SC-200 Practice Exam 64 — 20 Questions

Question 1

Which TWO of the following are valid methods to perform threat hunting in Microsoft Sentinel? (Choose TWO.)

Accepted Answer

Create and save custom KQL queries in the Hunting blade. Option A is correct because the Hunting blade in Microsoft Sentinel lets analysts create, save, and run custom KQL (Kusto Query Language) queries against the Log Analytics workspace, which is a core proactive threat-hunting technique. Option B is correct because Microsoft Sentinel ships with built-in hunting queries (based on MITRE ATT&CK tactics) that can be run directly from the Hunting blade to surface suspicious activity. Option C is not a hunting method; automation rules are used to trigger responses (such as running playbooks or changing incident properties) after an alert or incident is created, not to proactively search for threats. Option D is incorrect because Workbooks are for visualization and reporting of data, not for the query-driven, hypothesis-based exploration that defines threat hunting. Option E is incorrect because Playbooks are Logic Apps-based automation workflows that respond to incidents or alerts, not a mechanism for scheduling ad-hoc hunting queries.

Answer

Configure automated response rules to detect threats

Answer

Use Workbooks to visualize data and identify anomalies

Answer

Create a Playbook to automatically run queries on a schedule

Question 2

You are responding to a data exfiltration incident involving a user who copied sensitive files to a personal cloud storage service. The files were accessed from the user's managed device. Which Microsoft  Defender for Cloud Apps activity policy should you create to detect similar future incidents?

Accepted Answer

An activity policy that detects uploads to personal cloud storage services.. The incident involves a user copying sensitive files to a personal cloud storage service from a managed device. An activity policy in Microsoft Defender for Cloud Apps can be configured to detect specific activities, such as uploads to personal cloud storage services (e.g., Dropbox, Google Drive), by monitoring the 'Upload' event for recognized cloud apps. This directly addresses the detection of similar future incidents by alerting on the exact action (upload) to the specific service category (personal storage).

Answer

An anomaly detection policy that flags impossible travel.

Answer

A file policy that detects files shared with external users.

Answer

An app discovery policy that identifies new cloud apps used in the organization.

Question 3

Your organization uses Microsoft Sentinel. You receive a high-severity incident indicating a potential data exfiltration from an Azure Storage account. The incident contains entities such as IP addresses and user accounts. Which step should you perform first to contain the threat?

Accepted Answer

Investigate the incident to confirm the activity is malicious. In Microsoft Sentinel, the first step after receiving a high-severity incident is to investigate and confirm whether the activity is truly malicious. This triage step prevents unnecessary containment actions that could disrupt legitimate business operations. Only after confirming the threat should you proceed with containment measures like blocking IPs or disabling accounts.

Answer

Contact the user associated with the storage account

Answer

Block the suspicious IP address in the Azure Firewall

Answer

Disable the storage account

Question 4

An organization uses Microsoft 365 Defender and receives an alert for a suspicious email sent to multiple recipients. The analyst wants to view the email metadata, including the sender, subject, and any attachments. Which advanced hunting table should the analyst use?

Accepted Answer

EmailEvents. The EmailEvents table in Advanced Hunting stores the core metadata for every email processed by Microsoft Defender for Office 365, including sender, subject, recipient, and delivery status. Since the analyst needs to view the sender, subject, and attachments for a suspicious email sent to multiple recipients, EmailEvents is the correct starting point because it contains the primary email envelope information.

Answer

EmailAttachmentInfo

Answer

EmailUrlInfo

Answer

DeviceEmailEvents

Question 5

Your organization uses Microsoft Defender XDR for threat hunting. You suspect a threat actor is using scheduled tasks for persistence. Which hunting query would you use in Microsoft 365 Defender advanced hunting to find newly created scheduled tasks?

Accepted Answer

DeviceEvents | where ActionType == 'ScheduledTaskCreated'. Advanced hunting uses the DeviceEvents table to capture various security events, including scheduled task creation via the 'ScheduledTaskCreated' action type. Option A is correct because DeviceEvents with ActionType 'ScheduledTaskCreated' directly identifies newly created scheduled tasks. Option B (DeviceRegistryEvents) is incorrect because it captures registry modifications, and while scheduled tasks are stored in the registry, querying for 'Tasks' in the registry key is too broad and not specific to creation. Option C (DeviceProcessEvents) is incorrect because 'schtasks.exe' is the command-line tool used to create scheduled tasks, but querying for process events would capture executions rather than the actual creation of tasks, and it may miss tasks created via other methods. Option D (DeviceFileEvents) is incorrect because it tracks file operations, and scheduled tasks are not typically represented as files in a folder; the 'Tasks' folder path might refer to the Windows Task Scheduler library, but file events for task files (like .job files) are not the primary way to detect creation.

Answer

DeviceRegistryEvents | where RegistryKey contains 'Tasks'

Answer

DeviceProcessEvents | where FileName == 'schtasks.exe'

Answer

DeviceFileEvents | where FolderPath contains 'Tasks'

Question 6

A cloud security administrator receives an alert from Microsoft Defender for Cloud indicating that a virtual machine has been compromised. The administrator wants to quickly isolate the VM from the network to prevent further spread while preserving the disk for forensic analysis. Which action should the administrator take?

Accepted Answer

Use the "Isolate VM" action in the security alert.. The 'Isolate VM' action in Microsoft Defender for Cloud is designed specifically for compromised VMs. It applies a network security group (NSG) rule that denies all inbound and outbound traffic to the VM, effectively quarantining it from the network while leaving the disk intact for forensic analysis. This is the fastest and most direct method to contain the threat without altering the VM's configuration or disk state.

Answer

Apply a just-in-time (JIT) access policy to the VM.

Answer

Enable the Azure Security Benchmark initiative for the VM.

Answer

Configure a custom Azure Policy to deny network access.

Question 7

You are a security analyst at Contoso. Microsoft Sentinel is deployed with the Microsoft Defender for Cloud Apps connector. An incident is generated for a high-risk sign-in from a user named JaneDoe@contoso.com. The incident severity is Medium. The incident details show that the sign-in originated from an IP address in a country where Contoso has no business presence, and the user recently changed their password. You suspect account compromise. You need to take immediate action to contain the threat and prevent further unauthorized access. The user is currently active in Microsoft Entra ID. You have the following options: A) Force the user to re-authenticate by revoking their sessions in Microsoft Entra ID. B) Disable the user account in Microsoft Entra ID. C) Block the IP address in Microsoft Defender for Cloud Apps. D) Create a Sentinel automation rule to automatically disable accounts on similar alerts. Which action should you take first to contain the current incident?

Accepted Answer

Disable the user account in Microsoft Entra ID.. Disabling the user account immediately stops any further access using that account, which is the most direct containment action. Option A (Revoke sessions) would end current sessions but the user could still authenticate again if credentials are compromised. Option C (Block IP) is less effective as the attacker may use other IPs. Option D (Create automation rule) is a long-term solution, not immediate containment.

Answer

Force the user to re-authenticate by revoking their sessions.

Answer

Block the IP address in Microsoft Defender for Cloud Apps.

Answer

Create a Sentinel automation rule to automatically disable accounts on similar alerts.

Question 8

A security analyst wants to see the delivery status and phishing verdict of an email. Which advanced hunting table should the analyst query in Microsoft 365 Defender?

Accepted Answer

EmailEvents. The EmailEvents table in Microsoft 365 Defender's advanced hunting schema contains the delivery status (e.g., Delivered, Failed, Filtered as spam) and the phishing verdict (e.g., Phish, Normal) for each email. This table records the initial processing and classification of the email, making it the correct source for both pieces of information.

Answer

EmailPostDeliveryEvents

Answer

EmailAttachmentInfo

Answer

EmailUrlInfo

Question 9

An organization uses Microsoft Sentinel with the Microsoft Defender for Cloud connector enabled. A security analyst receives an alert from Defender for Cloud about a potential brute-force attack on an Azure VM. The analyst wants to automatically create an incident in Sentinel and trigger a playbook that blocks the attacker's IP using a firewall. Which type of Sentinel automation rule should the analyst configure?

Accepted Answer

Incident automation rule. Incident automation rules in Microsoft Sentinel allow you to automatically trigger a playbook when an incident is created or updated. Since the Defender for Cloud alert generates an incident in Sentinel, an incident automation rule can be configured to run a playbook that blocks the attacker's IP via a firewall, meeting the requirement without needing to modify the analytics rule itself.

Answer

Analytics rule automation

Answer

Playbook trigger

Answer

Custom log ingestion

Question 10

A company uses Microsoft Defender for Cloud and wants to automatically remediate non-compliant Azure resources by deploying missing configurations (e.g., enabling diagnostics when not enabled). Which feature should they enable?

Accepted Answer

Azure Policy's DeployIfNotExists effect. Azure Policy's DeployIfNotExists effect is the correct feature because it automatically remediates non-compliant Azure resources by deploying missing configurations, such as enabling diagnostic settings, when the resource is created or updated. This effect evaluates resources against a policy definition and, if the specified configuration does not exist, triggers a deployment task to apply the required settings. In Defender for Cloud, this is used to enforce security baselines by automatically correcting non-compliant resources without manual intervention.

Answer

Just-In-Time VM access

Answer

Adaptive network hardening

Answer

File integrity monitoring

Question 11

During a security incident, you need to collect email messages associated with a phishing campaign from multiple mailboxes in Microsoft 365. Which tool should you use to search and export these emails?

Accepted Answer

Content Search in the Microsoft Purview compliance portal.. Content Search in the Microsoft Purview compliance portal is the purpose-built tool for searching across Exchange mailboxes (and SharePoint/OneDrive) and exporting results to a PST or mailbox. It supports keyword queries, date ranges, sender/recipient filters, and bulk export across multiple mailboxes, which matches the phishing-campaign scenario.

Answer

Advanced Hunting in Microsoft Defender XDR.

Answer

Incident investigation in the Microsoft 365 Defender portal.

Answer

Mail Flow in the Exchange admin center.

Question 12

Your organization uses Microsoft Defender XDR. A security administrator reports that a user's device is showing high severity alerts for 'Tampering with Microsoft Defender Antivirus' but the device is not isolated. You need to ensure that when such alerts occur, the device is automatically isolated in Microsoft Defender for Endpoint. What should you do?

Accepted Answer

Create a custom detection rule in Microsoft Defender XDR. Microsoft Defender XDR's custom detection rules allow you to create automated actions based on specific alert triggers, such as 'Tampering with Microsoft Defender Antivirus'. By configuring a custom detection rule with an automated response action (e.g., 'Isolate device'), you can ensure the device is automatically isolated in Microsoft Defender for Endpoint when the alert occurs, without requiring manual intervention.

Answer

Create an automation rule in Microsoft Sentinel

Answer

Create an endpoint detection and response policy in Microsoft Intune

Answer

Configure an attack surface reduction rule

Question 13

Your organization uses Microsoft Defender for Cloud Apps. An alert indicates that a user is downloading large amounts of data from SharePoint Online. What should you do first to investigate?

Accepted Answer

Review the user's activity log in Defender for Cloud Apps.. The first step in investigating a potential data exfiltration alert is to review the user's activity log in Defender for Cloud Apps. This log provides granular details about the specific files downloaded, the volume of data, the time frame, and the source IP address, allowing you to validate whether the activity is anomalous or legitimate before taking any restrictive action.

Answer

Govern the user by suspending their account.

Answer

Create a new IP address range for the organization.

Answer

Block the SharePoint Online app for all users in Defender for Cloud Apps.

Question 14

A security analyst in Microsoft 365 Defender is using advanced hunting to investigate a suspected data exfiltration. The analyst wants to find all outbound network connections from a specific device that occurred in the last hour, ordered by timestamp. Which table and KQL query should the analyst use?

Accepted Answer

DeviceNetworkEvents | where DeviceName == "deviceA" and Timestamp > ago(1h) | project Timestamp, RemoteIP, RemotePort | order by Timestamp asc. The DeviceNetworkEvents table in Microsoft 365 Defender captures outbound network connections, including remote IP addresses and ports. The query filters for a specific device (DeviceName == 'deviceA'), limits results to the last hour using Timestamp > ago(1h), projects the relevant columns, and orders by Timestamp ascending to show the earliest connections first.

Answer

DeviceProcessEvents | where DeviceName == "deviceA" and Timestamp > ago(1h) | project Timestamp, RemoteIP, RemotePort | order by Timestamp asc

Answer

DeviceFileEvents | where DeviceName == "deviceA" and Timestamp > ago(1h) | project Timestamp, RemoteIP, RemotePort | order by Timestamp asc

Answer

EmailEvents | where SenderUpn == "deviceA" and Timestamp > ago(1h) | project Timestamp, RemoteIP, RemotePort | order by Timestamp asc

Question 15

You are a SOC analyst using Microsoft Sentinel. You receive an incident with high severity. You need to quickly gather additional context about the affected user account, including recent sign-in logs and role assignments. Which feature should you use?

Accepted Answer

Entity pages. Entity pages in Microsoft Sentinel provide a centralized, pre-built view of a specific entity (such as a user account), aggregating related alerts, incidents, and data from connected sources like Microsoft Entra ID sign-in logs and role assignments. This allows a SOC analyst to quickly gather contextual information without manually querying multiple data sources, making it the ideal feature for high-severity incidents requiring rapid investigation.

Answer

Sentinel Workbooks

Answer

Analytics rules

Answer

Hunting queries

Question 16

Which THREE are valid components of a Microsoft Sentinel automation rule?

Accepted Answer

Actions (e.g., Run playbook, Change severity). Automation rules in Microsoft Sentinel allow you to define actions such as running a playbook or changing the severity of an incident. These actions are executed automatically when the rule's trigger and conditions are met, enabling streamlined incident response without manual intervention.

Answer

Watchlist

Answer

KQL query

Question 17

Which TWO actions are part of managing a security operations environment in Microsoft Sentinel? (Select two.)

Accepted Answer

Creating automation rules to triage incidents. Automation rules in Microsoft Sentinel allow you to automatically triage incidents by applying actions such as assigning ownership, changing severity, or running playbooks. This is a core operational task within the security operations environment to streamline incident response and reduce manual effort.

Answer

Configuring physical access controls to the data center

Answer

Installing the Azure Monitor Agent on servers

Answer

Creating Microsoft Purview sensitivity labels

Question 18

An organization ingests its Palo Alto firewall logs into a custom table named 'PaloAlto_CL' in Microsoft Sentinel. A security analyst wants to create a scheduled analytics rule that triggers an incident when a single source IP is involved in more than 100 outbound connections to different destinations in 1 minute. Which KQL query and configuration would trigger the alert correctly?

Accepted Answer

summarize dcount(DestinationIP) by SourceIP, bin(TimeGenerated,1m) and set threshold >100. The requirement is to count distinct destination IPs per source IP per minute, not total connections. Using `dcount(DestinationIP)` with `bin(TimeGenerated,1m)` ensures we count unique destinations, and setting the threshold to >100 triggers when a single source IP connects to more than 100 different destinations in one minute, exactly matching the alert condition.

Answer

summarize count() by SourceIP, bin(TimeGenerated,1m) and set threshold >100

Answer

summarize count() by DestinationIP and threshold >100

Answer

summarize dcount(SourceIP) by DestinationIP, bin(TimeGenerated,1m) and threshold >100

Question 19

A security analyst in Microsoft 365 Defender is investigating an incident that contains multiple alerts from different sources (e.g., Microsoft Defender for Endpoint, Microsoft 365 Defender for Office). The analyst wants to see a consolidated list of all alerts associated with the incident, including their severity, status, and detection source. Which tab within the incident details page should the analyst use?

Accepted Answer

Alerts tab. The Alerts tab on the incident details page in Microsoft 365 Defender provides a consolidated, filterable list of all alerts linked to the incident, regardless of their source (e.g., Microsoft Defender for Endpoint, Microsoft Defender for Office 365). This tab displays each alert's severity, status, and detection source, allowing the analyst to triage and correlate alerts from different workloads in a single view. The other tabs focus on specific entities (devices, users, mailboxes) rather than the unified alert list.

Answer

Devices tab

Answer

Users tab

Answer

Mailboxes tab

Question 20

You are investigating a lateral movement incident in Microsoft Defender for Endpoint. The timeline shows that a user's credentials were used from a compromised workstation to access a sensitive server. Which action should you take to contain the incident?

Accepted Answer

Reset the compromised user's password and revoke all active sessions.. The incident involves lateral movement using stolen credentials. Resetting the compromised user's password and revoking all active sessions immediately invalidates the credentials the attacker used, preventing further unauthorized access to any resource, including the sensitive server. This directly addresses the root cause (credential theft) rather than just blocking network paths or isolating a single device.

Answer

Disable the sensitive server's network account.

Answer

Isolate the compromised workstation only.

Answer

Block all network traffic from the compromised workstation to the server.