SC-200 Practice Exam 51 — 20 Questions

Question 1

Your organization uses Microsoft Defender for Cloud Apps. You detect a suspicious app that has high data access and unusual API calls. You want to automatically block the app and notify the user. What should you implement?

Accepted Answer

Create an app governance policy that automatically blocks the app and sends a notification to the user.. Option C is correct because app governance policies in Defender for Cloud Apps allow automated actions like blocking apps and sending notifications. Option A is wrong because access policies are for user or device access, not app blocking. Option B is wrong because session policies control real-time sessions, not app blocking. Option D is wrong because DLP policies are for data loss prevention, not app control.

Answer

Create an access policy that blocks the app based on the risk level.

Answer

Create a session policy to monitor the app's API calls.

Answer

Create a DLP policy to prevent data exfiltration from the app.

Question 2

Your organization uses Microsoft Sentinel. You have a requirement to automatically add a tag to incidents that involve a specific user. The tag should be added when the incident is created. What should you configure?

Accepted Answer

Create an automation rule that triggers on incident creation and runs a playbook with the 'Add tag' action.. Option A is correct because an automation rule can run a playbook that adds a tag based on incident properties. Option B is wrong because watchlists are for enrichment, not tagging. Option C is wrong because analytics rules create alerts, not tags. Option D is wrong because entity behavior analytics does not add tags.

Answer

Add the user to a watchlist and create a fusion rule.

Answer

Modify the analytics rule to include a tag in the incident configuration.

Answer

Enable entity behavior analytics to automatically tag incidents.

Question 3

Your organization uses Microsoft Sentinel. A security incident is generated by a scheduled analytics rule. You need to automatically assign the incident to the SOC team and set its severity. What should you create?

Accepted Answer

An automation rule. Option D is correct because automation rules in Sentinel can perform actions like assigning owner and changing severity. Option A is wrong because playbooks are for complex tasks, but automation rules are simpler. Option B is wrong because workbooks are for visualization. Option C is wrong because analytics rules generate incidents, not handle them.

Answer

An analytics rule

Answer

A workbook

Answer

A playbook

Question 4

A SOC analyst is investigating a phishing campaign that targets Microsoft 365 users. The analyst needs to collect email message headers from multiple users' mailboxes. Which Microsoft 365 Defender action should the analyst use?

Accepted Answer

Use Microsoft 365 Defender > Email & collaboration > Explorer to query email headers.. Option C is correct because 'Email & collaboration > Explorer' allows hunting for email messages and collecting headers. Option A is wrong because 'Threat hunters' is a Microsoft Defender XDR role, not a specific action. Option B is wrong because 'Actions & submissions' is for submitting suspicious items, not for collecting headers. Option D is wrong because 'Attack simulation training' is for testing, not investigation.

Answer

Use Microsoft 365 Defender > Actions & submissions to view email headers.

Answer

Use Microsoft 365 Defender > Threat hunters to search for email headers.

Answer

Use Microsoft 365 Defender > Attack simulation training to collect headers.

Question 5

A security analyst receives a high-severity alert for a suspicious login from an unusual location. The alert was generated by Microsoft Sentinel from Microsoft Entra ID sign-in logs. The analyst needs to determine if the login was successful and if any data exfiltration occurred. What is the MOST efficient first step?

Accepted Answer

Run a KQL query in Microsoft Sentinel to review the SigninLogs table for the user within the alert time range.. Option B is correct because examining Microsoft Entra ID sign-in logs in Sentinel provides immediate details about login success/failure. Option A is wrong because Defender for Cloud Apps alerts may not include sign-in details. Option C is wrong because reviewing all firewalls is too broad and inefficient. Option D is wrong because checking Microsoft Defender XDR does not directly show sign-in details.

Answer

Use Microsoft Defender XDR to check the user's device timeline for suspicious activity.

Answer

Run a KQL query in Microsoft Sentinel to check Microsoft Defender for Cloud Apps alerts for the user.

Answer

Check the firewall logs in Azure Firewall for outbound connections from the user's IP.

Question 6

Which THREE are valid data connectors in Microsoft Sentinel for ingesting security events from Microsoft 365 services? (Choose three.)

Accepted Answer

Microsoft 365 Defender. Options A, C, and D are valid connectors. A: Microsoft Entra ID (formerly Azure AD) connector ingests sign-in logs and audit logs. C: Microsoft 365 Defender connector ingests alerts from Defender for Endpoint, Office 365, etc. D: Office 365 connector ingests Exchange, SharePoint, Teams logs. Option B is wrong because Microsoft Purview is a compliance portal, not a data connector. Option E is wrong because Microsoft Intune is a device management service, but its logs are ingested via other connectors (e.g., Azure AD).

Answer

Microsoft Purview

Answer

Microsoft Intune

Question 7

A security analyst needs to contain a compromised device that is spreading malware in the network. The device is enrolled in Microsoft Intune and managed by Microsoft Defender for Endpoint. What is the fastest way to isolate the device from the network?

Accepted Answer

Use Microsoft Defender for Endpoint to initiate device isolation.. Option A is correct because Defender for Endpoint supports device isolation action. Option B is wrong because disabling the device in Intune only prevents new management commands. Option C is wrong because wiping the device is destructive and may not be fastest. Option D is wrong because blocking the user's account does not isolate the device.

Answer

Disable the device in Microsoft Intune.

Answer

Perform a remote wipe of the device from Microsoft Intune.

Answer

Block the user's account in Microsoft Entra ID.

Question 8

Refer to the exhibit. You are reviewing an automation rule in Microsoft Sentinel. What will happen when a new incident with severity Medium is created?

Accepted Answer

The rule will not trigger because severity is Medium. The automation rule triggers only on 'IncidentCreated' with condition 'IncidentSeverity Equals High'. Medium severity does not meet the condition, so the rule does not run.

Answer

The rule will trigger and create a new incident

Answer

The rule will trigger and run the playbook

Answer

The rule will update the incident severity to High

Answer

The rule will trigger but skip the playbook

Question 9

During an incident response, you identify that a user's account was used to sign in from an unusual location. You need to contain the incident immediately. What should you do first?

Accepted Answer

Disable the user account in Microsoft Entra ID.. Option A is correct because disabling the user account in Microsoft Entra ID is the fastest way to stop all sign-ins, containing the incident. Option B is wrong because resetting password alone does not prevent the attacker from using existing tokens. Option C is wrong because revoking sessions does not block future sign-ins. Option D is wrong because Conditional Access policies cannot block a specific user instantly.

Answer

Reset the user's password.

Answer

Revoke the user's refresh tokens.

Answer

Create a Conditional Access policy to block the user.

Question 10

Which THREE actions are part of the containment phase in the Microsoft Incident Response process?

Accepted Answer

Block known malicious IP addresses at the firewall.. Options A, C, and D are correct. Disabling compromised accounts, isolating affected systems, and blocking malicious IPs are containment actions. Option B is wrong because collecting forensic data is part of investigation. Option E is wrong because notifying stakeholders is communication.

Answer

Notify senior management of the incident.

Answer

Collect forensic data from affected systems.

Question 11

Which TWO actions should you take when responding to a confirmed ransomware incident in Microsoft Defender for Endpoint?

Accepted Answer

Run a full antivirus scan on the affected devices.. Options B and D are correct. Isolating affected devices prevents spread, and running antivirus scans cleans the device. Option A is wrong because allowing malicious files is dangerous. Option C is wrong because collecting investigation package is for analysis, not immediate response. Option E is wrong because initiating live response might be needed but is not a standard first action.

Answer

Allow the ransomware executable in the firewall.

Answer

Collect an investigation package from the affected devices.

Answer

Initiate a live response session to delete files.

Question 12

Your organization uses Microsoft Sentinel. A security analyst receives an alert indicating that a user account was used to sign in from an unfamiliar location. You need to investigate the incident using Microsoft Defender XDR. Which action should you take first?

Accepted Answer

Review the alert in the Microsoft Defender XDR portal and classify it as a true or false positive.. Option D is correct because the first step in incident response is to classify the incident as a true or false positive. Option A is wrong because creating a playbook should be done after confirming the incident is a true positive. Option B is wrong because resetting the password should be a containment action after classification. Option C is wrong because turning off the user account is a containment action, not the first step.

Answer

Create an automated playbook to reset the user's password.

Answer

Turn off the user account in Microsoft Entra ID.

Answer

Reset the user's password immediately to prevent further access.

Question 13

Which THREE actions can you take in Microsoft Sentinel to respond to an incident?

Accepted Answer

Assign the incident to a user

Answer

Modify a KQL query in an analytics rule

Answer

Export logs to Azure Storage

Question 14

A SOC analyst is using Microsoft Sentinel to respond to an incident involving multiple compromised user accounts. The analyst needs to quickly see the timeline of all related events. Which feature should the analyst use?

Accepted Answer

Incident timeline.. Option A is correct because the incident timeline shows all alerts, bookmarks, and activities in chronological order. Option B is wrong because entity pages provide details about an entity, not a timeline. Option C is wrong because workbooks are for dashboards, not incident-specific timelines. Option D is wrong because the analytics rule page shows rule configuration, not timeline.

Answer

Entity behavior page.

Answer

Analytics rule page.

Answer

Workbook.

Question 15

Your organization uses Microsoft Defender for Office 365. A user reports receiving a phishing email that bypassed the default policy. You need to create a custom anti-phishing policy to block similar emails in the future. What should you configure?

Accepted Answer

Enable spoof intelligence and add the sender domain to the blocked senders list.. Option D is correct because spoof intelligence identifies and blocks spoofed senders. Option A is wrong because impersonation protection addresses CEO fraud, not general phishing. Option B is wrong because mail flow rules are transport rules, not anti-phishing. Option C is wrong because Safe Attachments handles attachments, not phishing content.

Answer

Enable Safe Attachments for the organization.

Answer

Configure impersonation protection for the user's domain.

Answer

Create a mail flow rule to block the sender's domain.

Question 16

Which TWO are valid incident management actions in Microsoft Sentinel? (Choose two.)

Accepted Answer

Change the incident status to 'Closed'. Options B and D are correct. B: Changing the status to 'Closed' is a valid action. D: Assigning the incident to another analyst is a valid action. Option A is wrong because deleting incidents is not supported; they can be closed or archived. Option C is wrong because merging incidents is not a direct action; incidents can be linked via groups. Option E is wrong because exporting incidents to a CSV is not a built-in action.

Answer

Merge two incidents into one

Answer

Export the incident to a CSV file

Answer

Delete an incident

Question 17

During an incident investigation, you discover that an attacker used a legitimate account to access sensitive data in Microsoft Purview Information Protection. You need to identify what data was accessed and by whom. Which log source should you query?

Accepted Answer

Microsoft Purview data access logs. Option D is correct because Purview logs track access to sensitive data. Option A is wrong because Azure AD sign-in logs show authentication only. Option B is wrong because Office 365 audit logs may not include Purview data access. Option C is wrong because Microsoft 365 Defender alerts are for detections, not detailed access logs.

Answer

Microsoft 365 Defender alerts

Answer

Microsoft Entra ID sign-in logs

Answer

Office 365 audit logs (unified audit log)

Question 18

Your Microsoft 365 tenant is protected by Microsoft Defender for Office 365. A user reports receiving a suspicious email with a link. You need to investigate whether the link was malicious and if any other users clicked it. Which tool should you use first?

Accepted Answer

Threat Explorer. Threat Explorer allows investigation of email threats, including URLs and user clicks. The others are for other purposes.

Answer

Microsoft Entra ID sign-in logs

Answer

Microsoft Purview compliance portal

Answer

Email Entity page in Microsoft Defender XDR

Answer

Attack Simulation Training

Question 19

Your organization uses Microsoft Sentinel and Microsoft Defender XDR. During an incident investigation, you find that a device is exfiltrating data to an external IP. You need to isolate the device from the network using automated response. Which action should you configure in an automation rule?

Accepted Answer

Run a playbook that triggers a Microsoft Defender for Endpoint 'Isolate device' action.. Option B is correct because Microsoft Defender for Endpoint provides the 'Isolate device' action that can be triggered from Sentinel automation rules. Option A is wrong because Microsoft Entra ID does not have device isolation. Option C is wrong because Intune is for device management but not immediate isolation. Option D is wrong because Microsoft Purview is for data governance, not device isolation.

Answer

Trigger a Microsoft Purview data loss prevention policy.

Answer

Run a Microsoft Entra ID playbook to disable the device.

Answer

Create an automation rule in Microsoft Intune to wipe the device.

Question 20

Which TWO Microsoft Defender XDR entities can be managed during incident response?

Accepted Answer

Devices. Options B and D are correct. Devices and user accounts are managed entities in Defender XDR. Option A is wrong because Azure subscriptions are not entities in Defender XDR. Option C is wrong because Microsoft 365 tenants are not managed entities. Option E is wrong because network interfaces are not entities.

Answer

Network interfaces

Answer

Azure subscriptions

Answer

Microsoft 365 tenants