SC-200 Practice Questions 1 — 50 Questions

Question 1

An organization uses Microsoft 365 Defender. During an incident, the analyst wants to automatically isolate a compromised device from the network while allowing communication with a specific list of trusted IP addresses (e.g., for patching). Which action in an automated investigation and response (AIR) playbook for endpoints can achieve this?

Accepted Answer

Isolate device. The 'Isolate device' action in Microsoft Defender for Endpoint's automated investigation and response (AIR) playbook can be configured to isolate a device from the network while allowing communication with a specified list of trusted IP addresses (e.g., for patching or compliance). This is achieved through the 'selective isolation' capability, which uses Windows Filtering Platform (WFP) to block all inbound/outbound traffic except to the defined IPs. Option B is correct because it directly matches the requirement to maintain connectivity to trusted endpoints during isolation.

Answer

Run antivirus scan

Answer

Contain device

Answer

Restrict app execution

Question 2

A security analyst is preparing to use a Jupyter notebook for threat hunting in Microsoft Sentinel. Which of the following sequences of actions is correct to start executing the notebook?

Accepted Answer

Provision compute → Clone Sentinel notebooks → Connect to workspace → Execute cells. Option A is correct because the correct sequence to start executing a Jupyter notebook for threat hunting in Microsoft Sentinel is to first provision compute (i.e., create a compute instance in Azure Machine Learning), then clone the Sentinel notebooks from the official GitHub repository, connect to the Sentinel workspace using the msticpy library, and finally execute the cells. This order ensures the compute environment is ready before loading the notebooks and establishing the workspace connection.

Answer

Clone Sentinel notebooks → Provision compute → Connect to workspace → Execute cells

Answer

Connect to workspace → Provision compute → Clone Sentinel notebooks → Execute cells

Answer

Provision compute → Connect to workspace → Clone Sentinel notebooks → Execute cells

Question 3

An organization has enabled enhanced security features for a hybrid infrastructure including SQL servers on-premises and in Azure. Which Microsoft Defender for Cloud plan provides threat detection for both SQL Server on-premises and Azure SQL Database?

Accepted Answer

Defender for SQL. Defender for SQL is the correct plan because it is specifically designed to protect both on-premises SQL Server instances (via Azure Arc-enabled SQL Server) and Azure SQL Database. It provides threat detection, vulnerability assessment, and advanced threat protection across the hybrid SQL estate, unlike other Defender plans that focus on different resource types.

Answer

Defender for Servers

Answer

Defender for Databases

Answer

Defender for Storage

Question 4

A phishing email was delivered to several users. The analyst wants to find all messages in the campaign, see delivery actions, and perform remediation from the Microsoft 365 Defender portal. Which tool should they use?

Accepted Answer

Threat Explorer.. Threat Explorer (also known as Explorer) in Microsoft 365 Defender is the correct tool because it provides a comprehensive view of email threats, including phishing campaigns. It allows analysts to search for all messages in a campaign, review delivery actions (e.g., blocked, delivered to junk, or delivered), and perform remediation actions such as soft delete, hard delete, or move to quarantine directly from the portal.

Answer

Microsoft Secure Score.

Answer

Azure Activity log.

Answer

Microsoft Defender Vulnerability Management software inventory.

Question 5

A company uses Microsoft Defender for Cloud and wants to automatically ensure that all Azure virtual machines have a specific security configuration baseline applied (e.g., default password policies). Which Defender for Cloud feature should they leverage to audit and enforce these configurations inside the VMs?

Accepted Answer

Azure Policy Guest Configuration. Azure Policy Guest Configuration is the correct feature because it extends Azure Policy to audit and enforce configurations inside the operating system of Azure VMs, including security baseline settings like default password policies. Unlike host-level policies, Guest Configuration can evaluate and remediate settings within the guest OS, making it the appropriate tool for this requirement.

Answer

Security policies

Answer

Just-In-Time VM access

Answer

Adaptive application controls

Question 6

A company uses Microsoft Defender for Cloud and wants to automatically remediate non-compliant Azure resources by deploying missing configurations (e.g., enabling diagnostics when not enabled). Which feature should they enable?

Accepted Answer

Azure Policy's DeployIfNotExists effect. Azure Policy's DeployIfNotExists effect is the correct feature because it automatically remediates non-compliant Azure resources by deploying missing configurations, such as enabling diagnostic settings, when the resource is created or updated. This effect evaluates resources against a policy definition and, if the specified configuration does not exist, triggers a deployment task to apply the required settings. In Defender for Cloud, this is used to enforce security baselines by automatically correcting non-compliant resources without manual intervention.

Answer

Just-In-Time VM access

Answer

Adaptive network hardening

Answer

File integrity monitoring

Question 7

A security analyst is configuring Microsoft Sentinel scheduled analytics rules to detect brute-force attacks on Microsoft Entra ID. Arrange the steps in the correct order from first to last.

Accepted Answer

Create a query using KQL to count failed sign-ins. → Set the rule schedule (run every 5 minutes). → Set the alert threshold (e.g., >5 failed sign-ins from same IP in 5 minutes). → Define incident properties (title, severity, tactics). → Configure grouping settings to group alerts into incidents.. Option A is correct because the standard workflow for creating a scheduled analytics rule in Microsoft Sentinel begins with defining the detection logic via a KQL query, then configuring the schedule and threshold, followed by incident properties and grouping settings. This sequence ensures the rule has a valid query before setting operational parameters like run frequency and alert aggregation.

Answer

Verify results before configuring the source or rule settings.

Answer

Configure alert grouping before defining the detection query or source.

Answer

Skip validation and enable the rule or plan immediately.

Question 8

An organization uses Microsoft 365 Defender. An automated investigation on a device has determined that a file is malicious and has been blocked. The analyst wants to verify that the file was blocked and see the action taken (e.g., block, allow). Which entity page provides this information?

Accepted Answer

File entity page. The File entity page in Microsoft Defender XDR provides a centralized view of a file's reputation, detection details, and the specific actions taken (e.g., blocked, allowed, quarantined) during automated investigations. Since the analyst needs to confirm the block action on a specific malicious file, this page directly displays the investigation result and the applied remediation action.

Answer

Device entity page

Answer

User entity page

Answer

Email entity page

Question 9

A Microsoft Sentinel scheduled analytics rule detects impossible travel but creates too many duplicate incidents for the same user within a short period. Which two rule settings should you tune? (Choose 2.)

Accepted Answer

Configure event grouping or incident grouping by user entity.. Option A is correct because configuring event grouping or incident grouping by user entity consolidates multiple alerts for the same user into a single incident, reducing duplicate incidents. In Microsoft Sentinel, this setting controls how alerts are aggregated into incidents based on entity fields like user account, ensuring that a burst of impossible travel alerts for the same user generates one incident instead of many.

Answer

Disable the data connector.

Answer

Delete the Log Analytics workspace.

Question 10

A company wants to continuously assess the compliance of their Azure resources against the CIS (Center for Internet Security) benchmark. Which Microsoft Defender for Cloud feature should they use?

Accepted Answer

Regulatory compliance dashboard. The Regulatory compliance dashboard in Microsoft Defender for Cloud provides pre-built assessments and continuous monitoring against specific compliance standards, including the CIS benchmark. It automatically evaluates Azure resources against CIS controls and displays compliance status, making it the correct feature for this requirement.

Answer

Secure score

Answer

Azure Policy

Answer

Workload protections

Question 11

A hybrid environment contains Azure VMs and on-premises servers connected through Azure Arc. Which two outcomes can Defender for Cloud provide for these servers? (Choose 2.)

Accepted Answer

Security recommendations for misconfigurations and missing updates.. Defender for Cloud continuously assesses the security posture of Azure VMs and Azure Arc-enabled on-premises servers. It generates security recommendations for misconfigurations (e.g., open management ports, weak encryption) and missing updates (e.g., OS patches, critical CVE fixes) by comparing the server's configuration against built-in security baselines and the Microsoft Security Response Center (MSRC) threat intelligence. This is a core capability of the cloud security posture management (CSPM) module within Defender for Cloud.

Answer

Automatic replacement of all unsupported operating systems.

Answer

Guaranteed compliance certification for every regulatory standard.

Question 12

A company runs its critical workloads on Azure Kubernetes Service (AKS). The security team wants to use Microsoft Defender for Cloud to protect the AKS clusters. After enabling Defender for Cloud on the subscription, they also need to enable the Defender for Containers plan. Which of the following capabilities becomes available specifically after enabling the Defender for Containers plan (with the plan turned on)?

Accepted Answer

Security alerts for container runtime threats, such as privilege escalation in a container.. Option C is correct because enabling the Defender for Containers plan in Microsoft Defender for Cloud activates host-level and cluster-level threat detection for AKS, including runtime threat protection. This allows Defender for Cloud to generate security alerts for container-specific threats such as privilege escalation, container breakout, and suspicious process execution within containers, which are not available with just the basic Defender for Cloud enabled on the subscription.

Answer

Azure Policy for Kubernetes add-on installation to enforce pod security policies.

Answer

Kubernetes audit logs are automatically streamed to the Log Analytics workspace.

Answer

Integration with Microsoft Sentinel for monitoring AKS logs.

Question 13

A company uses Microsoft Defender for Cloud. They need to continuously assess the compliance of their Azure resources against the CIS benchmark. Which feature should they enable?

Accepted Answer

Regulatory compliance dashboard. The Regulatory Compliance dashboard in Defender for Cloud provides built-in compliance standards such as CIS, SOC 2, and Azure CIS. By assigning the appropriate initiative, the dashboard continuously scans resources and reports compliance status. Secure Score is an aggregated risk score, not a compliance standard. Azure Policy is the underlying service used to enforce policies, but the feature that presents compliance is the dashboard. Just-in-Time VM access is a security control, not a compliance assessment tool.

Answer

Secure Score

Answer

Azure Policy

Answer

Just-In-Time VM access

Question 14

A SOC analyst is configuring a Microsoft Sentinel scheduled analytics rule to detect rare operations on Azure Key Vaults. The rule uses the AzureActivity table. The analyst wants to use a machine learning algorithm to identify anomalies based on historical activity patterns. Which analytics rule type should the analyst choose?

Accepted Answer

Anomaly detection. The Anomaly Detection rule type in Microsoft Sentinel is specifically designed to use machine learning algorithms to identify unusual patterns in historical data. For detecting rare operations on Azure Key Vaults based on historical activity patterns in the AzureActivity table, this rule type automatically applies time series analysis and ML models to baseline normal behavior and flag deviations, making it the correct choice.

Answer

Scheduled

Answer

Microsoft Security Incident (for using existing alert triggers)

Answer

NRT (Near-Real-Time)

Question 15

A SOC team uses Microsoft Sentinel and wants to ingest custom log events from an on-premises Linux application that writes to a local file. The team sets up the Log Analytics agent on the Linux server and configures a data connector. Which of the following is the necessary configuration step to collect the custom log file?

Accepted Answer

Use the Custom Logs feature in the Log Analytics workspace to specify the path to the application log file and define the log type name.. Option C is correct because the Custom Logs feature in the Log Analytics workspace is specifically designed to ingest text-based log files from on-premises Linux servers via the Log Analytics agent. You must specify the exact file path (e.g., /var/log/myapp.log) and define a custom log type name (e.g., MyApp_CL) to parse the file and send the data to a custom table in the Log Analytics workspace. This is the only method that directly collects custom application log files without requiring syslog or API-based ingestion.

Answer

Create a Syslog data connector and specify the facility and severity to filter the application logs from /var/log.

Answer

Configure the Log Analytics agent to collect performance counters for the application process.

Answer

Deploy a Log Analytics gateway and configure the application to write directly to the gateway using the HTTP Data Collector API.

Question 16

A security administrator wants to assess their Azure environment against the Azure Security Benchmark and also include custom security controls defined by their organization. They need a single, reusable policy initiative that can be assigned across multiple subscriptions and management groups. What should the administrator create in Microsoft Defender for Cloud?

Accepted Answer

A custom Azure Policy initiative. The administrator needs a single, reusable policy initiative that includes both Azure Security Benchmark controls and custom organizational controls. A custom Azure Policy initiative (also known as a policy set) allows combining multiple policy definitions, including built-in benchmark controls and custom definitions, into one assignable package across subscriptions and management groups. This is the correct approach because initiatives are designed for grouping related policies and can be assigned at scale in Microsoft Defender for Cloud.

Answer

A new regulatory compliance standard

Answer

A custom Azure Policy definition

Answer

A Secure Score recommendation override

Question 17

A security analyst is investigating a suspicious email that was reported by a user. The email contains an attachment with a known malicious macro. The analyst wants to find all instances of this same email being delivered to other users in the organization. Which Advanced Hunting table should the analyst query to find the delivery events?

Accepted Answer

EmailEvents. The EmailEvents table in Microsoft Defender XDR Advanced Hunting contains records of email delivery events, including sender, recipient, subject, and delivery status. Since the analyst needs to find all instances where the same email (with the malicious macro attachment) was delivered to other users, querying EmailEvents with the email's unique identifier (e.g., NetworkMessageId) will return all delivery events across the organization.

Answer

EmailAttachmentInfo

Answer

EmailUrlInfo

Answer

DeviceFileEvents

Question 18

A security analyst wants to see the delivery status and phishing verdict of an email. Which advanced hunting table should the analyst query in Microsoft 365 Defender?

Accepted Answer

EmailEvents. The EmailEvents table in Microsoft 365 Defender's advanced hunting schema contains the delivery status (e.g., Delivered, Failed, Filtered as spam) and the phishing verdict (e.g., Phish, Normal) for each email. This table records the initial processing and classification of the email, making it the correct source for both pieces of information.

Answer

EmailPostDeliveryEvents

Answer

EmailAttachmentInfo

Answer

EmailUrlInfo

Question 19

A large enterprise uses Microsoft Defender for Cloud with the integrated Microsoft Defender Vulnerability Management solution enabled for all servers. The security team wants to identify all virtual machines that have not been scanned for vulnerabilities in the last 7 days. They plan to use Azure Resource Graph (ARG) to generate a report. Which KQL query would correctly identify these machines?

Accepted Answer

securityresources | where type =~ 'microsoft.security/assessments' and name == '4da3e7e8-0e4b-4c5e-8e0a-7e8f4e8e4e8e' | where properties.status.code == 'Unhealthy' and properties.status.firstEvaluationDate < ago(7d). Option A is correct because it queries the `securityresources` table for the specific vulnerability assessment type (`microsoft.security/assessments`) and filters for the vulnerability assessment result named with the GUID `4da3e7e8-0e4b-4c5e-8e0a-7e8f4e8e4e8e`, which corresponds to the 'Vulnerabilities in your virtual machines should be remediated' assessment. It then checks that the status code is 'Unhealthy' (indicating vulnerabilities were found) and that the `firstEvaluationDate` is older than 7 days, which identifies machines that have not been scanned recently.

Answer

resources | where type =~ 'microsoft.compute/virtualmachines' | where properties.storageProfile.osDisk.managedDisk.id != ''

Answer

securityresources | where type =~ 'microsoft.security/regulatorycompliancestandards'

Answer

resources | where type =~ 'microsoft.security/securitystatuses'

Question 20

A security analyst is investigating a user who may have been compromised. The analyst sees a sign-in from an unusual location and then a series of suspicious actions performed by that user, including deleting files and sending emails. The analyst wants to find all emails sent by the user after the anomalous sign-in. Which advanced hunting tables should be used?

Accepted Answer

EmailEvents and IdentityLogonEvents. Option A is correct because the investigation requires correlating a specific sign-in event (from IdentityLogonEvents) with subsequent email activity (from EmailEvents). IdentityLogonEvents captures authentication details including location, while EmailEvents records email send/receive metadata. Joining these tables on the user principal name (UPN) and timestamp allows the analyst to filter all emails sent after the anomalous sign-in.

Answer

EmailEvents and DeviceFileEvents

Answer

IdentityLogonEvents and DeviceEvents

Answer

EmailAttachmentInfo and EmailUrlInfo alone