SC-200 Practice Questions 2 — 50 Questions

Question 1

You are a SOC analyst investigating an incident where a user's credentials were used to access a sensitive SharePoint site from an unusual location. Microsoft Defender for Cloud Apps detected the activity as a suspicious sign-in. You need to create a detection rule that alerts whenever a user accesses SharePoint from a location not in the allowed list. What type of rule should you create in Microsoft Defender for Cloud Apps?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Activity policy.. An Activity policy in Microsoft Defender for Cloud Apps allows you to create custom rules that trigger alerts based on specific user activities, such as accessing SharePoint from a location not in the allowed list. This policy type evaluates each activity against defined conditions (e.g., IP address ranges, geolocation) and can generate alerts or take automated actions. It is the correct choice because it directly matches the requirement to detect a specific access pattern (location-based anomaly) rather than broad behavioral patterns.

Answer

App discovery policy.

Answer

Session policy.

Answer

Anomaly detection policy.

Question 2

Which TWO data sources are natively supported by Microsoft Sentinel for ingesting security events? (Choose two.)

Accepted Answer

Windows Security Events. Windows Security Events are natively supported by Microsoft Sentinel via the Windows Security Events via AMA connector or the legacy Log Analytics agent. This connector ingests security event logs (e.g., Event ID 4625 for failed logons) directly into Sentinel without requiring a third-party parser or custom data connector. Azure Activity Logs are also natively supported through the Azure Activity connector, which streams subscription-level operational events (e.g., resource creation, policy changes) into Sentinel at no additional cost.

Answer

Salesforce audit logs

Answer

GitHub audit logs

Answer

Google Cloud Platform (GCP) logs

Question 3

Which THREE actions should be taken when a phishing attack is detected in Microsoft Defender XDR?

Accepted Answer

Report the email as phishing in Microsoft Defender for Office 365. Reporting the email as phishing in Microsoft Defender for Office 365 triggers automated investigation and remediation workflows, including tenant-level block actions and threat intelligence updates. This action directly supports the incident response process by enabling the security team to analyze the phishing attempt and prevent further delivery to other users.

Answer

Run a full antivirus scan on the user's device

Answer

Reset the user's password

Question 4

Which THREE components are required to use Microsoft Sentinel's automation rules to automatically respond to incidents?

Accepted Answer

The appropriate permissions to run playbooks.. Automation rules require appropriate permissions (e.g., Microsoft Sentinel Contributor or Automation Contributor) to execute playbooks. Without these permissions, the automation rule cannot invoke the playbook when an incident is created or updated, even if the rule and playbook are properly configured.

Answer

A playbook created in Azure Logic Apps.

Answer

An analytics rule generating alerts.

Question 5

You have deployed Microsoft Defender for Endpoint and integrated it with Microsoft Sentinel. You notice that alerts from Defender for Endpoint are not appearing in Sentinel. What should you check first?

Accepted Answer

Verify that the Microsoft 365 Defender connector in Sentinel is enabled and configured.. The Microsoft 365 Defender connector in Microsoft Sentinel is the specific data connector responsible for ingesting alerts from Microsoft Defender for Endpoint (and other Defender products). If this connector is not enabled or misconfigured, alerts will not flow into Sentinel regardless of licensing, device onboarding, or analytics rules. This is the first and most direct check because the connector acts as the ingestion pipeline.

Answer

Confirm that Defender for Endpoint is licensed for all users.

Answer

Check that the alert severity is not being filtered out by analytics rules.

Answer

Ensure that all devices are onboarded to Defender for Endpoint.

Question 6

Your organization uses Microsoft Sentinel for security operations. You need to ensure that a specific AWS CloudTrail log is ingested into Microsoft Sentinel. Which data connector should you use?

Accepted Answer

Amazon Web Services S3 Connector. The Amazon Web Services S3 Connector is the correct choice because AWS CloudTrail logs are stored as JSON files in an S3 bucket. Microsoft Sentinel ingests these logs by connecting directly to the S3 bucket, reading the CloudTrail log files, and pulling them into the Log Analytics workspace. The AWS CloudTrail Connector, by contrast, is a legacy connector that requires a separate AWS Lambda function and is deprecated in favor of the S3 connector.

Answer

AWS CloudTrail Connector

Answer

Azure Functions (AWS)

Answer

AWS Security Hub Connector

Question 7

You are configuring Microsoft Sentinel to ingest logs from a third-party firewall via Syslog. The data connector shows 'Connected' but no events are being received. You have verified network connectivity and firewall configuration. What should you check next?

Accepted Answer

Validate that the Data Collection Rule (DCR) is properly configured to ingest the Syslog facility and severity.. When a Syslog data connector shows 'Connected' but no events are received, the most common cause is a misconfigured Data Collection Rule (DCR). The DCR defines which Syslog facilities and severities to collect; if it does not match the firewall's actual Syslog output (e.g., facility 'local0' with severity 'informational'), events will be filtered out before ingestion. Network connectivity and firewall configuration are already verified, so the DCR is the next logical check.

Answer

Verify that the connector has the necessary OAuth permissions in Microsoft Entra ID.

Answer

Check that the user who configured the connector has the Microsoft Sentinel Contributor role.

Answer

Ensure the firewall is registered in Azure Policy as a compliant resource.

Question 8

A security analyst receives a high-severity alert for a suspicious login from an unusual location. The alert was generated by Microsoft Sentinel from Microsoft Entra ID sign-in logs. The analyst needs to determine if the login was successful and if any data exfiltration occurred. What is the MOST efficient first step?

Accepted Answer

Run a KQL query in Microsoft Sentinel to review the SigninLogs table for the user within the alert time range.. The most efficient first step is to run a KQL query in Microsoft Sentinel against the SigninLogs table for the specific user within the alert time range. This directly confirms whether the suspicious login was successful by checking the 'ResultType' and 'ResultDescription' fields, which is the fastest way to validate the alert's core claim before investigating data exfiltration.

Answer

Use Microsoft Defender XDR to check the user's device timeline for suspicious activity.

Answer

Run a KQL query in Microsoft Sentinel to check Microsoft Defender for Cloud Apps alerts for the user.

Answer

Check the firewall logs in Azure Firewall for outbound connections from the user's IP.

Question 9

Your organization has a Microsoft Sentinel workspace that ingests logs from multiple sources. You need to implement a process to review and approve changes to analytics rules before they are deployed to production. What should you use?

Accepted Answer

Configure Microsoft Sentinel repository integration with Azure DevOps and use branch policies for approval.. Microsoft Sentinel repository integration with Azure DevOps (or GitHub) enables source control for analytics rules, allowing changes to be managed through pull requests and branch policies. This enforces a review and approval workflow before rules are deployed to production, directly meeting the requirement for a structured change management process.

Answer

Create a playbook that emails the SOC manager when an analytics rule is modified.

Answer

Use a workbook to track changes to analytics rules.

Answer

Export analytics rules to a notebook for manual review.

Question 10

A SOC analyst is configuring a Microsoft Sentinel automation rule to trigger a playbook when an incident is created. The playbook should only run if the incident severity is 'High' and the incident title contains 'Phishing'. Which two conditions should the analyst add to the automation rule? (Select all that apply.) (Choose 2.)

Accepted Answer

Incident severity equals High. The automation rule condition 'Incident severity equals High' directly matches the requirement that the playbook should only trigger for incidents with a severity of 'High'. In Microsoft Sentinel, automation rules evaluate conditions against incident properties, and severity is a standard field that can be filtered using the 'equals' operator. This ensures the playbook is not invoked for lower-severity incidents.

Answer

Incident status is New

Answer

Incident owner is Unassigned

Question 11

An organization uses Microsoft 365 Defender. A security analyst is investigating an incident where a user's device was compromised. The analyst wants to determine if the attacker attempted to access sensitive files stored in SharePoint Online from that device. Which advanced hunting table should the analyst query to find file access events from cloud apps?

Accepted Answer

CloudAppEvents. The CloudAppEvents table in Microsoft 365 Defender captures audit logs for cloud applications, including SharePoint Online. It records file access events such as viewing, downloading, or modifying files, making it the correct table to query when investigating attacker attempts to access sensitive files from a compromised device.

Answer

IdentityLogonEvents

Answer

DeviceFileEvents

Answer

EmailEvents

Question 12

Your organization uses Microsoft Sentinel. An incident is created from a fusion detection that combines multiple signals. You need to ensure that when the incident is resolved, all related alerts are also resolved automatically. What should you do?

Accepted Answer

Create an automation rule triggered when an incident is closed, with the action 'Close alert'. An automation rule triggered when an incident is closed can include the action 'Close alert', which automatically closes all alerts linked to that incident. This ensures that when the incident is resolved, all related alerts are also resolved without manual intervention.

Answer

Create a playbook triggered on incident creation that closes alerts

Answer

Create an automation rule triggered when an alert is created

Answer

Configure the analytics rule to close alerts when the incident is resolved

Question 13

A SOC analyst wants to create a visual dashboard in Microsoft Sentinel to monitor sign-in activity trends over the past 30 days. Which feature should the analyst use?

Accepted Answer

Workbooks. Workbooks in Microsoft Sentinel provide a flexible canvas for creating custom visual dashboards using Azure Monitor Workbooks. They allow the analyst to query Log Analytics workspaces (e.g., SigninLogs table) and render time-series charts, trend lines, and other visualizations to monitor sign-in activity over the past 30 days. This is the correct feature for building a visual dashboard.

Answer

Analytics rules

Answer

Playbooks

Answer

Threat Intelligence

Question 14

Your organization uses Microsoft Sentinel and wants to ensure that all incident-related data is retained for at least 90 days for compliance purposes. Which configuration should you check?

Accepted Answer

Log Analytics workspace retention settings. Log Analytics workspace retention settings directly control how long raw data ingested into Microsoft Sentinel is stored. For compliance requiring 90-day retention of incident-related data, you must configure the workspace retention period to at least 90 days (or use archive policies for longer retention). Incident data in Sentinel is derived from this underlying workspace data, so retention settings at the workspace level ensure the data persists for the required duration.

Answer

Watchlist settings

Answer

Analytics rule settings

Answer

Incident settings in Sentinel

Question 15

Your organization uses Microsoft Defender for Identity (MDI) and Microsoft Sentinel. You notice that MDI alerts are not appearing in Sentinel. You have already installed the MDI data connector and configured the workspace. What is the most likely cause?

Accepted Answer

The data connector is not enabled, even though it is installed. The most likely cause is that the MDI data connector, although installed, is not enabled. In Microsoft Sentinel, installing a data connector only makes it available; you must explicitly enable it to start ingesting data. Without enabling the connector, alerts from Microsoft Defender for Identity will not flow into Sentinel, even if the workspace is correctly configured.

Answer

The workspace is in a different region than MDI

Answer

The Microsoft 365 Defender connector is not installed

Answer

Microsoft Defender for Identity is not licensed

Question 16

Your organization uses Microsoft Sentinel. You have been asked to configure automated responses to security incidents. Which TWO of the following can be used to automate responses in Microsoft Sentinel?

Accepted Answer

Playbooks (Azure Logic Apps). Playbooks in Microsoft Sentinel are built on Azure Logic Apps, allowing you to automate complex, multi-step response workflows triggered by security incidents. They can execute actions like blocking IPs, resetting passwords, or enriching alerts with threat intelligence, making them a core automation tool for incident response.

Answer

Workbooks

Answer

Power Automate flows

Answer

Custom connectors

Question 17

The exhibit shows the output of a Microsoft Defender for Endpoint API call to get machine information. What does the isolationStatus value indicate?

Accepted Answer

The device has been isolated from the network.. The isolationStatus value in Microsoft Defender for Endpoint indicates whether a device has been isolated from the network. When the value is 'Isolated', it means the device is blocked from communicating with other devices or the internet, typically as a response to a security incident. Option D is correct because this status directly reflects that the device is isolated from the network.

Answer

The device is healthy and has no issues.

Answer

The device is currently being scanned for malware.

Answer

The device is not isolated and is fully connected.

Question 18

You are configuring Microsoft Sentinel to ingest syslog data from a network appliance. After configuring the data connector, you notice that no data is appearing in the CommonSecurityLog table. The syslog server is sending data to the Azure Monitor Agent (AMA) on the log collector. What should you verify first?

Accepted Answer

Verify that a Data Collection Rule is defined to collect the syslog facilities.. The Azure Monitor Agent (AMA) requires a Data Collection Rule (DCR) to specify which syslog facilities and severity levels to collect. Without a DCR, the AMA will not forward syslog data to the CommonSecurityLog table, even if the syslog server is sending data to the collector. This is the most common missing configuration step after setting up the data connector.

Answer

Check the Heartbeat table for the log collector.

Answer

Ensure the syslog appliance can reach the collector on UDP port 514.

Answer

Check the data connector health status in Sentinel.

Question 19

The exhibit shows a partial playbook trigger configuration in Microsoft Sentinel. When will this playbook be triggered?

Accepted Answer

When an incident of severity High is created.. The playbook trigger configuration shown in the exhibit specifies that the playbook runs when an incident is created, and it includes a condition that filters for incidents with a severity of High. In Microsoft Sentinel, playbook triggers can be set on incident creation or alert creation, and conditions like severity are evaluated at the time of the trigger event. Here, the trigger is explicitly set to 'When an incident is created' with a severity condition of 'High', so the playbook only fires when a new incident with High severity is created.

Answer

When an incident is updated with severity High.

Answer

When an alert is generated with severity High.

Answer

When any incident is created.

Question 20

A Microsoft Sentinel scheduled analytics rule detects impossible travel but creates too many duplicate incidents for the same user within a short period. Which two rule settings should you tune? (Choose 2.)

Accepted Answer

Configure event grouping or incident grouping by user entity.. Configuring event grouping or incident grouping by user entity consolidates multiple alerts for the same user into a single incident, reducing duplicate incidents. In Microsoft Sentinel, this setting controls how alerts are aggregated into incidents based on entity fields like user account, ensuring that a burst of impossible travel alerts for the same user generates one incident instead of many.

Answer

Disable the data connector.

Answer

Delete the Log Analytics workspace.