SC-200 Practice Exam 64 — 20 Questions

Question 1

Your organization uses Microsoft Sentinel with a workspace in the East US region. You need to respond to an incident involving data exfiltration from a virtual machine in West Europe. The incident was created from a custom analytics rule that queries the AzureActivity table. What should you do to ensure the incident contains all relevant evidence from the West Europe region?

Accepted Answer

Ensure that Azure activity logs from West Europe are streamed to the same Sentinel workspace in East US. Option C is correct because the workspace is in East US, but data from West Europe must be ingested into the same workspace for the rule to query it. Option A is wrong because the analytics rule runs in the workspace where it is defined, not in multiple workspaces. Option B is wrong because setting the scope to West Europe does not bring data into the East US workspace. Option D is wrong because incidents are workspace-scoped and cannot be merged across workspaces by default.

Answer

Create the analytics rule in a separate workspace in West Europe

Answer

Configure the analytics rule to query the West Europe workspace

Answer

Use the incident merge feature to combine incidents from multiple workspaces

Question 2

You are investigating an incident in Microsoft Defender XDR that involves a user who clicked a link in a phishing email. The email was detected and blocked by Microsoft Defender for Office 365, but the user still clicked the link before it was blocked. The incident includes an alert for 'Malicious URL click'. What additional information should you check to determine if the user's credentials were compromised?

Accepted Answer

Check for sign-in events from unusual locations or anonymous IP addresses after the click. Option D is correct because a URL click could lead to a credential harvesting page. Checking for subsequent failed logins from unusual locations indicates that credentials were used. Option A is wrong because the email was blocked, so there was no attachment. Option B is wrong because a password reset does not indicate compromise. Option C is wrong because the block already happened; the click is what matters.

Answer

Check if the link was blocked by the time the user clicked

Answer

Check if the user has recently changed their password

Answer

Check if the email had any attachments

Question 3

Which THREE components can be used in Microsoft Sentinel to automate incident response?

Accepted Answer

Automation rules. Correct answers are A, B, and E. Automation rules, playbooks, and triggers are part of Microsoft Sentinel's automation capabilities. Analytics rules generate incidents but do not automate response. Watchlists are for enrichment, not automation.

Answer

Watchlists

Answer

Analytics rules

Question 4

During an incident response, you need to collect email messages from a user's mailbox in Microsoft 365 for evidence. The user is suspected of phishing. Which Microsoft Purview solution should you use?

Accepted Answer

eDiscovery (Standard). Option C is correct because eDiscovery (Standard) allows authorized users to search and export mailbox content, including email messages, for legal and investigative purposes. Option A is wrong because DLP is for data loss prevention, not collection. Option B is wrong because Records Management is for retention labels. Option D is wrong because Audit logs track activities, not content collection.

Answer

Data Loss Prevention

Answer

Records Management

Answer

Audit (Standard)

Question 5

During a ransomware incident, a security analyst needs to isolate an affected Windows 10 device managed by Microsoft Intune. The device is currently online and connected to the corporate network. Which remediation action should be taken from Microsoft Defender XDR to achieve this?

Accepted Answer

Initiate device isolation from the Microsoft Defender for Endpoint console. Option A is correct because device isolation in Microsoft Defender for Endpoint disconnects the device from the network while allowing communication with the Defender service. Option B is wrong because running a full antivirus scan does not isolate the device. Option C is wrong because turning off Windows Firewall would increase exposure. Option D is wrong because blocking the device in Intune revokes access to resources but does not isolate the device from the network.

Answer

Block the device in Microsoft Intune

Answer

Disable the Windows Firewall via Intune

Answer

Run a full antivirus scan from Microsoft Defender for Endpoint

Question 6

Which TWO response actions are available in Microsoft Defender for Endpoint for a compromised device? (Choose two.)

Accepted Answer

Run a full antivirus scan. Options A and D are correct because Defender for Endpoint supports isolating a device and running a full antivirus scan. Option B is wrong because resetting the device to factory defaults is not a standard response action. Option C is wrong because disabling the user account is an identity action, not a device action. Option E is wrong because changing the firewall rules is not a predefined response action in Defender for Endpoint.

Answer

Disable the user account

Answer

Change the Windows Firewall rules

Answer

Reset the device to factory defaults

Question 7

You are investigating a suspicious sign-in reported in Microsoft Defender for Cloud Apps. The activity shows that a user accessed a sensitive SharePoint site from an anonymous IP address. What is the most effective immediate response to prevent further access?

Accepted Answer

Suspend the user account in Microsoft 365 Defender.. Option D is correct because suspending the user immediately blocks access to all cloud apps. Option A is wrong because disabling the device does not prevent cloud access from other devices. Option B is wrong because changing permissions on the site does not address the user's compromised state. Option C is wrong because blocking the IP may not be effective if the attacker uses different IPs.

Answer

Change the SharePoint site permissions to remove the user's access.

Answer

Disable the user's device in Microsoft Intune.

Answer

Add the anonymous IP address to the blocked IP address list in Conditional Access.

Question 8

During a ransomware incident, Microsoft Sentinel generated an incident with high severity. The incident includes alerts from Microsoft Defender for Endpoint, Microsoft Defender for Office 365, and Microsoft Entra ID. Your team needs to automate the containment process. What is the best approach to automatically isolate affected devices and disable compromised accounts?

Accepted Answer

Create an automation rule in Microsoft Sentinel that runs a playbook to isolate devices and disable accounts. Option D is correct because automation rules in Sentinel can trigger playbooks that perform cross-product actions like isolation and account disablement. Option A is wrong because automated investigation in Defender for Endpoint only isolates devices, not accounts. Option B is wrong because custom detection rules only create alerts, not automated responses. Option C is wrong because advanced hunting is manual and does not automate response.

Answer

Use advanced hunting to find all affected devices and accounts

Answer

Create a custom detection rule in Microsoft Sentinel to trigger an incident

Answer

Configure automated investigation and response in Microsoft Defender for Endpoint

Question 9

Which THREE are valid incident severity levels in Microsoft Sentinel?

Accepted Answer

Low. The correct answers are A, B, and D. Sentinel uses Low, Medium, High, and Informational. Critical is not a level; the highest is High. Informational is a valid severity.

Answer

Critical

Answer

Informational

Question 10

A company uses Microsoft Defender XDR and has enabled automatic attack disruption for human-operated ransomware. During an incident, the system automatically contains a compromised account. However, the SOC team wants to ensure that the containment action is reversible and that the account can be restored after investigation. What should the team do before restoring the account?

Accepted Answer

Change the account's password and enable multi-factor authentication.. The correct answer is D. The account must be reset and verified clean to prevent the attacker from regaining access. The other options are not sufficient or incorrect.

Answer

Verify that no other accounts were compromised.

Answer

Remove the account from all administrative roles.

Answer

Run a full antivirus scan on the account's devices.

Question 11

Your incident response team receives an alert from Microsoft Sentinel for a user account that has been compromised. The alert indicates that the user's credentials were used from an unfamiliar location. What is the first action you should take?

Accepted Answer

Disable the user account in Microsoft Entra ID. Option B is correct because immediately disabling the compromised user account stops further unauthorized access. Option A is wrong because reviewing logs delays the containment. Option C is wrong because resetting password after disabling is standard, but disabling first is critical. Option D is wrong because notifying the user before containment could alert the attacker.

Answer

Review the sign-in logs to confirm the alert

Answer

Reset the user's password

Answer

Notify the user and ask them to change their password

Question 12

Which TWO of the following are valid data connectors for Microsoft Sentinel? (Select TWO.)

Accepted Answer

Azure Firewall. Options B and D are correct. Microsoft Entra ID and Azure Firewall have built-in connectors. Option A is wrong because Google Cloud Storage is not a default connector; it requires custom ingestion. Option C is wrong because Docker is not a data source for Sentinel. Option E is wrong because Amazon RDS is not a direct connector.

Answer

Docker containers

Answer

Amazon RDS

Answer

Google Cloud Storage

Question 13

Which THREE of the following are recommended practices for creating effective threat hunting queries in Microsoft Sentinel? (Select three.)

Accepted Answer

Include known indicators of compromise from threat feeds. Options A, B, and E are correct. A: use time constraints for performance. B: use external threat intelligence. E: use MITRE ATT&CK mapping. C is wrong because broad patterns miss subtle signs. D is wrong because wildcards strain performance.

Answer

Use only broad patterns to avoid missing anything

Answer

Use wildcards extensively to capture variations

Question 14

Refer to the exhibit. You are configuring an automation rule in Microsoft Sentinel. The rule triggers when an incident is created, changes its status to 'Active', assigns it to 'tier2', and runs a playbook. However, you notice that the playbook is not executing for incidents with severity 'Low'. What is the most likely reason?

Accepted Answer

The severityFilter excludes incidents with severity 'Low'.. Option A is correct because the severityFilter is set to 'High,Medium', so incidents with severity 'Low' are not processed by this automation rule. Option B is wrong because the triggers array is not empty. Option C is wrong because there is no condition blocking Low severity. Option D is wrong because the rule is enabled (not shown disabled).

Answer

The triggers array is empty, so no incidents trigger the rule.

Answer

The rule has a condition that filters out Low severity incidents.

Answer

The playbook is disabled in Microsoft Sentinel.

Question 15

Your organization uses Microsoft Sentinel. You receive a high-severity incident indicating a potential data exfiltration from an Azure Storage account. The incident contains entities such as IP addresses and user accounts. Which step should you perform first to contain the threat?

Accepted Answer

Investigate the incident to confirm the activity is malicious. Option C is correct because the first step in incident response is to verify the alert is a true positive before taking containment actions. Option A is wrong because blocking the IP may be premature if the alert is false. Option B is wrong because disabling the storage account could impact legitimate operations. Option D is wrong because contacting the user may tip off a malicious insider.

Answer

Contact the user associated with the storage account

Answer

Block the suspicious IP address in the Azure Firewall

Answer

Disable the storage account

Question 16

Refer to the exhibit. You are configuring an automation rule in Microsoft Sentinel to block IP addresses from high-severity incidents. The rule triggers on incident creation but fails to block the IP. What is the most likely cause?

Accepted Answer

The entity path 'incident.entities.IP' is incorrect; it needs to iterate over entities. Option C is correct because the JSON uses 'incident.entities.IP' but the actual path likely requires iterating over entities; the syntax is incorrect. Option A is wrong because the severity condition is correct. Option B is wrong because there is no inconsistency; the trigger type is incidentTrigger. Option D is wrong because blockIP is a valid action type in automation rules.

Answer

The trigger type should be 'alertTrigger' instead of 'incidentTrigger'

Answer

The action type 'blockIP' is not supported in automation rules

Answer

The severity condition should be 'GreaterThan' instead of 'Equals'

Question 17

Your organization uses Microsoft Sentinel with the Microsoft Defender XDR connector. You have a critical incident that involves multiple alerts across different services. The incident is being updated with new alerts. You need to ensure that a specific playbook runs only when the incident severity is updated to High. How should you configure the automation rule?

Accepted Answer

Set the trigger to 'When incident is updated' and add a condition on severity equals High.. Option B is correct because automation rules can trigger on incident update and filter by severity. Option A is wrong because condition 'when incident is created' would not trigger on update. Option C is wrong because the trigger condition should be on incident update, not alert creation. Option D is wrong because automation rules are not configured inside playbooks.

Answer

Set the trigger to 'When an alert is created' and filter for alerts with High severity.

Answer

Set the trigger to 'When incident is created' and add a condition on severity equals High.

Answer

Configure the condition inside the playbook to check severity and exit if not High.

Question 18

You are investigating a phishing incident in Microsoft Defender XDR. The alert indicates that a user clicked a malicious link in an email. After confirming the email was delivered to the user's inbox, what should be your first action?

Accepted Answer

Use Microsoft Defender for Office 365 to soft-delete the email from the user's mailbox and other recipients. Option A is correct because soft-deleting the email from all mailboxes removes the threat from the user's and possibly other recipients' inboxes. Option B is wrong because blocking the URL is important but does not remove the already delivered email. Option C is wrong because resetting the password is necessary only if credentials were compromised, but the immediate action is to remove the email. Option D is wrong because training is a long-term prevention, not an immediate response.

Answer

Add the URL to the tenant block list in Microsoft Defender for Office 365

Answer

Send a training notification to the user

Answer

Reset the user's password immediately

Question 19

Refer to the exhibit. You are configuring a Microsoft Sentinel scheduled analytics rule with the above incident creation settings. What is the effect of setting 'groupingConfiguration.enabled' to false?

Accepted Answer

Each alert will generate a separate incident. Option A is correct because grouping configuration controls whether alerts are grouped into a single incident. Disabling it means each alert creates its own incident. Option B is wrong because the rule still creates incidents. Option C is wrong because the rule runs on the schedule defined elsewhere. Option D is wrong because suppression is a different setting.

Answer

Alerts will be suppressed for 5 minutes

Answer

The rule will run every 5 minutes

Answer

No incidents will be created

Question 20

A SOC analyst is using Microsoft Sentinel to investigate an incident involving a user who accessed a sensitive database from an unusual location. The analyst wants to find all activities performed by this user within the last 24 hours from multiple data sources. Which KQL operator should the analyst use to combine the results of two queries that return different schemas?

Accepted Answer

union. The correct answer is C. The union operator combines tables or query results with different schemas by adding columns. Join requires a common column. The other operators are not appropriate.

Answer

summarize

Answer

join

Answer

where