SC-200 Practice Exam 53 — 20 Questions

Question 1

Your organization uses Microsoft Sentinel with UEBA enabled. You need to identify anomalous user behavior that indicates a potential compromise. Which entity behavior analytics feature should you use?

Accepted Answer

Entity behavior analytics peer comparison. Entity behavior analytics peer comparison (option C) is the correct feature because it uses UEBA to compare a user's activities against their historical baseline and peer group behavior to detect anomalies indicative of compromise. This directly addresses the requirement to identify anomalous user behavior, as peer comparison highlights deviations like unusual access patterns or data exfiltration attempts that single-entity baselines might miss.

Answer

Automation rules

Answer

Hunting queries

Answer

Anomaly rules in analytics

Question 2

A SOC analyst is triaging an incident in Microsoft Sentinel and needs to assign it to a senior analyst for further investigation. What is the correct action?

Accepted Answer

Open the incident and change the Owner field to the senior analyst.. In Microsoft Sentinel, the correct way to assign an incident to a specific analyst is to open the incident and change the Owner field to that analyst. This action formally transfers ownership and responsibility for the incident within the SIEM, ensuring proper tracking and accountability. Other methods, such as adding comments or sending emails, do not update the incident's ownership metadata.

Answer

Create a new incident and manually add the senior analyst as a comment.

Answer

Close the incident and reopen it under the senior analyst's name.

Answer

Run a playbook that sends an email to the senior analyst.

Question 3

Your organization uses Microsoft Sentinel with UEBA enabled. You need to identify anomalous user behavior that indicates a potential compromise. Which entity behavior analytics feature should you use?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Review the incident timeline and entity mapping in the incident details.. The first step in investigating a Fusion incident in Microsoft Sentinel is to review the incident timeline and entity mapping. This provides a consolidated view of all correlated alerts, their timestamps, and the entities involved (e.g., IP addresses, user accounts), enabling you to quickly assess whether the alerts are logically connected and indicative of a true positive attack chain. Starting with this high-level overview is efficient before diving into raw logs.

Answer

Run a KQL query on the raw logs to see if the alerts are connected.

Answer

Assign the incident to a senior analyst for further investigation.

Answer

Close the incident as a false positive if the alerts seem unrelated.

Question 4

A company uses Microsoft Defender for Cloud's Just-In-Time (JIT) VM access to secure its Azure virtual machines. A security analyst needs to grant a developer temporary RDP access to a specific VM for debugging purposes. Instead of using the default request approval flow, the analyst wants to configure an exemption so that the developer's access request never triggers a recommendation for that VM. Which action must the analyst perform?

Accepted Answer

Add an exemption for the VM on the 'Management ports should be closed on just-in-time based virtual machines' recommendation.. To prevent a specific VM from triggering a recommendation for open management ports, you must add an exemption directly on the 'Management ports should be closed on just-in-time based virtual machines' recommendation in Defender for Cloud. This exemption tells the recommendation engine to exclude that VM from compliance evaluation, so no alert or recommendation is generated for it. Approving a request with a long expiration does not suppress the underlying recommendation; it only grants temporary access.

Answer

Approve the access request once from the JIT blade and set a long expiration.

Answer

Configure a custom Azure Policy to allow open management ports for that VM.

Answer

Disable the JIT solution for the entire subscription from the Defender for Cloud environment settings.

Question 5

During a threat hunt, you discover that a PowerShell script executed on multiple servers and established outbound connections to an external IP address. Which data source should you query in Microsoft Defender XDR to identify the specific command-line arguments used?

Accepted Answer

DeviceProcessEvents. DeviceProcessEvents in Microsoft Defender XDR contains detailed information about process creation, including the command-line arguments used when a process was started. Querying this table will reveal the specific arguments passed to the PowerShell script. This is the correct data source for command-line details.

Answer

DeviceEvents

Answer

DeviceImageLoadEvents

Answer

DeviceNetworkEvents

Question 6

Your organization has Microsoft Defender for Endpoint deployed. You need to configure automatic attack disruption for ransomware attacks. What should you enable?

Accepted Answer

Automatic attack disruption in Microsoft 365 Defender.. Automatic attack disruption in Microsoft 365 Defender is the correct feature to enable because it uses advanced detection signals to automatically contain compromised assets during ransomware attacks, such as isolating devices or blocking accounts, without manual intervention. This capability is specifically designed to stop the spread of ransomware in real time by leveraging Microsoft's threat intelligence and behavioral analytics.

Answer

Attack surface reduction rules.

Answer

Live Response capabilities.

Answer

Device discovery settings.

Question 7

A SOC manager wants to implement a new workflow where high-severity Microsoft Defender for Cloud Apps alerts are automatically sent to a Teams channel for immediate action. The solution must not require custom code. What should the manager configure?

Accepted Answer

Create an automation rule in Microsoft Sentinel with a playbook that posts to Teams. Microsoft Sentinel's automation rules can trigger a playbook (built on Azure Logic Apps) when a high-severity alert is generated, and the playbook can post a message to a Teams channel without requiring custom code. This directly meets the requirement of automatically sending high-severity Microsoft Defender for Cloud Apps alerts to Teams for immediate action, leveraging built-in connectors.

Answer

Use Microsoft Power Automate to monitor the alerts and send a Teams message

Answer

Configure a rule in Microsoft Defender XDR to send email notifications

Answer

Configure Microsoft Entra ID to send the alerts to Teams

Question 8

A Microsoft Defender for Endpoint alert indicates that a device has been communicating with a known command-and-control (C2) server. The device is critical for production. What is the most appropriate response?

Accepted Answer

Isolate the device using Microsoft Defender for Endpoint's device isolation feature.. Microsoft Defender for Endpoint's device isolation feature is designed to contain a compromised device while preserving forensic data and minimizing disruption. For a critical production device, full isolation (blocking all network traffic except to the Defender service) stops C2 communication without physically disconnecting the device, allowing the security team to investigate and remediate remotely.

Answer

Disconnect the network cable of the device.

Answer

Run a full antivirus scan on the device.

Answer

Block the C2 server URL in the firewall.

Question 9

An analyst runs this advanced hunting query to investigate suspicious command-line activity. Which type of activity is this query most likely detecting?

Accepted Answer

Execution of obfuscated scripts via encoded commands. The query likely searches for command lines containing encoded or obfuscated script indicators, such as 'powershell -enc' or Base64-encoded commands, which are common in malicious script execution. Advanced hunting in Microsoft 365 Defender uses Kusto Query Language (KQL) to query device process events. Detecting encoded commands is a typical technique to identify obfuscated scripts that evade detection.

Answer

Data exfiltration to external IPs

Answer

Privilege escalation attempts

Answer

Port scanning activity

Question 10

Your organization uses Microsoft Sentinel and Microsoft Entra ID. You need to implement a solution that automatically disables a user account in Microsoft Entra ID when a high-severity incident involving that user is created in Sentinel. The solution must also send a notification to the security team. You have a playbook that disables the user and sends an email. What should you configure to trigger the playbook?

Accepted Answer

Create an automation rule that runs when an incident is created with severity High and triggers the playbook.. To automatically trigger a playbook when a high-severity incident is created in Microsoft Sentinel, you should create an automation rule. Automation rules in Microsoft Sentinel allow you to define conditions (such as incident severity) and actions (such as running a playbook). This is the native, no-code way to trigger playbooks based on incident creation.

Answer

Configure the playbook to run on a schedule and query incidents.

Answer

Create a workbook that triggers the playbook when a high-severity incident appears.

Answer

Configure the playbook as a response action in the analytics rule that generates the incident.

Question 11

A SOC analyst is creating a scheduled analytics rule in Microsoft Sentinel to detect brute-force attacks on Microsoft Entra ID. The rule should generate an incident when a single user account fails to authenticate more than 10 times in 5 minutes from the same IP address. Which KQL operator is most appropriate to aggregate the count of failed sign-ins?

Accepted Answer

summarize. The `summarize` operator is the correct choice because it aggregates data into groups based on specified criteria, such as counting the number of failed sign-ins per user and IP address within a time window. In this scenario, you need to count events where `ResultType` indicates failure (e.g., 50053 or 50057), grouped by `UserPrincipalName` and `IPAddress`, and then filter for counts exceeding 10. The `summarize` operator with `count()` directly provides this aggregation, enabling the rule to trigger an incident when the threshold is met.

Answer

extend

Answer

project

Answer

where

Question 12

Your organization uses Microsoft Defender for Cloud Apps. You need to create a policy that alerts when a user downloads more than 10 files from SharePoint in 5 minutes. What type of policy should you create?

Accepted Answer

Activity policy. An Activity policy in Microsoft Defender for Cloud Apps is designed to monitor and respond to specific user activities, such as file downloads from SharePoint, based on predefined thresholds. By configuring the policy with a threshold of more than 10 downloads within 5 minutes, it triggers an alert when the activity exceeds this limit, enabling detection of potential data exfiltration or anomalous user behavior.

Answer

App permissions policy

Answer

Session policy

Answer

Anomaly detection policy

Question 13

Your organization has Microsoft Defender for Cloud Apps enabled. You need to generate an alert when a user downloads more than 100 files from SharePoint in one hour. What should you create?

Accepted Answer

An anomaly detection policy in Microsoft Defender for Cloud Apps.. An anomaly detection policy in Microsoft Defender for Cloud Apps is designed to detect unusual user behavior, such as mass file downloads, by establishing a baseline and triggering alerts when activity deviates from the norm. This policy type specifically supports the scenario of detecting a user downloading more than 100 files from SharePoint in one hour, as it can be configured with custom thresholds for file download activity.

Answer

A data loss prevention (DLP) policy in Microsoft Purview.

Answer

A custom alert in Microsoft Sentinel using the CloudAppEvents table.

Answer

An app governance policy in Microsoft Defender for Cloud Apps.

Question 14

A security administrator wants to see the overall security posture of all their Azure subscriptions in a single numerical score. Which dashboard in Microsoft Defender for Cloud provides this score based on implemented security controls?

Accepted Answer

Secure Score. The Secure Score dashboard in Microsoft Defender for Cloud aggregates the security posture across all Azure subscriptions into a single numerical score. This score is calculated based on the implementation of security controls and recommendations, reflecting the percentage of completed security measures. The administrator needs this consolidated view, which is exactly what Secure Score provides.

Answer

Regulatory Compliance

Answer

Inventory

Answer

Recommendations

Question 15

You are configuring automated responses in Microsoft Sentinel. You have created an automation rule that runs a playbook when an incident is created. The playbook performs actions in Microsoft Entra ID and Microsoft Defender for Cloud. However, the playbook fails with a permissions error. What should you do?

Accepted Answer

Assign the managed identity of the playbook the required roles in Microsoft Entra ID and Defender for Cloud.. The playbook fails with a permissions error because it uses a managed identity to authenticate to Microsoft Entra ID and Microsoft Defender for Cloud, but that identity has not been granted the necessary Azure RBAC roles (e.g., Security Reader, Security Admin) on the target resources. Assigning the required roles to the managed identity directly resolves the authorization failure.

Answer

Enable 'Allow playbooks to use managed identity' in the Sentinel settings.

Answer

Configure the Microsoft Entra ID connector in Sentinel with delegated permissions.

Answer

Grant the security analyst's account Contributor permissions on the automation rule.

Question 16

Which THREE capabilities are provided by Microsoft Defender for Cloud's Cloud Security Posture Management (CSPM) plan? (Select THREE.)

Accepted Answer

Compliance dashboard that shows your posture against regulatory standards.. Microsoft Defender for Cloud's CSPM plan includes a compliance dashboard that continuously assesses your cloud resources against regulatory standards such as SOC 2, ISO 27001, and PCI DSS. This dashboard provides a real-time view of your compliance posture, mapping security controls to specific regulatory requirements and highlighting non-compliant resources.

Answer

Endpoint detection and response for on-premises machines.

Answer

Integrated vulnerability assessment for virtual machines.

Question 17

Your team uses Microsoft Sentinel to monitor multiple Azure subscriptions. You need to grant a junior analyst the ability to view incidents and run playbooks, but not modify analytics rules or data connectors. Which built-in role should you assign?

Accepted Answer

Microsoft Sentinel Responder. Microsoft Sentinel Responder is the correct built-in role because it grants the junior analyst the ability to view incidents and run playbooks, while explicitly preventing modifications to analytics rules or data connectors. This role provides the exact permissions needed for incident response tasks without allowing changes to the security configuration.

Answer

Microsoft Sentinel Contributor

Answer

Automation Contributor

Answer

Microsoft Sentinel Reader

Question 18

Your organization uses Microsoft Defender for Cloud Apps and Microsoft Sentinel. An alert indicates that an external IP address is downloading large amounts of data from a SharePoint site containing confidential documents. The activity is coming from a valid user account that appears to be compromised. What should you do first to stop the data exfiltration?

Accepted Answer

Suspend the user account in Microsoft Entra ID. The first priority is to immediately stop the ongoing data exfiltration by suspending the compromised user account in Microsoft Entra ID. This disables the attacker's access via that account, halting the download. Blocking the external IP address (Option C) is less effective because the attacker could switch IPs. Changing SharePoint permissions (Option D) or deleting documents (Option A) would not stop the current download session as quickly as suspending the account.

Answer

Delete the confidential documents from SharePoint

Answer

Block the external IP address in Microsoft Defender for Cloud Apps

Answer

Change the SharePoint site permissions to deny access

Question 19

Your organization is using Microsoft Sentinel and you are responsible for managing the security operations environment. You need to ensure that a new security analyst can triage incidents but cannot modify analytics rules. Which role should you assign?

Accepted Answer

Microsoft Sentinel Responder. The Microsoft Sentinel Responder role provides the necessary permissions to triage incidents (view, investigate, respond) while explicitly excluding write access to analytics rules. This matches the requirement for a security analyst who needs to handle incidents but cannot modify detection logic.

Answer

Microsoft Sentinel Reader

Answer

Microsoft Sentinel Contributor

Answer

Microsoft Sentinel Contributor with a custom role denying rule modification

Question 20

Your organization uses Microsoft Sentinel with UEBA enabled. You are investigating a suspicious incident where a user's account is reported to have accessed an unusual amount of data from a SharePoint site. The incident alert points to the user 'jdoe@contoso.com'. You open the incident and see that the entity timeline for jdoe shows several activities, including file downloads. However, you notice that the timeline does not include any Azure AD sign-in events for this user. You need to include sign-in events in the entity timeline to get a complete picture. What should you do?

Accepted Answer

Install the Azure Active Directory connector to ingest sign-in logs.. The entity timeline in Microsoft Sentinel relies on data already ingested into the workspace. Since Microsoft Entra ID sign-in events are not appearing, the most likely cause is that the Microsoft Entra ID connector has not been installed or configured. Installing this connector ingests sign-in logs (and audit logs) into Sentinel, which then populates the entity timeline with sign-in activities for users like jdoe.

Answer

Enable UEBA for Azure AD in the Sentinel settings.

Answer

Install the Office 365 connector to ingest Azure AD logs.

Answer

Configure the entity timeline to include Azure AD events manually.