SC-200 Practice Exam 66 — 20 Questions

Question 1

A company uses Microsoft Sentinel as its SIEM. The security team is investigating an incident that involves multiple alerts from different data sources. The team wants to see a timeline of all related activities across all data sources in one view. Which Microsoft Sentinel feature should they use?

Accepted Answer

Incident timeline. Option D is correct because the Incident timeline in Microsoft Sentinel provides a unified chronological view of all alerts and events related to an incident. Option A is wrong because the Investigation graph is more about entity relationships. Option B is wrong because workbooks are for custom dashboards. Option C is wrong because the Hunting page is for proactive searches, not incident investigation.

Answer

Workbooks

Answer

Investigation graph

Answer

Hunting page

Question 2

Refer to the exhibit. An incident in Microsoft Sentinel contains the entities shown. Which additional data source would be most useful to investigate this incident?

Accepted Answer

Microsoft Entra ID sign-in logs. Option B is correct because the incident involves a suspicious sign-in from an unfamiliar IP. Checking Microsoft Entra ID sign-in logs can provide additional context like authentication details, user agent, and risk level. Option A is wrong because Microsoft Defender for Endpoint focuses on endpoints, not cloud sign-ins. Option C is wrong because Microsoft Purview is for compliance and data governance. Option D is wrong because Microsoft Intune is for device management, not sign-in events.

Answer

Microsoft Defender for Endpoint device timeline

Answer

Microsoft Purview audit logs

Answer

Microsoft Intune device compliance logs

Question 3

Which TWO actions are appropriate when handling a confirmed ransomware incident in Microsoft 365?

Accepted Answer

Isolate affected devices from the network.. Correct: Isolate affected devices to prevent spread, and change passwords for compromised accounts. Wrong: Paying ransom is not recommended; restoring from backup is good but not immediate; scanning with antivirus is reactive and may not remove all traces.

Answer

Run a full antivirus scan on all devices.

Answer

Restore encrypted files from backup immediately without investigation.

Answer

Pay the ransom to regain access.

Question 4

You are responding to an incident where a user's Microsoft Entra ID account was compromised and used to send phishing emails internally. You need to prevent further damage. Which two actions should you take first?

Accepted Answer

Revoke the user's sessions. Option A is correct because disabling the account stops immediate use. Option D is correct because revoking sessions ensures any active tokens are invalidated. Option B is wrong because resetting password is secondary. Option C is wrong because blocking external email is too broad. Option E is wrong because it's unnecessary for internal phishing.

Answer

Reset the user's password

Answer

Block all external email from the organization

Answer

Remove the user from all distribution groups

Question 5

After a security incident, you need to preserve evidence from a compromised Microsoft 365 tenant. What is the best method to preserve data?

Accepted Answer

Place the user's mailbox and OneDrive on litigation hold. Option A is correct because litigation hold preserves all data. Option B is wrong because deletion is destructive. Option C is wrong because eDiscovery is for search, not preservation. Option D is wrong because backup is not immediate preservation.

Answer

Take a backup of the entire tenant

Answer

Use Microsoft Purview eDiscovery to search and export

Answer

Export the data to a PST file and delete the original

Question 6

Refer to the exhibit. A SOC analyst runs this Advanced Hunting query in Microsoft Defender XDR to detect potential living-off-the-land (LotL) attacks. An alert is triggered when a device shows multiple occurrences of 'mshta.exe' executing with a remote script. Which additional data source should the analyst check to confirm the attack?

Accepted Answer

DeviceNetworkEvents. The correct answer is D. Network communication from the device to an external IP would confirm a remote connection attempt. The other options are not directly relevant or are redundant.

Answer

DeviceFileEvents

Answer

DeviceLogonEvents

Answer

DeviceRegistryEvents

Question 7

Your organization is using Microsoft Sentinel as a SIEM. You need to forward logs from a legacy firewall that does not support common event format (CEF) or Syslog. Which solution should you use?

Accepted Answer

Deploy a Logstash forwarder with the Sentinel output plugin. Option A is correct because Logstash can parse custom log formats and forward to Sentinel via HTTP Data Collector API. Option B is wrong because Azure Policy is for governance, not log ingestion. Option C is wrong because Logic Apps can process logs but is not designed for high-volume log forwarding. Option D is wrong because Azure Monitor Agent supports Windows/Linux, not custom formats.

Answer

Use Azure Policy to export logs from the firewall

Answer

Install Azure Monitor Agent on the firewall

Answer

Create a Logic App with an HTTP trigger

Question 8

An organization uses Microsoft Sentinel. A security engineer needs to set up automatic response actions when a high-severity incident is created. The engineer wants to trigger a playbook that sends a notification to a Microsoft Teams channel and creates a ticket in ServiceNow. What should the engineer use?

Accepted Answer

An automation rule that triggers a playbook. Option B is correct because automation rules in Microsoft Sentinel can trigger playbooks (Azure Logic Apps) when incidents are created or updated. Option A is wrong because analytics rules create alerts, not incidents directly. Option C is wrong because workbooks are for visualization, not automation. Option D is wrong because watchlists are for correlation, not automated response.

Answer

An analytics rule with incident creation enabled

Answer

A watchlist to detect the incident

Answer

A workbook with a custom alert

Question 9

Refer to the exhibit. An automation rule is configured as shown. When will the playbook be triggered?

Accepted Answer

When a new incident is created with severity High, from Microsoft Defender for Endpoint, and with 'Malware' in the title. Option A is correct because the rule triggers on incident creation with conditions: severity is High, provider is Microsoft Defender for Endpoint, and title contains 'Malware'. All conditions must be met. Option B is wrong because the condition is IncidentCreated, not IncidentUpdated. Option C is wrong because the provider condition restricts to Defender for Endpoint only. Option D is wrong because severity must be High, not any.

Answer

When any incident is created from Microsoft Defender for Endpoint

Answer

When a new incident with any severity contains 'Malware' in the title

Answer

When an incident is updated to High severity

Question 10

An organization uses Microsoft Sentinel with the Microsoft Defender XDR connector. An incident is generated for a user who is suspected of being compromised. The analyst wants to automatically block the user's sign-ins using a playbook. Which connector should the playbook use?

Accepted Answer

Microsoft Entra ID connector. Microsoft Entra ID (Azure AD) connector allows updating user risk or disabling account. Microsoft 365 Defender is for alerts; Teams is for notifications; Sentinel connector is for ingestion.

Answer

Microsoft Sentinel connector

Answer

Microsoft 365 Defender connector

Answer

Microsoft Teams connector

Question 11

You receive an alert in Microsoft Sentinel indicating a potential privilege escalation using the 'AzureHound' tool. You need to determine if the alert is a true positive. What is the first step you should take?

Accepted Answer

Check the user's recent activity and the targeted resource in Microsoft Entra ID audit logs. Option B is correct because the alert provides the user and resource details that should be verified. Option A is wrong because blocking the user may be premature. Option C is wrong because it's too broad. Option D is wrong because it doesn't investigate the specific alert.

Answer

Review the Microsoft Defender for Cloud recommendation for the resource

Answer

Block the user account immediately

Answer

Run a full antivirus scan on all devices

Question 12

You are testing this analytics rule. It should detect encoded PowerShell commands not from System32, but it is generating false positives. What is the most likely cause?

Accepted Answer

The rule does not exclude other legitimate paths like SysWOW64. Option B is correct because the rule does not filter out other legitimate directories like SysWOW64. Option A is wrong because the syntax is correct. Option C is wrong because the rule should not include System32. Option D is wrong because the query is fine.

Answer

The severity should be Informational

Answer

The rule should also include System32

Answer

The query syntax is incorrect

Question 13

Your organization uses Microsoft Sentinel. An incident is created from an Azure Active Directory (now Microsoft Entra ID) sign-in alert. You need to determine if the sign-in was from a compromised token. What data source should you examine?

Accepted Answer

Sign-in logs in Microsoft Entra ID. Option D is correct because sign-in logs show token details such as token issuer and session info. Option A is wrong because audit logs track changes, not sign-in details. Option B is wrong because Azure activity logs are for resource operations. Option C is wrong because Microsoft Defender for Cloud Apps logs are for cloud app sessions, not token details.

Answer

Audit logs in Microsoft Entra ID

Answer

Azure Activity Log

Answer

Microsoft Defender for Cloud Apps logs

Question 14

During an incident response, your team identifies a suspicious PowerShell command executed on multiple devices. Which Microsoft Defender XDR feature should you use to block the command across all endpoints immediately?

Accepted Answer

Indicators of compromise (IoC). Option C is correct because Microsoft Defender XDR's Indicator of Compromise (IoC) allows custom indicators to block file hashes, IPs, URLs, or commands. Option A is wrong because ASR rules are broader and not designed for ad-hoc command blocking. Option B is wrong because Device Control manages hardware peripherals. Option D is wrong because PUA protection targets potentially unwanted applications, not specific commands.

Answer

Potentially Unwanted Application (PUA) protection

Answer

Attack Surface Reduction (ASR) rules

Answer

Device Control policies

Question 15

Which THREE of the following are key steps when containing a ransomware incident in Microsoft Defender XDR? (Select THREE.)

Accepted Answer

Block known malicious file hashes via Indicators of compromise. Options A, B, and D are correct. Isolating devices, blocking indicators, and disabling user accounts are key containment steps. Option C is wrong because restoring from backup is part of recovery, not containment. Option E is wrong because analyzing the root cause is part of investigation after containment.

Answer

Restore encrypted files from backup

Answer

Analyze the root cause of the outbreak

Question 16

An organization uses Microsoft Defender for Endpoint. A user reports that their device is running slowly and they see unexpected pop-ups. The security team suspects malware. What should the team do first to investigate?

Accepted Answer

Run a quick scan on the device from Microsoft Defender for Endpoint. Option A is correct because running a quick scan in Microsoft Defender for Endpoint will detect common malware quickly. Option B is wrong because submitting the file to Microsoft for analysis is not the first step. Option C is wrong because initiating a live response session is more invasive and should be used after initial detection. Option D is wrong because checking the device inventory does not help with active malware.

Answer

Check the device inventory for recent software installations

Answer

Initiate a live response session on the device

Answer

Submit a suspicious file to Microsoft for analysis

Question 17

A security analyst detects a suspicious sign-in from an unusual location using Microsoft Entra ID. The user has not enabled MFA. Which action should the analyst take first to investigate and potentially contain the incident?

Accepted Answer

Disable the user account.. Disabling the user account is the immediate containment action to prevent further unauthorized access while investigation proceeds. Resetting password alone doesn't stop current session; blocking legacy auth is a broader action that may break legitimate services; MFA is enabling but not immediate containment.

Answer

Reset the user's password immediately.

Answer

Enable Conditional Access to block all sign-ins from that location.

Answer

Block legacy authentication for the entire tenant.

Question 18

Which THREE elements are required to create a custom detection rule in Microsoft Sentinel?

Accepted Answer

A KQL query. A custom detection rule requires a KQL query to define logic, a schedule to run the query, and entity mapping to link results to incidents. Alert threshold is optional; playbook is separate.

Answer

An alert threshold

Answer

An automation playbook

Question 19

Which THREE actions should you take when investigating a potential data exfiltration incident detected by Microsoft Defender for Cloud Apps?

Accepted Answer

Create a file policy to detect similar activities in the future. Option A is correct because governance actions can be applied to the user. Option C is correct because SIEM integration provides context. Option D is correct because file policies are key. Option B is wrong because MDI is for on-premises AD. Option E is wrong because cloud discovery is for shadow IT.

Answer

Check Microsoft Defender for Identity for related alerts

Answer

Run a cloud discovery report to identify unsanctioned apps

Question 20

You are investigating a security incident in Microsoft Defender XDR where a user received a phishing email that bypassed Exchange Online Protection. The email contained a link to a credential harvesting page. After the user entered credentials, the attacker used them to sign in from an unusual location. You need to recommend an automated response to prevent further credential theft from similar emails. What should you implement?

Accepted Answer

Create an Attack Simulation Training campaign in Microsoft Defender for Office 365.. Option A is correct because Attack Simulation Training in Microsoft Defender for Office 365 can create and automate phishing campaigns to train users, reducing the risk of credential theft. Option B is wrong because Safe Links protects against malicious links in real time but does not train users. Option C is wrong because Conditional Access policies require an identity provider and are not an automated response to emails. Option D is wrong because Cloud App Security is for shadow IT discovery, not email-based phishing prevention.

Answer

Enable Cloud App Security to detect and block malicious cloud apps.

Answer

Enable Safe Links policy for all users.

Answer

Configure a Conditional Access policy to block sign-ins from unusual locations.