SC-200 Practice Exam 62 — 20 Questions

Question 1

You are responding to an incident where a user's device may be compromised. You need to collect forensic data from the device using Microsoft Defender for Endpoint. Which action should you take?

Accepted Answer

Collect investigation package. The 'Collect investigation package' action in Microsoft Defender for Endpoint is specifically designed to gather forensic data—such as registry hives, event logs, memory dumps, and disk images—from a device for offline analysis. This is the correct choice because the question explicitly asks to collect forensic data, and this action packages all relevant artifacts into a single .zip file for detailed examination.

Answer

Isolate device

Answer

Initiate Live Response

Answer

Run antivirus scan

Question 2

You are investigating a ransomware incident in Microsoft Sentinel. The incident contains multiple alerts from Microsoft Defender for Endpoint, Microsoft Defender for Office 365, and Microsoft Defender for Identity. You need to correlate the alerts and identify the initial entry point. Which KQL function should you use to combine the alerts?

Accepted Answer

make_set(). D is correct because `make_set()` is used with `summarize` to create a distinct list of values from a column across multiple rows, which is essential for correlating alerts from different data sources (e.g., DeviceEvents, EmailEvents, IdentityLogonEvents) by a common identifier like `DeviceName` or `AccountUpn`. This allows you to group alerts from Defender for Endpoint, Office 365, and Identity into a single row per entity, making it easier to trace the initial entry point by analyzing the timeline of distinct alert types.

Answer

materialize()

Answer

union

Answer

mv-expand

Question 3

Which THREE steps are part of the containment phase of incident response in Microsoft Sentinel? (Select THREE.)

Accepted Answer

Disable compromised user accounts in Microsoft Entra ID.. Disabling compromised user accounts in Microsoft Entra ID is a containment step because it immediately revokes the account's access tokens and prevents further authentication, stopping an attacker from using that identity to move laterally or access resources. This aligns with the containment phase's goal of limiting the blast radius of an incident.

Answer

Collect forensic data from affected endpoints.

Answer

Restore encrypted files from backup.

Question 4

A security analyst is investigating a suspicious email that was reported by a user. The email contains an attachment with a known malicious macro. The analyst wants to find all instances of this same email being delivered to other users in the organization. Which Advanced Hunting table should the analyst query to find the delivery events?

Accepted Answer

EmailEvents. The EmailEvents table in Microsoft Defender XDR Advanced Hunting contains records of email delivery events, including sender, recipient, subject, and delivery status. Since the analyst needs to find all instances where the same email (with the malicious macro attachment) was delivered to other users, querying EmailEvents with the email's unique identifier (e.g., NetworkMessageId) will return all delivery events across the organization.

Answer

EmailAttachmentInfo

Answer

EmailUrlInfo

Answer

DeviceFileEvents

Question 5

Your organization uses Microsoft Sentinel with a Log Analytics workspace in the East US region. You have deployed the Microsoft Defender for Cloud connector. You notice that security alerts from Defender for Cloud are not appearing as incidents in Sentinel. You have confirmed that the connector is enabled and data is flowing. What is the most likely cause?

Accepted Answer

You need to create an analytics rule with a rule template that uses the SecurityAlert table.. The Microsoft Defender for Cloud connector ingests security alerts into the Log Analytics workspace's SecurityAlert table, but incidents in Microsoft Sentinel are generated only by analytics rules. Without a configured analytics rule that queries the SecurityAlert table (such as the built-in 'Create incidents based on Microsoft Defender for Cloud alerts' template), no incidents will be created even if data is flowing. Option C correctly identifies this missing step.

Answer

The Sentinel workspace does not have required permissions to create incidents.

Answer

There is a delay in incident creation; wait for 24 hours.

Answer

The Microsoft Defender for Cloud connector is not properly configured.

Question 6

Which THREE steps should be included in a Microsoft Sentinel playbook for automatic incident response when a high-severity alert fires?

Accepted Answer

Investigate the alert by enriching with threat intelligence. Microsoft Sentinel playbooks, built on Azure Logic Apps, can automatically enrich alerts with threat intelligence from sources like the Threat Intelligence API or integrated TI platforms (e.g., VirusTotal, AlienVault OTX). This enrichment provides context (e.g., known malicious IPs, hashes, or domains) directly within the incident, enabling faster triage and informed response decisions without manual investigation.

Answer

Pause the incident for 24 hours before taking action

Answer

Create a new Azure resource for logging

Question 7

A security analyst in Microsoft Sentinel is creating a scheduled analytics rule to detect multiple failed logon attempts from the same source IP address. The rule should generate an incident only when the count of failed logons exceeds 10 within a 5-minute window. Which configuration setting is essential to limit the incident generation to this threshold?

Accepted Answer

Alert threshold set to a value of 10. The alert threshold setting in a Microsoft Sentinel scheduled analytics rule directly controls the minimum number of query results required to generate an incident. By setting the threshold to 10, the rule will only fire when the query returns more than 10 failed logon events within the 5-minute window, matching the requirement exactly.

Answer

Event grouping set to 'Group all events into a single alert'

Answer

Query scheduling set to run every 5 minutes

Answer

Entity mapping for source IP address

Question 8

Your organization uses Microsoft Purview Data Loss Prevention (DLP) and Microsoft Defender for Cloud Apps. During an incident, you discover that a user is exfiltrating sensitive data via a sanctioned cloud app. You need to block the user's ability to share files in that app immediately. What should you do?

Accepted Answer

Create a session policy in Microsoft Defender for Cloud Apps to block the user's file sharing activity.. To immediately block a user's file-sharing activity in a sanctioned cloud app, create a session policy in Microsoft Defender for Cloud Apps. Session policies use Conditional Access App Control to proxy the session and apply real-time controls such as block download, block upload, or block sharing for specific users or groups. This is the fastest, most targeted control for the described scenario.

Answer

Disable the app connector for that cloud app in Microsoft Defender for Cloud Apps.

Answer

Remove the user from the Microsoft Entra ID group that allows access to the cloud app.

Answer

Create a Microsoft Purview DLP policy to block sharing of sensitive content.

Question 9

During an incident, an analyst finds that a user's account was compromised and used to send spam. The analyst needs to revoke all active sessions for that user. What should the analyst do?

Accepted Answer

Revoke the user's sessions in Microsoft Entra ID.. Revoking sessions in Microsoft Entra ID immediately invalidates all refresh tokens and active sign-in sessions for the compromised user, cutting off the attacker's access without disrupting the account's ability to be re-secured. This is the targeted response for session hijacking because it terminates existing tokens rather than just changing credentials. Password reset alone does not invalidate already-issued tokens, so the attacker could remain authenticated.

Answer

Reset the user's password.

Answer

Create a Conditional Access policy to block the user.

Answer

Disable the user account in Microsoft Entra ID.

Question 10

While threat hunting in Microsoft Defender for Cloud Apps, you notice a user has an unusually high number of failed login attempts from a single IP address. What is the most effective next step to determine if this is a brute-force attack?

Accepted Answer

Investigate the IP address in the Microsoft Defender for Cloud Apps Activity log to review all failed attempts. The most direct method is to investigate the IP address in the Microsoft Defender for Cloud Apps Activity log by filtering for that IP and reviewing the failed attempts. Option A (Immediately block the IP) is premature without confirming the pattern. Option C (Creating an anomaly detection policy) is for future detection, not for immediate analysis. Option D (Checking the user's device for malware) is not relevant for cloud app access failures.

Answer

Immediately block the IP address

Answer

Create a new anomaly detection policy for that user

Answer

Check the user's device for malware

Question 11

Which THREE elements are essential when creating a custom incident response playbook in Microsoft Sentinel? (Choose THREE.)

Accepted Answer

Appropriate permissions via managed identity or service principal for the playbook to execute actions.. A custom incident response playbook in Microsoft Sentinel requires appropriate permissions to execute actions against Azure resources. This is achieved by assigning a managed identity or configuring a service principal for the Logic App, which authenticates and authorizes the playbook to run actions such as blocking IPs, isolating machines, or querying threat intelligence. Without these permissions, the playbook would fail at runtime due to authentication errors, making it non-functional.

Answer

A mandatory approval step before any action is taken.

Answer

An analytics rule that generates the incident.

Question 12

Which TWO actions should you take to optimize cost in Microsoft Sentinel while maintaining security coverage? (Choose two.)

Accepted Answer

Adjust the interactive retention period for tables that don't need long-term interactive access.. Reducing interactive retention for tables that do not require long-term, fast query access directly lowers storage costs. Microsoft Sentinel charges per GB for data stored in the interactive retention tier, while data moved to long-term retention (up to 12 years) is significantly cheaper. By tailoring retention periods to actual operational needs, you avoid paying premium rates for data that is rarely queried interactively.

Answer

Enable continuous export for all tables.

Answer

Purchase a Pay-as-you-go commitment tier.

Answer

Add more tables to ingest data.

Question 13

Refer to the exhibit. You are investigating a user account that shows multiple logons to the Azure Portal from various countries within a short time. The query returns no results despite known logons. What is the most likely issue?

Accepted Answer

IdentityLogonEvents does not contain Azure Portal logon events; use AADSignInEventsBeta instead.. IdentityLogonEvents in Microsoft Defender for Identity (MDI) captures on-premises Active Directory authentication events, not Microsoft Entra ID (Entra ID) sign-in events. Azure Portal logons are Microsoft Entra ID sign-in events, which are stored in the AADSignInEventsBeta table in Microsoft 365 Defender advanced hunting. Therefore, querying IdentityLogonEvents for Azure Portal logons returns no results, and the correct table is AADSignInEventsBeta.

Answer

The Timestamp filter should be Timestamp > ago(7d) but instead it's written incorrectly.

Answer

The AccountUpn field is not present in IdentityLogonEvents.

Answer

The Application filter should be 'Azure Portal' in a different case.

Question 14

Your organization uses Microsoft Sentinel. An incident is created from an Azure Active Directory (now Microsoft Entra ID) sign-in alert. You need to determine if the sign-in was from a compromised token. What data source should you examine?

Accepted Answer

Sign-in logs in Microsoft Entra ID. Sign-in logs in Microsoft Entra ID contain detailed token information such as token issuer, session ID, and device details, which are essential for determining if a token was compromised. Option A is incorrect because audit logs track changes to directory objects, not sign-in details. Option B is incorrect because Azure Activity Log monitors Azure resource operations, not sign-in events. Option D is incorrect because Microsoft Defender for Cloud Apps logs focus on cloud application sessions and anomalies, but do not provide the granular sign-in token details found in sign-in logs.

Answer

Audit logs in Microsoft Entra ID

Answer

Azure Activity Log

Answer

Microsoft Defender for Cloud Apps logs

Question 15

Your Microsoft 365 tenant is protected by Microsoft Defender for Office 365. A user reports receiving a suspicious email with a link. You need to investigate whether the link was malicious and if any other users clicked it. Which tool should you use first?

Accepted Answer

Threat Explorer. Threat Explorer (Option D) is the correct first tool because it provides a centralized view of email threats, including malicious links and clicks. You can filter by URL or sender to identify if the specific link was detected as malicious and then use the 'Click to allow/block' feature or the 'URL clicks' view to see which users clicked it. This aligns with the incident response workflow for investigating phishing campaigns in Defender for Office 365.

Answer

Microsoft Entra ID sign-in logs

Answer

Microsoft Purview compliance portal

Answer

Email Entity page in Microsoft Defender XDR

Answer

Attack Simulation Training

Question 16

You are responding to a phishing incident. The investigation reveals that a user clicked a link in a phishing email and entered credentials on a fake site. You need to contain the incident and prevent further compromise. What should you do first?

Accepted Answer

Reset the user's password and revoke sessions.. The immediate priority when credentials have been compromised is to invalidate them, preventing the attacker from using them for further access. Resetting the password and revoking sessions (e.g., via Microsoft Entra ID 'Revoke-AzureADUserAllRefreshToken' or 'Revoke-MgUserSignInSession') ensures the attacker cannot authenticate again, even if they have the password hash or active tokens. This aligns with the NIST SP 800-61 incident response containment phase.

Answer

Report the phishing site to Microsoft.

Answer

Block the phishing URL in Microsoft Defender for Office 365.

Answer

Delete the phishing email from the user's mailbox.

Question 17

Your organization uses Microsoft Sentinel and has configured analytics rules for detecting ransomware. You receive an alert indicating possible ransomware activity on a server. Which THREE actions should you take to contain and investigate the incident? (Choose three.)

Accepted Answer

Initiate a live response session to collect forensic artifacts.. Option B is correct because initiating a live response session in Microsoft Defender for Endpoint lets you run forensic commands (e.g., getfile, analyze, run) on the affected server to collect volatile artifacts such as memory, running processes, and network connections for investigation. Option C is correct because Microsoft Sentinel incidents are integrated with Microsoft 365 Defender, so reviewing the incident timeline provides correlated alerts, entities, and investigation data across endpoints, identities, and email to understand the attack scope. Option E is correct because isolating the server via Microsoft Defender for Endpoint network isolation blocks inbound/outbound traffic (except for Defender communication) to stop ransomware propagation while preserving the ability to investigate. Option A is not appropriate during containment/investigation because creating a new analytics rule is a detection-engineering task, not an incident response action. Option D is not appropriate because resetting the password of the anomalous account is a remediation step that may destroy evidence and does not contain the server-based ransomware activity.

Answer

Create a new analytics rule to detect similar behavior.

Answer

Reset the password of the account that showed anomalous behavior.

Question 18

Refer to the exhibit. A custom detection rule in Microsoft Sentinel uses this JSON definition. An analyst notices that the rule is generating alerts for legitimate administrative scripts launched from File Explorer. What is the best way to reduce false positives while retaining detection of malicious Office-based PowerShell launches?

Accepted Answer

Add an additional filter to exclude PowerShell executions from specific administrative user accounts. Adding conditions to exclude known administrative scenarios (e.g., specific user accounts) reduces false positives without removing the parent process filter entirely. Option B is wrong because removing the parent process filter would broaden detection, likely increasing false positives. Option C is wrong because lowering severity does not reduce false positives. Option D is wrong because increasing time range does not help.

Answer

Increase the query time range to 30 days

Answer

Change the severity to Informational to suppress alerts

Answer

Remove the parent process filter and rely only on FileName == 'powershell.exe'

Question 19

You are hunting for signs of credential theft in Microsoft Defender XDR. Which advanced hunting table is most appropriate to investigate suspicious logon events?

Accepted Answer

IdentityLogonEvents. IdentityLogonEvents contains authentication logs, which are most relevant for investigating suspicious logon events and credential theft. Option A (DeviceNetworkEvents) is for network connections. Option B (DeviceProcessEvents) is for process events. Option C (EmailEvents) is for email records.

Answer

DeviceNetworkEvents

Answer

DeviceProcessEvents

Answer

EmailEvents

Question 20

You are testing this analytics rule. It should detect encoded PowerShell commands not from System32, but it is generating false positives. What is the most likely cause?

Accepted Answer

The rule does not exclude other legitimate paths like SysWOW64. The rule is designed to detect encoded PowerShell commands not originating from System32, but it is generating false positives. The most likely cause is that the rule does not exclude other legitimate paths such as SysWOW64, which also contains legitimate PowerShell executables on 64-bit Windows. Adding an exclusion for SysWOW64 (and possibly other trusted paths) would reduce false positives while maintaining detection of suspicious executions.

Answer

The severity should be Informational

Answer

The rule should also include System32

Answer

The query syntax is incorrect