SC-200 Practice Exam 60 — 20 Questions

Question 1

Your company uses Microsoft Defender for Office 365. A user reports receiving a phishing email that bypassed the default policy. The email contains an external link to a credential harvesting site. You need to block similar emails in the future. What should you do?

Accepted Answer

Create a Safe Links policy and add the malicious domain to the blocked URLs list.. Option D is correct because creating a Safe Links policy and adding the domain to the blocked URLs list prevents users from clicking malicious links. Option A is wrong because anti-spam policies do not block specific URLs. Option B is wrong because tenant allow/block lists are for sender/domain blocking, not URLs. Option C is wrong because anti-malware policies do not handle link blocking.

Answer

Create an anti-spam policy to block the sender's domain.

Answer

Create an anti-malware policy to block the attachment type.

Answer

Add the sender's domain to the Tenant Allow/Block List.

Question 2

A SOC analyst needs to automate response to a phishing email reported by a user. The playbook should automatically block the sender in Exchange Online and delete the email from all recipients. Which Microsoft Sentinel automation action should the analyst use?

Accepted Answer

Use the Microsoft Teams connector to post an adaptive card for approval, then use the Exchange Online PowerShell connector to run a script to block sender and delete email.. Option C is correct because Microsoft Teams connector can trigger adaptive cards to get analyst approval before blocking. Option A is wrong because email connector sends emails, not blocks. Option B is wrong because ServiceNow is for ticketing, not immediate blocking. Option D is wrong because Azure Automation can run scripts but is not the primary connector for Exchange Online actions.

Answer

Use the Azure Automation connector to run a runbook that deletes the email only.

Answer

Use the Microsoft 365 Defender connector with an action to run an advanced hunting query.

Answer

Use the ServiceNow connector to create an incident ticket.

Question 3

Refer to the exhibit. An alert in Microsoft Defender for Identity shows suspicious PowerCLI execution on an Exchange server. The service account 'svc_exchange' is used. What is the most likely true-positive scenario?

Accepted Answer

An attacker using a compromised service account to access mailboxes via remote PowerShell. Option C is correct because PowerCLI on an Exchange server is unusual for a service account and suggests an attacker using a compromised account to access mailboxes remotely. Option A is wrong because PowerCLI is not a standard Exchange management tool. Option B is wrong because PowerCLI is not used for mail flow troubleshooting. Option D is wrong because the IP 192.168.1.100 is internal, not external.

Answer

A security tool scanning for vulnerabilities

Answer

A misconfigured backup application running from an external IP

Answer

A legitimate IT admin running Exchange management scripts

Question 4

Your company uses Microsoft Sentinel with the Microsoft Defender for Cloud Apps connector. An incident is created when a user performs an unusual mass download from SharePoint Online. The playbook assigned to the incident automatically suspends the user account in Microsoft Entra ID. However, after investigation, the user's activity is determined to be legitimate (they were backing up data for a migration). You need to restore the user's account and ensure that the user can access all resources immediately. You also need to update the incident to reflect the findings. What should you do?

Accepted Answer

Re-enable the user account in Microsoft Entra ID and set the incident status to Closed with classification 'False positive'.. Option B is correct because re-enabling the account in Entra ID restores access, and closing the incident with a classification updates the record. Option A is wrong because resetting password is unnecessary. Option C is wrong because re-inviting is for guest users. Option D is wrong because editing the playbook is not needed.

Answer

Send a new invitation to the user via Microsoft Entra ID and close the incident as resolved.

Answer

Reset the user's password in Microsoft Entra ID and force a password change at next sign-in.

Answer

Edit the playbook to remove the suspend action and re-run it for the incident.

Question 5

Your organization uses Microsoft Defender for Cloud. You need to remediate a security recommendation that indicates a virtual machine is missing critical security updates. Which TWO actions should you take to remediate this recommendation?

Accepted Answer

Connect to the VM and install the missing updates.. Options A and B are correct. Installing missing updates (A) directly remediates the recommendation, and enabling automatic updates (B) prevents future issues. Option C is wrong because restarting the VM does not install updates. Option D is wrong because the recommendation is about updates, not NSGs. Option E is wrong because creating an exception would ignore the recommendation.

Answer

Add a network security group to block inbound traffic to the VM.

Answer

Create an exemption for the recommendation in Defender for Cloud.

Answer

Restart the VM to trigger update installation.

Question 6

During a security incident, a Microsoft Sentinel analytics rule generated an alert for a suspicious sign-in from an unusual location. The incident involves a user whose account has been compromised. The security team needs to take immediate actions to remediate and prevent further damage. Which THREE actions should the security team prioritize?

Accepted Answer

Reset the user's password. Option A is correct because disabling the user account stops further access. Option C is correct because resetting the password ensures the attacker cannot reuse stolen credentials. Option E is correct because revoking session tokens ends active sessions. Option B is wrong because reviewing audit logs is important but not immediate. Option D is wrong because raising the risk level is a classification, not a remediation.

Answer

Review audit logs for all users

Answer

Raise the user's risk level in Identity Protection

Question 7

A security analyst receives a Microsoft Defender for Cloud Apps alert about a suspicious sign-in from an IP address in a sanctioned app. The analyst needs to immediately prevent further access from that IP. What should the analyst do?

Accepted Answer

Create an IP address-based access policy in Microsoft Defender for Cloud Apps.. Option C is correct because creating an IP-based access policy in Defender for Cloud Apps allows blocking the specific IP. Option A is wrong because Conditional Access policies are managed in Microsoft Entra ID, not directly from the alert. Option B is wrong because resetting the user's password does not block the IP. Option D is wrong because a mailbox rule cannot block IP access.

Answer

Create a mailbox rule to delete emails from that IP.

Answer

Create a Conditional Access policy in Microsoft Entra ID to block the IP.

Answer

Reset the user's password and require MFA re-registration.

Question 8

During an incident response, a SOC analyst identifies that a malicious PowerShell script was executed on multiple endpoints. The analyst needs to collect relevant files from all affected endpoints for further analysis. What should the analyst use?

Accepted Answer

Microsoft Defender for Endpoint Live Response.. Option D is correct because Microsoft Defender for Endpoint's Live Response allows collecting files from endpoints. Option A is wrong because Microsoft Defender for Cloud Apps does not collect files from endpoints. Option B is wrong because Microsoft Sentinel is for SIEM, not live file collection. Option C is wrong because Microsoft Purview is for compliance.

Answer

Microsoft Defender for Cloud Apps file investigation.

Answer

Microsoft Purview eDiscovery.

Answer

Microsoft Sentinel incident investigation graph.

Question 9

A SOC team uses Microsoft Sentinel with Microsoft Defender XDR integration. An incident is created from a Defender for Endpoint alert. The analyst wants to run a KQL query across all affected devices without creating a new analytics rule. How can the analyst achieve this?

Accepted Answer

Use the incident's Logs blade to run a KQL query.. Option B is correct because the incident's Logs blade allows running ad-hoc KQL queries. Option A is wrong because the analytics rule is for scheduled queries. Option C is wrong because the workbook is for visualizations. Option D is wrong because the hunting blade is for proactive hunting, not incident-specific.

Answer

Modify the analytics rule that created the incident.

Answer

Use the Microsoft Sentinel Hunting blade.

Answer

Create a new workbook.

Question 10

Which THREE steps are part of the containment phase of incident response in Microsoft Sentinel? (Select THREE.)

Accepted Answer

Disable compromised user accounts in Microsoft Entra ID.. Option A is correct because isolating affected resources prevents further damage. Option C is correct because blocking indicators helps stop attacks. Option E is correct because disabling compromised accounts stops unauthorized access. Option B is wrong because collecting forensic data is part of investigation, not containment. Option D is wrong because restoring from backup is part of recovery.

Answer

Collect forensic data from affected endpoints.

Answer

Restore encrypted files from backup.

Question 11

Which TWO are valid incident classification categories in Microsoft Sentinel? (Select TWO.)

Accepted Answer

True Positive. Option B is correct because True Positive is a valid classification. Option E is correct because Benign Positive is also a valid classification. Option A is wrong because False Positive is a classification, but not listed as a category in the question context? Actually, False Positive is also valid, but we need exactly two correct. According to Microsoft Sentinel incident classification, True Positive, False Positive, Benign Positive are common. But the question asks for TWO, and the correct ones here are True Positive and Benign Positive. Option C is wrong because Malicious is not a standard classification. Option D is wrong because Informational is not a classification.

Answer

False Positive

Answer

Malicious

Answer

Informational

Question 12

Refer to the exhibit. An analyst runs the command to install the Azure Monitor Agent on a VM. What is the primary purpose of installing this agent in the context of security incident response?

Accepted Answer

To collect security events and performance data for analysis in Microsoft Sentinel.. Option A is correct because the Azure Monitor Agent collects logs and performance data, which can be used for security analysis. Option B is wrong because the agent does not block threats. Option C is wrong because Defender for Cloud is a separate service. Option D is wrong because the agent is for data collection, not vulnerability scanning.

Answer

To integrate the VM with Microsoft Defender for Cloud.

Answer

To scan the VM for vulnerabilities.

Answer

To enable real-time malware protection on the VM.

Question 13

You are performing a threat hunt in Microsoft Sentinel. You want to identify devices that have been communicating with known malicious IP addresses. Which data source should you query?

Accepted Answer

CommonSecurityLog. Option A is correct because CommonSecurityLog contains network traffic logs from security appliances. Option B is for Windows events, not network. Option C is for DNS queries. Option D is for device events from Defender for Endpoint, but not IP communications.

Answer

SecurityEvent

Answer

DnsEvents

Answer

DeviceNetworkEvents

Question 14

Your organization uses Microsoft Sentinel. A new incident is created from a fusion alert that combines multiple low-severity alerts. The analyst needs to determine the entities involved. What should the analyst review?

Accepted Answer

The incident's entities tab.. Option C is correct because the incident entities tab lists all entities (users, IPs, hosts) related to the incident. Option A is wrong because the analytics rule is the source, not entities. Option B is wrong because the workbook may not show entities for a specific incident. Option D is wrong because the incident timeline shows events, not entities.

Answer

The Sentinel Overview workbook.

Answer

The analytics rule that generated the incident.

Answer

The incident's timeline.

Question 15

Refer to the exhibit. An analyst runs Get-MpThreat on a device. Based on the output, what is the status of the threat?

Accepted Answer

The threat was blocked and did not execute.. Option C is correct because DidThreatExecute is False and IsActive is False, meaning the threat was blocked before execution. Option A is wrong because Action:6 (Quarantine) indicates it was handled. Option B is wrong because IsActive is False. Option D is wrong because IsActive is False.

Answer

The threat executed and is now inactive.

Answer

The threat was quarantined and is still active.

Answer

The threat is currently active on the device.

Question 16

Your Microsoft Sentinel workspace receives logs from multiple sources. You need to ensure that an incident response playbook is triggered automatically when a specific alert is generated. What should you create?

Accepted Answer

An automation rule.. Option C is correct because an automation rule in Microsoft Sentinel can trigger a playbook when an alert is created. Option A is wrong because a logic app is the playbook itself, not the trigger. Option B is wrong because a data connector ingests data, not triggers actions. Option D is wrong because an analytics rule generates alerts, but the playbook trigger is an automation rule.

Answer

A data connector.

Answer

An analytics rule.

Answer

A new Logic App.

Question 17

Your Microsoft Sentinel workspace ingests logs from multiple sources. During an incident, you need to quickly identify all user accounts that have been compromised based on a known malicious IP address. Which KQL operator is most efficient for this?

Accepted Answer

lookup. Option B is correct because the lookup operator is optimized for joining large tables with a small reference set (the malicious IP). Option A is wrong because join is less efficient for this pattern. Option C is wrong because where clause would require filtering each row individually. Option D is wrong because summarize is for aggregation, not matching.

Answer

summarize

Answer

where

Answer

join kind=inner

Question 18

Your organization uses Microsoft Sentinel and Microsoft Defender for Cloud. During a security incident involving a compromised Azure VM, which THREE actions are appropriate to contain and investigate the incident?

Accepted Answer

Use Microsoft Defender for Cloud's Just-in-Time VM access to isolate the VM.. Options A, C, and E are correct because enabling network security group flow logs helps trace lateral movement, isolating the VM in Defender for Cloud stops communication, and creating an automation rule can trigger a playbook for response. Option B is wrong because deleting the VM destroys evidence. Option D is wrong because updating the VM does not contain the incident.

Answer

Delete the compromised VM to prevent further damage.

Answer

Update the VM's operating system to the latest patch.

Question 19

Your organization uses Microsoft Sentinel and Microsoft Defender XDR. You have a custom analytics rule that triggers on a Defender for Endpoint alert. When the rule triggers, a playbook is executed that creates an incident in Microsoft Sentinel and sends a message to a Teams channel. The playbook fails to execute. Which permission should you verify first?

Accepted Answer

The automation rule has the correct managed identity or connection permissions. Option A is correct because playbooks require an automation rule with appropriate permissions to run. Option B is wrong because Teams channel permissions are for posting messages, not for playbook execution. Option C is wrong because Microsoft Sentinel reader role is for viewing incidents, not executing playbooks. Option D is wrong because Microsoft Entra ID admin rights are not required for playbook execution.

Answer

The Teams channel has the appropriate permissions for incoming webhooks

Answer

The analyst has Microsoft Sentinel Reader role

Answer

The user has Microsoft Entra ID Global Administrator role

Question 20

You are responding to a data exfiltration incident involving a user who copied sensitive files to a personal cloud storage service. The files were accessed from the user's managed device. Which Microsoft  Defender for Cloud Apps activity policy should you create to detect similar future incidents?

Accepted Answer

An activity policy that detects uploads to personal cloud storage services.. Option C is correct because an activity policy can monitor file uploads to non-corporate cloud apps. Option A is wrong because a file policy applies to files already in cloud apps. Option B is wrong because an anomaly detection policy is for unusual behavior, not specific uploads. Option D is wrong because an app discovery policy identifies shadow IT apps, not specific activities.

Answer

An anomaly detection policy that flags impossible travel.

Answer

A file policy that detects files shared with external users.

Answer

An app discovery policy that identifies new cloud apps used in the organization.