SC-200 Practice Exam 58 — 20 Questions

Question 1

You are performing a threat hunt in Microsoft Sentinel and have a KQL query that returns a high number of false positives. You want to reduce the noise without missing real threats. Which approach should you take?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Write a KQL query that looks for uncommon process chains, such as wscript.exe launched from Microsoft Office.. Focusing on uncommon process chains—like wscript.exe spawned by Microsoft Office—targets specific, high-fidelity indicators of malicious activity (e.g., macro-based attacks) rather than relying on broad, noisy signatures. This approach reduces false positives by filtering out normal, benign process relationships while preserving detection of real threats that deviate from baseline behavior. In Microsoft Sentinel, such behavioral hunting queries leverage KQL joins and process lineage to surface anomalies that are more likely to be true positives.

Answer

Add a filter to exclude all Microsoft signed processes.

Answer

Remove the time filter and run the query against all historical data.

Answer

Broaden the time range to capture more data.

Question 2

The KQL query above is used in a threat hunt. What is the most likely scenario this query is designed to detect?

Accepted Answer

Hunting for code execution via rundll32.exe loading JavaScript. The query specifically looks for rundll32.exe loading JavaScript files, which is a known technique for executing malicious code while evading detection. This aligns with option C, as it directly describes the behavior the query is designed to hunt for. The query likely includes process creation events where rundll32.exe is the parent or child process and the command line contains .js or .jse extensions, indicating JavaScript execution.

Answer

Identification of lateral movement using PsExec

Answer

Discovery of data exfiltration using FTP

Answer

Detection of regsvr32.exe being used to execute scriptlet files

Question 3

During a threat hunt, you suspect a user may have exfiltrated data via email. Which Microsoft 365 Defender advanced hunting table should you query to review email attachments and their file hashes?

Accepted Answer

EmailAttachmentInfo. EmailAttachmentInfo is the correct table because it specifically contains metadata about email attachments, including the SHA256 hash of each attached file, file name, file type, and size. This table is designed for scenarios where you need to investigate suspicious attachments, such as during a data exfiltration hunt. The other tables focus on URLs, general email events, or post-delivery actions, not attachment details.

Answer

EmailUrlInfo

Answer

EmailEvents

Answer

EmailPostDeliveryEvents

Question 4

A security analyst is using advanced hunting in Microsoft 365 Defender to investigate a potential brute-force attack against an on-premises Exchange server. The analyst wants to find authentication failures from a specific IP address. Which table should the analyst query?

Accepted Answer

IdentityLogonEvents. IdentityLogonEvents is the correct table because it captures authentication attempts monitored by Microsoft Defender for Identity, which deploys a dedicated sensor directly on Active Directory Domain Controllers (and optionally AD FS/AD CS servers) to inspect Kerberos, NTLM, and LDAP traffic in real time. This gives visibility into on-premises Exchange server authentication against Active Directory, including details such as account, target device, IP address, protocol, and success/failure status. This table is specifically designed for identity sign-in events, making it the right choice in Advanced Hunting.

Answer

EmailEvents

Answer

DeviceLogonEvents

Answer

CloudAppEvents

Question 5

Your organization uses Microsoft Sentinel and has enabled the Microsoft 365 Defender connector. You want to automatically assign incidents to a specific analyst team based on the incident severity and type. Which component should you configure?

Accepted Answer

Automation rule in Microsoft Sentinel. Automation rules in Microsoft Sentinel allow you to automatically assign incidents to specific teams based on conditions like severity and type. This is the correct component because it provides a no-code, rule-based engine for incident management tasks, including assignment, without requiring custom logic or external automation.

Answer

Analytics rule in Microsoft Sentinel

Answer

Workbook in Microsoft Sentinel

Answer

Custom playbook in Microsoft Sentinel

Question 6

Your organization uses Microsoft Sentinel and Microsoft Defender for Cloud. You need to ensure that security alerts from Defender for Cloud are automatically ingested into Sentinel. What should you configure?

Accepted Answer

Add the 'Microsoft Defender for Cloud' data connector in Microsoft Sentinel.. The 'Microsoft Defender for Cloud' data connector in Microsoft Sentinel is specifically designed to ingest security alerts from Defender for Cloud into Sentinel. When you enable this connector, it automatically synchronizes alerts from all connected Defender for Cloud subscriptions, allowing you to investigate and respond to those alerts within Sentinel's unified security operations environment.

Answer

Enable diagnostic settings on the Defender for Cloud subscription.

Answer

Configure the 'Azure Activity' data connector.

Answer

Create an automation rule in Sentinel to fetch alerts from Defender for Cloud.

Question 7

To hunt for malicious PowerShell encoded commands, which columns in the DeviceProcessEvents table in Microsoft 365 Defender advanced hunting should you focus on?

Accepted Answer

ProcessCommandLine. Encoded PowerShell commands (e.g., -EncodedCommand or -enc) appear in the full command line used to launch the process, which is captured in the ProcessCommandLine column of DeviceProcessEvents. Filtering or searching ProcessCommandLine for base64-like strings or the -enc switch is the standard hunting technique for detecting obfuscated PowerShell execution.

Answer

DeviceName

Answer

FileName

Answer

InitiatingProcessFileName

Question 8

Your SOC uses Microsoft Defender for Cloud Apps. An alert indicates that a user is downloading a large number of files from SharePoint. Which action should you take to investigate and potentially block the activity?

Accepted Answer

Suspend the user in Defender for Cloud Apps. In Microsoft Defender for Cloud Apps, suspending a user is a direct response action that blocks the user from accessing cloud apps and can be used during investigation of suspicious activity like mass file downloads. This is the native remediation action within the CASB solution, allowing the SOC to contain the threat without disabling the identity across all of Microsoft Entra ID.

Answer

Create a Conditional Access policy to block the user

Answer

Block the IP address in Azure Firewall

Answer

Use Microsoft Intune to wipe the user's device

Question 9

Your team uses Microsoft Sentinel to monitor Azure subscriptions. You need to ensure that only users with the 'Microsoft Sentinel Contributor' role can create and edit analytics rules. You want to enforce this using Azure Policy. What should you do?

Accepted Answer

Create an Azure Policy that denies creation of analytics rules if the user doesn't have the 'Microsoft Sentinel Contributor' role.. Azure Policy can enforce guardrails by denying resource creation or modification based on conditions, such as the user's role. By creating a policy that denies the creation or editing of analytics rules unless the user has the 'Microsoft Sentinel Contributor' role, you directly enforce the requirement. This approach uses Azure Policy's 'deny' effect to prevent unauthorized actions at the Azure Resource Manager level, regardless of other permissions.

Answer

Use Azure Blueprints to assign the 'Microsoft Sentinel Contributor' role to a security group.

Answer

Assign the 'Microsoft Sentinel Contributor' role to all users at the subscription level.

Answer

Create a custom role that denies write access to analytics rules.

Question 10

Refer to the exhibit. An alert in Microsoft Defender for Identity shows suspicious PowerCLI execution on an Exchange server. The service account 'svc_exchange' is used. What is the most likely true-positive scenario?

Accepted Answer

An attacker using a compromised service account to access mailboxes via remote PowerShell. PowerCLI execution on an Exchange server, especially using a service account like 'svc_exchange', is a strong indicator of an attacker leveraging compromised credentials to remotely access Exchange via PowerShell. Microsoft Defender for Identity detects this because PowerCLI is not a native Exchange management tool; it is typically used by attackers to interact with Exchange Web Services (EWS) or Remote PowerShell (WinRM) for mailbox access, data exfiltration, or persistence. The combination of a service account (often over-privileged and not monitored) and PowerCLI from an unusual source or time makes this a true-positive compromise scenario.

Answer

A security tool scanning for vulnerabilities

Answer

A misconfigured backup application running from an external IP

Answer

A legitimate IT admin running Exchange management scripts

Question 11

Which THREE are valid methods to collect forensic evidence from a compromised Windows machine during incident response in Microsoft Defender XDR? (Choose three.)

Accepted Answer

Collect a memory dump from the device using Live Response. Options B, D, and E are correct: Live Response allows script execution and file collection; collecting a memory dump captures volatile evidence necessary for forensic analysis; exporting Windows Event Logs provides a timeline of events. Option A is incorrect because resetting the device destroys evidence instead of preserving it. Option C is incorrect because full disk imaging is not natively supported in Microsoft Defender XDR; it requires external tools.

Answer

Reset the device to a clean state

Answer

Perform a full disk image using Microsoft Defender for Endpoint

Question 12

Your organization uses Microsoft Defender for Endpoint. An endpoint is detected as infected with a trojan. The analyst needs to isolate the device from the network while preserving forensic data. What action should the analyst take?

Accepted Answer

Initiate the 'Isolate device' action from the Microsoft Defender XDR portal.. The 'Isolate device' action in Microsoft Defender XDR (formerly Microsoft 365 Defender) disconnects the device from all network traffic except the Defender for Endpoint service, preserving forensic data on the device while preventing the trojan from communicating with command-and-control servers. This action uses a built-in network isolation mechanism that blocks inbound and outbound connections at the OS level, ensuring the device remains accessible for investigation and remediation.

Answer

Remove the device from the Active Directory domain.

Answer

Disable the network adapter on the device.

Answer

Perform a full reimage of the device.

Question 13

After a security incident, you need to collect forensic evidence from a Windows 10 machine. Which Microsoft tool should you use to create a memory dump?

Accepted Answer

Microsoft Defender for Endpoint Live Response. Microsoft Defender for Endpoint Live Response provides a `dump` command that can capture a full memory dump from a live Windows 10 system without causing a crash. This preserves volatile forensic evidence such as running processes, network connections, and encryption keys. In contrast, the Microsoft Crash Dump Tool (NotMyFault or Sysinternals) is designed to trigger a system crash (BSOD) for debugging purposes, which is destructive and not appropriate for forensic collection. Therefore, for a security incident requiring a memory dump without system disruption, Live Response is the correct tool.

Answer

Remote Desktop Protocol (RDP)

Answer

Microsoft Crash Dump Tool (e.g., NotMyFault or Sysinternals tools)

Answer

Microsoft Defender for Cloud Apps

Question 14

A security analyst is investigating a suspicious process on an endpoint and needs to see all network connections initiated by that process. The analyst knows the ProcessId and DeviceName. Which advanced hunting table in Microsoft 365 Defender should the analyst query to retrieve network connection details associated with this process?

Accepted Answer

DeviceNetworkEvents. The DeviceNetworkEvents table in Microsoft 365 Defender is specifically designed to capture network connection events, including source and destination IP addresses, ports, protocols, and the initiating process ID (ProcessId). By querying this table with the known ProcessId and DeviceName, the analyst can retrieve all network connections initiated by that process, making it the correct choice for this investigation.

Answer

DeviceProcessEvents

Answer

DeviceEvents

Answer

IdentityLogonEvents

Question 15

Your team uses Microsoft Sentinel to manage incidents. You want to automatically assign incidents with a severity of 'High' to the Tier 2 security team. Which feature should you configure?

Accepted Answer

Automation rule. Automation rules in Microsoft Sentinel are designed to perform lightweight incident-level orchestration such as assigning owners, changing severity, adding tags, or closing incidents based on conditions. To auto-assign High-severity incidents to Tier 2, you create an automation rule with a condition on severity and an action to assign the owner. This is exactly the native, no-code mechanism for incident triage routing.

Answer

Playbook

Answer

Analytics rule

Answer

Workbook

Question 16

Which TWO actions can be taken directly from the Microsoft Defender XDR incident queue? (Select TWO.)

Accepted Answer

Isolate a device involved in the incident. The Microsoft Defender XDR incident queue provides direct actions, including device isolation, to contain threats without navigating to separate device management consoles. This capability is built into the incident investigation pane, allowing security analysts to quickly isolate a device involved in an incident from the unified queue.

Answer

Modify a data connector's log collection

Answer

Create a new analytics rule

Answer

Create an automation rule

Question 17

An organization uses Microsoft Defender for Office 365. The security team wants to automatically investigate and respond to user-reported phishing emails. Which feature should they enable to automate this process?

Accepted Answer

Automated investigation and response (AIR). Automated investigation and response (AIR) in Microsoft Defender for Office 365 automatically triggers a playbook when a user reports a phishing email via the Report Message or Report Phishing add-in. It collects the email, analyzes it using threat intelligence and machine learning, and takes remediation actions such as soft-deleting the message or blocking the sender, all without manual intervention.

Answer

Attack simulation training

Answer

Campaign views

Answer

Threat Explorer

Question 18

You are reviewing a Microsoft Sentinel analytics rule configuration. The rule is not generating incidents as expected. What is the most likely cause?

Accepted Answer

The query references a table that is not available in the Sentinel workspace.. If the query in an analytics rule references a table that does not exist in the Microsoft Sentinel workspace, the rule will fail to execute or return no results, preventing incident generation. This is a common misconfiguration when migrating or authoring rules that depend on specific data connectors or schema that have not been onboarded.

Answer

The queryFrequency and queryPeriod are mismatched.

Answer

The suppressionDuration is set to 5 hours, suppressing alerts.

Answer

The action type 'MFA disabled' is not supported in IdentityLogonEvents.

Question 19

Your organization uses Microsoft Purview Compliance Manager to manage compliance activities. You need to assign a specific improvement action to a colleague for implementation. What should you do?

Accepted Answer

In the 'Improvement actions' tab, select the action and click 'Assign'. In Microsoft Purview Compliance Manager, improvement actions are the specific tasks that need to be completed to meet compliance controls. Each improvement action can be directly assigned to a colleague by selecting the action in the 'Improvement actions' tab and clicking the 'Assign' button, which allows you to specify the assignee and due date. This is the intended workflow for delegating implementation responsibilities within Compliance Manager.

Answer

Create a new alert policy to notify the colleague

Answer

Modify the assessment to include the colleague as an owner

Answer

Use the 'Assessments' tab to delegate tasks

Question 20

You are investigating a security incident in Microsoft Sentinel where a user received a phishing email containing a link to a malicious domain. The link was clicked, but no further actions were observed. Which playbook action should you take immediately to prevent potential lateral movement?

Accepted Answer

Block the malicious domain on the firewall. The user only clicked the link without performing any further actions (e.g., no credential entry or file download). Blocking the malicious domain on the firewall immediately prevents the user or any other host from reaching the domain, stopping potential lateral movement via subsequent connections. This aligns with the principle of containing the threat at the network layer before it can spread.

Answer

Disable the user's account

Answer

Revoke the user's active sessions

Answer

Reset the user's password