new Azure subscription automatically has Microsoft Defender for Cloud enabled with the 'Defender for Cloud (CSPM)' plan active. What should you do?

Accepted Answer

Assign a built-in Azure Policy initiative that deploys Microsoft Defender for Cloud configuration to subscriptions.. Azure Policy can enforce compliance at scale by assigning the built-in initiative 'Deploy Microsoft Defender for Cloud configuration' to a management group or subscription. This initiative includes policies that automatically enable Microsoft Defender for Cloud and activate the 'Defender for Cloud (CSPM)' plan on new subscriptions, ensuring consistent security posture without manual intervention.

Answer

Create an automation account that runs a PowerShell script daily to check and enable Defender for Cloud.

Answer

Configure Azure Arc to enforce the plan on new subscriptions.

Answer

Use Microsoft Sentinel's 'Subscription Migration' playbook.

Question 13

Which TWO are supported methods to ingest syslog data into Microsoft Sentinel?

Accepted Answer

Common Event Format (CEF) connector. The Common Event Format (CEF) connector is a supported method because it uses a syslog daemon on a Linux log collector to receive CEF-formatted syslog messages over UDP/TCP (port 514 or 25226) and forwards them to the Log Analytics workspace via the Log Analytics agent. This connector specifically parses CEF headers and maps fields to Sentinel's schema, making it a native ingestion path for security appliances like Palo Alto Networks or Fortinet.

Answer

Logstash output plugin

Answer

Azure Event Hubs

Answer

Direct Azure Monitor Agent ingestion without connector

Question 14

Which TWO steps are necessary to configure Microsoft Sentinel to automatically disable a compromised user account in Microsoft Entra ID when a high-severity incident is created?

Accepted Answer

Create a playbook that uses the Microsoft Entra ID 'Disable user' action.. A playbook is an automated workflow that can contain the 'Disable user' action from Microsoft Entra ID, which directly disables a compromised user account. This action leverages the Microsoft Graph API to update the user's accountEnabled property to false, effectively blocking sign-ins. Without this playbook, there is no mechanism to execute the disablement action when an incident is created.

Answer

Enable the Microsoft Defender XDR connector.

Answer

Enable the Microsoft Entra ID Protection data connector.

Answer

Create an analytics rule that detects compromised user accounts.

Question 15

A security analyst is investigating a potential ransomware incident in Microsoft Defender XDR. The analyst needs to confirm the scope of the attack and halt further propagation. Which TWO actions should the analyst take first?

Accepted Answer

Initiate automated investigation on the affected devices. Initiating automated investigation on affected devices (A) is correct because Microsoft Defender XDR's automated investigation uses built-in playbooks to automatically analyze alerts, determine the scope of compromise, and suggest remediation actions without manual intervention. This is the fastest way to confirm the attack scope while simultaneously halting propagation. Isolating affected devices (D) is correct because network isolation immediately cuts off communication between the compromised device and other systems, preventing lateral movement and further encryption of network shares. Both actions are first-response steps in a ransomware incident.

Answer

Reset passwords for all users in the organization

Answer

Collect forensic evidence from affected systems

Answer

Run a full antivirus scan on all endpoints