SC-200 Practice Exam 51 — 20 Questions

Question 1

Refer to the exhibit. An analyst is reviewing a custom detection rule in Microsoft Sentinel. The rule is triggering many false positives from legitimate remote desktop connections. What should the analyst do to reduce false positives while keeping detection of pass-the-hash attacks?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Add an exclusion for known administrative jump boxes.. The rule detects pass-the-hash attacks by looking for suspicious logon patterns (e.g., LogonType 3 with NTLM authentication). Legitimate remote desktop connections from known administrative jump boxes are a common source of false positives. Adding an exclusion for these trusted IPs or hostnames allows the rule to continue detecting pass-the-hash attempts from other sources while suppressing noise from authorized administrative activity. This is a standard tuning technique in Microsoft Sentinel to improve signal-to-noise ratio without weakening detection coverage.

Answer

Change the data source from SecurityEvent to Event.

Answer

Remove the AuthenticationPackage filter to include all packages.

Answer

Change LogonType to 10 to target remote interactive logons.

Question 2

An analyst uses this KQL query in Microsoft Sentinel to hunt for potential brute-force attacks. What is the primary purpose of the join operation?

Accepted Answer

To identify accounts that had both a high number of failed logons and at least one successful logon from the same IP. The join in the KQL query correlates failed logon events with successful logon events on the same account and IP, so its primary purpose is to surface accounts that experienced many failed logons followed by at least one success from the same IP — a classic brute-force success indicator. This narrows the hunt to high-risk accounts rather than all failed logons.

Answer

To filter out IP addresses that have only successful logons

Answer

To calculate the ratio of failed to successful logons for each account

Answer

To remove duplicate entries of account and IP combinations

Question 3

Your team uses Microsoft Sentinel to investigate incidents. You need to create a custom analytic rule that triggers an incident when a user signs in from an unfamiliar location. What is the most efficient way to achieve this?

Accepted Answer

Use a built-in Anomalous Sign-in Location rule template.. Microsoft Sentinel provides a built-in 'Anomalous Sign-in Location' rule template that leverages Microsoft Entra ID Identity Protection data to detect sign-ins from unfamiliar locations. This template is pre-configured with the necessary KQL logic and alerting, making it the most efficient method without requiring custom development or additional data sources.

Answer

Create a playbook triggered by Microsoft Entra ID alerts.

Answer

Write a custom KQL query using SigninLogs.

Answer

Configure a Microsoft Purview insider risk policy.

Question 4

A SOC analyst is creating a scheduled analytics rule in Microsoft Sentinel to detect sign-ins from IP addresses that are not in the organization's known allow list. The allow list is maintained in a custom watchlist named 'AllowedIPs'. The analyst wants the KQL query to efficiently filter out allowed IPs. Which KQL approach should the analyst use?

Accepted Answer

Use the _GetWatchlist('AllowedIPs') function and filter with the '!in' operator.. The _GetWatchlist('AllowedIPs') function retrieves the watchlist content at query runtime, and combining it with the '!in' operator efficiently filters out sign-ins from IPs present in the watchlist. This approach is dynamic, meaning updates to the watchlist are automatically reflected without modifying the query, and it avoids hardcoding IPs or using inefficient row-by-row lookups.

Answer

Use the 'lookup' operator to map IPs against the watchlist.

Answer

Use a 'let' statement to define a static list of allowed IPs.

Answer

Use the 'evaluate' operator with a python script.

Question 5

You are a threat hunter and you want to identify potential lateral movement in your environment. Which Microsoft Defender XDR hunting table would you query to find network connections from a compromised workstation to other internal devices?

Accepted Answer

DeviceNetworkEvents. DeviceNetworkEvents is the correct table because it records network connection telemetry from Defender for Endpoint sensors, including outbound and inbound connections, remote IPs, ports, and the initiating process. Lateral movement typically manifests as SMB, RDP, WinRM, or other internal connections from a compromised host to peer systems, all of which appear in this table. Querying DeviceNetworkEvents lets you correlate the initiating process with remote endpoints to spot anomalous east-west traffic. The other tables capture process, logon, or file activity, not raw network connection details.

Answer

DeviceProcessEvents

Answer

DeviceLogonEvents

Answer

DeviceFileEvents

Question 6

An incident in Microsoft Defender XDR involves a device that is suspected to be infected with ransomware. The device is online and actively encrypting files. Which action should you take to contain the threat?

Accepted Answer

Isolate the device from the network. Isolating the device from the network (Option A) is the correct immediate action because it stops the ransomware from communicating with its command-and-control (C2) server and prevents further lateral movement or encryption of network shares. In Microsoft Defender for Endpoint, device isolation blocks all inbound and outbound traffic at the OS kernel level, while still allowing the device to remain online for forensic analysis and remediation. This containment strategy is critical when the device is actively encrypting files, as it halts the attack's spread without losing the ability to investigate or remediate.

Answer

Disable the user's account

Answer

Run a full antivirus scan on the device

Answer

Collect a memory dump from the device

Question 7

A security analyst is investigating a phishing incident and needs to find the specific email message that was delivered to a user. The analyst knows the subject line and the sender domain. Which advanced hunting table should the analyst query?

Accepted Answer

EmailEvents. The EmailEvents table in Microsoft Defender XDR's advanced hunting schema contains the core properties of email messages, including subject line, sender domain, recipient details, and delivery status. Since the analyst needs to find a specific email by subject and sender domain, this table is the correct starting point for querying delivered messages.

Answer

EmailAttachmentInfo

Answer

EmailUrlInfo

Answer

EmailPostDeliveryEvents

Question 8

You are reviewing an analytics rule in Microsoft Sentinel. The rule is supposed to alert when a Confidential sensitivity label file is accessed. However, no alerts have been generated despite known accesses. What is the most likely reason?

Accepted Answer

The required data connector for Microsoft Purview Information Protection is not connected.. The query should reference the MicrosoftPurviewInformationProtection table (populated by the Microsoft Purview Information Protection data connector), not a nonexistent 'SensitivityLabelEvent' table. With the connector disconnected, that table is empty, which is why the rule's query returns zero rows and no alert fires despite the query logic, schedule, and trigger threshold all being otherwise correct.

Answer

The suppression duration is set to 5 hours, which suppresses alerts.

Answer

The query frequency and period are too short to capture the events.

Answer

The trigger condition is set to 'GreaterThan' 0, which should fire on any event.

Question 9

You are reviewing a threat hunting KQL query in Microsoft Sentinel. The query references an external CSV containing malicious IPs. The query returns no results despite known malicious activity. What is the most likely issue?

Accepted Answer

The external CSV file is not accessible or the URL is malformed.. The query uses the externaldata operator to load an external CSV file. If the file URL is malformed or inaccessible, the query will not load any IPs, resulting in no matches. Option A is incorrect because externaldata is supported in Microsoft Sentinel. Option B is incorrect because the HuntingTimeRange variable is likely used correctly to filter by time, but time filtering is not the cause of zero results. Option C is incorrect because the project clause selects the RemoteIP column; it does not remove it.

Answer

The externaldata function is not supported in Microsoft Sentinel.

Answer

The HuntingTimeRange variable is not being used correctly.

Answer

The project clause removes the RemoteIP column.

Question 10

A threat hunter wants to correlate alerts from multiple Microsoft security products in Microsoft Sentinel. Which feature should be used to create a unified incident?

Accepted Answer

Analytics Rules. Analytics Rules in Microsoft Sentinel can be configured to create incidents from alerts across multiple security products, enabling unified incident creation for threat hunting. Option A (Threat Intelligence) is used to import and use threat intelligence feeds, not to create incidents. Option B (Jupyter Notebooks) provides a platform for security analysis and automation using Python, not for incident creation. Option D (Investigation Graph) is a visual tool for exploring connections between entities in an investigation, not for creating incidents.

Answer

Threat Intelligence

Answer

Jupyter Notebooks

Answer

Investigation Graph

Question 11

During a threat hunting exercise, you need to pivot from a suspicious IP address to find all related alerts and incidents in Microsoft Sentinel. Which feature should you use?

Accepted Answer

Investigation graph. The investigation graph in Microsoft Sentinel allows visual pivoting and exploration of entities, making it the correct tool for pivoting from a suspicious IP to find related alerts and incidents. Option A (Workbooks) is incorrect because workbooks are for creating dashboards and reports. Option B (Incidents blade) is incorrect because it shows incidents but does not provide entity relationship visualization. Option D (Playbook) is incorrect because playbooks automate responses, not pivot investigations.

Answer

Workbook

Answer

Incidents blade

Answer

Playbook

Question 12

Refer to the exhibit. You are reviewing a custom hunting query in Microsoft Defender XDR. The query aims to identify devices with more than 100 outbound connections in the last 30 days to IPs that appear in active threat intelligence indicators. However, the query returns no results. What is the most likely cause?

Accepted Answer

The ThreatIntelligenceIndicator table does not contain any indicators with an Active status that match the remote IPs.. The most likely cause is that the ThreatIntelligenceIndicator table does not contain any active indicators that match the remote IPs from the DeviceNetworkEvents. The query uses an inner join between DeviceNetworkEvents and ThreatIntelligenceIndicator on RemoteIP and NetworkIP. If there are no matching indicators, the join produces zero results. Option A is incorrect because filtering for public IPs is correct for outbound connections to the internet. Option B is incorrect because IP version mismatch would cause a join failure, but the query would still return results if the version matched. Option D is incorrect because the threshold of 100 connections may be high, but if there were matching indicators, some devices would return results.

Answer

The RemoteIPType filter for 'Public' excludes all internal IPs, but devices connect to internal IPs mostly.

Answer

The join on RemoteIP and NetworkIP is mismatched because one is IPv4 and the other IPv6.

Answer

The ConnectionCount threshold of 100 is too high; most devices do not exceed this.

Question 13

You receive an alert in Microsoft Sentinel indicating a potential privilege escalation using the 'AzureHound' tool. You need to determine if the alert is a true positive. What is the first step you should take?

Accepted Answer

Check the user's recent activity and the targeted resource in Microsoft Entra ID audit logs. To determine whether an AzureHound privilege-escalation alert is a true positive, you must validate the underlying identity activity — specifically what the user did and which resource was targeted — using Microsoft Entra ID audit logs. AzureHound enumerates Microsoft Entra ID/Entra ID objects and permissions, so the audit trail of directory reads, role assignments, or consent grants is the authoritative evidence. This confirms or refutes the alert before taking disruptive action.

Answer

Review the Microsoft Defender for Cloud recommendation for the resource

Answer

Block the user account immediately

Answer

Run a full antivirus scan on all devices

Question 14

Refer to the exhibit. You are deploying this analytics rule in Microsoft Sentinel. Which activity will trigger an alert?

Accepted Answer

Word launching cmd.exe. The analytics rule is configured to trigger an alert when a process creation event (Event ID 4688) has a parent process of 'winword.exe' and a child process of 'cmd.exe'. This specific parent-child relationship indicates that Microsoft Word is launching a command prompt, which is a common technique used in malicious documents to execute commands. The rule's query filters for 'ParentImage' containing 'winword.exe' and 'Image' containing 'cmd.exe', so only when Word launches cmd.exe will the alert fire.

Answer

cmd.exe launching winword.exe

Answer

Any process creation event

Answer

Winword.exe execution

Answer

Any cmd.exe execution

Question 15

Which TWO data sources are commonly used in Microsoft Sentinel for threat hunting related to lateral movement? (Select TWO.)

Accepted Answer

SecurityEvent. SecurityEvent (B) is correct because it captures Windows Security event log data forwarded via AMA/Log Analytics, including logon events (4624, 4625), explicit credential use (4648), and special privilege assignment (4672) that are the primary telemetry for detecting lateral movement techniques like pass-the-hash and RDP pivoting. DeviceNetworkEvents (D) is correct because it comes from Microsoft Defender for Endpoint and records inbound/outbound network connections with process, IP, and port context, which is essential for spotting lateral movement such as SMB (445), WMI, PsExec, and remote service creation across hosts. SigninLogs (A) is not among the marked answers: it covers Entra ID authentication events and is more relevant to identity-based attacks and initial access than host-to-host lateral movement. OfficeActivity (C) tracks SharePoint, Exchange, and Teams user actions, which relate to data exfiltration or phishing rather than lateral movement across endpoints. AuditLogs (E) records Entra ID directory changes such as role assignments and app registrations, which support privilege escalation and persistence investigations, not lateral movement hunting.

Answer

SigninLogs

Answer

OfficeActivity

Answer

AuditLogs

Question 16

Refer to the exhibit. You are reviewing an Azure Security Center automation (now Microsoft Defender for Cloud) that should automatically trigger a Logic App when an alert is generated. However, the automation is not triggering. What is the most likely cause?

Accepted Answer

The automation is missing the 'triggers' property to filter on specific alert types. Microsoft Defender for Cloud automation requires a 'triggers' property to define which alert types should invoke the Logic App. Without this property, the automation is created but never fires, as it has no conditions to match incoming alerts. The exhibit shows the automation resource is configured, but missing the triggers array means no alerts will trigger the Logic App.

Answer

The action type is incorrect; it should be 'EventHub'

Answer

The logicAppResourceId is missing

Answer

The apiVersion is invalid

Question 17

Your organization uses Microsoft Defender XDR and Microsoft Sentinel. You need to ensure that high-severity incidents are automatically escalated to the on-call security engineer via Microsoft Teams. Which three components should you configure?

Accepted Answer

A playbook that uses a condition to check severity and then sends a Teams message.. A playbook in Microsoft Sentinel can contain a condition action that evaluates the incident severity. If the severity is 'High', the playbook then uses a Microsoft Teams connector to send a message to the on-call security engineer, automating the escalation process.

Answer

An analytics rule that sends a Teams message when a high-severity alert fires.

Answer

A workbook that displays high-severity incidents for manual escalation.

Question 18

During an incident response, a SOC analyst identifies that a malicious PowerShell script was executed on multiple endpoints. The analyst needs to collect relevant files from all affected endpoints for further analysis. What should the analyst use?

Accepted Answer

Microsoft Defender for Endpoint Live Response.. Microsoft Defender for Endpoint Live Response allows analysts to remotely connect to endpoints and collect files, run scripts, and perform forensic actions in real time. This is the correct tool for gathering malicious PowerShell scripts from multiple affected endpoints during incident response.

Answer

Microsoft Defender for Cloud Apps file investigation.

Answer

Microsoft Purview eDiscovery.

Answer

Microsoft Sentinel incident investigation graph.

Question 19

Your security operations center (SOC) uses Microsoft Sentinel. Analysts need to collaborate on incidents by adding comments and changing severity. Which feature should they use?

Accepted Answer

Incident management. Incident management in Microsoft Sentinel provides the built-in capability for SOC analysts to collaborate on incidents by adding comments and changing severity. This feature allows multiple analysts to work on the same incident, track changes, and update the severity level directly within the incident interface, which is essential for effective teamwork and triage.

Answer

Hunting

Answer

Playbooks

Answer

Workbooks

Question 20

Refer to the exhibit. An automation rule is configured as shown. When will the playbook be triggered?

Accepted Answer

When a new incident is created with severity High, from Microsoft Defender for Endpoint, and with 'Malware' in the title. In Microsoft Sentinel automation rules, all configured conditions are evaluated with AND logic — every condition must be true for the rule to fire. The exhibit shows three conditions: incident severity = High, the incident must be created (not updated), and the title must contain 'Malware'. Additionally, the rule is scoped to incidents originating from Microsoft Defender for Endpoint. Therefore, the playbook triggers only when a new incident is created that is High severity, sourced from Defender for Endpoint, and has 'Malware' in the title.

Answer

When any incident is created from Microsoft Defender for Endpoint

Answer

When a new incident with any severity contains 'Malware' in the title

Answer

When an incident is updated to High severity