SC-200 Practice Exam 67 — 20 Questions

Question 1

A security analyst is reviewing an email-related incident in Microsoft 365 Defender. The analyst wants to see the full delivery details, including the sender IP, authentication status, and the reason why the email was determined to be malicious. Which section of the email entity page should the analyst open?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Detection details. The Detection details section of the email entity page in Microsoft 365 Defender provides comprehensive information about why an email was determined to be malicious, including the sender IP address, authentication status (SPF, DKIM, DMARC results), and the specific detection technology or policy that triggered the verdict. This section consolidates the full delivery details and threat analysis into a single view, making it the correct choice for the analyst's needs.

Answer

Details

Answer

Timeline

Answer

Preview

Question 2

Your organization uses Microsoft Sentinel with UEBA enabled. You notice that the UEBA entity pages are not showing any insights for Azure resources. What is the most likely cause?

Accepted Answer

The resource context data is not being ingested from Azure Resource Manager.. UEBA entity pages for Azure resources rely on resource context data, which includes metadata about Azure resources such as virtual machines, storage accounts, and their activities. This data is ingested from Azure Resource Manager (ARM) via the Azure Activity data connector. If the resource context data is not being ingested, UEBA cannot correlate activities to specific Azure resources, resulting in no insights on entity pages. Option D correctly identifies this missing data source as the root cause.

Answer

UEBA is not enabled for the workspace.

Answer

The user accounts are not synchronized with Microsoft Entra ID.

Answer

The Azure Activity data connector is not configured.

Question 3

A threat hunter is investigating a potential data exfiltration via DNS tunneling. Which Microsoft Defender XDR advanced hunting table should the analyst primarily use to examine DNS queries from endpoints?

Accepted Answer

DeviceEvents. In Microsoft Defender XDR advanced hunting, raw DNS query telemetry from endpoints is recorded in the DeviceEvents table, where events with ActionType equal to 'DnsQuery' include the queried domain (in AdditionalFields) and the initiating process. DeviceNetworkEvents records network connection events (RemoteIP, RemoteUrl, RemotePort, etc.) and does not contain a DnsQuery field or per-query DNS resolution data. Therefore, to examine DNS queries from endpoints for suspected DNS tunneling, the analyst should use DeviceEvents filtered on ActionType == 'DnsQuery'.

Answer

IdentityLogonEvents

Answer

AlertInfo

Answer

EmailEvents

Question 4

You are investigating a security incident in Microsoft Sentinel where a user reported receiving a phishing email with a malicious attachment. You need to identify all users who received the same email within the last 24 hours. Which KQL query should you use?

Accepted Answer

EmailEvents | where SenderFromAddress == 'attacker@example.com' and Subject == 'Invoice' and Timestamp > ago(24h) | project RecipientEmailAddress. To find all users who received the same phishing email, you must pivot on the email's identifying attributes — sender and subject — rather than the reported recipient. Querying EmailEvents filtered by SenderFromAddress, Subject, and a 24-hour window, then projecting RecipientEmailAddress, returns every recipient of that campaign.

Answer

EmailEvents | where RecipientEmailAddress == 'user@contoso.com' and Timestamp > ago(24h) | project SenderFromAddress, Subject

Answer

EmailUrlInfo | where Url == 'http://malicious.com' | project RecipientEmailAddress

Answer

EmailAttachmentInfo | where FileName == 'malicious.doc' | project RecipientEmailAddress

Question 5

In Microsoft 365 Defender, an analyst is investigating an incident involving a malicious script. The analyst wants to see the command-line arguments executed by the script on a specific device. Which Advanced Hunting table should the analyst query?

Accepted Answer

DeviceProcessEvents. The DeviceProcessEvents table in Advanced Hunting captures process creation events, including the command-line arguments used to execute a process. Since the analyst needs to see the command-line arguments executed by a malicious script on a specific device, querying DeviceProcessEvents is the correct approach because it records the ProcessCommandLine column for each process creation event.

Answer

DeviceNetworkEvents

Answer

DeviceFileEvents

Answer

DeviceEvents

Question 6

Which TWO are recommended first steps when responding to a confirmed ransomware incident in Microsoft Defender XDR?

Accepted Answer

Isolate affected devices using Microsoft Defender for Endpoint. The correct answers are D and E. Isolating affected devices using Microsoft Defender for Endpoint (D) and revoking user sessions to require reauthentication (E) are immediate containment steps to prevent further spread. Assessing financial impact (A) is part of investigation, not first response. Disabling all user accounts (B) is too disruptive and not recommended as a first step. Running a full antivirus scan (C) may alert the attacker and is not a containment measure.

Answer

Assess the financial impact of the incident

Answer

Disable all user accounts

Answer

Run a full antivirus scan on all devices

Question 7

Your organization uses Microsoft Defender for Endpoint. You need to ensure that when a malware alert is generated, an automated investigation is triggered. What should you configure?

Accepted Answer

Enable automated investigation and remediation in the Microsoft 365 Defender portal.. Enabling automated investigation and remediation in the Microsoft 365 Defender portal is the specific configuration that triggers an automated investigation when a malware alert is generated by Microsoft Defender for Endpoint. This feature allows the security operations team to define the automation level (e.g., full, semi, or no automation) for alerts, ensuring that when a malware alert fires, the system automatically initiates an investigation to contain and remediate the threat without manual intervention.

Answer

Configure the Action center settings.

Answer

Create custom indicators of compromise (IOCs).

Answer

Use threat analytics to trigger investigations.

Question 8

An analyst runs this PowerShell script to query Microsoft Sentinel data. The query returns no results. What is the most likely reason?

Accepted Answer

No events matched the specific combination of process name and command line in the last 7 days. The query syntax is valid (e.g., using where and summarize appropriately), the API endpoint and timestamp filter are standard for Microsoft Sentinel queries. The most probable reason for no results is that no events with rundll32.exe and javascript in the command line occurred within the specified 7-day window. Options A, B, and D describe issues that would typically cause errors, not just empty results, making C the most likely explanation.

Answer

The timestamp filter is invalid; it should use TimeGenerated instead of Timestamp

Answer

The query syntax is incorrect; summarize cannot be used after where

Answer

The API endpoint URL is incorrect; it should be /v2/workspaces

Question 9

Your organization uses Microsoft Sentinel. You need to ensure that an incident is automatically assigned to a specific analyst when it is created. What should you create?

Accepted Answer

An automation rule with an 'Assign incident' action.. An automation rule in Microsoft Sentinel can be configured to run when an incident is created and includes an 'Assign incident' action that automatically assigns the incident to a specific analyst or group. This is the native, no-code method for incident assignment without requiring external logic or playbooks.

Answer

An analytics rule with an output to a specific user.

Answer

A playbook triggered by incident creation.

Answer

A watchlist that maps incident types to owners.

Question 10

Your organization uses Microsoft Sentinel and Microsoft Defender XDR. You receive an alert about a suspicious sign-in from an IP address associated with a known malicious actor. The sign-in was for a privileged account. You need to immediately contain the incident. What should you do first?

Accepted Answer

Disable the user account in Microsoft Entra ID.. Disabling the user account in Microsoft Entra ID immediately stops the attacker from using the compromised credentials. Option A is wrong because resetting the password might not be fast enough if the attacker has an active session. Option C is wrong because creating an analytics rule does not contain the incident immediately; it only helps detect similar sign-ins in the future. Option D is wrong because blocking the IP address in the firewall is reactive and may not be effective if the attacker uses a different IP.

Answer

Reset the user's password.

Answer

Create a custom analytics rule in Sentinel to detect similar sign-ins.

Answer

Block the IP address in the firewall.

Question 11

Your organization uses Microsoft Defender for Office 365. You need to ensure that when a user reports a phishing email, the email is automatically analyzed and remediated. What should you configure?

Accepted Answer

Configure User Reported Message settings to use the built-in reporting tool and automated investigation.. Configuring User Reported Message settings in Microsoft 365 Defender to use the built-in reporting tool and enable automated investigation ensures that when a user reports a phishing email, it is routed to Microsoft, analyzed, and remediated automatically (e.g., moved to quarantine, soft-deleted, or blocked for other recipients). This is the purpose-built feature for the scenario. It ties the user report directly into the automated investigation and response (AIR) pipeline.

Answer

Configure Anti-Phish policy to move messages to quarantine.

Answer

Enable Safe Attachments policy.

Answer

Enable Safe Links policy.

Question 12

Your organization has a Microsoft Sentinel workspace that ingests data from multiple sources. You notice that the cost of data ingestion is higher than expected. You need to reduce costs without affecting security visibility. Which action should you take?

Accepted Answer

Configure specific tables to use the Basic Logs tier instead of Analytics Logs.. Configuring specific tables to use the Basic Logs tier reduces ingestion costs for high-volume, low-security-value data (e.g., verbose diagnostics or debug logs) while retaining full analytical capabilities for security-critical tables in the Analytics Logs tier. Basic Logs are charged at a lower ingestion rate and support simple queries, but they lack the full KQL and indexing features of Analytics Logs, so you must carefully select which tables to downgrade to avoid impacting security visibility.

Answer

Reduce the data retention period for all tables to 30 days.

Answer

Disable the collection of Windows event logs from domain controllers.

Answer

Export logs to Azure Storage and use Azure Data Explorer for analysis.

Question 13

An organization uses Microsoft Defender for Cloud and needs to track compliance with internal security policies that are not covered by any built-in regulatory standard. They want to see the compliance status for these internal controls in the Regulatory Compliance dashboard alongside other standards. What should they configure?

Accepted Answer

Create a custom Azure Policy initiative with the required controls and assign it to the relevant scopes.. To track compliance with internal security policies not covered by built-in regulatory standards, you must create a custom Azure Policy initiative that defines the required controls and assign it to the relevant scopes. Defender for Cloud automatically evaluates resources against assigned initiatives and surfaces the compliance status in the Regulatory Compliance dashboard alongside built-in standards, allowing unified visibility.

Answer

Create a custom assessment in the Microsoft Defender for Cloud recommendations dashboard.

Answer

Use the Secure Score API to develop a custom dashboard outside Defender for Cloud.

Answer

Enable the "Custom compliance" feature in Defender for Cloud's pricing tier.

Question 14

Your organization uses Microsoft Sentinel with UEBA enabled. You need to investigate a potential insider threat where a user is accessing sensitive data outside of business hours. Which three built-in UEBA entities should you review?

Accepted Answer

User account. User account (B) is correct because UEBA in Microsoft Sentinel profiles user behavior to detect anomalies such as accessing sensitive data outside business hours. The user account entity is the primary identity used to correlate activities, logon events, and data access patterns, enabling the detection of insider threats based on deviations from established baselines.

Answer

Azure subscription

Answer

Resource group

Question 15

You have a Microsoft Sentinel automation rule as shown in the exhibit. The rule triggers a playbook that blocks a user in Microsoft Entra ID. The rule is enabled but never fires. What is the most likely reason?

Accepted Answer

The playbook does not have a Microsoft Sentinel trigger.. The automation rule is configured to trigger a playbook, but for a playbook to be invoked by a Microsoft Sentinel automation rule, it must have a Microsoft Sentinel trigger (e.g., 'When a response to a Microsoft Sentinel incident is triggered'). Without this trigger, the playbook cannot receive the incident context from Sentinel, so the rule will never fire even if all other conditions are met.

Answer

The automation rule is disabled.

Answer

No incidents with High severity are created.

Answer

The JSON syntax is invalid.

Question 16

Which TWO response actions are available in Microsoft Defender for Endpoint for a compromised device? (Choose two.)

Accepted Answer

Run a full antivirus scan. Options B and D are correct because Microsoft Defender for Endpoint includes predefined response actions such as running a full antivirus scan and isolating a device from the network. Option A is incorrect because disabling the user account is an identity mitigation action in Microsoft Entra ID, not a device response in Defender for Endpoint. Option C is incorrect because changing Windows Firewall rules is not a standard response action in Defender for Endpoint. Option E is incorrect because resetting a device to factory defaults is not a supported response action.

Answer

Disable the user account

Answer

Change the Windows Firewall rules

Answer

Reset the device to factory defaults

Question 17

Which TWO are immediate containment actions in Microsoft Sentinel for a compromised Azure VM? (Choose two.)

Accepted Answer

Apply an NSG to block all inbound and outbound traffic. (Apply an NSG to block all inbound and outbound traffic), an immediate containment action that isolates the compromised Azure VM by blocking network traffic. Option A (install anti-malware extension) is a remediation step, not immediate containment. Option C (reset password) does not stop an active attack and may interfere with investigation. Option D (initiate VM backup) is not containment and could preserve compromised data. Option E (stop the VM using an automation rule) is not a valid Sentinel containment action; automation rules trigger playbooks and do not directly stop VMs, and stopping the VM can destroy volatile evidence.

Answer

Install anti-malware extension

Answer

Reset the VM administrator password

Answer

Initiate a VM backup

Answer

Stop the VM using an automation rule

Question 18

Refer to the exhibit. You are reviewing an automation rule in Microsoft Sentinel. What will happen when a new incident with severity Medium is created?

Accepted Answer

The rule will not trigger because severity is Medium. The automation rule is configured with a condition that triggers only when the incident severity is 'High'. Since the new incident has a severity of 'Medium', the condition is not met, and the rule does not trigger. Automation rules in Microsoft Sentinel evaluate conditions based on the incident's properties at creation time; if the condition fails, no actions (including playbook execution or incident creation) occur.

Answer

The rule will trigger and create a new incident

Answer

The rule will trigger and run the playbook

Answer

The rule will update the incident severity to High

Answer

The rule will trigger but skip the playbook

Question 19

A security analyst is investigating a potential malware outbreak detected by Microsoft 365 Defender. The analyst needs to identify all devices that have executed a specific parent process with a given ProcessId. Which column in the DeviceProcessEvents table should be used to find processes whose parent is the specified process?

Accepted Answer

ParentProcessId. The ParentProcessId column in the DeviceProcessEvents table stores the process ID (PID) of the parent process that initiated the current process. To find all child processes spawned by a specific parent process with a known ProcessId, you query the ParentProcessId column for that value. This directly links child processes to their parent, enabling the analyst to trace the malware's execution chain.

Answer

InitiatingProcessId

Answer

ProcessId

Answer

LogonId

Question 20

Your organization uses Microsoft Sentinel in a multi-workspace environment with a central SOC. You need to create a single incident view across all workspaces while minimizing latency. What should you deploy?

Accepted Answer

Enable incident across workspaces in Microsoft Sentinel. Microsoft Sentinel's 'Incident across workspaces' feature (enabled via the 'SecurityIncident' table union) provides a single incident view across multiple workspaces with minimal latency by leveraging built-in cross-workspace incident synchronization. This avoids the overhead of manual queries or external orchestration, ensuring near-real-time incident correlation for a central SOC.

Answer

Use cross-workspace queries in a workbook

Answer

Merge all workspaces into one Log Analytics workspace

Answer

Set up Azure Lighthouse and connect workspaces