SC-200 Practice Exam 52 — 20 Questions

Question 1

You are reviewing an alert rule in Microsoft Sentinel created via ARM template. What is the primary purpose of this rule?

Accepted Answer

To send an alert when a sign-in with high risk level is detected.. Option B is correct because the rule triggers when a sign-in risk level is high, sending an alert to an action group. Option A is wrong because it does not block the user. Option C is wrong because it creates an alert, not an incident directly. Option D is wrong because it does not isolate devices.

Answer

To isolate the user's device from the network.

Answer

To automatically block the user from signing in.

Answer

To create an incident in Microsoft Sentinel.

Question 2

During a security incident, you need to isolate a compromised Windows device from the network while allowing communication with Microsoft Defender for Endpoint services. Which Microsoft Defender for Endpoint action should you use?

Accepted Answer

Isolate device. Option B is correct because 'Isolate device' allows communication with Defender for Endpoint services while blocking other network traffic. Option A is wrong because 'Run antivirus scan' only scans and does not isolate. Option C is wrong because 'Restrict app execution' limits applications but does not isolate network. Option D is wrong because 'Collect investigation package' gathers data but does not isolate.

Answer

Run antivirus scan

Answer

Collect investigation package

Answer

Restrict app execution

Question 3

Which TWO actions are valid containment steps for a compromised user account in Microsoft Defender XDR?

Accepted Answer

Disable the user account in Microsoft Entra ID

Answer

Create a new email rule to forward emails

Answer

Add the user to a privileged role

Answer

Run a full antivirus scan on the user's device

Question 4

Which TWO actions can be performed using Microsoft Sentinel's automation rules? (Choose two.)

Accepted Answer

Change the severity of an incident.. Option A and D are correct. Automation rules can trigger playbooks and change incident severity. Option B is wrong because automation rules cannot directly block IP addresses; that requires a playbook. Option C is wrong because automation rules run on incidents, not on queries. Option E is wrong because automation rules do not manage user permissions.

Answer

Block an IP address in Azure Firewall.

Answer

Assign a user to an incident owner.

Answer

Run a KQL query against a Log Analytics workspace.

Question 5

A security team is investigating a ransomware incident that encrypted files on several Windows servers. Microsoft Defender for Endpoint detected the ransomware but the initial infection vector is unknown. Which KQL query in Microsoft Sentinel would BEST identify the initial process that executed the ransomware?

Accepted Answer

DeviceProcessEvents | where FileName contains 'ransomware.exe' | project DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, Timestamp. Option B is correct because DeviceProcessEvents tracks process creation events and can trace parent-child relationships. Option A is wrong because DeviceFileEvents tracks file changes, not process creation. Option C is wrong because DeviceNetworkEvents tracks network connections, not processes. Option D is wrong because DeviceEvents includes various events but not as directly for process ancestry.

Answer

DeviceNetworkEvents | where RemoteUrl contains 'malicious' | project DeviceName, RemoteIP, Timestamp

Answer

DeviceFileEvents | where FileName contains 'ransomware.exe' | project DeviceName, ActionType, Timestamp

Answer

DeviceEvents | where ActionType == 'RansomwareDetection' | project DeviceName, Timestamp

Question 6

You deploy the above ARM template to create a scheduled analytics rule in Microsoft Sentinel. After deployment, the rule runs but never generates incidents. What is the MOST likely cause?

Accepted Answer

The saved search resource type is incorrectly used; it should not be included in the template.. Option D is correct because the saved search (savedSearches) resource type is not a valid alert rule in Sentinel; the alert rule resource type should be 'Microsoft.SecurityInsights/alertRules' with the correct schema. The template includes a saved search and an alert rule, but the alert rule's query uses SigninLogs which is valid. However, the issue is that the saved search is incorrectly defined as a resource. Option A is wrong because the query is valid. Option B is wrong because severity is valid. Option C is wrong because the rule is enabled.

Answer

The severity level 'Medium' is not supported.

Answer

The rule is disabled because 'enabled' is set to true but there is a typo.

Answer

The query 'SigninLogs | where ResultType == 50057' is invalid.

Question 7

Your organization uses Microsoft Sentinel with Fusion and Microsoft Security incident creation rules. You receive a high-severity incident from Microsoft Defender for Cloud Apps. The incident has a low confidence score. What should you do first?

Accepted Answer

Validate the alert by correlating with other logs.. Option B is correct because validating the alert ensures that the incident is actionable before escalating. Option A is wrong because escalating without validation may waste resources. Option C is wrong because dismissing without investigation may miss a real threat. Option D is wrong because suppressing low confidence alerts may cause missed detections.

Answer

Dismiss the incident as a false positive due to low confidence.

Answer

Suppress all future alerts from Defender for Cloud Apps with low confidence.

Answer

Escalate the incident to the SOC manager immediately.

Question 8

You are investigating a ransomware incident in Microsoft Sentinel. The incident contains multiple alerts. You need to group related alerts under the same incident to reduce alert fatigue. What should you do?

Accepted Answer

Configure incident creation rules in the analytics rule.. Option A is correct because incident creation rules in Sentinel automatically group alerts by entities and time window. Option B is wrong because analytics rules create alerts, not incidents. Option C is wrong because automation rules trigger playbooks, not grouping. Option D is wrong because entity behavior analytics is a separate feature.

Answer

Enable User and Entity Behavior Analytics (UEBA).

Answer

Create a new analytics rule to combine alerts.

Answer

Use an automation rule to merge incidents.

Question 9

You are reviewing an automation rule in Microsoft Sentinel. The rule triggers on incident creation with severity High. However, during a recent High severity incident, the playbook did not run. What is the most likely cause?

Accepted Answer

The automation rule does not have an owner assigned.. Option B is correct because automation rules require an assigned owner to run playbooks. Option A is wrong because the rule triggers on creation, not closure. Option C is wrong because the condition is correct for High severity. Option D is wrong because the action order is fine.

Answer

The action order is set to 1, but another action has a higher priority.

Answer

The condition requires IncidentSeverity equals High, but the incident was classified as Medium.

Answer

The rule triggers on incident creation, but the incident was first closed and then reopened.

Question 10

You are analyzing a firewall policy in Azure Firewall deployed via Azure Policy. What is the effect of this rule?

Accepted Answer

Denies inbound traffic from IP 10.0.0.5 to any destination.. Option B is correct because the rule denies inbound traffic from IP 10.0.0.5 to any destination. Option A is wrong because it denies, not allows. Option C is wrong because the direction is inbound. Option D is wrong because it blocks all traffic from that IP, not just specific ports.

Answer

Allows outbound traffic from any source to IP 10.0.0.5.

Answer

Allows inbound traffic from IP 10.0.0.5 to any destination.

Answer

Denies outbound traffic from any source to IP 10.0.0.5.

Question 11

You are investigating a phishing incident in Microsoft Defender XDR. The incident involves a user who clicked a malicious link in an email. Which data source would you use to trace the email's origin?

Accepted Answer

Microsoft Defender for Office 365. Option A is correct because Microsoft Defender for Office 365 provides email and phishing data. Option B is wrong because Defender for Endpoint focuses on devices. Option C is wrong because Defender for Identity focuses on on-premises identity threats. Option D is wrong because Defender for Cloud Apps focuses on cloud applications.

Answer

Microsoft Defender for Endpoint

Answer

Microsoft Defender for Cloud Apps

Answer

Microsoft Defender for Identity

Question 12

You have a Microsoft Sentinel analytical rule with the above configuration. During a security incident, multiple high-severity alerts are generated within a 5-minute window. How does the rule handle these alerts?

Accepted Answer

Alerts with the same entities are grouped into a single incident.. Option C is correct because grouping is enabled with a 5-minute lookback and 'All' entities matching method, meaning alerts with identical entities are grouped into one incident. Option A is wrong because grouping is enabled, not disabled. Option B is wrong because alerts are grouped, not created separately. Option D is wrong because alerts are not suppressed; suppression is disabled.

Answer

Only the first alert creates an incident; subsequent alerts are ignored.

Answer

Each alert creates a separate incident.

Answer

Alerts are suppressed for 5 minutes after the first alert.

Question 13

A SOC analyst needs to investigate a potential data exfiltration incident involving a user uploading files to an external cloud storage service. Which Microsoft Sentinel data source would provide the MOST relevant information?

Accepted Answer

OfficeActivity. Option B is correct because OfficeActivity includes SharePoint and OneDrive audit logs, which track file uploads. Option A is wrong because SigninLogs only shows sign-ins. Option C is wrong because AzureActivity tracks Azure resource actions, not file uploads. Option D is wrong because CommonSecurityLog is for firewall logs, not file uploads.

Answer

SigninLogs

Answer

CommonSecurityLog

Answer

AzureActivity

Question 14

You are investigating a brute force attack on a user account in Microsoft Entra ID. The sign-in logs show multiple failed attempts from different IP addresses. Which property in the sign-in logs indicates the type of authentication used?

Accepted Answer

authenticationRequirement. Option C is correct because authenticationRequirement indicates the type of authentication (e.g., multi-factor authentication). Option A is wrong because conditionalAccessStatus is for policy evaluation. Option B is wrong because riskEventTypes is for risk detection. Option D is wrong because clientAppUsed indicates the application, not authentication type.

Answer

riskEventTypes

Answer

conditionalAccessStatus

Answer

clientAppUsed

Question 15

You are responding to a phishing incident. The investigation reveals that a user clicked a link in a phishing email and entered credentials on a fake site. You need to contain the incident and prevent further compromise. What should you do first?

Accepted Answer

Reset the user's password and revoke sessions.. Option D is correct because resetting the compromised user password immediately prevents further access using stolen credentials. Option A is wrong because blocking the URL does not invalidate already stolen credentials. Option B is wrong because deleting the email from the user's mailbox does not prevent use of stolen credentials. Option C is wrong because reporting the site to Microsoft is reactive.

Answer

Report the phishing site to Microsoft.

Answer

Block the phishing URL in Microsoft Defender for Office 365.

Answer

Delete the phishing email from the user's mailbox.

Question 16

You are investigating repeated SQL injection alerts. The KQL query returns IP addresses with more than 5 alerts in the last 7 days. What is the purpose of the `summarize` and `where AlertCount > 5` lines?

Accepted Answer

To identify IPs with a high number of alerts, indicating a possible attack.. Option D is correct because the query groups alerts by IP and filters for those with high frequency, indicating a potential attack. Option A is wrong because the query does not remove duplicates. Option B is wrong because it does not count distinct IPs. Option C is wrong because it does not correlate with other tables.

Answer

To correlate alerts with other data sources.

Answer

To remove duplicate alerts from the same IP.

Answer

To count the number of distinct IP addresses.

Question 17

You are reviewing a scheduled analytics rule in Microsoft Sentinel. What does the suppressionDuration setting affect?

Accepted Answer

It stops the rule from creating new alerts for that duration after an alert is generated.. Option C is correct. Suppression duration determines how long to wait before creating another alert from the same rule after an alert is generated, suppressing duplicates. Option A is wrong because it does not affect query execution. Option B is wrong because it does not affect incident grouping. Option D is wrong because it does not stop the rule from running.

Answer

It groups alerts into a single incident within that time window.

Answer

It delays the execution of the query by that amount of time.

Answer

It determines how often the query runs.

Question 18

Your organization uses Microsoft Sentinel. You receive an incident that involves a potential lateral movement detected by Microsoft Defender for Identity. You need to investigate the timeline of the attack. Which Microsoft Sentinel feature should you use?

Accepted Answer

Investigation graph. Option C is correct because the investigation graph in Sentinel provides a visual timeline of related alerts and entities. Option A is wrong because workbooks are for reporting, not investigation. Option B is wrong because analytics rules generate alerts, not investigate. Option D is wrong because automation rules trigger playbooks, not investigation.

Answer

Workbooks

Answer

Automation rules

Answer

Analytics rules

Question 19

Which TWO of the following are valid response actions that can be taken on a device from Microsoft Defender for Endpoint? (Choose two.)

Accepted Answer

Run antivirus scan. The correct answers are A and E. Isolation and Run antivirus scan are standard response actions. Option B is wrong because password reset is not a device action. Option C is wrong because disabling the user is an identity action. Option D is wrong because quarantining an email is a Microsoft 365 Defender action.

Answer

Quarantine email

Answer

Disable user account

Answer

Reset user password

Question 20

During a security incident, you need to block a malicious IP address at the network level for all Azure resources in a subscription. You have Azure Firewall deployed. What is the MOST efficient method to implement the block?

Accepted Answer

Use Azure Firewall Manager to create a global deny rule for the IP address across all firewalls.. Option D is correct because Azure Firewall Manager allows central management of firewall policies, including application and network rules across subscriptions. Option A is wrong because NSGs are per-subnet and not as efficient. Option B is wrong because Azure Firewall policies are not automatically applied to all VMs. Option C is wrong because each Azure Firewall rule applies to that firewall only.

Answer

Block the IP using Microsoft Defender for Cloud's adaptive network hardening.

Answer

Create a network security group (NSG) rule on each virtual network subnet to deny the IP.

Answer

Add a rule to the Azure Firewall policy to deny outbound traffic to the IP address.

SC-200 Practice Exam 52 — 20 Questions

Exhibit

SC-200 Practice Exam 52 — 20 Questions

Exhibit