SC-200 Practice Exam 66 — 20 Questions

Question 1

Your organization uses Microsoft Defender for Cloud Apps. You need to block downloads from a specific app for users outside the corporate network. What should you configure?

Accepted Answer

A session policy. A session policy in Microsoft Defender for Cloud Apps allows you to monitor and control user activities in real time by leveraging reverse proxy architecture. To block downloads from a specific app for users outside the corporate network, you configure a session policy with the action 'Block' and apply a condition based on the IP address tag (e.g., 'Not corporate IP range'). This enforces the restriction at the moment the user attempts to download, without affecting other app activities.

Answer

An anomaly detection alert

Answer

A file policy

Answer

An access policy

Question 2

Your organization uses Microsoft Sentinel and Microsoft Defender for Identity. An alert fires for a potential DCSync attack. The incident response team needs to immediately block the source account from performing directory replication. Which action should be taken?

Accepted Answer

Disable the account in Microsoft Entra ID (if synced) or Active Directory.. Immediately disabling the account in Microsoft Entra ID (if synced) or Active Directory is the fastest way to stop the compromised account from performing any directory replication, including DCSync attacks. DCSync abuses the domain controller's replication protocol (MS-DRSR) to request password hashes, and disabling the account blocks all Kerberos and NTLM authentication, effectively halting the attack at the source.

Answer

Use Microsoft Defender for Identity to disable the account.

Answer

Reset the account password and enforce a sign-out.

Answer

Remove the account from the Domain Admins group.

Question 3

A security analyst in Microsoft Sentinel wants to correlate Microsoft Entra ID sign-in logs with IP addresses known to be associated with a threat actor. The threat actor's IPs are stored in a custom table named 'ThreatIntelligence_IP' that is ingested daily. The analyst needs to create an analytics rule that triggers only when a sign-in occurs from one of these IPs AND when the user is not in a list of approved users (stored in another custom table 'ApprovedUsers'). Which KQL query pattern should the analyst use to achieve this correlation and filtering?

Accepted Answer

SigninLogs | join kind=inner ThreatIntelligence_IP on IPAddress | join kind=leftanti (ApprovedUsers | project UserId) on $left.UserId == $right.UserId. It uses a `join kind=inner` to match sign-in logs with threat IPs, ensuring only sign-ins from known malicious IPs are considered. It then applies a `join kind=leftanti` to exclude any user who appears in the ApprovedUsers table, effectively filtering out approved users. This pattern guarantees that the rule triggers only when both conditions are met: the IP is in the threat list and the user is not approved.

Answer

SigninLogs | join ThreatIntelligence_IP on IPAddress | where UserId notin (ApprovedUsers | project UserId)

Answer

SigninLogs | where IPAddress in (ThreatIntelligence_IP | project IPAddress) and UserId !in (ApprovedUsers | project UserId)

Answer

SigninLogs | join ThreatIntelligence_IP on IPAddress | where not(UserId in (ApprovedUsers | project UserId))

Question 4

Which THREE of the following are best practices for performing threat hunting in Microsoft Defender XDR? (Select THREE.)

Accepted Answer

Start with a hypothesis based on threat intelligence or recent incidents.. Option C is correct because effective threat hunting in Microsoft Defender XDR is hypothesis-driven: analysts should begin with a testable hypothesis derived from threat intelligence, known adversary TTPs, or lessons learned from recent incidents, then validate or refute it with data. Option D is correct because advanced hunting in Defender XDR relies on KQL (Kusto Query Language) queries against the unified schema, and combining custom KQL with built-in hunting capabilities (such as built-in queries, hunting graphs, and detection-rule creation from query results) gives both flexibility and efficiency. Option E is correct because Defender XDR's core strength is cross-domain correlation, so hunting should span the unified advanced hunting tables covering devices (DeviceEvents, DeviceProcessEvents), email (EmailEvents, EmailAttachmentInfo), and identities (IdentityLogonEvents, IdentityInfo) to surface multi-stage attacks that a single workload would miss. Option A is not a best practice because relying only on automated detection alerts is reactive alert triage, not proactive hunting for threats that evade existing detections. Option B is not a best practice because restricting hunting to a single data source defeats the purpose of Defender XDR's unified, cross-domain telemetry and hides correlated attack chains.

Answer

Focus only on alerts generated by automated detection rules.

Answer

Limit hunting to a single data source to reduce complexity.

Question 5

Arrange the steps in the correct order to create and save a custom hunting query in Microsoft Sentinel.

Accepted Answer

Open the Microsoft Sentinel workspace in the Azure portal → Navigate to the Hunting blade in the Sentinel menu → Click on the 'New Query' button → Write the KQL query in the query editor → Run the query to verify results → Save the query with a meaningful name and description. Creating a custom hunting query in Microsoft Sentinel requires first accessing the workspace, then navigating to the Hunting blade, clicking 'New Query', writing the KQL query, running it to validate results, and finally saving it with a meaningful name and description. This sequence ensures the query is tested before being stored, aligning with Sentinel's workflow for ad-hoc threat hunting.

Answer

Verify results before configuring the source or rule settings.

Answer

Configure alert grouping before defining the detection query or source.

Answer

Skip validation and enable the rule or plan immediately.

Question 6

A security administrator wants to enable Microsoft Defender for Cloud on all Azure subscriptions to generate security alerts for resources. What is the minimum configuration required on a subscription?

Accepted Answer

Enable enhanced security features on the subscription. Enabling enhanced security features (now called Defender for Cloud plans) on a subscription is the minimum configuration required to generate security alerts. This action activates the Defender for Cloud workload protection plans (e.g., Defender for Servers, Defender for SQL) that provide threat detection and alerts for resources within that subscription. Without this step, the subscription remains in the free tier, which only offers basic security assessments and recommendations, not security alerts.

Answer

Assign Azure Policy to enable Defender for Cloud plans on the subscription

Answer

Install the Azure Monitor Agent on all virtual machines in the subscription

Answer

Enable Microsoft Defender for Cloud at the management group level only

Question 7

Refer to the exhibit. You are analyzing high severity alerts from Microsoft Defender for Endpoint in Microsoft Sentinel. What does this KQL query do?

Accepted Answer

It lists high severity Defender for Endpoint alerts, grouped by name and day, ordered by frequency. The KQL query uses `summarize` with `count()` to group alerts by `AlertName` and `startofday(TimeGenerated)`, then sorts by `count_` descending. This directly produces a list of high severity Defender for Endpoint alerts grouped by name and day, ordered by frequency, matching option C.

Answer

It counts alerts for a specific alert name

Answer

It displays detailed properties of each alert

Answer

It shows all alerts from Defender for Endpoint in the last week

Question 8

Which THREE components are part of Microsoft's unified security operations platform (Microsoft Defender XDR)?

Accepted Answer

Microsoft Defender for Endpoint.. Microsoft Defender XDR is Microsoft's unified security operations platform that integrates signals from across the Microsoft 365 ecosystem. Microsoft Defender for Endpoint is a core component, providing endpoint detection and response (EDR) capabilities, including behavioral-based detection, automated investigation, and threat hunting on Windows, macOS, Linux, Android, and iOS devices. It contributes telemetry such as process creation, network connections, and file events to the unified incident and alert correlation in the Defender XDR portal.

Answer

Microsoft Intune.

Answer

Microsoft Sentinel.

Question 9

Your organization uses Microsoft Sentinel and Microsoft Defender XDR. You want to ensure that incidents generated in Microsoft 365 Defender are automatically synchronized to Microsoft Sentinel. What should you configure?

Accepted Answer

Enable the Microsoft Defender XDR data connector in Microsoft Sentinel. The Microsoft Defender XDR data connector in Microsoft Sentinel is specifically designed to synchronize incidents from Microsoft 365 Defender into Sentinel. When enabled, this connector uses the Microsoft Graph Security API to ingest incidents, alerts, and evidence, ensuring automatic and bidirectional synchronization without requiring additional automation rules or analytics queries.

Answer

Set up an automation rule to import incidents

Answer

Configure the Microsoft Sentinel connector in Microsoft Defender XDR

Answer

Create an analytics rule to query Defender XDR data

Question 10

Which THREE components are required to enable automated investigation and response (AIR) in Microsoft Defender XDR for alerts from Microsoft Defender for Identity?

Accepted Answer

Automated investigation and response enabled in Microsoft Defender XDR.. Automated investigation and response (AIR) must be explicitly enabled in Microsoft Defender XDR to allow the platform to automatically respond to alerts. Without this setting enabled, even if other components are in place, the system will not trigger automated actions for Defender for Identity alerts.

Answer

Microsoft Sentinel workspace configured to ingest Defender for Identity alerts.

Answer

A custom playbook in Microsoft Sentinel.

Question 11

Refer to the exhibit. The KQL query runs in Microsoft Sentinel and returns no results. The analyst expects to see failed logon attempts. What is the most likely reason?

Accepted Answer

The ResultType field does not exist in IdentityLogonEvents.. The query filters on ResultType == 'Failed', but the field is likely named 'Result' or uses different values like 'Failure'. Also, the table 'IdentityLogonEvents' may not exist; it might be 'AADSignInEventsBeta' or similar. But the most common issue is incorrect field name for result type.

Answer

The Application filter is incorrect.

Answer

The summarize operator is misused.

Answer

The TimeRange variable is too short.

Question 12

Which TWO remediation actions are available in Microsoft Defender for Endpoint when responding to a malware infection?

Accepted Answer

Run a full antivirus scan. Option A (Run a full antivirus scan) is correct because Microsoft Defender for Endpoint's device response actions include initiating a full Microsoft Defender Antivirus scan on the endpoint to detect and remediate residual malware artifacts beyond what was already found. Option E (Isolate the device from the network) is correct because device isolation is a core Defender for Endpoint live response action that cuts the endpoint off from the network (while optionally allowing Outlook/Teams communication) to contain the infection and prevent lateral movement. Option B is not a Defender for Endpoint remediation action; disabling user accounts is handled through identity services such as Active Directory or Entra ID, not the MDE device response console. Option C is not offered as an MDE response action; factory reset is a device-management operation (e.g., Intune), not a Defender for Endpoint remediation. Option D is incorrect because blocking an application in Defender for Cloud Apps is a Cloud App Security (CASB) control for cloud app sessions, not a Defender for Endpoint endpoint remediation action.

Answer

Disable the user account

Answer

Reset the device to factory settings

Answer

Block the application in Defender for Cloud Apps

Question 13

You are a threat hunter using Microsoft Sentinel. You have ingested syslog data from a Palo Alto firewall. You want to create a scheduled query rule that alerts when more than 10 outbound connections to a known bad IP address occur within 5 minutes. Which KQL function should you use to summarize the count?

Accepted Answer

summarize count() by SourceIp, DestinationIp. The `summarize` operator is the KQL aggregation function that groups rows by one or more columns and computes aggregate values such as `count()`, `sum()`, `avg()`, etc. In this scenario, `summarize count() by SourceIp, DestinationIp` produces a row per unique SourceIp/DestinationIp pair with the number of outbound connection events, which can then be filtered with a `where` clause (e.g., `where Count > 10`) to trigger the Sentinel scheduled query rule. This directly satisfies the requirement to count connections within the 5-minute rule window.

Answer

project SourceIp, DestinationIp

Answer

extend Count = 1

Answer

join kind=inner (Syslog)

Question 14

An organization uses Microsoft Defender for Office 365. A security analyst is investigating a phishing email that was delivered to a user. The user clicked the link, but it was blocked by Defender for Office 365 at the time of click. The analyst needs to view the full click verdict, including the specific block action (e.g., blocked by custom block list). Where can the analyst find this information?

Accepted Answer

The email entity page in Microsoft 365 Defender. The email entity page in Microsoft 365 Defender provides the full click verdict for a specific email, including the exact block action (e.g., blocked by custom block list, blocked by URL reputation). This page aggregates all detection and verdict details for a single email, making it the correct location for the analyst to view the specific block action at time of click.

Answer

Threat Explorer in Microsoft 365 Defender

Answer

The advanced hunting table EmailEvents

Answer

The Attack simulation training dashboard

Question 15

Your organization uses Microsoft Sentinel and Microsoft Defender XDR. You need to ensure that an external user from a partner organization can access a specific Sentinel workbook without having access to the entire Log Analytics workspace. What should you do?

Accepted Answer

Use Azure AD B2B collaboration to invite the external user and assign the Sentinel Reader role on the workbook.. Microsoft Entra B2B collaboration allows you to invite an external user from a partner organization into your Microsoft Entra ID tenant. By assigning the Sentinel Reader role specifically on the workbook resource (not the workspace), the user can view the workbook without gaining access to the underlying Log Analytics workspace data or other Sentinel resources. This meets the requirement of granular, scoped access.

Answer

Create a new Log Analytics workspace dedicated to the external partner and deploy the workbook there.

Answer

Share the workbook as a shared dashboard in the Azure portal.

Answer

Add the external user to the resource group containing the workspace with Reader role.

Question 16

Which THREE actions are recommended when conducting a threat hunting exercise in Microsoft Sentinel using the MITRE ATT&CK framework?

Accepted Answer

Use the hunting queries from the Microsoft Sentinel Content hub as a starting point.. Options B, D, and E are recommended actions. B: Using hunting queries from the Microsoft Sentinel Content hub provides a validated starting point. D: Documenting findings and updating detection rules helps improve future hunts. E: Mapping hypotheses to MITRE ATT&CK tactics and techniques ensures comprehensive coverage. A is incorrect because focusing only on unseen techniques ignores known threats that may still be active. C is incorrect because relying exclusively on automated detection rules can miss advanced persistent threats that require manual hunting.

Answer

Focus only on techniques that have not been seen in your environment before.

Answer

Rely exclusively on automated detection rules to identify threats.

Question 17

During a security incident, you need to block a malicious IP address at the network level for all Azure resources in a subscription. You have Azure Firewall deployed. What is the MOST efficient method to implement the block?

Accepted Answer

Use Azure Firewall Manager to create a global deny rule for the IP address across all firewalls.. Azure Firewall Manager provides centralized management of Azure Firewall policies across multiple firewalls, allowing you to create a global deny rule that applies to all firewalls in a subscription. This is the most efficient method because it avoids configuring individual firewalls or NSGs, and it ensures consistent enforcement at the network level for all Azure resources.

Answer

Block the IP using Microsoft Defender for Cloud's adaptive network hardening.

Answer

Create a network security group (NSG) rule on each virtual network subnet to deny the IP.

Answer

Add a rule to the Azure Firewall policy to deny outbound traffic to the IP address.

Question 18

Order the steps to investigate a user account compromise using Microsoft Sentinel incidents.

Accepted Answer

Review incident details, then analyze associated alerts and user behavior analytics, then perform advanced hunting queries for indicators, then remediate and close the incident.. Investigation starts with incident details, then reviewing alerts and behavior analytics, followed by deep querying, and finally remediation.

Answer

Perform advanced hunting queries for indicators, then review incident details, then analyze associated alerts and user behavior analytics, then remediate and close the incident.

Answer

Analyze associated alerts and user behavior analytics, then review incident details, then perform advanced hunting queries for indicators, then remediate and close the incident.

Answer

Remediate and close the incident, then review incident details, then analyze associated alerts and user behavior analytics, then perform advanced hunting queries for indicators.

Question 19

Your organization uses Microsoft Sentinel. A security analyst reports that an incident was automatically closed without investigation. You need to identify why the incident was closed automatically. Which Sentinel feature should you review?

Accepted Answer

Automation rules. Automation rules in Microsoft Sentinel allow you to define automated responses to incidents, including automatically closing them based on specific conditions (e.g., severity, title, or entity). If an incident was closed without investigation, an automation rule likely triggered a closure action, such as setting the status to 'Closed' with a specific classification. Reviewing the automation rules list and their trigger conditions will reveal which rule caused the automatic closure.

Answer

Analytics rules

Answer

Playbooks

Answer

Workbooks

Answer

Watchlists

Question 20

A security analyst detects a suspicious login from an unusual location for a user in Microsoft Defender XDR. The analyst needs to investigate and contain the incident. Which TWO actions should be taken?

Accepted Answer

Disable the user account from Microsoft Entra ID.. Option A is correct because disabling the user account in Microsoft Entra ID immediately blocks the compromised identity from authenticating, which is the fastest containment action to stop further unauthorized access during a suspicious-login incident. Option C is correct because reviewing the user's sign-in logs and Identity Protection risk level in Microsoft Entra ID provides the investigative context — source IP, location, device, and whether the sign-in was flagged as risky — needed to confirm compromise before or alongside containment. Option B is not the right primary action because advanced hunting is a proactive threat-hunting tool, not the standard investigative/containment step for a specific flagged sign-in. Option D is not appropriate here because automated investigation playbooks are triggered by specific alerts or incidents and are not the analyst's direct manual containment action. Option E is not the best choice because a password reset alone does not immediately terminate active sessions or block the account, so it is weaker containment than disabling the account.

Answer

Create a custom hunting query in Microsoft 365 Defender advanced hunting.

Answer

Run an automated investigation playbook.

Answer

Reset the user's password.