SC-200 Practice Exam 55 — 20 Questions

Question 1

In a threat hunt, you discover that a non-admin user account created a scheduled task that executes a PowerShell script to connect to an external IP on port 4444. Which of the following is the most likely interpretation of this activity?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The scheduled task is likely a reverse shell for persistence and remote access. A non-admin user creating a scheduled task that runs PowerShell to connect to an external IP on port 4444 is a textbook reverse shell pattern. Port 4444 is the default listener port for Metasploit's meterpreter payload, and scheduled tasks provide persistence across reboots. The combination of non-admin context, external IP, unusual port, and scheduled execution strongly indicates attacker persistence and command-and-control.

Answer

The user is performing legitimate remote administration

Answer

The PowerShell script is a remote assistance tool

Answer

The scheduled task is part of a software update mechanism

Question 2

A security analyst is configuring a Microsoft Sentinel playbook to automatically respond to phishing incidents. The playbook should only run when an incident of severity 'High' is created and the incident is not already assigned to a user. Which automation rule condition and trigger configuration should the analyst use?

Accepted Answer

Configure an automation rule with trigger 'When incident is created', conditions for severity equals High and 'Assigned to' is empty, and action to run the playbook.. The automation rule trigger 'When incident is created' ensures the playbook runs immediately upon incident creation, and the conditions for severity equals 'High' and 'Assigned to' is empty filter incidents precisely as required. This configuration offloads the filtering to Sentinel's automation rule engine, which is more efficient and reliable than handling it inside the playbook logic.

Answer

Configure a playbook trigger 'When an incident is updated' and add a condition in the playbook logic app to check severity and assignment.

Answer

Schedule the playbook to run every 5 minutes and query for new incidents with required properties.

Answer

Configure an automation rule with trigger 'When incident is created' and only condition for severity equals High; the playbook will handle unassigned checks internally.

Question 3

During an incident response, you need to collect forensic evidence from a compromised Windows device using Microsoft Defender for Endpoint live response. Which command should you use to gather running processes?

Accepted Answer

processes. The `processes` command in Microsoft Defender for Endpoint live response enumerates all currently running processes on the target device, returning details such as PID, name, and user context. It is one of the built-in live response commands specifically designed for forensic triage and incident investigation without needing to install third-party tooling. This makes it the correct choice for gathering running process evidence during an active incident.

Answer

dir

Answer

reg query

Answer

netstat

Question 4

Your company uses Microsoft Defender XDR. The security team needs to restrict access to the Microsoft Defender portal so that only analysts in the 'Security Operations' group can view incidents. What is the most efficient way to achieve this?

Accepted Answer

Create a custom role in the Microsoft Defender portal with permissions to view incidents and assign it to the Security Operations group.. Microsoft Defender XDR uses role-based access control (RBAC) within the portal itself. Creating a custom role with permissions to view incidents and assigning it to the Security Operations group directly controls access to incident data without affecting broader Microsoft Entra ID roles or requiring Conditional Access policies. This is the most efficient method as it scopes permissions precisely to the Defender portal's incident management functionality.

Answer

Assign the Security Operations group the Defender for Endpoint administrator role.

Answer

Configure Conditional Access policy to allow only Security Operations group to sign in to the Defender portal.

Answer

Assign the Security Operations group the Security Reader role in Microsoft Entra ID.

Question 5

You are configuring Microsoft Sentinel automation rules to handle incidents generated from Microsoft Defender for Cloud. You need to ensure that when a high-severity security alert is triggered, an automated response runs a playbook that creates a support ticket in ServiceNow. However, the playbook fails to execute for some alerts. Upon investigation, you find that the automation rule is triggered only when the incident is created. What is the most likely cause of the failure?

Accepted Answer

The automation rule is configured to trigger only on incident creation, but the playbook requires the incident to be in an updated state.. The automation rule is configured to trigger only on incident creation. However, the playbook requires the incident to be in an updated state to execute, meaning the automation rule does not fire when the incident is updated after creation. This mismatch causes the playbook to fail for alerts that require an update trigger.

Answer

The automation rule lacks permissions to the ServiceNow connector because of Microsoft Entra ID conditional access policies.

Answer

Playbooks cannot be called by automation rules in Microsoft Sentinel.

Answer

Automation rules cannot be triggered on incident creation from Microsoft Defender for Cloud.

Question 6

A SOC analyst needs to create an automated response in Microsoft Sentinel that, when a specific type of incident is created, automatically creates a ticket in ServiceNow and blocks the source IP address in Azure Firewall. The analyst already has a playbook that performs these actions. What is the correct configuration to trigger this playbook?

Accepted Answer

Attach the playbook to an automation rule that includes the condition for the target incident type.. Automation rules in Microsoft Sentinel are the correct mechanism to trigger a playbook automatically when an incident is created. By attaching the playbook to an automation rule with a condition that matches the specific incident type (e.g., based on incident title or tag), the rule executes the playbook immediately upon incident creation, fulfilling the requirement without manual intervention.

Answer

Configure the playbook to run on a scheduled recurrence every 5 minutes.

Answer

Add the playbook to the incident's comments as a quick link.

Answer

Use a separate Power Automate flow with a trigger that watches for new Sentinel incidents.

Question 7

Your organization uses Microsoft Defender for Cloud Apps to monitor SaaS application usage. You need to generate an alert when a user performs more than 50 failed login attempts in 10 minutes, and the alert must be based on a built-in anomaly detection policy. What should you do?

Accepted Answer

Enable the 'Multiple failed login attempts' anomaly detection policy in Defender for Cloud Apps.. Microsoft Defender for Cloud Apps includes a built-in anomaly detection policy named 'Multiple failed login attempts' that specifically monitors for a high volume of failed logins from a single user within a short time window. This policy is enabled by default and can be customized to trigger alerts when the threshold (e.g., more than 50 failed attempts in 10 minutes) is exceeded, without requiring any additional configuration or custom policy creation.

Answer

Create a data loss prevention (DLP) policy in Microsoft Purview that triggers on failed logins.

Answer

Deploy a session policy in Defender for Cloud Apps that blocks after 50 failed logins.

Answer

Configure an app connector for each SaaS app and then create a custom activity policy.

Question 8

Your organization is using Microsoft Defender for Office 365. A user reports receiving a suspicious email that appears to be from the CEO requesting an urgent wire transfer. You need to investigate the email and take immediate action. What should you do first?

Accepted Answer

Use Threat Explorer in the Microsoft 365 Defender portal to find and delete the email.. Threat Explorer in the Microsoft 365 Defender portal provides the fastest and most direct way to investigate and remediate a specific suspicious email across all mailboxes. It allows you to search for the email by sender, subject, or recipient, and then take immediate action such as soft-delete or hard-delete to remove it from user inboxes. This is the correct first step for an urgent incident response scenario involving a targeted phishing attack.

Answer

Use the Exchange admin center to run a message trace.

Answer

Use the Security & Compliance Center to create a mail flow rule.

Answer

Submit the email to Microsoft for analysis using the Submissions page.

Question 9

Refer to the exhibit. You are troubleshooting an endpoint that is not receiving real-time protection from Microsoft Defender Antivirus. The output shows RealTimeProtectionEnabled is False. Which command should you run next to enable real-time protection?

Accepted Answer

Set-MpPreference -DisableRealtimeMonitoring $false. The Set-MpPreference cmdlet with the -DisableRealtimeMonitoring $false parameter is the correct command to enable real-time protection in Microsoft Defender Antivirus. The output shows RealTimeProtectionEnabled is False, which directly corresponds to the DisableRealtimeMonitoring setting; setting it to $false re-enables the feature. This cmdlet modifies the local policy for the Microsoft Defender Antivirus engine, immediately activating real-time scanning of file operations and process activity.

Answer

Add-MpPreference -ExclusionPath C:\Temp

Answer

Start-MpScan

Answer

Update-MpSignature

Question 10

Your company uses Microsoft Defender for Office 365. A user reports receiving a phishing email that bypassed the default policy. The email contains an external link to a credential harvesting site. You need to block similar emails in the future. What should you do?

Accepted Answer

Create a Safe Links policy and add the malicious domain to the blocked URLs list.. The phishing email contains a link to a credential harvesting site, so the most direct way to block similar emails in the future is to use a Safe Links policy. Safe Links proactively scans and blocks URLs at time of click, and you can add the malicious domain to the blocked URLs list to prevent users from accessing that site. This addresses the specific threat vector (malicious URL) rather than the sender's domain or attachment type.

Answer

Create an anti-spam policy to block the sender's domain.

Answer

Create an anti-malware policy to block the attachment type.

Answer

Add the sender's domain to the Tenant Allow/Block List.

Question 11

Which TWO tasks can you perform using Microsoft Sentinel automation rules?

Accepted Answer

Assign an incident to an analyst.. Automation rules in Microsoft Sentinel can directly assign incidents to specific analysts or groups without requiring a playbook. This is a native action within the automation rule configuration, enabling immediate ownership and accountability for incident response.

Answer

Send an email notification without a playbook.

Answer

Delete an incident.

Answer

Create a new analytics rule.

Question 12

A company manages multiple Azure subscriptions under a single management group. The security team wants to enable Microsoft Defender for Cloud's enhanced security features (e.g., Defender for Servers) for all subscriptions under that management group with minimal administrative effort. Which method should they use?

Accepted Answer

Enable the plans at the management group level. Enabling Microsoft Defender for Cloud's enhanced security features at the management group level applies the plans to all current and future subscriptions under that management group with a single action, minimizing administrative effort. This is the most efficient method because Defender for Cloud supports inheritance of security policies and plans from the management group down to subscriptions, eliminating the need for per-subscription configuration.

Answer

Enable the plans individually on each subscription

Answer

Use Azure Blueprints to assign the plans to each subscription

Answer

Create a custom Azure Policy that enforces the installation of the Log Analytics agent

Question 13

Which THREE are valid incident classification categories in Microsoft Sentinel? (Select THREE.)

Accepted Answer

False Positive. In Microsoft Sentinel, incident classification captures the analyst's triage verdict on an incident, and the three supported values are True Positive, Benign Positive, and False Positive. Option D (True Positive) is correct because it marks an incident confirmed as a genuine security threat requiring action. Option E (Benign Positive) is correct because it marks an incident that triggered legitimately but represents expected or authorized activity rather than an attack. Option A (False Positive) is correct because it marks an incident caused by inaccurate or misconfigured detection logic that does not reflect real activity. Option B (Malicious) is not a classification value — maliciousness is conveyed through severity and tactics/entities, not the classification field. Option C (Informational) is not a classification value either; it is not one of the three triage verdicts Sentinel exposes for incident classification.

Answer

Malicious

Answer

Informational

Question 14

Which TWO tables in Microsoft Defender XDR advanced hunting are most useful for detecting data exfiltration attempts? (Select two.)

Accepted Answer

DeviceNetworkEvents. DeviceNetworkEvents (B) is correct because it records outbound network connections from endpoints, including RemoteIP, RemotePort, RemoteUrl, and bytes sent/received, which lets you spot anomalous transfers to external or untrusted destinations indicative of exfiltration. CloudAppEvents (C) is correct because it captures activity in cloud applications and services (for example file downloads, sharing, and uploads via Microsoft 365 and other connected apps), which is where data is commonly staged and moved out. DeviceProcessEvents (A) shows process creation and command lines, which may reveal staging or archiving tools but not the actual data transfer, so it is less directly useful. EmailEvents (D) covers mail flow and delivery metadata, which is relevant to phishing or email-based leaks but not general exfiltration channels. DeviceInfo (E) is only static asset and configuration inventory, so it contains no transfer activity to detect.

Answer

DeviceProcessEvents

Answer

EmailEvents

Answer

DeviceInfo

Question 15

Which THREE actions can be performed by automation rules in Microsoft Sentinel?

Accepted Answer

Assign an incident to a specific owner. Automation rules in Microsoft Sentinel are designed to triage and manage incidents, so option C is correct because they can assign an incident to a specific owner (for example, setting the Owner field to a user or group) as part of incident handling. Option D is correct because automation rules can trigger a playbook on an incident, which is a core capability used to run automated response logic when an incident is created or updated. Option E is correct because automation rules can add tags to an incident, enabling classification, filtering, and later automation based on those tags. Options A and B are not correct: automation rules cannot modify a data connector to ingest more logs, and they cannot create a new analytics rule; those are configuration tasks performed through the Sentinel data connectors and analytics rule creation interfaces, not through incident automation rules.

Answer

Modify a data connector to ingest more logs

Answer

Create a new analytics rule

Question 16

During an incident response, a security analyst identifies that a user's account was used to access sensitive data from an anomalous location. The analyst needs to immediately prevent further access from that account while preserving forensic data. Which action should the analyst take?

Accepted Answer

Disable the user account in Microsoft Entra ID.. Disabling the user account in Microsoft Entra ID immediately prevents any further authentication or access to resources, including sensitive data, while preserving the account's forensic data (e.g., sign-in logs, audit events) for investigation. This action stops all current and future sessions without deleting the account or its associated data, which is critical for incident response.

Answer

Revoke the user's current sessions in Microsoft Entra ID.

Answer

Block the IP address of the anomalous location in the firewall.

Answer

Enable multi-factor authentication (MFA) for the user.

Question 17

Your organization uses Microsoft Sentinel and has enabled UEBA (User and Entity Behavior Analytics). You notice a series of incidents involving anomalous logon times for a privileged user. You want to automate the response to disable the user's account in Microsoft Entra ID when such incidents are created. What should you configure?

Accepted Answer

Create an automation rule that runs a playbook when an incident from the UEBA analytics rule is created, and configure the playbook to disable the user in Microsoft Entra ID.. Microsoft Sentinel automation rules can trigger a playbook when an incident is created by a specific analytics rule (e.g., a UEBA-based rule). The playbook, built in Azure Logic Apps, can then use the Microsoft Graph API to disable the user's account in Microsoft Entra ID. This provides a fully automated, event-driven response to anomalous logon time incidents without manual intervention.

Answer

Create an analytics rule that triggers on UEBA anomalies and directly disables the user.

Answer

Add the user to a watchlist and create a playbook that runs on a schedule.

Answer

Configure UEBA to automatically disable the user when anomalous behavior is detected.

Question 18

A threat hunter wants to identify all devices that have communicated with a known malicious IP address in the last 7 days. Which table in Microsoft Defender for Endpoint advanced hunting should be queried?

Accepted Answer

DeviceNetworkEvents. The DeviceNetworkEvents table in Microsoft Defender for Endpoint advanced hunting contains information about network connections, including remote IP addresses and ports. To identify devices that communicated with a specific malicious IP, querying this table for the RemoteIP field is the correct approach. It captures both inbound and outbound network traffic events.

Answer

DeviceFileEvents

Answer

DeviceProcessEvents

Answer

DeviceRegistryEvents

Question 19

You are configuring Microsoft Sentinel to detect potential ransomware activity. The security team wants to be alerted when a single host contacts multiple suspicious domains within a short time. Which analytic rule type should you create?

Accepted Answer

NRT (Near-Real-Time) rule. A NRT (Near-Real-Time) rule is the correct choice because it continuously processes events with a minimum latency of about 1 minute, making it ideal for detecting patterns like a single host contacting multiple suspicious domains within a short time window. Unlike scheduled rules that run on a fixed interval (e.g., every 5 minutes), NRT rules evaluate data as it arrives, enabling rapid detection of multi-event sequences such as DNS queries to known malicious domains.

Answer

Scheduled query rule

Answer

Anomaly rule

Answer

Microsoft security rule

Question 20

A SOC analyst is creating a Microsoft Sentinel scheduled analytics rule to detect failed sign-in attempts from a specific list of known malicious IP addresses. The IP addresses are stored in a CSV file that is updated weekly. The analyst uploads the file as a new table in the Log Analytics workspace. Which KQL operator should the analyst use to reference this table within the rule's query?

Accepted Answer

Use the custom table name directly in the query, e.g., 'MaliciousIPs_CL'.. When a CSV file is uploaded as a new table in the Log Analytics workspace, it becomes a custom table with a '_CL' suffix (e.g., 'MaliciousIPs_CL'). The analyst can then reference this table directly in the KQL query, just like any other table in the workspace. This is the standard method for using custom log data ingested via the Log Analytics agent or direct upload.

Answer

Use 'externaldata()' to point to the CSV file in Azure Blob storage.

Answer

Use 'union' with the workspace name to include the CSV data.

Answer

Use 'watchlist' function, because CSV files are automatically treated as watchlists.