SC-200 Practice Exam 61 — 20 Questions

Question 1

You are investigating a potential malicious PowerShell execution in Microsoft Defender for Endpoint using this KQL query in Advanced Hunting. The query returns no results. What is the most likely cause?

Accepted Answer

The table name should be 'DeviceProcessEvents' instead of 'DeviceEvents'.. Option C is correct because DeviceEvents table is not part of Defender for Endpoint schema; the correct table is DeviceProcessEvents. Option A is wrong because 'take 100' does not affect the query logic. Option B is wrong because the column names are correct. Option D is wrong because the time range is valid.

Answer

The column names are incorrect; 'InitiatingProcessFileName' should be 'ParentProcessFileName'.

Answer

The 'take 100' operator limits results to only 100, but the query may return results if more data exists.

Answer

The query uses 'ago(7d)' which may be too short for historical data.

Question 2

You are hunting for signs of credential theft in Microsoft Defender XDR. Which advanced hunting table is most appropriate to investigate suspicious logon events?

Accepted Answer

IdentityLogonEvents. Option B is correct because IdentityLogonEvents contains authentication logs. Option A is for email. Option C is for process events. Option D is for network events.

Answer

DeviceNetworkEvents

Answer

DeviceProcessEvents

Answer

EmailEvents

Question 3

During an incident, an analyst finds that a user's account was compromised and used to send spam. The analyst needs to revoke all active sessions for that user. What should the analyst do?

Accepted Answer

Revoke the user's sessions in Microsoft Entra ID.. Option C is correct because revoking sessions in Microsoft Entra ID invalidates all tokens. Option A is wrong because resetting password does not revoke existing sessions. Option B is wrong because disabling the user stops new sign-ins but may not revoke current sessions. Option D is wrong because Conditional Access policies do not revoke sessions.

Answer

Reset the user's password.

Answer

Create a Conditional Access policy to block the user.

Answer

Disable the user account in Microsoft Entra ID.

Question 4

Your organization uses Microsoft Defender for Endpoint. A user reports that their device is running slowly and exhibiting unusual network activity. You run a live response session and find a suspicious process running. Which action should you take first to contain the threat?

Accepted Answer

Isolate the device from the network.. Option A is correct because isolating the device immediately prevents the threat from spreading to other devices while you investigate further. Option B is wrong because terminating the process alone does not prevent re-execution. Option C is wrong because collecting a memory dump does not contain the threat. Option D is wrong because adding a firewall rule is too slow and may not block all lateral movement.

Answer

Collect a full memory dump for analysis.

Answer

Terminate the suspicious process.

Answer

Add a firewall rule to block outbound traffic from the device.

Question 5

Which THREE are valid investigation actions in Microsoft Sentinel? (Select THREE.)

Accepted Answer

View related entities such as IP addresses.. Option A is correct because investigation can show related alerts. Option B is correct because investigation can show entities like IPs. Option E is correct because investigation can show related incidents. Option C is wrong because running a playbook is a remediation action, not an investigation action. Option D is wrong because investigation does not modify analytics rules.

Answer

Run a playbook.

Answer

Modify an analytics rule.

Question 6

Your team uses Microsoft Sentinel to manage incidents. You want to automatically assign incidents with a severity of 'High' to the Tier 2 security team. Which feature should you configure?

Accepted Answer

Automation rule. Option B is correct because automation rules in Microsoft Sentinel can automatically assign incidents based on conditions like severity. Option A is wrong because analytics rules generate alerts, not assign incidents. Option C is wrong because playbooks are for response actions, not assignment. Option D is wrong because workbooks are for visualization.

Answer

Playbook

Answer

Analytics rule

Answer

Workbook

Question 7

Your security team is investigating a suspicious sign-in from an unfamiliar IP address. The user has Microsoft Entra ID P2 licenses and is assigned a Conditional Access policy that requires MFA for all cloud apps. During the incident response, you find that the sign-in succeeded despite the user not completing MFA. Which action should you take first to investigate the discrepancy?

Accepted Answer

Review the Microsoft Entra sign-in logs for the specific sign-in event. Option B is correct because the sign-in logs provide detailed authentication details, including whether MFA was satisfied or bypassed. Option A is wrong because the user risk policy triggers on detected risk, but the issue is about MFA enforcement. Option C is wrong because the audit logs show administrative actions, not authentication details. Option D is wrong because the sign-in logs show the policy applied, not the policy configuration itself.

Answer

Review the user risk detection in Microsoft Entra ID Protection

Answer

Check the Microsoft Entra audit logs for policy changes

Answer

Use the Conditional Access What If tool

Question 8

Which THREE of the following are valid incident types in Microsoft 365 Defender? (Choose three.)

Accepted Answer

Phishing. Options A, B, and D are correct because Microsoft 365 Defender incidents include categories like 'Malware', 'Phishing', and 'Data exfiltration'. Option C is wrong because 'Misconfiguration' is not an incident type; it is a finding. Option E is wrong because 'Insider risk' is managed in Microsoft Purview, not as a primary incident type in Defender.

Answer

Insider risk

Answer

Misconfiguration

Question 9

Your incident response team uses Microsoft Sentinel with automation rules and playbooks. During an incident, you need to automatically collect a memory dump from an affected Windows server and upload it to an Azure storage account for analysis. Which type of playbook should you use?

Accepted Answer

A playbook triggered by an automation rule when the incident is created.. Option A is correct because automation rules can trigger playbooks on incident creation or update. Option B is wrong because playbooks can be triggered by automation rules, not directly by analytics rules. Option C is wrong because playbooks can be triggered automatically. Option D is wrong because playbooks run in Azure, not on the server.

Answer

A playbook that installs a script on the server to collect the dump.

Answer

A playbook triggered directly from the analytics rule that generates the alert.

Answer

A playbook that must be run manually from the incident page.

Question 10

Your security team receives an alert from Microsoft Defender for Endpoint indicating a suspicious PowerShell command was executed on a device. The command attempted to download a payload from a known malicious IP. After confirming the alert is a true positive, what should be your first containment step?

Accepted Answer

Isolate the device from the network using Microsoft Defender for Endpoint. Option B is correct because immediately isolating the affected device from the network prevents lateral movement and further compromise. Option A is wrong because password reset does not address the existing compromise. Option C is wrong because disabling the user account may not stop the malicious process already running. Option D is wrong because searching for indicators is part of investigation, not immediate containment.

Answer

Search for similar commands across all devices using advanced hunting

Answer

Disable the user account in Microsoft Entra ID

Answer

Reset the user's password

Question 11

Which TWO are recommended first steps when responding to a confirmed ransomware incident in Microsoft Defender XDR?

Accepted Answer

Isolate affected devices using Microsoft Defender for Endpoint. The correct answers are A and D. Isolating affected devices and revoking user sessions are immediate containment steps. Disabling accounts is also important but can be done after revoking sessions. Running a full antivirus scan is not a first step; it may alert the attacker. Assessing impact is part of investigation, not first containment.

Answer

Assess the financial impact of the incident

Answer

Disable all user accounts

Answer

Run a full antivirus scan on all devices

Question 12

You are using the Microsoft Sentinel Threat Hunting experience to create a new hunting query. Which tab should you select to bookmark a suspicious event for further investigation?

Accepted Answer

Bookmarks. Option B is correct because the Bookmarks tab allows you to save and annotate events. Option A is for query results. Option C is for saved queries. Option D is for entity pages.

Answer

Results

Answer

Queries

Answer

Entities

Question 13

A security analyst receives a Microsoft Defender for Identity alert about a suspicious Kerberos attack. The analyst needs to contain the compromised account immediately. What should the analyst do?

Accepted Answer

Disable the user account in Microsoft Entra ID.. Option A is correct because disabling the account in Microsoft Entra ID stops authentication. Option B is wrong because resetting password without disabling may allow ongoing attacks. Option C is wrong because removing from groups does not prevent authentication. Option D is wrong because the user's own password reset may not be effective.

Answer

Remove the user from all privileged groups.

Answer

Require the user to change their password at next sign-in.

Answer

Reset the user's password and notify the user.

Question 14

Your organization uses Microsoft Defender for Cloud to protect Azure resources. A security alert indicates that a virtual machine (VM) is communicating with a known malicious IP. The analyst needs to isolate the VM from the network to prevent further data exfiltration. What should the analyst do?

Accepted Answer

Apply a Just-in-time VM access policy in Microsoft Defender for Cloud to deny all inbound and outbound traffic.. Option B is correct because Defender for Cloud's Just-in-time VM access can create a network security group (NSG) rule to deny all traffic, effectively isolating the VM. Option A is wrong because Azure Bastion provides RDP/SSH access, not isolation. Option C is wrong because Azure Firewall rules apply to the entire network, not a single VM. Option D is wrong because Azure Monitor does not isolate VMs.

Answer

Use Azure Bastion to connect to the VM and shut it down.

Answer

Use Azure Monitor to create an alert and then manually stop the VM.

Answer

Create an Azure Firewall rule to block traffic to the malicious IP.

Question 15

Which TWO actions should an analyst take when a user reports receiving a suspicious email with an attachment? (Select TWO.)

Accepted Answer

Submit the email to Microsoft for analysis using the Submissions page in Microsoft 365 Defender.. Option A is correct because submitting the email to Microsoft for analysis helps improve detection. Option D is correct because deleting the email from the mailbox removes it from the user's environment. Option B is wrong because opening the attachment would be unsafe. Option C is wrong because blocking the sender in Outlook only affects that user. Option E is wrong because running a script is not recommended.

Answer

Run a PowerShell script to automatically forward the email to IT.

Answer

Open the attachment to verify if it is malicious.

Answer

Block the sender in the user's Outlook settings.

Question 16

You are investigating an incident in Microsoft Sentinel where a user account was used to sign in from an unfamiliar location and then accessed multiple sensitive files. Which step is most important to perform first?

Accepted Answer

Disable the user account and reset the password.. Option A is correct because confirming account compromise is the highest priority to stop further malicious activity. Option B is wrong because checking firewall logs is less immediate. Option C is wrong because blocking IP addresses may not be effective if the attacker uses proxies. Option D is wrong because reviewing permissions is a secondary step.

Answer

Block the IP address of the unfamiliar location.

Answer

Check firewall logs for related network traffic.

Answer

Review file permissions on the accessed files.

Question 17

During a security incident, you need to create a custom detection rule in Microsoft Sentinel to alert on multiple failed logins followed by a successful login from the same IP within 10 minutes. Which KQL function should you use to group events by IP address and time window?

Accepted Answer

summarize. Option C is correct because `summarize` with `make_list` or `count` is used to aggregate events within a time window. Option A is wrong because `project` selects columns, not aggregates. Option B is wrong because `extend` adds computed columns but does not group. Option D is wrong because `join` combines tables but does not aggregate within a window.

Answer

join

Answer

extend

Answer

project

Question 18

You receive a Microsoft Defender for Identity alert for a suspicious Kerberos ticket request. What is the most likely intent of this attack?

Accepted Answer

Credential theft to gain persistent access.. Option D is correct because a suspicious Kerberos ticket request often indicates a Golden Ticket attack or similar credential theft. Option A is wrong because it targets authentication mechanisms, not data exfiltration directly. Option B is wrong because it is not directly related to service account compromise. Option C is wrong because it is more about persistence than denial of service.

Answer

Lateral movement using compromised service accounts.

Answer

Denial of service on domain controllers.

Answer

Data exfiltration from SharePoint.

Question 19

Which TWO are valid methods to submit a file for analysis in Microsoft Defender for Endpoint? (Select TWO.)

Accepted Answer

Submit a file using the Microsoft 365 Defender API.. Option A is correct because you can submit via the security portal. Option E is correct because the Microsoft 365 Defender API allows submissions. Option B is wrong because live response is for collecting files, not submitting for analysis. Option C is wrong because Microsoft Sentinel is not a submission interface. Option D is wrong because Intune manages devices, not file submissions.

Answer

Submit a file via live response.

Answer

Submit a file through Microsoft Sentinel.

Answer

Submit a file via Microsoft Intune.

Question 20

Refer to the exhibit. You are creating an automation rule in Microsoft Sentinel to trigger a playbook when an alert is created. However, the playbook does not run. What is the most likely cause?

Accepted Answer

The playbook's resource ID is incorrect.. Option A is correct because the `logicAppResourceId` might be incorrect or the playbook might not be accessible. Option B is wrong because the rule name is irrelevant. Option C is wrong because there is no permission issue indicated. Option D is wrong because the JSON is valid.

Answer

The JSON syntax is invalid.

Answer

The automation rule lacks permissions to the playbook.

Answer

The displayName is not unique.

SC-200 Practice Exam 61 — 20 Questions

Exhibit

SC-200 Practice Exam 61 — 20 Questions

Exhibit