SC-200 Practice Exam 61 — 20 Questions

Question 1

Your organization uses Microsoft Defender for Cloud to protect hybrid cloud workloads. An alert indicates that a container in Azure Kubernetes Service (AKS) is running a privileged container. Which response action should you take first?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Investigate the alert details in Microsoft Defender for Cloud. When a Microsoft Defender for Cloud alert indicates a privileged container in AKS, the first response action should be to investigate the alert details within Defender for Cloud. This allows you to assess the scope, impact, and context of the alert—such as which container, namespace, and pod is involved, and whether it is a false positive—before taking any disruptive remediation steps. Prematurely disabling, deleting, or restarting resources could destroy forensic evidence and escalate the incident unnecessarily.

Answer

Disable the container immediately

Answer

Restart the AKS cluster

Answer

Delete the container and its image

Question 2

Refer to the exhibit. A security analyst runs this KQL query in Microsoft Sentinel during an investigation. The analyst expects to see alerts related to malware from IP 10.0.0.5 but receives no results. The SecurityAlert table contains data from the last 24 hours. What is the most likely reason for no results?

Accepted Answer

The ExtendedProperties column does not contain a key named 'IPAddress' for these alerts.. The most likely reason for no results is that the ExtendedProperties column does not contain a key named 'IPAddress' for these alerts. In Microsoft Sentinel, the SecurityAlert table stores additional alert details in the ExtendedProperties column as a dynamic (JSON) field, and the specific key name varies by alert provider — if the key is not 'IPAddress', the query filter returns nothing.

Answer

The 'contains' operator is case-sensitive.

Answer

The time filter 'ago(1d)' is too restrictive; should use 'ago(7d)'.

Answer

The 'project' statement drops the necessary columns.

Question 3

Your organization is implementing Microsoft Sentinel. You need to ensure that security events from AWS CloudTrail are collected. What should you configure?

Accepted Answer

AWS S3 connector in Sentinel.. The AWS S3 connector in Microsoft Sentinel is the correct solution because AWS CloudTrail logs are stored in an S3 bucket. Sentinel's native AWS S3 connector ingests these logs by polling the S3 bucket for new CloudTrail events, parsing them into the Sentinel workspace for security monitoring. This is the designated method for collecting CloudTrail data into Sentinel, as documented by Microsoft.

Answer

Azure Policy to audit AWS resources.

Answer

Microsoft Defender for Cloud to monitor AWS.

Answer

A REST API connector to call CloudTrail API.

Question 4

A company uses Microsoft Defender for Cloud with Defender for Servers enabled. The security team wants to receive an alert when a new user is added to the local Administrators group on a Windows virtual machine. Which data source must be enabled in Defender for Cloud to capture this event?

Accepted Answer

Enable the collection of Windows Security Event Log events (e.g., Event ID 4732) through the Log Analytics agent configuration.. The event of adding a user to the local Administrators group on Windows is logged as Security Event ID 4732. To capture this event in Defender for Cloud, the Log Analytics agent must be configured to collect Windows Security Event Log events, which includes Event ID 4732. This data source enables Defender for Cloud to generate security alerts based on such privileged group modifications.

Answer

Enable Just-in-Time (JIT) VM access on the virtual machine.

Answer

Enable Adaptive Application Controls (AAC) for the virtual machine.

Answer

Enable Azure Defender for SQL on the subscription.

Question 5

A security operations center (SOC) uses Microsoft Sentinel. The team wants to detect anomalous behavior for a specific user account that typically logs in only during business hours from a known IP range. They create a scheduled analytics rule that queries the SigninLogs table for logins outside that range or outside business hours. To reduce false positives, which of the following configurations should the analyst apply?

Accepted Answer

Set the alert threshold to 5 occurrences within the query lookback period.. Setting an alert threshold (e.g., 5 occurrences within the query lookback period) reduces false positives by requiring the anomalous behavior to be persistent rather than a single outlier. In Microsoft Sentinel, the alert threshold filters out noise from occasional legitimate logins that might accidentally fall outside business hours or the known IP range, ensuring the rule only fires when the pattern is repeated enough to indicate a real threat.

Answer

Enable entity mapping for the user account to correlate with other data sources.

Answer

Increase the query scheduling frequency to every 5 minutes from every hour.

Answer

Group all events into a single alert and set the suppression limit to 1 hour.

Question 6

A security incident in Microsoft Sentinel has been classified as a true positive and remediated. According to your SOC playbook, the incident should be closed with a classification of 'True Positive' and a sub-classification of 'Confirmed activity'. What is the correct way to close the incident in Microsoft Sentinel?

Accepted Answer

In the Microsoft Sentinel incident, set Status to 'Closed', Classification to 'True Positive', and Sub-classification to 'Confirmed activity'.. Using the Microsoft Security Graph API to close the incident is unnecessary and out of scope here: the scenario calls for a single incident to be manually closed per the SOC playbook's exact classification and sub-classification values, which is done directly in the Microsoft Sentinel incident pane. The Graph API is useful for bulk/programmatic incident updates, but that is not what this scenario requires, so it is not the correct choice here.

Answer

Close the incident in Microsoft Defender XDR and let it sync to Microsoft Sentinel.

Answer

Change the incident status to 'Closed' without adding a classification.

Answer

Use the Microsoft Security Graph API to close the incident with the appropriate classification.

Question 7

You need to ensure that Microsoft Sentinel can access threat intelligence feeds from external sources like AlienVault OTX. Which data connector should you use?

Accepted Answer

Threat Intelligence - TAXII data connector. The Threat Intelligence - TAXII data connector is the correct choice because it enables Microsoft Sentinel to ingest threat intelligence feeds from external sources that support the TAXII (Trusted Automated eXchange of Indicator Information) protocol, such as AlienVault OTX. This connector uses the STIX (Structured Threat Information Expression) standard to pull indicators of compromise (IOCs) like IP addresses, domains, and hashes directly into Sentinel for correlation and alerting.

Answer

Microsoft 365 Defender data connector

Answer

Microsoft Entra ID data connector

Answer

Amazon Web Services data connector

Question 8

You are a security analyst for a multinational company with Microsoft Sentinel deployed in a central workspace. You need to grant a team of analysts in the European branch the ability to view incidents and run queries, but they should not be able to modify analytics rules or data connectors. The team already has Microsoft Sentinel Reader role assigned. However, they report that they cannot run KQL queries in the Logs blade. You need to provide the minimum additional permissions. What should you do?

Accepted Answer

Assign the Log Analytics Reader role to the team on the Sentinel workspace.. The Microsoft Sentinel Reader role grants read access to Sentinel data, including incidents, but does not include the ability to run KQL queries in the Logs blade because that requires read permissions on the underlying Log Analytics workspace. The Log Analytics Reader role provides the necessary read access to log data and the ability to execute queries without granting write permissions to analytics rules or data connectors, fulfilling the requirement with minimal privileges.

Answer

Assign the Log Analytics Contributor role to the team on the Sentinel workspace.

Answer

Assign the Microsoft Sentinel Contributor role to the team on the Sentinel workspace.

Answer

Assign the Reader role to the team on the Sentinel workspace.

Question 9

You are managing a Microsoft Sentinel environment. An analyst reports that a scheduled analytics rule is not generating alerts. The rule has been enabled for a week. What is the most likely cause?

Accepted Answer

The rule's query does not match any events in the workspace.. The most likely cause is that the rule's query does not match any events in the workspace. Since the rule has been enabled for a week, if the query logic is correct and data exists, alerts should have been generated. The absence of alerts strongly indicates that the query returns zero results, which is a common issue when the KQL query references tables, columns, or conditions that do not exist in the ingested data.

Answer

The rule is disabled due to a cost threshold.

Answer

The rule has a short lookback period that misses data.

Answer

The rule is configured as a real-time rule instead of scheduled.

Question 10

You need to grant a junior analyst the ability to view and investigate incidents in Microsoft Sentinel, but not make any changes. Which built-in role should you assign?

Accepted Answer

Microsoft Sentinel Reader. The Microsoft Sentinel Reader role provides read-only access to Sentinel resources, including incidents, workbooks, and analytics rules, without allowing any modifications. This aligns with the requirement to view and investigate incidents without making changes, as the role explicitly denies write, delete, or action permissions on Sentinel data.

Answer

Microsoft Sentinel Responder

Answer

Microsoft Sentinel Contributor

Answer

Microsoft Sentinel Automation Contributor

Question 11

An organization manages multiple Azure subscriptions under a single management group. They want to automatically enable Microsoft Defender for Cloud's enhanced security plans (e.g., Defender for Servers) on any new subscription added to the management group. Which configuration method should they use?

Accepted Answer

Create an Azure Policy that assigns the Defender for Cloud pricing tier at the management group level. Azure Policy can be assigned at the management group scope to enforce the 'Configure Microsoft Defender for Cloud plans to be enabled' policy, which automatically sets the pricing tier (e.g., Standard) for Defender for Servers on any new subscription added to that management group. This ensures compliance without manual intervention, as the policy evaluates and remediates new subscriptions upon creation or addition.

Answer

Enable auto-provisioning in Defender for Cloud's settings

Answer

Use Azure Blueprints to define the subscription configurations

Answer

Manually enable plans per subscription as they are added

Question 12

You are investigating a phishing incident in Microsoft Defender XDR. The incident involves a user who clicked a malicious link in an email. Which data source would you use to trace the email's origin?

Accepted Answer

Microsoft Defender for Office 365. Microsoft Defender for Office 365 (MDO) is the correct data source because it provides email-specific telemetry, including SMTP headers, sender IP addresses, and authentication results (SPF, DKIM, DMARC). This data is essential for tracing the origin of a phishing email that a user clicked. MDO's Threat Explorer and Email Entity page allow you to reconstruct the email's path from the sending server to the recipient's inbox.

Answer

Microsoft Defender for Endpoint

Answer

Microsoft Defender for Cloud Apps

Answer

Microsoft Defender for Identity

Question 13

Which THREE are valid investigation actions in Microsoft Sentinel? (Select THREE.)

Accepted Answer

View related entities such as IP addresses.. Viewing related entities such as IP addresses is a fundamental investigation action in Microsoft Sentinel. Option C is correct because viewing related incidents helps in correlating events. Option E is correct because viewing related alerts provides context. Option B is incorrect because running a playbook is a remediation action, not an investigation action. Option D is incorrect because modifying an analytics rule is a configuration task outside the investigation scope.

Answer

Run a playbook.

Answer

Modify an analytics rule.

Question 14

Which THREE Microsoft Sentinel features are specifically designed to assist with threat hunting?

Accepted Answer

Livestream for real-time hunting.. Option A, Livestream for real-time hunting, is correct because Microsoft Sentinel's Livestream feature lets analysts run a hunting query continuously and view results as they occur, which is specifically built for interactive, real-time threat hunting rather than post-incident reporting. Option C, Bookmarks to record interesting results, is correct because bookmarks preserve notable entities, events, or query results from hunting activities so they can be retained, tagged, and later promoted into incidents or used in investigations. Option E, The Hunting blade with built-in and custom queries, is correct because the Hunting blade in Microsoft Sentinel provides prebuilt KQL hunting queries mapped to MITRE ATT&CK techniques plus the ability to create and run custom queries, making it the core hunting workspace. Option B, Workbooks for interactive dashboards, is not marked correct because workbooks are primarily used for visualization, monitoring, and reporting on data rather than being a dedicated hunting tool. Option D, Automation rules to respond to incidents, is not marked correct because automation rules orchestrate incident handling, triage, and response actions, which is an SOAR capability rather than a threat-hunting feature.

Answer

Workbooks for interactive dashboards.

Answer

Automation rules to respond to incidents.

Question 15

A SOC analyst is investigating a phishing campaign that targets Microsoft 365 users. The analyst needs to collect email message headers from multiple users' mailboxes. Which Microsoft 365 Defender action should the analyst use?

Accepted Answer

Use Microsoft 365 Defender > Email & collaboration > Explorer to query email headers.. Microsoft 365 Defender's Email & collaboration > Explorer (also known as Threat Explorer) is the dedicated tool for querying email message headers across multiple user mailboxes. It allows analysts to search for specific email messages by sender, recipient, subject, or other attributes, and then view the full internet message headers (RFC 5322) for forensic analysis. This is the standard workflow for investigating phishing campaigns in Microsoft 365 Defender.

Answer

Use Microsoft 365 Defender > Actions & submissions to view email headers.

Answer

Use Microsoft 365 Defender > Threat hunters to search for email headers.

Answer

Use Microsoft 365 Defender > Attack simulation training to collect headers.

Question 16

A global organization has Azure subscriptions organized under a single management group. The security team wants to ensure that the Azure Security Benchmark initiative is assigned once to cover all current and future subscriptions within that management group, without needing to assign it individually. They also want to see compliance results aggregated at the management group level. In Microsoft Defender for Cloud, what is the correct approach to achieve this?

Accepted Answer

Assign the Azure Security Benchmark initiative directly to the management group via Azure Policy, and use the Defender for Cloud's Regulatory Compliance dashboard.. Assigning the Azure Security Benchmark initiative directly to the management group via Azure Policy ensures that the policy initiative is inherited by all current and future subscriptions under that management group. Defender for Cloud's Regulatory Compliance dashboard then aggregates compliance results at the management group level, providing a single view of compliance across the entire hierarchy without requiring individual assignments.

Answer

Enable Defender for Cloud's enhanced security features on each subscription, and the benchmark will be automatically applied.

Answer

Create a custom assessment in Defender for Cloud that queries the management group scope.

Answer

Assign the initiative to the root management group using Azure Policy, then configure Defender for Cloud to ignore individual subscription assignments.

Question 17

A security analyst is investigating a Microsoft Defender for Cloud Apps alert about a suspicious OAuth app that has high permissions. The analyst needs to disable the app immediately. What is the correct action?

Accepted Answer

From the Microsoft Defender for Cloud Apps alert, select 'Disable app'.. Microsoft Defender for Cloud Apps provides a built-in 'Disable app' action directly from the alert, which immediately revokes the OAuth app's permissions and prevents further access without deleting the app registration. This is the fastest way to mitigate the threat while preserving the app for potential forensic analysis.

Answer

Revoke all tokens for the app in Microsoft Entra ID.

Answer

Generate a new client secret for the app.

Answer

Go to Microsoft Entra ID admin center and delete the app registration.

Question 18

You are responsible for Microsoft Sentinel pricing. You notice that data ingestion costs are high due to verbose logs from Windows security events. You need to reduce costs while still collecting critical security events. What should you do?

Accepted Answer

Configure Windows Security Events via AMA connector with event filtering. The Azure Monitor Agent (AMA) connector for Windows Security Events allows granular filtering of event IDs and levels, enabling you to collect only critical security events (e.g., 4624, 4625) while excluding verbose logs like Event ID 5156 (Windows Filtering Platform permit connections). This reduces ingestion volume and cost without losing essential security visibility.

Answer

Use Common Event Format (CEF) connector instead of Windows Events

Answer

Change the table plan to Basic Logs

Answer

Increase the workspace retention period to archive warm data

Question 19

Your organization uses Microsoft Defender for Cloud to protect hybrid cloud workloads. An alert indicates that a container in Azure Kubernetes Service (AKS) is running a privileged container. Which response action should you take first?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Create a scheduled query rule in Microsoft Sentinel. The detection requires correlating events across Microsoft Entra ID (privileged role assignment) and SharePoint (mass download) within a 5-minute window. Microsoft Sentinel's scheduled query rules can ingest data from multiple sources (e.g., AuditLogs for Entra ID and SharePoint via Office 365 connector) and use KQL to join these events with a time constraint, making it the only native solution for cross-domain, time-bound custom detections.

Answer

Create an advanced hunting query in Microsoft Defender XDR

Answer

Use a custom detection rule in Microsoft 365 Defender

Answer

Use a Microsoft Purview insider risk policy

Question 20

Refer to the exhibit. You are reviewing an alert in Microsoft Defender for Endpoint. The alert details are shown. Which of the following actions should you take first?

Accepted Answer

Investigate the device and the alert details. The first step in incident response is to investigate the alert details and the affected device to understand the scope and severity of the threat. Without investigation, you cannot determine whether the alert is a true positive, whether isolation is appropriate, or which remediation steps are needed. Microsoft Defender for Endpoint provides a rich investigation experience, including the alert story, device timeline, and related events, which must be reviewed before taking any containment or remediation actions.

Answer

Mark the alert as a false positive

Answer

Initiate device isolation to contain the threat

Answer

Run a full antivirus scan on the device