SC-200 Practice Exam 60 — 20 Questions

Question 1

Which THREE features in Microsoft Sentinel allow an analyst to automate incident response actions?

Accepted Answer

Playbooks (Logic Apps). Playbooks (Logic Apps) are correct because they provide a library of pre-built or custom workflows that can be triggered by automation rules or analytics rules to execute complex, multi-step incident response actions, such as blocking IPs, isolating hosts, or enriching alerts with threat intelligence. They integrate with Azure services and third-party APIs via connectors, enabling automated remediation without manual intervention.

Answer

Watchlists

Answer

Workbooks

Question 2

Your SOC team receives a high-priority incident related to a potential malware outbreak. You need to quickly identify all affected devices and users across the environment. What Microsoft Defender XDR feature should you use?

Accepted Answer

Incident graph. The incident graph in Microsoft Defender XDR visually maps the relationships between alerts, devices, users, IP addresses, and other entities involved in an incident, letting analysts quickly see the full scope of an outbreak. It aggregates related alerts into a single incident and shows lateral movement, affected users, and affected devices in one view. This is the fastest way to identify all impacted assets and accounts during a high-priority malware incident.

Answer

Advanced hunting

Answer

Action center

Answer

Microsoft Sentinel workbook

Question 3

You are investigating a phishing incident in Microsoft Defender for Office 365. Which THREE pieces of information are available in the Threat Explorer?

Accepted Answer

Sender IP address. Sender IP address is available in Threat Explorer because it is a core property of email message trace data in Microsoft Defender for Office 365. Threat Explorer captures the originating IP address from the SMTP session header, which is essential for identifying the source of a phishing attack and correlating with threat intelligence feeds.

Answer

Email body content

Answer

User's mailbox audit log

Question 4

An organization has connected a Palo Alto Networks firewall to Microsoft Sentinel using the Common Event Format (CEF) connector via a Linux log forwarder. The analyst notices that some expected firewall logs are missing in Sentinel. Which troubleshooting step should be performed first to check if the logs are reaching the Sentinel workspace?

Accepted Answer

Run a KQL query in the Sentinel Logs workspace: CommonSecurityLog | where TimeGenerated > ago(1h) | take 10. The first step in troubleshooting missing logs in Microsoft Sentinel is to verify whether the logs are actually reaching the workspace. Running a KQL query against the CommonSecurityLog table (which stores CEF data) with a recent time filter confirms if any CEF logs have been ingested. If the query returns results, the issue lies elsewhere (e.g., parsing or missing events); if it returns no results, the problem is upstream (connector, forwarder, or source). This step isolates the problem to the Sentinel ingestion pipeline before investigating network or configuration issues.

Answer

Check the firewall configuration to ensure syslog forwarding is enabled and pointing to the correct Linux forwarder

Answer

Verify network connectivity between the firewall and the Linux forwarder on port 514 (or the configured port)

Answer

Restart the Log Analytics agent on the Linux forwarder

Question 5

Your organization has multiple Azure subscriptions and wants to ensure that all of them have Microsoft Defender for Cloud's enhanced security features enabled. What is the minimal step required to achieve this for all subscriptions?

Accepted Answer

Enable the required Defender for Cloud plans at the management group level. Enabling Microsoft Defender for Cloud plans at the management group level is the minimal step because it applies the configuration to all child subscriptions under that management group in a single action. This leverages Azure's hierarchical management structure, ensuring every subscription inherits the enhanced security features without needing individual subscription-level configuration.

Answer

Assign an Azure Policy initiative to enable Defender for Cloud on each subscription

Answer

Install the Log Analytics agent on all virtual machines in each subscription

Answer

Create a security contact email for each subscription

Question 6

Which TWO are required to enable Microsoft Sentinel to use AI-generated incident summaries?

Accepted Answer

The Security Reader role assigned to the user. Microsoft Sentinel's AI-generated incident summaries require Microsoft Copilot for Security to be enabled, as this feature leverages Copilot's natural language processing capabilities to summarize incidents. Additionally, the user must have the Security Reader role assigned to access and view these summaries within Sentinel, ensuring proper permissions for security data.

Answer

An Azure OpenAI service instance deployed

Answer

A Log Analytics workspace with a premium pricing tier

Answer

A Power BI Pro license

Question 7

Your company uses Microsoft Sentinel with the Microsoft Defender for Cloud Apps connector. An incident is created when a user performs an unusual mass download from SharePoint Online. The playbook assigned to the incident automatically suspends the user account in Microsoft Entra ID. However, after investigation, the user's activity is determined to be legitimate (they were backing up data for a migration). You need to restore the user's account and ensure that the user can access all resources immediately. You also need to update the incident to reflect the findings. What should you do?

Accepted Answer

Re-enable the user account in Microsoft Entra ID and set the incident status to Closed with classification 'False positive'.. The user account was suspended by the playbook, so you must manually re-enable it in Microsoft Entra ID to restore access immediately. Setting the incident status to 'Closed' with classification 'False positive' accurately reflects that the alert was triggered by legitimate activity, which is the proper way to close a false positive in Microsoft Sentinel.

Answer

Send a new invitation to the user via Microsoft Entra ID and close the incident as resolved.

Answer

Reset the user's password in Microsoft Entra ID and force a password change at next sign-in.

Answer

Edit the playbook to remove the suspend action and re-run it for the incident.

Question 8

In Microsoft 365 Defender, an analyst is investigating an incident where a user's credentials were used to sign in from an unusual geo-location. The analyst wants to find all other sign-in events from the same IP address in the last 7 days. Which Advanced Hunting table should be used?

Accepted Answer

AADSignInEventsBeta. A is correct because the AADSignInEventsBeta table in Advanced Hunting captures Microsoft Entra ID sign-in logs, including details like IP address, geo-location, and user principal name. This table is specifically designed for investigating interactive and non-interactive sign-in events from Microsoft Entra ID, making it the appropriate source to query for all sign-ins from a given IP address over the last 7 days.

Answer

IdentityLogonEvents

Answer

CloudAppEvents

Answer

DeviceLogonEvents

Question 9

Your security team receives alerts from Microsoft Defender for Cloud. You need to configure automated response to remediate a specific alert type. What should you create in Microsoft Sentinel?

Accepted Answer

An automation rule. In Microsoft Sentinel, automation rules are the correct mechanism to define automated responses triggered by alerts, including those from Microsoft Defender for Cloud. They allow you to run playbooks, change incident severity, assign ownership, or add comments when a specific alert type fires, enabling remediation without manual intervention.

Answer

An analytics rule

Answer

A workbook

Answer

A watchlist

Question 10

A SOC analyst is investigating a potential brute-force attack on an Azure VM. The analyst has ingested Windows Security Events into Microsoft Sentinel. Which KQL query would count the number of failed logon attempts (EventID 4625) per user account in the last hour?

Accepted Answer

SecurityEvent | where EventID == 4625 and TimeGenerated > ago(1h) | summarize Count = count() by Account. It filters for EventID 4625 (failed logon) and restricts the time range to the last hour before summarizing the count per Account. This ensures only relevant events are counted, and the aggregation is performed on the correct field (Account) from the SecurityEvent table, which contains Windows Security Events ingested into Sentinel.

Answer

SecurityEvent | where EventID == 4625 | summarize Count = count() by Account | where TimeGenerated > ago(1h)

Answer

SigninLogs | where ResultType != 0 | summarize Count = count() by UserPrincipalName | where TimeGenerated > ago(1h)

Answer

SecurityEvent | where EventID == 4625 | make-series Count = count() default=0 on TimeGenerated from ago(1h) to now() step 1h by Account

Question 11

Refer to the exhibit. You run this KQL query in Microsoft Sentinel. What is the purpose of the query?

Accepted Answer

To count alerts by severity over the last week. The KQL query uses the `SecurityAlert` table and summarizes alerts by `AlertSeverity` using the `count()` aggregation function. The `where TimeGenerated > ago(7d)` filter restricts results to the last 7 days, and the `project` clause outputs only the severity and count columns. This directly produces a count of alerts grouped by severity over the last week, matching option B.

Answer

To list all incidents in the last 7 days

Answer

To find the most recent high-severity alert

Answer

To identify hunting results

Question 12

A SOC analyst needs to create a custom scheduled analytics rule in Microsoft Sentinel that detects when a user attempts to sign in from an IP address not in the organization's allowlist. The rule should run every 5 minutes. Which table should the analyst query?

Accepted Answer

SigninLogs. The SigninLogs table in Microsoft Sentinel captures interactive user sign-in events, including the source IP address. Since the rule needs to detect user sign-in attempts from non-allowlisted IPs, SigninLogs is the correct table to query. It provides the necessary fields like UserPrincipalName, IPAddress, and ResultType to build the detection logic.

Answer

AADNonInteractiveUserSignInLogs

Answer

AuditLogs

Answer

AzureActivity

Question 13

Which THREE components are required to implement a threat intelligence feed in Microsoft Sentinel using the Threat Intelligence - TAXII data connector?

Accepted Answer

Root collection ID. The root collection ID is a required component for the Threat Intelligence - TAXII data connector because it identifies the specific collection of threat indicators on the TAXII server. Without this ID, Microsoft Sentinel cannot determine which set of indicators to ingest, as a single TAXII server may host multiple collections. The connector uses the root collection ID to query the correct STIX/TAXII endpoint and retrieve the relevant threat intelligence feed.

Answer

A Log Analytics workspace with Microsoft Sentinel enabled

Answer

A watchlist named 'ThreatIntelligenceIndicators'

Question 14

You are a threat hunter at Northwind Traders. The organization uses Microsoft Defender for Identity (MDI) and Microsoft Sentinel. You suspect a golden ticket attack may have occurred in the domain. You need to create a hunting query in Microsoft Sentinel that leverages data from MDI to detect possible golden ticket usage. Which of the following queries or approaches is most appropriate?

Accepted Answer

Query SecurityAlert where AlertName contains 'Golden Ticket' or 'Suspicious Kerberos'. Microsoft Defender for Identity (MDI) generates security alerts for suspicious Kerberos activity, including golden ticket attacks, which are surfaced in Microsoft Sentinel via the SecurityAlert table. Querying SecurityAlert for AlertName containing 'Golden Ticket' or 'Suspicious Kerberos' directly leverages MDI's built-in detections. This is the most appropriate approach because MDI already analyzes domain controller traffic and creates high-fidelity alerts.

Answer

Query DeviceProcessEvents for processes related to Kerberos

Answer

Query CommonSecurityLog for unusual DNS queries related to Kerberos

Answer

Query IdentityLogonEvents for failed Kerberos authentication

Question 15

A security analyst is configuring a Microsoft Sentinel playbook to automate the response to phishing incidents. When an incident is created based on a phishing analytics rule, the playbook needs to execute an action in Microsoft 365 Defender, such as blocking the sender email address. Which connector should the analyst add to the playbook to interact with Microsoft 365 Defender?

Accepted Answer

Microsoft 365 Defender connector. The Microsoft 365 Defender connector is the correct choice because it provides the necessary actions to interact directly with Microsoft 365 Defender components, such as blocking a sender email address via the Advanced Hunting or action APIs. This connector enables the playbook to trigger remediation actions like email quarantine or sender block within the Microsoft 365 Defender portal, which is essential for automating responses to phishing incidents in Microsoft Sentinel.

Answer

Microsoft Entra ID connector

Answer

Azure DevOps connector

Answer

Teams connector

Question 16

Refer to the exhibit. You are configuring a Microsoft Sentinel scheduled analytics rule with the above incident creation settings. What is the effect of setting 'groupingConfiguration.enabled' to false?

Accepted Answer

Each alert will generate a separate incident. When groupingConfiguration.enabled is set to false in a Microsoft Sentinel scheduled analytics rule, the alert-grouping logic is disabled entirely. This means Sentinel will not bundle multiple alerts from a single rule run into one incident; instead, every individual alert generated by the query produces its own distinct incident. This is useful when each alert requires separate triage or when alerts represent unrelated events that should not be merged.

Answer

Alerts will be suppressed for 5 minutes

Answer

The rule will run every 5 minutes

Answer

No incidents will be created

Question 17

Which THREE of the following are valid sources of threat intelligence that can be ingested into Microsoft Sentinel for threat hunting? (Select three.)

Accepted Answer

Microsoft Threat Intelligence feed. Microsoft Sentinel natively ingests threat intelligence through the Microsoft Defender Threat Intelligence (MDTI) connector, so option B (Microsoft Threat Intelligence feed) is a valid source that populates the ThreatIntelligenceIndicator table for hunting. Option C (TAXII server) is correct because Sentinel supports the Threat Intelligence - TAXII data connector, which pulls STIX/TAXII 2.x indicators from a TAXII 2.0/2.1 endpoint. Option D (Custom threat intelligence via API) is correct because Sentinel exposes the Upload Indicators API (Microsoft Sentinel Threat Intelligence Upload API) and the Graph Security tiIndicators API, allowing custom or third-party feeds to be pushed programmatically. Option A (Syslog from a firewall) is not a threat intelligence source; it is raw log telemetry ingested via the Syslog/CEF connector for detection, not curated indicator data. Option E (Azure Policy) is a governance/compliance service for enforcing resource configurations and has no role in ingesting threat intelligence indicators.

Answer

Syslog from a firewall

Answer

Azure Policy

Question 18

Which of the following detection scenarios can be implemented using a scheduled analytics rule in Microsoft Sentinel? (Select all that apply.) (Choose 2.)

Accepted Answer

Identifying sign-ins from IP addresses listed in a custom threat intelligence watchlist.. Scheduled analytics rules in Microsoft Sentinel can be configured to run KQL queries at regular intervals. These queries can join multiple data sources, including watchlists and Windows Security Events (SecurityEvent table). For option A, querying SigninLogs and joining with a custom threat intelligence watchlist identifies sign-ins from malicious IPs. For option C, aggregating failed logon events from SecurityEvent (e.g., EventID 4625) and grouping by source IP or account can detect brute-force patterns. Option B is better suited for UEBA anomaly detection, and option D is an automated response action, not detection. Therefore, A and C are correct.

Answer

Detecting anomalous sign-in behavior based on user entity behavior.

Answer

Automatically blocking malicious IPs on a firewall.

Question 19

A company uses Microsoft Defender for Cloud to protect Azure virtual machines. The security team wants to identify which VMs have missing system updates such as critical security patches. Which Defender for Cloud feature should they use?

Accepted Answer

Vulnerability assessment. Vulnerability assessment in Microsoft Defender for Cloud scans Azure VMs for missing system updates, including critical security patches, by integrating with built-in or partner vulnerability scanners (e.g., Qualys). This feature provides a continuous assessment of OS and application vulnerabilities, directly addressing the need to identify VMs with missing patches.

Answer

Adaptive application controls

Answer

Just-in-time VM access

Answer

File integrity monitoring

Question 20

A security analyst needs to contain a compromised device that is spreading malware in the network. The device is enrolled in Microsoft Intune and managed by Microsoft Defender for Endpoint. What is the fastest way to isolate the device from the network?

Accepted Answer

Use Microsoft Defender for Endpoint to initiate device isolation.. Microsoft Defender for Endpoint provides a dedicated 'Device isolation' action that immediately blocks all network traffic to and from the device while maintaining connectivity to the Defender service for management and monitoring. This is the fastest containment method as it can be triggered directly from the Defender portal without requiring additional configuration or user interaction.

Answer

Disable the device in Microsoft Intune.

Answer

Perform a remote wipe of the device from Microsoft Intune.

Answer

Block the user's account in Microsoft Entra ID.