SC-200 Practice Exam 63 — 20 Questions

Question 1

Your organization uses Microsoft Sentinel and Microsoft Defender XDR. You need to ensure that incidents created in Microsoft Defender XDR are automatically synchronized to Microsoft Sentinel with the least administrative effort. What should you configure?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Enable the Microsoft Defender XDR data connector in Microsoft Sentinel.. The Microsoft Defender XDR data connector in Microsoft Sentinel provides a built-in, one-click integration that automatically synchronizes incidents from Microsoft Defender XDR to Microsoft Sentinel with no custom development required. This connector uses the Microsoft Graph Security API to ingest incidents, alerts, and evidence, ensuring seamless bidirectional synchronization with the least administrative effort.

Answer

Create a Logic App that uses the Microsoft Defender XDR API to fetch incidents and push them to Microsoft Sentinel.

Answer

Use the Microsoft Sentinel API to pull incidents from Microsoft Defender XDR.

Answer

Enable raw data ingestion from Microsoft Defender for Endpoint to Microsoft Sentinel.

Question 2

You are investigating a security incident in Microsoft Sentinel. You want to visualize the relationships between entities such as IP addresses, users, and hosts. Which tool should you use?

Accepted Answer

Investigation graph. The Investigation graph in Microsoft Sentinel is specifically designed to visualize relationships between entities such as IP addresses, users, and hosts, making it the correct tool for this task. Analytics rules (B) are used for detection, automation rules (C) for automated responses, and workbooks (D) for dashboards and reporting, not for entity relationship visualization.

Answer

Analytics rules

Answer

Automation rules

Answer

Workbooks

Question 3

You are investigating an incident in Microsoft Sentinel where a user account was used to sign in from an unfamiliar location and then accessed multiple sensitive files. Which step is most important to perform first?

Accepted Answer

Disable the user account and reset the password.. Confirming account compromise and immediately disabling the user account is the highest priority to stop further malicious activity. Resetting the password prevents the attacker from using the compromised credentials. Option A is incorrect because blocking the IP address alone may be ineffective if the attacker uses proxies, and it does not secure the account. Option B is incorrect because checking firewall logs is a secondary forensic step that does not address the immediate threat. Option C is incorrect because reviewing file permissions should be done after securing the account.

Answer

Block the IP address of the unfamiliar location.

Answer

Check firewall logs for related network traffic.

Answer

Review file permissions on the accessed files.

Question 4

A security operations analyst is reviewing recommendations in Microsoft Defender for Cloud. For a virtual machine that is missing critical security updates, which recommendation category will highlight this issue?

Accepted Answer

Secure score. In Microsoft Defender for Cloud, the Secure score category directly reflects the security posture of your resources by tracking the implementation of security recommendations. Missing critical security updates on a virtual machine are flagged as a recommendation within this category, and resolving them improves your secure score percentage. This is because secure score is calculated based on the compliance status of each recommendation, with missing updates being a key control for vulnerability management.

Answer

Regulatory compliance

Answer

Workload protections

Answer

Inventory

Question 5

Which THREE components are part of the Microsoft Defender XDR incident management process?

Accepted Answer

Entities. Entities are a core component of the Microsoft Defender XDR incident management process because they represent the assets (such as users, devices, mailboxes, and applications) that are involved in an incident. The incident graph automatically links related entities to provide a unified view of the attack story, enabling analysts to pivot from an alert to the affected resources for investigation and response.

Answer

User settings

Answer

Playbooks

Question 6

During a ransomware incident, Microsoft Sentinel generated an incident with high severity. The incident includes alerts from Microsoft Defender for Endpoint, Microsoft Defender for Office 365, and Microsoft Entra ID. Your team needs to automate the containment process. What is the best approach to automatically isolate affected devices and disable compromised accounts?

Accepted Answer

Create an automation rule in Microsoft Sentinel that runs a playbook to isolate devices and disable accounts. The best approach is to create an automation rule in Microsoft Sentinel that triggers a playbook to isolate devices and disable accounts. Automation rules can be configured to run playbooks automatically when an incident is created, and the playbook can call Microsoft Defender for Endpoint to isolate devices and Microsoft Entra ID to disable accounts. This provides a centralized, automated containment workflow across multiple sources.

Answer

Use advanced hunting to find all affected devices and accounts

Answer

Create a custom detection rule in Microsoft Sentinel to trigger an incident

Answer

Configure automated investigation and response in Microsoft Defender for Endpoint

Question 7

Your company uses Microsoft Sentinel and Microsoft Defender for Cloud Apps (MCAS). A security analyst detects that a user is accessing a sanctioned cloud app from an unusual location. The analyst creates an incident in Sentinel. You need to automatically apply a session policy in MCAS to block downloads from that user for the next hour. You have an existing playbook that can apply session policies. What is the most efficient way to automate this response?

Accepted Answer

Create an automation rule in Sentinel that triggers when an incident is created with the relevant conditions and runs the playbook.. An automation rule in Microsoft Sentinel is triggered by incident creation and can run a playbook automatically when specified conditions are met. This is the most efficient way to automate the response because it eliminates manual intervention and ensures the session policy is applied immediately upon incident creation. The automation rule can be scoped to incidents with specific analytics rules, severities, or entities, matching the requirement.

Answer

Instruct the analyst to run the playbook manually from the incident page each time.

Answer

Configure the incident creation rule in MCAS to automatically run the playbook.

Answer

Modify the analytics rule that detected the anomaly to run the playbook as an automated response.

Question 8

Arrange the steps to enable and configure Microsoft Defender for Identity (MDI) sensor on a domain controller.

Accepted Answer

Download the sensor package, run the installer, enter the access key during installation, then verify the sensor status in the portal.. MDI sensors are installed on domain controllers to capture and analyze authentication events.

Answer

Run the installer, download the sensor package, enter the access key, then verify the sensor status.

Answer

Enter the access key, download the sensor package, run the installer, then verify the sensor status.

Answer

Download the sensor package, run the installer, verify the sensor status, then enter the access key.

Question 9

You are investigating a potential malicious PowerShell execution in Microsoft Defender for Endpoint using this KQL query in Advanced Hunting. The query returns no results. What is the most likely cause?

Accepted Answer

The table name should be 'DeviceProcessEvents' instead of 'DeviceEvents'.. The query uses the table 'DeviceEvents', which is incorrect for hunting process execution events. The correct table for process creation events in Microsoft Defender for Endpoint Advanced Hunting is 'DeviceProcessEvents'. 'DeviceEvents' contains other types of events (e.g., registry, file, network) but not process creation data, so the query returns no results.

Answer

The column names are incorrect; 'InitiatingProcessFileName' should be 'ParentProcessFileName'.

Answer

The 'take 100' operator limits results to only 100, but the query may return results if more data exists.

Answer

The query uses 'ago(7d)' which may be too short for historical data.

Question 10

Your organization uses Microsoft Sentinel and Microsoft Defender XDR. You want to automatically isolate a device when a high-severity incident is created. What is the most efficient way to achieve this?

Accepted Answer

Create an automation rule in Microsoft Sentinel that triggers a playbook, which uses the Microsoft Defender for Endpoint connector to isolate the device.. It leverages Microsoft Sentinel's automation rules to trigger a playbook that uses the Microsoft Defender for Endpoint connector, enabling automated device isolation in response to a high-severity incident. This approach is the most efficient as it combines Sentinel's incident-driven automation with Defender for Endpoint's native isolation action, eliminating manual intervention and ensuring rapid response.

Answer

Manually isolate the device from the Microsoft Defender for Endpoint console after the incident is created.

Answer

Create an automation rule in Microsoft Sentinel that runs a PowerShell script to isolate the device.

Answer

Create a custom detection rule in Microsoft Defender XDR that triggers device isolation.

Question 11

Your organization plans to use Microsoft Sentinel for incident management. Which TWO are native incident management features in Sentinel?

Accepted Answer

Incident comments and collaboration. Microsoft Sentinel provides native incident comments and collaboration features that allow analysts to add notes, tag team members, and maintain a running audit trail directly within the incident record. This is a built-in capability, not requiring any external integration or additional licensing.

Answer

Automated email notifications on incident creation

Answer

Integration with ServiceNow via out-of-the-box connector

Answer

Integration with Microsoft Teams for incident chat

Question 12

During a threat hunt, a security analyst uses Microsoft Sentinel and identifies a series of failed logon attempts from a single IP address targeting multiple user accounts. The analyst wants to create a scheduled analytics rule that generates an alert when the same IP address fails to logon to more than 10 different accounts within 5 minutes. Which KQL operator should be used to count distinct accounts per IP?

Accepted Answer

dcount(Account). The dcount(Account) operator is correct because it counts the number of distinct values in the Account column, which is exactly what the analyst needs: the number of unique accounts targeted by failed logons from a single IP. The full query would use summarize dcount(Account) by IPAddress and then filter for counts greater than 10 within a 5-minute window. This directly addresses the requirement to count distinct accounts per IP.

Answer

count()

Answer

summarize count() by Account

Answer

distinct Account

Question 13

An organization uses Microsoft 365 Defender. A security analyst is investigating a malware incident on a user's device. The automated investigation and response (AIR) has already isolated the device from the network. The analyst now needs to collect a copy of a specific suspicious file from the device for further analysis. Which action should the analyst initiate from the device's entity page?

Accepted Answer

Collect investigation package. The 'Collect investigation package' action on the device entity page in Microsoft 365 Defender gathers a ZIP file containing the device's forensic data, including specific suspicious files, registry keys, and memory dumps. This is the designed method for retrieving a copy of a file for offline analysis without requiring interactive access, and it works even after AIR has isolated the device.

Answer

Run antivirus scan

Answer

Restrict app execution

Answer

Initiate a live response session

Question 14

Your organization has deployed Microsoft Sentinel and Microsoft Defender XDR. You need to ensure that all Defender XDR incidents are automatically synchronized into Microsoft Sentinel for a single pane of glass. What should you configure?

Accepted Answer

Enable the Microsoft Sentinel data connector for Microsoft Defender XDR. The Microsoft Sentinel data connector for Microsoft Defender XDR is the native integration that automatically synchronizes all Defender XDR incidents into Sentinel. This connector ingests incidents, alerts, and evidence from Defender XDR into the Sentinel workspace, enabling a single pane of glass without requiring custom scripting or manual workflows.

Answer

Use Microsoft Graph API to sync incidents daily

Answer

Create an automation rule in Microsoft Sentinel to create incidents from Defender XDR alerts

Answer

Configure Microsoft Defender XDR to forward incidents to Sentinel using a webhook

Question 15

Your organization uses Microsoft Sentinel and Microsoft Defender XDR. You need to ensure that incidents created in Microsoft Defender XDR are automatically synchronized to Microsoft Sentinel with the least administrative effort. What should you configure?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Check the Windows Event Log collection configuration in the Log Analytics workspace data collection rules.. Since the Log Analytics agent is installed and some events are collected, connectivity and agent health are already proven. The most likely cause of selective event gaps is the data collection configuration — specifically the Windows Event Logs settings in the workspace's data collection rules (or legacy agent configuration) that define which event logs and severity levels are forwarded.

Answer

Confirm that the workspace key is correctly deployed on the servers.

Answer

Verify that the Log Analytics agent is running and has network connectivity to Azure.

Answer

Ensure that the servers are listed in the Azure Arc management pane.

Question 16

You are responding to an incident where a user's credentials were stolen via a phishing email. The attacker used the credentials to access Microsoft Entra ID and then tried to perform privileged role escalation. Which Microsoft Sentinel solution should you use to detect this type of attack?

Accepted Answer

UEBA (User and Entity Behavior Analytics). UEBA (User and Entity Behavior Analytics) is the correct solution because it uses machine learning to establish baseline behavioral patterns for users and entities, then detects anomalies such as a user logging in from an unusual location and immediately attempting privileged role escalation. This directly identifies the credential theft and privilege escalation chain described in the incident, whereas other options focus on network traffic, generic syslog ingestion, or threat intelligence matching, which would not catch the behavioral anomaly of a stolen credential being used for role escalation.

Answer

Network Security Group flow logs

Answer

Syslog data connector

Answer

Threat intelligence connectors

Question 17

You are setting up Microsoft Sentinel for the first time. You need to ingest Windows security events from on-premises servers using the Azure Monitor Agent. Which data connector should you enable in Microsoft Sentinel?

Accepted Answer

Windows Security Events via AMA. The Windows Security Events via AMA data connector is specifically designed to collect Windows security events (e.g., Event ID 4625, 4688) from on-premises servers using the Azure Monitor Agent (AMA). This connector leverages the AMA's Data Collection Rules (DCRs) to filter and ingest security-relevant logs directly into Microsoft Sentinel, making it the correct choice for this scenario.

Answer

Common Event Format (CEF) via AMA

Answer

Syslog via AMA

Answer

DNS via AMA

Question 18

During a security incident, you need to create a custom detection rule in Microsoft Sentinel to alert on multiple failed logins followed by a successful login from the same IP within 10 minutes. Which KQL function should you use to group events by IP address and time window?

Accepted Answer

summarize. The `summarize` operator is the correct choice because it groups events by one or more columns (e.g., IP address) and performs aggregations over a defined time window. In this scenario, you need to count failed logins and then check for a subsequent successful login within 10 minutes from the same IP, which requires grouping by IP and time. `summarize` allows you to use `bin()` on a timestamp to create time buckets, enabling the detection of multiple failed logins followed by a success within that window. This is the standard KQL approach for time-based correlation in Microsoft Sentinel.

Answer

join

Answer

extend

Answer

project

Question 19

Your organization uses Microsoft Defender for Cloud and Microsoft Sentinel. You need to ensure that security alerts from Defender for Cloud are automatically synchronized to Sentinel and assigned to the cloud security team. Which three actions should you take?

Accepted Answer

Create an automation rule that sets the incident owner to the cloud security team.. Automation rules in Microsoft Sentinel allow you to automatically assign incident owners based on conditions such as alert severity or source connector. By creating an automation rule that sets the incident owner to the cloud security team, you ensure that every Defender for Cloud alert synchronized to Sentinel is immediately assigned to the appropriate team without manual intervention.

Answer

Manually export alerts from Defender for Cloud to Sentinel daily.

Answer

Create a playbook that periodically pulls alerts from Defender for Cloud.

Question 20

You are configuring Microsoft Defender for Cloud Apps with Cloud Discovery. You need to ensure that logs from your network proxies are processed correctly. Which THREE steps are required?

Accepted Answer

Upload the log files manually or configure automatic log upload using the log collector.. Microsoft Defender for Cloud Apps Cloud Discovery requires log data from network proxies to be ingested either by manually uploading log files or by configuring automatic log upload via the log collector. The log collector is a Docker-based container that parses and normalizes proxy logs before forwarding them to Defender for Cloud Apps, enabling shadow IT discovery without manual intervention.

Answer

Install the Microsoft Defender for Cloud Apps connector in Sentinel.

Answer

Enable Azure Information Protection for labeling.