SC-200 Practice Exam 65 — 20 Questions

Question 1

You are a security analyst at Fabrikam. The company uses Microsoft Defender for Cloud Apps and Microsoft Sentinel. During a threat hunt, you need to identify users who are accessing cloud applications from multiple geographic locations in a short time, which could indicate credential theft or token replay. You want to create a hunting query in Microsoft Sentinel using the CloudAppEvents table. Which approach should you take?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Query CloudAppEvents, summarize by AccountDisplayName and bin(TimeGenerated, 1h), then use dcount(CountryCode) > 1. The CloudAppEvents table in Microsoft Sentinel contains Microsoft Defender for Cloud Apps activity logs, including user sign-ins and access to cloud applications with geographic metadata such as CountryCode. Summarizing by AccountDisplayName and binning TimeGenerated into 1-hour windows, then filtering where dcount(CountryCode) > 1, directly detects the impossible-travel pattern described. This is the canonical KQL approach for multi-geo access hunting in Sentinel.

Answer

Query CommonSecurityLog for VPN connections

Answer

Query OfficeActivity for sign-in logs

Answer

Query SecurityAlert for location-related alerts

Question 2

During an incident, you need to prevent a malicious process from running on all endpoints using Microsoft Defender for Endpoint. The process is not yet detected by antivirus signatures. Which action should you use?

Accepted Answer

Add an indicator to block the process. Microsoft Defender for Endpoint allows you to create custom indicators of compromise (IoCs) to block or allow specific processes, files, or behaviors. Since the malicious process is not yet detected by antivirus signatures, adding an indicator to block the process file hash or certificate is the most direct and immediate action to prevent it from running on all endpoints.

Answer

Run antivirus scan

Answer

Collect investigation package

Answer

Initiate Live Response

Question 3

Match each Microsoft 365 Defender role to its permission level.

Accepted Answer

Global Administrator: Full administrative access to all Microsoft 365 services. The correct matches: Global Administrator has full access; Security Administrator manages security; Security Reader has read-only access; Compliance Administrator manages compliance. Common confusions include swapping full access with read-only or misattributing the Global Administrator's scope.

Answer

Global Administrator: Read-only access to security reports

Answer

Security Administrator: Full administrative access to all Microsoft 365 services

Question 4

Your organization uses Microsoft Sentinel. You need to ensure that incident investigation is efficient by automatically grouping related alerts into incidents. Which configuration should you use?

Accepted Answer

Configure alert grouping in the analytics rule wizard. Microsoft Sentinel's analytics rule wizard includes a dedicated 'Alert grouping' configuration that allows you to specify how alerts from the same analytics rule are automatically combined into a single incident. This setting is essential for efficient incident investigation, as it reduces alert noise by grouping related alerts based on criteria such as matching entities, time windows, or custom alert details, ensuring that security analysts work with consolidated incidents rather than individual alerts.

Answer

Create an automation rule to group alerts

Answer

Use a playbook to merge incidents

Answer

Define a watchlist to consolidate alerts

Question 5

A company has enabled Microsoft Defender for Cloud on its Azure subscription. The security team wants to ensure that all existing virtual machines have a vulnerability assessment solution installed. Which Defender for Cloud feature can automatically deploy a vulnerability assessment agent to supported VMs?

Accepted Answer

Vulnerability assessment recommendations. The Vulnerability Assessment (VA) recommendations in Microsoft Defender for Cloud can automatically deploy a vulnerability assessment agent (such as the Qualys or Microsoft Defender Vulnerability Management agent) to supported Azure VMs. When a VM is found to be missing a VA solution, Defender for Cloud can enable the 'Auto-provision' setting for the VA recommendation, which triggers the agent installation without manual intervention. This directly meets the requirement to ensure all existing VMs have a vulnerability assessment solution installed.

Answer

Defender for Servers plan

Answer

Security policies

Answer

Workload protections

Question 6

Your Microsoft Sentinel workspace has a Microsoft 365 Defender connector configured. You notice that incidents are being created from Microsoft Defender for Office 365 alerts, but not from Microsoft Defender for Identity alerts. What should you check?

Accepted Answer

Enable the Microsoft Defender for Identity alert streaming in the connector configuration.. The Microsoft 365 Defender connector in Microsoft Sentinel requires explicit enablement of alert streaming for each Microsoft Defender service. By default, the connector may stream alerts from Defender for Office 365 but not from Defender for Identity unless the corresponding toggle is turned on in the connector configuration. Option A directly addresses this by instructing you to enable the Defender for Identity alert streaming, which resolves the missing incident creation.

Answer

Verify that the Microsoft 365 Defender connector is connected.

Answer

Ensure you have licenses for Microsoft Defender for Identity.

Answer

Check the incident correlation rules in Microsoft Defender XDR.

Question 7

A cloud security team uses Microsoft Defender for Cloud with Defender for Servers enabled. They want to ensure that all Azure virtual machines have automatic provisioning of the Log Analytics agent (Azure Monitor Agent) turned on. Where should this configuration be set to cover existing and future VMs?

Accepted Answer

In Microsoft Defender for Cloud > Environment settings > Select subscription > Settings & monitoring > Log Analytics agent for Azure VMs > Set to 'On'. The 'Settings & monitoring' pane under Environment settings in Microsoft Defender for Cloud is the centralized location to enable automatic provisioning of the Log Analytics agent (Azure Monitor Agent) at the subscription level. This setting ensures that both existing Azure VMs and any future VMs are automatically provisioned with the agent, without requiring individual VM configuration or manual policy assignment.

Answer

In Azure Policy > Assign a policy that deploys the Log Analytics agent to VMs

Answer

In Microsoft Defender for Cloud > Security policy > Data collection

Answer

In Azure virtual machine blade > Auto-provisioning

Question 8

During a ransomware incident, an analyst needs to identify which files were encrypted on an endpoint. The endpoint is running Windows and is managed by Microsoft Defender for Endpoint. Which data source should the analyst query in Advanced hunting?

Accepted Answer

DeviceFileEvents. DeviceFileEvents is the correct data source because it captures file creation, modification, and deletion events on endpoints. During a ransomware incident, encrypted files are typically created with a new extension or modified in place, and DeviceFileEvents logs these changes, allowing the analyst to identify which files were affected.

Answer

DeviceRegistryEvents

Answer

DeviceNetworkEvents

Answer

DeviceProcessEvents

Question 9

Your organization uses Microsoft Sentinel and has multiple workspaces for different regions. The security team wants to use a single workbook to display data from all workspaces. What is the correct approach?

Accepted Answer

Create a workbook with cross-workspace queries using the workspace() expression. Microsoft Sentinel workbooks support cross-workspace queries using the `workspace()` expression in Kusto Query Language (KQL). This allows a single workbook to aggregate and display data from multiple Sentinel workspaces without moving or duplicating the data, meeting the security team's requirement efficiently.

Answer

Export data from all workspaces to a single Azure Data Lake

Answer

Create a workbook in one workspace and configure it to use Azure Lighthouse

Answer

Create a workbook in each workspace and merge them manually

Question 10

A security analyst receives a Microsoft Defender for Cloud Apps alert about a user performing unusual file downloads from SharePoint. The analyst needs to investigate the user's activity in the last 24 hours. Which log source should the analyst query first?

Accepted Answer

Cloud App Security logs in Microsoft Sentinel. D is correct because Cloud App Security logs in Microsoft Sentinel provide the most granular and immediate visibility into user activities within Microsoft Defender for Cloud Apps, including file downloads from SharePoint. These logs capture detailed metadata such as file names, download counts, and user IP addresses, enabling the analyst to quickly identify anomalous behavior without needing to correlate across multiple data sources.

Answer

Microsoft Entra ID sign-in logs

Answer

Microsoft Intune device logs

Answer

Office 365 audit logs

Question 11

Arrange the steps to deploy Microsoft Defender for Cloud Apps (formerly MCAS) and connect it to a cloud app.

Accepted Answer

Step 1: Add an app connector for the cloud app. Step 2: Authenticate the connector. Step 3: Enable monitoring and policies.. Deploying Cloud App Security involves adding an app connector and authenticating to enable monitoring and control.

Answer

Step 1: Enable monitoring and policies. Step 2: Add an app connector. Step 3: Authenticate the connector.

Answer

Step 1: Authenticate the connector. Step 2: Add an app connector. Step 3: Enable monitoring and policies.

Answer

Step 1: Add an app connector. Step 2: Enable monitoring and policies. Step 3: Authenticate the connector.

Question 12

A cloud security team uses Microsoft Defender for Cloud with Defender for Servers enabled. They want to integrate a third-party vulnerability assessment solution for their Azure VMs and ensure findings appear in the Defender for Cloud recommendations. What must be done?

Accepted Answer

Enable the 'Integrated' partner solution in Defender for Cloud and install the scanner on VMs.. Defender for Cloud supports integrating third-party vulnerability assessment solutions through the 'Integrated' partner solution setting. Once enabled, you must install the partner's scanner agent on each Azure VM. The findings are then ingested into Defender for Cloud and appear in the 'Vulnerabilities in your virtual machines should be remediated' recommendation, allowing the security team to view and manage them alongside built-in assessments.

Answer

Configure a data connector in Microsoft Sentinel to forward the partner's findings.

Answer

Deploy the Microsoft Defender Vulnerability Management solution instead of a third-party tool.

Answer

Use Azure Policy to assign a built-in initiative that mandates vulnerability scanning.

Question 13

Which TWO of the following are valid methods to retrieve data from Microsoft Sentinel for external analysis during an incident?

Accepted Answer

Connect Log Analytics workspace to external tools via API.. The Log Analytics workspace that underpins Microsoft Sentinel exposes a REST API, allowing external tools to query and export data programmatically for analysis. This API supports OAuth 2.0 authentication and can retrieve log data via KQL queries, making it a valid method for external integration during incident response.

Answer

Use Microsoft Sentinel PowerShell cmdlets.

Answer

Create a Power BI dashboard.

Answer

Use the Export to CSV feature in the Logs blade.

Question 14

You are configuring Microsoft Sentinel to send email notifications to the SOC manager when a high-severity incident is created. What should you use?

Accepted Answer

Create a playbook that sends an email and assign it to an automation rule.. Automation rules in Microsoft Sentinel can trigger a playbook (an Azure Logic Apps workflow) when an incident is created. The playbook can include an action to send an email notification, enabling automated response to high-severity incidents without manual intervention.

Answer

Configure an analytics rule to send an email when an incident is created.

Answer

Use a workbook to track incidents and configure an alert for email.

Answer

Add the SOC manager's email to a watchlist and configure a scheduled query.

Question 15

Your organization uses Microsoft Defender XDR. A security incident involving a compromised user account has been identified. Which THREE actions should you take to contain and remediate the incident?

Accepted Answer

Disable the user account in Microsoft Entra ID.. Disabling the user account in Microsoft Entra ID is a critical containment step because it immediately prevents the compromised account from authenticating to any Microsoft cloud services, including Exchange Online, SharePoint, and Teams. This action blocks further unauthorized access at the identity level, which is the foundation of the attack vector in a user account compromise. It is a direct and effective way to stop the attacker from using the account for lateral movement or data exfiltration.

Answer

Block all IP addresses that the user has connected from.

Answer

Restore the user's mailbox from a backup.

Question 16

A security analyst is investigating a malware incident and has identified a specific parent process ID (PID) on an endpoint. The analyst wants to retrieve all outbound network connections made by any child processes spawned by this parent process. Which advanced hunting table should the analyst query to get the network connection details, including the destination IP and the child process ID?

Accepted Answer

DeviceNetworkEvents. DeviceNetworkEvents is the correct table because it specifically captures outbound network connections, including destination IP addresses and process IDs (PID). By filtering on the parent process ID and then joining or filtering on child process IDs, the analyst can trace all network connections initiated by child processes spawned from the identified parent PID.

Answer

DeviceProcessEvents

Answer

DeviceEvents

Answer

IdentityNetworkEvents

Question 17

You have a Microsoft Sentinel automation rule that triggers a playbook. The playbook definition is shown in the exhibit. The playbook runs but no email is sent. What is the most likely cause?

Accepted Answer

The playbook uses a recurrence trigger instead of a Microsoft Sentinel trigger.. The playbook uses a recurrence trigger, which means it runs on a schedule (e.g., every hour) rather than being invoked by a Microsoft Sentinel incident or alert. A Microsoft Sentinel automation rule can only trigger a playbook that has a Microsoft Sentinel trigger (e.g., 'When a response to a Microsoft Sentinel incident is triggered'). Without the correct trigger, the playbook will execute on its schedule but will not receive the incident context or be invoked by the automation rule, so no email is sent.

Answer

The JSON syntax is invalid.

Answer

The email operation 'SendEmailV2' is deprecated.

Answer

The connection name 'office365' is incorrect.

Question 18

Your organization is migrating from Azure Active Directory to Microsoft Entra ID. You need to ensure that Microsoft Sentinel continues to receive identity logs. What should you do?

Accepted Answer

No action is required; the existing connector automatically updates.. The migration from Microsoft Entra ID (Azure AD) to Microsoft Entra ID is a rebranding and consolidation effort that does not change the underlying service endpoints, APIs, or log schemas. The existing Microsoft Entra ID data connector in Microsoft Sentinel continues to collect identity logs (e.g., Sign-in logs, Audit logs, Provisioning logs) without any reconfiguration because the connector is tied to the same underlying directory service. Therefore, no action is required; the existing connector automatically updates to reflect the new name.

Answer

Install the new Microsoft 365 Defender connector for identity logs.

Answer

Reconfigure the diagnostic settings to send logs to a new Log Analytics workspace.

Answer

Create a new data connector for Microsoft Entra ID.

Question 19

You are configuring Microsoft Sentinel SOAR capabilities. You need to create an automated response that, when a critical incident is created, triggers a playbook that sends a message to a Teams channel. Which connector should you use in the playbook?

Accepted Answer

Microsoft Teams connector. The Microsoft Teams connector is the correct choice because it enables the playbook to post messages directly to a Teams channel via an HTTP trigger and the Teams webhook action. This connector is specifically designed for sending notifications and messages to Teams, which aligns with the requirement to alert a channel when a critical incident is created.

Answer

Microsoft Exchange connector

Answer

Azure DevOps connector

Answer

Microsoft Entra ID connector

Question 20

Which THREE actions are recommended practices for managing Microsoft Sentinel costs?

Accepted Answer

Set daily caps on high-volume tables.. Setting daily caps on high-volume tables is a recommended practice because it prevents unexpected cost overruns by limiting the amount of data ingested into expensive tables like SecurityEvent or CommonSecurityLog. Microsoft Sentinel bills per GB ingested, so capping tables that generate large volumes of noise (e.g., verbose Windows event logs) directly controls costs without necessarily impacting security visibility, as critical alerts can still be generated from other sources.

Answer

Ingest all logs to ensure complete visibility.

Answer

Increase retention period to 1 year for all tables.