SC-200 Practice Exam 59 — 20 Questions

Question 1

Which TWO actions should you take to improve the performance of Microsoft Sentinel analytics rules that are running slowly? (Choose two.)

Accepted Answer

Reduce the query time window. Reducing the query time window (Option B) directly limits the volume of data the analytics rule must process per execution, which reduces query latency and overall rule execution time. This is a common performance optimization because Sentinel analytics rules run KQL queries against the Log Analytics workspace, and smaller time ranges mean fewer log records to scan.

Answer

Assign a higher severity to the rule

Answer

Increase the rule run frequency

Answer

Add additional entity mapping

Question 2

You run the above KQL query in Microsoft Sentinel to identify ransomware alerts from the last day. The result shows zero rows. Which is the most likely reason?

Accepted Answer

No alerts with 'ransomware' in the name occurred in the last day. The KQL query filters for alerts where the name contains 'ransomware'. If no such alerts were generated in the last day, the query returns zero rows. This is the most likely reason because the query logic is correct, and the absence of data is a valid outcome, not an error.

Answer

The table name 'SecurityAlert' is incorrect; it should be 'Alert'

Answer

The user does not have permission to access the SecurityAlert table

Answer

The time filter of 1 day is too restrictive; need to increase range

Question 3

Your threat hunt identifies a process that is making outbound connections to an unknown IP address. Which Microsoft Defender for Endpoint action can you take to immediately isolate the device?

Accepted Answer

Isolate device. The 'Isolate device' action in Microsoft Defender for Endpoint immediately cuts off a device from all network communication except for the Defender for Endpoint service itself, preventing the malicious process from exfiltrating data or communicating with command-and-control servers. This is the only action that provides immediate network isolation while preserving the ability to remotely investigate and remediate the device. Other actions like collecting an investigation package or running an antivirus scan do not stop active outbound connections.

Answer

Collect investigation package

Answer

Block file

Answer

Run antivirus scan

Question 4

Your organization is implementing Microsoft Sentinel in a multi-tenant environment using Azure Lighthouse. The SOC team needs to investigate incidents across all tenants from a single interface. Which configuration is required?

Accepted Answer

Onboard multiple workspaces to Azure Lighthouse and use a central workspace for investigation.. Azure Lighthouse enables cross-tenant management by allowing the SOC team to delegate access to multiple Sentinel workspaces from a single control plane. This configuration lets investigators view and manage incidents across all tenants without needing separate sign-ins or duplicating data, which is essential for a multi-tenant SOC environment.

Answer

Use Azure AD B2B to grant users from other tenants access to the workspace.

Answer

Create a single workspace and have all tenants send logs to it.

Answer

Assign custom roles in each tenant's Sentinel workspace.

Question 5

Which THREE actions can you take in Microsoft Sentinel to respond to an incident?

Accepted Answer

Assign the incident to a user. Assigning an incident to a user is a core incident response action in Microsoft Sentinel. It establishes ownership, ensuring a specific analyst is responsible for investigation and remediation. This action is performed directly from the incident details pane and is a fundamental step in managing the incident lifecycle.

Answer

Modify a KQL query in an analytics rule

Answer

Export logs to Azure Storage

Question 6

Your Microsoft Defender XDR environment is experiencing high false positive rates for a specific type of alert. You need to reduce the noise without completely disabling the alert. What is the most effective method?

Accepted Answer

Create a custom detection rule to tune the detection logic.. Creating a custom detection rule allows you to refine the detection logic by adding specific conditions, such as excluding known benign processes or IP addresses, thereby reducing false positives while retaining the alert's core detection capability. This approach directly tunes the detection mechanism rather than masking or disabling it, aligning with the goal of reducing noise without completely disabling the alert.

Answer

Create a suppression rule for the alert.

Answer

Use an automation rule to automatically close the false positive incidents.

Answer

Disable the built-in detection rule.

Question 7

Your company uses Microsoft Defender for Endpoint (MDE) and Microsoft Sentinel. You need to ensure that when a device is determined to be compromised, the device is automatically isolated from the network and a Sentinel incident is updated with the isolation status. What is the most efficient way to achieve this?

Accepted Answer

Create a Microsoft Sentinel automation rule with a playbook that isolates the device and updates the incident. It leverages Microsoft Sentinel's automation capabilities to respond to security incidents without manual intervention. By creating an automation rule that triggers a playbook (an Azure Logic Apps workflow), you can automatically isolate a compromised device via Microsoft Defender for Endpoint APIs and simultaneously update the Sentinel incident with the isolation status. This provides the most efficient, end-to-end automated response directly within the security operations workflow.

Answer

Have the SOC analyst manually isolate the device from the MDE console and update the incident in Sentinel

Answer

Configure Microsoft Intune to automatically isolate the device when a compliance policy is violated

Answer

Use Microsoft Defender XDR conditional access to block the device

Question 8

During a ransomware incident, a security analyst needs to isolate an affected Windows 10 device managed by Microsoft Intune. The device is currently online and connected to the corporate network. Which remediation action should be taken from Microsoft Defender XDR to achieve this?

Accepted Answer

Initiate device isolation from the Microsoft Defender for Endpoint console. Device isolation from the Microsoft Defender for Endpoint console (accessible via Microsoft Defender XDR) immediately cuts the device off from the network while preserving the Defender communication channel, allowing the analyst to investigate and remediate without losing contact with the endpoint. This is the purpose-built ransomware containment action.

Answer

Block the device in Microsoft Intune

Answer

Disable the Windows Firewall via Intune

Answer

Run a full antivirus scan from Microsoft Defender for Endpoint

Question 9

Your organization uses Microsoft Sentinel with Fusion and Microsoft Security incident creation rules. You receive a high-severity incident from Microsoft Defender for Cloud Apps. The incident has a low confidence score. What should you do first?

Accepted Answer

Validate the alert by correlating with other logs.. A low confidence score indicates the alert may be a false positive, but it should not be dismissed without investigation. In Microsoft Sentinel, low confidence alerts from Defender for Cloud Apps require validation through correlation with other logs (e.g., Microsoft Entra ID sign-ins, network logs) to confirm malicious activity before taking action. This aligns with the incident response process of triage and verification, not immediate dismissal or suppression.

Answer

Dismiss the incident as a false positive due to low confidence.

Answer

Suppress all future alerts from Defender for Cloud Apps with low confidence.

Answer

Escalate the incident to the SOC manager immediately.

Question 10

Your organization uses Microsoft Defender for Cloud and you need to ensure that security recommendations are automatically remediated for non-compliant resources. You have enabled 'Auto provisioning' for the Log Analytics agent. What additional step is required to enable automatic remediation?

Accepted Answer

Enable the 'DeployIfNotExists' policy for specific recommendations. Enabling 'Auto provisioning' for the Log Analytics agent only ensures the agent is installed on VMs, but does not automatically remediate security recommendations. To achieve automatic remediation, you must enable the 'DeployIfNotExists' effect on specific Azure Policy definitions (e.g., 'System updates should be installed on your machines'), which triggers remediation tasks when resources are non-compliant. This is a separate step in Defender for Cloud's 'Security policy' blade under 'Settings & monitoring'.

Answer

No additional step is required; auto provisioning automatically remediates

Answer

Configure manual remediation in Defender for Cloud

Answer

Create a custom Azure Policy initiative with audit effect

Question 11

A security analyst is configuring a Microsoft Sentinel workspace. The analyst needs to connect a third-party firewall that sends logs via Syslog and supports a common event format (CEF). Which data connector should the analyst use to ingest these logs?

Accepted Answer

Common Event Format (CEF) via AMA. The Common Event Format (CEF) via AMA data connector is specifically designed to ingest logs from security appliances that send Syslog messages in CEF format. CEF is an industry-standard format that allows firewalls and other devices to send structured event data, and the Azure Monitor Agent (AMA) replaces the older Log Analytics Agent for this purpose. This connector parses the CEF headers and maps the fields to the appropriate Microsoft Sentinel tables, enabling efficient threat detection and analysis.

Answer

Windows Security Events via AMA

Answer

Azure Activity Log

Answer

Office 365 connector

Question 12

A security administrator in Microsoft Defender for Cloud notices that the Secure Score is lower than expected. Which action would most effectively improve the Secure Score by reducing the attack surface?

Accepted Answer

Enable Just-in-Time (JIT) VM access for all virtual machines.. Enabling Just-in-Time (JIT) VM access reduces the attack surface by locking down inbound traffic to Azure VMs, allowing only authorized users to open specific ports (e.g., RDP 3389, SSH 22) for a limited time. This directly improves the Secure Score because Microsoft Defender for Cloud includes JIT recommendations as a high-impact security control, and implementing it reduces the number of exposed management ports that attackers can target.

Answer

Configure auditing on all SQL databases.

Answer

Disable all low-severity security alerts in the subscription.

Answer

Install EDR agents on all on-premises servers.

Question 13

The exhibit shows an automation rule in Microsoft Sentinel. The analyst reports that the playbook is not triggered for high-severity incidents. What is the most likely cause?

Accepted Answer

The rule triggers only on incident creation, not on updates.. The automation rule is configured to trigger 'When incident is created,' which means it only runs the playbook at the moment the incident is first generated. If the incident's severity is updated after creation (e.g., from medium to high), the rule does not re-trigger, so the playbook will not execute for that high-severity incident. This is the most likely cause because the analyst reports that high-severity incidents are not triggering the playbook, and the rule's trigger condition explicitly excludes updates.

Answer

The playbook resource ID is invalid.

Answer

The condition syntax is incorrect.

Answer

The tenant ID is missing.

Question 14

A security administrator needs to ensure that only approved applications can run on a set of Windows Server virtual machines. The administrator has already enabled Microsoft Defender for Cloud's enhanced security features. Which Defender for Cloud feature should the administrator configure to define a list of allowed applications and get alerts when unapproved applications are executed?

Accepted Answer

Adaptive Application Controls. Adaptive Application Controls (AAC) is the correct feature because it uses machine learning to establish a baseline of known-safe processes on your Windows Server VMs, then enforces an allowlist so that only those approved applications can run. When an unapproved application is executed, AAC generates a security alert in Microsoft Defender for Cloud, meeting the requirement to both define allowed applications and receive alerts on violations.

Answer

File Integrity Monitoring (FIM)

Answer

Just-in-Time VM Access (JIT)

Answer

Vulnerability Assessment

Question 15

Your organization plans to implement Microsoft Sentinel. Which THREE components are required for a basic deployment? (Choose three.)

Accepted Answer

Analytics rules to generate incidents.. Analytics rules are required to generate incidents from the data ingested into Microsoft Sentinel. Without analytics rules, the raw log data remains unprocessed and no security incidents are created, making the deployment non-functional for detection and response.

Answer

User and Entity Behavior Analytics (UEBA) enabled.

Answer

Bookmarks for incident investigations.

Question 16

The analyst notices that the rule does not fire for a user who has 12 sign-ins from the same IP address, but all are low risk. The expected behavior is to alert when a single user has more than 10 sign-ins from the same IP with at least one high-risk sign-in. What is the issue?

Accepted Answer

The query requires a high-risk sign-in from the same IP, but none exist, so no match.. The KQL query uses an inner join on UserPrincipalName and IPAddress, which only returns rows where a high-risk sign-in exists from the same IP. Since all 12 sign-ins from that IP are low risk, the join produces no matching rows, and the rule does not fire. The threshold of 10 is irrelevant when the join condition fails to produce any results.

Answer

The join should be on UserPrincipalName only, not IPAddress.

Answer

The join should be leftouter to include sign-ins without high risk.

Answer

The threshold is set to 10, but the user has 12 sign-ins, so it should fire.

Question 17

A security administrator wants to quickly view the overall security posture of all Azure subscriptions under a single management group that are monitored by Microsoft Defender for Cloud. Where in the Azure portal should they navigate?

Accepted Answer

Microsoft Defender for Cloud overview page. The Microsoft Defender for Cloud overview page provides a unified dashboard that displays the secure score, regulatory compliance, and security alerts across all subscriptions under a management group. This is the default landing page for assessing the overall security posture, aggregating data from all monitored subscriptions in a single view.

Answer

Azure Monitor

Answer

Azure Policy Compliance dashboard

Answer

Azure Advisor

Question 18

A security administrator receives an alert from Microsoft Defender for Identity about a suspicious Kerberos ticket request from a domain controller. The alert suggests a possible Golden Ticket attack. Which action should the administrator take to validate the alert?

Accepted Answer

Check the domain controller's Security event log for Event ID 4769 with suspicious attributes.. Event ID 4769 (Kerberos Service Ticket Request) on a domain controller is the authoritative source for validating suspicious ticket requests. In a Golden Ticket attack, the forged ticket often exhibits anomalous attributes such as an unusually long lifetime, a non-existent or disabled user account, or encryption type mismatches (e.g., RC4 when AES is expected). Reviewing this log directly confirms whether the ticket characteristics deviate from normal Kerberos behavior, providing definitive evidence for the alert.

Answer

Review Microsoft Defender for Identity alerts for brute force attempts.

Answer

Reset the krbtgt account password twice.

Answer

Verify if the user account associated with the ticket is disabled.

Question 19

You are reviewing an incident in Microsoft Sentinel. The incident is assigned to a user. What does the 'assignedTo' field indicate?

Accepted Answer

The incident is assigned to that user for investigation.. In Microsoft Sentinel, the 'assignedTo' field is used to track ownership of an incident during its lifecycle. When an incident is assigned to a user, it indicates that user is responsible for investigating and resolving the incident, not that they created or closed it. This field is set manually or via automation rules to ensure clear accountability for incident response.

Answer

The incident was created by that user.

Answer

The incident was closed by that user.

Answer

The incident is assigned to a Microsoft Entra group.

Question 20

During an incident response, you need to collect a memory dump from a compromised Windows 10 device managed by Microsoft Defender for Endpoint. Which action should you take in the Microsoft Defender XDR portal?

Accepted Answer

Initiate a Live Response session and run the 'memdump' command. To collect a memory dump from a compromised Windows 10 device managed by Microsoft Defender for Endpoint, you must initiate a Live Response session and run the 'memdump' command. Live Response provides a remote shell that allows forensic commands like 'memdump' to capture the full memory contents of the target machine, which is essential for analyzing volatile data during incident response. Other options, such as custom detection scripts or automated investigations, do not directly support memory acquisition.

Answer

Run a custom detection script

Answer

Execute a Power Automate flow to collect memory

Answer

Start a full antivirus scan

Answer

Submit the device for automated investigation