SC-200 Practice Exam 56 — 20 Questions

Question 1

You are reviewing a custom hunting query in Microsoft Sentinel. The query above returns results, but you suspect it misses low-frequency beaconing. Which modification improves detection while reducing false positives?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Use a sliding window to count distinct connection times per IP per device. Low-frequency beaconing is characterized by a small number of connections spread over long, regular intervals — a simple count threshold misses it because the total count is low. Using a sliding window (e.g., bin() or make-series with a time window) to count distinct connection times per remote IP per device surfaces the periodicity and regularity that distinguishes beaconing from normal traffic, while grouping by both IP and device reduces false positives from benign recurring connections.

Answer

Group by DeviceName only

Answer

Decrease the count threshold to 10

Answer

Add RemotePort to the summarize clause

Question 2

You are a security operations analyst. You need to review all incidents from the past 24 hours that have a high severity and involve multiple users. In Microsoft Sentinel, which blade should you use?

Accepted Answer

Incidents. The Incidents blade in Microsoft Sentinel is the correct place to review all security incidents, including filtering by severity and the number of users involved. It provides a centralized view where you can apply filters for 'High' severity and 'Multiple users' to meet the requirement of reviewing incidents from the past 24 hours. The Hunting, Workbooks, and Analytics blades serve different purposes and do not offer the same incident review and filtering capabilities.

Answer

Hunting

Answer

Workbooks

Answer

Analytics

Question 3

Which TWO data sources should you enable in Microsoft Sentinel to improve detection of credential theft attacks?

Accepted Answer

Windows Security Events (via AMA). Option A, Windows Security Events (via AMA), is correct because it collects the Security event log through the Azure Monitor Agent and surfaces the exact events credential-theft detection relies on, such as 4624/4625 logons, 4648 explicit-credential use, 4672 special privileges, and 4768/4769 Kerberos TGT/TGS requests used to spot pass-the-hash, pass-the-ticket, and Kerberoasting. Option C, Microsoft Entra ID Sign-in logs, is correct because it captures Entra ID authentication telemetry — sign-in results, conditional access outcomes, MFA details, and risk detections — which Sentinel uses to detect password spray, brute force, impossible travel, and token/session theft against cloud identities. Option B, DNS logs, is not required here since DNS telemetry supports exfiltration, C2, and DGA detection rather than credential theft. Option D, Windows Firewall logs, records allowed/blocked network connections and is irrelevant to authentication abuse. Option E, Performance counters, provides host resource metrics and has no bearing on detecting stolen credentials.

Answer

DNS logs

Answer

Windows Firewall logs

Answer

Performance counters

Question 4

You are the security analyst for a company that uses Microsoft Sentinel. You notice that a critical analytics rule has not generated any incidents in the past week, but you know that relevant logs are being ingested. You need to troubleshoot why the rule is not firing. What is the first step you should take?

Accepted Answer

Run the analytics rule's query directly in Log Analytics to see if it returns results.. The first step in troubleshooting a Sentinel analytics rule that is not generating incidents despite relevant logs being ingested is to run the rule's query directly in Log Analytics. This isolates whether the issue is with the query logic itself (e.g., syntax errors, time range misconfiguration, or data not matching the KQL conditions) rather than with data ingestion or rule settings. If the query returns results in Log Analytics, the problem lies elsewhere; if it returns no results, the query needs adjustment.

Answer

Check the incident creation rule configuration.

Answer

Verify that the log sources are connected and sending data to the workspace.

Answer

Disable and re-enable the analytics rule.

Question 5

Your organization uses Microsoft Defender for Cloud Apps and Microsoft Sentinel. You receive an alert indicating that a user from the finance department accessed a sensitive SharePoint file from an IP address associated with a known malicious Tor exit node. The file contains payment information. The user's account has not been disabled. What should you do first to contain the incident?

Accepted Answer

Suspend the user's account in Microsoft Entra ID. The first step to contain the incident is to suspend the user's account in Microsoft Entra ID (Option D). This immediately revokes access to all resources, preventing further data exfiltration while preserving the current state for investigation. Option A is incorrect because deleting the SharePoint file may destroy evidence. Option B is incorrect because blocking the IP address in Defender for Cloud Apps is less effective; the attacker can easily switch to a different IP address. Option C is incorrect because notifying the user could alert a potential attacker who might have compromised the account, leading to further malicious actions.

Answer

Delete the SharePoint file from the site

Answer

Notify the user of the suspicious activity

Answer

Block the IP address in Microsoft Defender for Cloud Apps

Question 6

Your Microsoft Sentinel environment is not generating incidents from a custom KQL detection rule. The rule runs successfully in the Log Analytics query editor but no incidents appear. What is the most likely cause?

Accepted Answer

The rule is set to create alerts but not incidents. The most likely cause is that the rule is set to create alerts but not incidents. In Microsoft Sentinel, analytics rules have a toggle to 'Create incidents' from alerts. If this toggle is disabled, alerts are generated but not grouped into incidents. The query running successfully in Log Analytics confirms the rule logic works, but incidents will not appear unless the incident creation toggle is enabled. Entity mapping is not required for incident creation; it enhances correlation but is not a prerequisite.

Answer

The rule's alert grouping settings are misconfigured

Answer

The rule's query schedule is too long

Answer

The rule does not have entity mapping configured

Question 7

You are configuring Microsoft Defender for Cloud Apps. You need to create a policy that alerts when a user downloads more than 100 files in 10 minutes from SharePoint. Which policy type should you use?

Accepted Answer

Activity policy. An Activity policy in Microsoft Defender for Cloud Apps monitors specific user activities (e.g., file downloads) and can trigger alerts based on thresholds like 'more than 100 downloads in 10 minutes'. This policy type is designed for granular, behavior-based detection of suspicious actions, making it the correct choice for this scenario.

Answer

Anomaly detection policy

Answer

File policy

Answer

Cloud discovery policy

Question 8

Your SOC team uses Microsoft Sentinel incident management. You need to ensure that when an incident is created, it automatically runs a playbook to gather additional context from threat intelligence sources. What should you create?

Accepted Answer

Automation rule with a trigger on incident creation.. Microsoft Sentinel automation rules can be configured with a trigger on incident creation to automatically run a playbook. This allows the SOC team to gather additional context from threat intelligence sources without manual intervention, directly addressing the requirement to execute a playbook when an incident is created.

Answer

Workbook that queries threat intelligence.

Answer

Watchlist that maps to the incident.

Answer

Analytics rule that generates an alert.

Question 9

You are configuring Microsoft Sentinel to ingest data from multiple sources. Which TWO of the following are valid data connectors that can be used to ingest AWS CloudTrail logs?

Accepted Answer

Azure Functions connector. The AWS S3 connector (Option C) is a valid data connector for ingesting AWS CloudTrail logs into Microsoft Sentinel by reading the logs directly from an S3 bucket. The Azure Functions connector (Option A) is also valid because it can be configured to trigger on CloudTrail log delivery to S3, using a function app to parse and forward the logs to Sentinel via the Log Analytics HTTP Data Collector API.

Answer

Office 365 connector

Answer

Microsoft Defender for Cloud connector

Answer

Syslog connector

Question 10

A SOC analyst is configuring a multi-region deployment of Microsoft Sentinel. The requirement is to ingest security logs from Azure resources located in three different Azure regions. The analyst needs to create the workspace in one region and then use cross-workspace queries to view data from all regions. What is the correct sequence of steps?

Accepted Answer

Step 1: Create Log Analytics workspaces in each region. Step 2: Enable Sentinel on each workspace. Step 3: Connect data sources. Step 4: Configure cross-workspace queries.. To use cross-workspace queries in Microsoft Sentinel, you must first create a Log Analytics workspace in each region, enable Sentinel on each workspace, connect the data sources to their respective regional workspaces, and then configure cross-workspace queries to unify the data. This sequence ensures that each region's logs are ingested locally, which is required for cross-workspace queries to reference them via the `workspace()` expression.

Answer

Step 1: Enable Sentinel in one region. Step 2: Create workspaces in other regions. Step 3: Connect data sources. Step 4: Configure cross-workspace queries.

Answer

Step 1: Connect data sources. Step 2: Create workspaces. Step 3: Enable Sentinel. Step 4: Configure cross-workspace queries.

Answer

Step 1: Create a central workspace. Step 2: Enable Sentinel on it. Step 3: Connect data sources from all regions to the central workspace. Step 4: Configure cross-workspace queries.

Question 11

You are reviewing an automation rule ARM template for Microsoft Sentinel. What is the result of deploying this automation rule?

Accepted Answer

When a High severity incident is created, the rule changes its severity to Medium and assigns it to SOC-Tier2.. The ARM template defines an automation rule that triggers when an incident is created with a severity of High. The rule's actions change the severity to Medium and assign the incident to the SOC-Tier2 owner. This matches option C exactly.

Answer

The rule assigns the incident to SOC-Tier2 only if the severity is Medium.

Answer

The rule triggers when an incident is updated and resets the severity to High.

Answer

The rule triggers when a High severity incident is created but does not change the severity.

Question 12

A security analyst is investigating lateral movement in Microsoft 365 Defender. They have identified a compromised device (DeviceA) and want to find all other devices that have been accessed from DeviceA via RDP in the last 24 hours. Which advanced hunting table contains RDP connection events?

Accepted Answer

DeviceNetworkEvents. DeviceNetworkEvents is the correct table because it captures network-level connection events, including outbound RDP (TCP port 3389) connections. When a compromised device initiates an RDP session to another device, the network event is logged here, allowing the analyst to trace lateral movement by filtering for `RemotePort == 3389` and `RemoteIP` of the target.

Answer

DeviceLogonEvents

Answer

DeviceProcessEvents

Answer

IdentityLogonEvents

Question 13

Which THREE of the following are valid sources of data that a threat hunter can use in Microsoft Sentinel for hunting? (Choose three.)

Accepted Answer

Microsoft Entra ID audit logs. Microsoft Sentinel ingests Microsoft Entra ID audit logs through the Microsoft Entra ID (now Entra ID) data connector, which records sign-in and directory activity and is a legitimate hunting source, so option A is correct. Microsoft 365 audit logs are collected via the Office 365 data connector (using the Management Activity API) and provide Exchange, SharePoint, Teams, and general audit events usable for hunting, making option D correct. AWS CloudTrail logs are supported through the Amazon Web Services S3/CloudTrail connector, which pulls API activity into Sentinel for cross-cloud hunting, so option E is correct. Azure Cost Management data (option B) is billing and cost-analysis telemetry, not security event data ingested as a hunting table in Sentinel, and Azure DevOps pipelines (option C) are CI/CD build/release processes rather than a native Sentinel hunting data source, so neither belongs.

Answer

Azure Cost Management data

Answer

Azure DevOps pipelines

Question 14

A company uses Microsoft Defender for Cloud to manage security across multiple Azure subscriptions. They want to automatically remediate non-compliant resources when a policy violation is detected—for example, enabling encryption on a storage account that has it disabled. Which feature should they configure?

Accepted Answer

Azure Policy's DeployIfNotExists effect. Azure Policy's DeployIfNotExists effect is the correct feature because it automatically deploys a resource configuration (such as enabling encryption on a storage account) when a policy evaluation detects non-compliance. This effect runs during policy evaluation and remediation tasks, ensuring that the resource is brought into compliance without manual intervention. It is specifically designed for automated remediation of non-compliant resources in Azure, aligning with the requirement to fix violations like missing encryption.

Answer

Regulatory compliance dashboard

Answer

Adaptive network hardening

Answer

Just-In-Time VM access

Question 15

Your SOC uses Microsoft Sentinel and Microsoft Defender XDR. An incident is generated from a Microsoft Defender for Identity alert about a suspicious Kerberos ticket request. The incident is assigned the 'Medium' severity. You want to automatically increase the severity to 'High' if the user is in a privileged role, based on data from Microsoft Entra ID. What is the most efficient way to achieve this?

Accepted Answer

Create an automation rule in Microsoft Sentinel triggered on incident creation, which runs a playbook that checks Microsoft Entra ID roles and updates the severity accordingly.. Automation rules in Microsoft Sentinel can trigger a playbook on incident creation, and that playbook can use the Microsoft Graph API to query Microsoft Entra ID for the user's role assignments. If the user holds a privileged role (e.g., Global Administrator), the playbook can programmatically update the incident's severity to 'High'. This approach is event-driven, efficient, and does not require modifying existing analytics rules or creating additional scheduled queries.

Answer

Enable automatic attack disruption in Microsoft Defender XDR to handle the incident.

Answer

Modify the analytics rule that generates the incident to check user roles during query execution.

Answer

Create a scheduled analytics rule that queries Microsoft Entra ID audit logs and updates incident severity via a watchlist.

Question 16

You are managing a Microsoft Sentinel environment. You need to ensure that incidents are automatically assigned to the appropriate analyst based on the type of attack. The assignment must consider the current workload of each analyst. What should you use?

Accepted Answer

Use an automation rule with a playbook that queries the current incident assignments and assigns to the least busy analyst.. Automation rules in Microsoft Sentinel can trigger a playbook (Azure Logic App) that queries the current incident assignments and assigns the incident to the analyst with the fewest active incidents. This satisfies both the attack-type mapping (via the analytics rule that generates the incident) and the workload-balancing requirement, as the playbook can dynamically evaluate workload using Azure Resource Graph or Sentinel's API.

Answer

Configure multiple analytics rules, each with a different incident owner.

Answer

Create a watchlist that maps attack types to analyst names and use it in an analytics rule.

Answer

Create a workbook that shows analyst workload and manually assign.

Question 17

Your Microsoft Sentinel workspace ingests logs from multiple sources but you notice that some custom logs are missing in the Log Analytics workspace. You've confirmed that the data connectors are healthy. What is the most likely cause?

Accepted Answer

The custom log table schema does not match the incoming log format.. When data connectors are healthy but custom logs are missing, the most common cause is a schema mismatch between the custom log table definition in the Log Analytics workspace and the actual log data being sent. Microsoft Sentinel requires the custom log table's schema (columns, data types, and delimiters) to exactly match the incoming log format; otherwise, the ingestion pipeline drops the records without error. This is because the Log Analytics agent or AMA uses the table schema to parse and transform the data, and any deviation results in silent failures.

Answer

There is a time gap between log generation and ingestion.

Answer

The workspace has exceeded its daily ingestion limit.

Answer

The data connectors are not properly configured for custom log ingestion.

Question 18

Your organization uses Microsoft Sentinel and has multiple workspaces for different business units. You need to enable cross-workspace querying for the security operations center (SOC) analysts. What should you do?

Accepted Answer

Use the workspace() expression in KQL queries. The `workspace()` expression in KQL allows a query to reference tables from multiple Log Analytics workspaces within a single query. This enables SOC analysts to perform cross-workspace queries without moving data, which is the correct approach for a multi-workspace Sentinel deployment.

Answer

Configure a data connector for each workspace

Answer

Enable incident merging across workspaces

Answer

Create a single workspace and migrate all data

Question 19

Your organization uses Microsoft Defender for Cloud Apps to discover shadow IT. You notice that a new cloud app is being used by multiple users but has a risk score of 8. What should you do first to manage the risk?

Accepted Answer

Investigate the app's risk factors and user activity. A risk score of 8 indicates the app is high-risk, but immediate blocking or unsanctioning could disrupt business operations if the app is legitimate or used for approved purposes. The first step is to investigate the app's risk factors (e.g., data residency, encryption standards, compliance certifications) and user activity (e.g., volume of data uploaded, types of files shared) to understand the actual threat. This aligns with Microsoft's recommended incident response process: assess before acting.

Answer

Block the app at the proxy

Answer

Immediately unsanction the app in Defender for Cloud Apps

Answer

Create a policy to alert on use of this app

Question 20

A security operations center (SOC) uses Microsoft Sentinel. They want to automatically block a user's account when a high-severity incident is created. Which automation action should you use in a playbook?

Accepted Answer

Run a playbook that calls the Microsoft Graph API to disable the user account.. Disabling the user account via Microsoft Graph API is the most direct and effective way to prevent further access when a high-severity incident is created. This action immediately blocks the user from authenticating across all services, which aligns with the requirement to automatically block the account. Other options either do not block the account (e.g., revoking sessions or resetting password) or are indirect and less reliable (e.g., updating Conditional Access policies).

Answer

Run a playbook that revokes the user's current sessions using Microsoft Graph API.

Answer

Run a playbook that resets the user's password.

Answer

Run a playbook that updates a conditional access policy in Microsoft Entra ID.