SC-200 Practice Exam 68 — 20 Questions

Question 1

Which THREE of the following are key steps when containing a ransomware incident in Microsoft Defender XDR? (Select THREE.)

Accepted Answer

Block known malicious file hashes via Indicators of compromise. Blocking malicious file hashes via indicators of compromise (B), disabling compromised user accounts (C), and isolating compromised devices (E) are key steps in containing a ransomware incident. Restoring from backup (A) is part of recovery, and analyzing root cause (D) is part of investigation, both of which occur after containment.

Answer

Restore encrypted files from backup

Answer

Analyze the root cause of the outbreak

Question 2

Your organization uses Microsoft 365 Defender. During an incident, which TWO actions can be taken directly from the Microsoft 365 Defender portal to remediate a compromised email account?

Accepted Answer

Soft delete malicious emails from the user's mailbox.. Option C is correct because the Microsoft 365 Defender portal (via the Email & collaboration > Explorer/Threat Explorer remediation actions) lets responders soft delete malicious emails from a user's mailbox, moving them to the Recoverable Items folder so they can be purged or restored. Option D is correct because the portal's action center and user investigation page provide 'Reset password' and 'Revoke sessions' actions, which force a password change and invalidate existing authentication tokens to cut off an attacker's access. Option A is not a direct remediation action offered in the Defender portal for a compromised account, and mailbox delegation is managed through Exchange admin center/PowerShell. Option B is a preventive tenant-level allow/block list change, not an account remediation action, and it targets a sender address rather than the compromised mailbox. Option E is not a supported action; mail flow cannot be selectively 'isolated' for a mailbox from the Defender portal.

Answer

Remove mailbox delegation permissions.

Answer

Block the sender's email address in the tenant's allow/block list.

Answer

Isolate the user's mailbox from receiving emails.

Question 3

Based on the ARM template snippet, what is the purpose of this analytics rule?

Accepted Answer

To detect brute force attacks on user accounts. The query counts failed logon events (EventID 4625) and triggers when the count exceeds a threshold (e.g., 5) within a time window, indicating multiple failed attempts. Option B is correct because a high count of failed logon attempts from the same account or IP is a classic sign of a brute force attack. Option C is incorrect because EventID 4625 is a failed logon, not a successful login. Option D is incorrect because the query does not include EventID 4740 (account lockout) and does not check for lockouts.

Answer

To detect multiple failed logon attempts within a time window

Answer

To detect successful logins by account

Answer

To detect account lockouts

Question 4

Which TWO actions should you take to ensure that Microsoft Sentinel can detect and respond to threats across your multicloud environment, including AWS and GCP?

Accepted Answer

Create analytics rules in Microsoft Sentinel to detect threats from the ingested multicloud logs.. Analytics rules in Microsoft Sentinel define the conditions under which alerts are generated from ingested data. Without these rules, the raw logs from AWS S3 and GCP Pub/Sub would be stored but not evaluated for threats, rendering detection ineffective. Creating custom or built-in analytics rules is essential to transform ingested multicloud logs into actionable security incidents.

Answer

Use Azure Policy to deploy the connectors automatically.

Answer

Enable the Microsoft Defender XDR connector for AWS and GCP.

Answer

Create a separate Microsoft Sentinel workspace for each cloud provider.

Question 5

Your SOC team uses Microsoft Sentinel with multiple workspaces across regions. You need to implement a solution that allows analysts to query all workspaces from a single location without moving data. Which feature should you configure?

Accepted Answer

Use cross-workspace queries with workspace() expressions in KQL.. Cross-workspace queries using the `workspace()` expression in KQL allow analysts to query multiple Log Analytics workspaces from a single query context without moving or centralizing the data. This is the native Microsoft Sentinel feature designed for multi-workspace environments, enabling seamless querying across regions while keeping data in its original workspace.

Answer

Export data to Azure Data Explorer and query there.

Answer

Create a single Log Analytics workspace and have all data sources send logs there.

Answer

Configure Azure Lighthouse to manage all workspaces.

Question 6

Which THREE of the following are indicators of a potential pass-the-hash attack that a threat hunter should investigate in Microsoft Defender for Identity?

Accepted Answer

Multiple failed logon attempts followed by a successful logon from the same IP. Option B is correct because a burst of failed logons immediately followed by a success from the same source IP is a classic credential-stuffing/brute-force precursor that often precedes or accompanies pass-the-hash, where stolen NTLM hashes are replayed to authenticate. Option C is correct because pass-the-hash relies on NTLM authentication, and anomalous NTLM traffic originating from a domain controller (which should normally use Kerberos for domain auth) is a strong Defender for Identity signal of hash replay or lateral movement. Option D is correct because LogonType 9 (NewCredentials) with Event ID 4624 indicates a process is using explicit alternate credentials via NTLM, which is exactly how tools like Mimikatz or PsExec execute pass-the-hash with a stolen hash rather than a password. Option A is not correct because a high volume of TGS requests points to Kerberoasting or ticket-based attacks, not pass-the-hash, which uses NTLM rather than TGS tickets. Option E is not correct because CPU spikes on domain controllers are a generic performance/availability indicator and are not a specific behavioral signature of pass-the-hash in Defender for Identity.

Answer

High volume of TGS requests from a single user

Answer

Anomalous spike in CPU usage on domain controllers

Question 7

During a threat hunt, you identify a suspicious process that spawned from Microsoft Word with a command-line argument containing ' -enc '. Which hunting technique is most appropriate to investigate this further?

Accepted Answer

Review the PowerShell script block logging. The '-enc' argument is a well-known PowerShell parameter indicating a Base64-encoded command, often used by attackers to obfuscate malicious scripts. In Microsoft Defender for Endpoint and SC-200 hunting scenarios, the most appropriate technique is to review PowerShell script block logging (Event ID 4104), which records the decoded script block content and provides the actual PowerShell code executed. This allows the analyst to understand the intent and actions of the suspicious process without manually decoding the argument. While manual decoding can be useful, script block logging is the standard hunting technique that surfaces the decoded command directly in the telemetry.

Answer

Initiate network traffic analysis for the host

Answer

Check the file hash against threat intelligence feeds

Answer

Decode the base64-encoded command-line argument

Question 8

Your organization has Microsoft Sentinel deployed across multiple workspaces for different business units. The security team wants to view a unified incident queue across all workspaces. What should you implement?

Accepted Answer

Create cross-workspace queries and use the incident view with workspace references. Microsoft Sentinel supports cross-workspace incident viewing through the use of workspace references in queries and the unified incident view. By configuring cross-workspace queries and enabling the incident view with workspace references, the security team can aggregate and display incidents from multiple Sentinel workspaces in a single queue, providing a unified view without moving data.

Answer

Use Microsoft Defender XDR portal to view all incidents

Answer

Use Azure Lighthouse to manage multiple workspaces

Answer

Configure a single workspace to receive all incidents

Question 9

Refer to the exhibit. You are viewing an incident in Microsoft Sentinel via the API. The incident is missing an owner. Which automation rule action would assign this incident to the SOC manager?

Accepted Answer

Assign incident to: SOC Manager. The 'Assign incident to' action in Microsoft Sentinel automation rules directly changes the incident's owner property. By selecting 'SOC Manager' as the value, the rule sets the incident's owner field to that specific user or group, which is the exact requirement to resolve the missing owner.

Answer

Change incident status to: Active

Answer

Run playbook (SimplePlaybook)

Answer

Add tags: ["Malware", "Endpoint"]

Question 10

Refer to the exhibit. You have created an automation rule in Microsoft Sentinel with the above configuration. The playbook isolates the device and disables the user account. After enabling the rule, you notice that a low-severity incident containing an alert titled 'Ransomware Behavior' did NOT trigger the automation. What is the most likely reason?

Accepted Answer

The incident severity is Low, but the rule only triggers on High severity. Microsoft Sentinel automation rules have a condition set that includes severity; if the rule is configured to trigger only on High-severity incidents, a Low-severity incident will never fire the rule regardless of the alert title. The exhibit shows the rule's conditions, and the most likely mismatch is the severity filter. The playbook itself is not the issue because the rule simply never evaluated to true for this incident.

Answer

The 'ContainsAny' operator does not match single values

Answer

The automation rule does not have permission to run the playbook

Answer

The playbook ID is invalid

Question 11

Your SOC uses Microsoft Defender XDR. You need to create a custom detection rule that triggers when a specific process is executed on multiple devices within an hour. Which feature should you use?

Accepted Answer

Microsoft Defender XDR custom detection rule. Microsoft Defender XDR custom detection rules are built on top of Advanced Hunting and allow you to define conditions that trigger an alert when a specific process is executed across multiple devices within a defined time window (e.g., one hour). This feature is native to Defender XDR and does not require a separate SIEM like Sentinel, making it the correct choice for creating a detection rule that operates within the Defender XDR environment.

Answer

Advanced hunting query

Answer

Microsoft Sentinel scheduled analytics rule

Answer

Attack simulation training

Question 12

Your organization is implementing Microsoft Sentinel. You need to design a solution to automatically disable a user account in Microsoft Entra ID when a high-severity incident is triggered in Microsoft Sentinel related to that user. Which component should you use?

Accepted Answer

A playbook that uses the Microsoft Graph API to disable the user.. A playbook is the correct component because it is an automated workflow that can be triggered by a Microsoft Sentinel incident. By using the Microsoft Graph API within the playbook, you can programmatically disable a user account in Microsoft Entra ID, which is the required action for a high-severity incident. This aligns with the need for an automated response that integrates Sentinel with identity management.

Answer

An analytics rule that includes a query to disable the user.

Answer

An automation rule that runs a PowerShell script on a hybrid worker.

Answer

A workbook that triggers a webhook to disable the user.

Question 13

During an incident involving a compromised Azure VM, the security team wants to capture a memory dump for forensic analysis. The VM is running Windows Server 2022. What is the recommended approach?

Accepted Answer

Initiate a live response session on the VM and run the 'dump memory' command.. Microsoft Defender for Endpoint's live response capability provides a built-in 'dump memory' command that captures a full memory dump of the compromised Azure VM for forensic analysis. This is the recommended approach as it allows memory acquisition without requiring additional tools or direct RDP/PSRemoting access, preserving the forensic integrity of the volatile data.

Answer

Use Azure Backup to create a VM snapshot.

Answer

Establish a PowerShell remote session and run 'Get-Process | Export-CliXML'.

Answer

Use Azure Disk Encryption to export the disk.

Question 14

You are a security operations analyst for Contoso Ltd. The company uses Microsoft Sentinel as its SIEM and Microsoft Defender for Cloud Apps for SaaS security. You are tasked with threat hunting for potential data exfiltration via Microsoft SharePoint Online. You need to create a hunting query that identifies users who have downloaded an unusually high number of files from SharePoint within a short time window compared to their historical baseline. The query should be run in Microsoft Sentinel using the OfficeActivity table. Which of the following approaches should you take?

Accepted Answer

Query the OfficeActivity table, filter for Operation=='FileDownloaded', summarize by UserId and bin(TimeGenerated, 1h), then use a join with a historical baseline table to detect deviations. The OfficeActivity table in Microsoft Sentinel contains audit logs for Microsoft 365 services, including SharePoint Online. Filtering for Operation=='FileDownloaded' and summarizing by UserId and time bin allows you to count downloads per user per hour. Joining with a historical baseline table (e.g., created via a separate query or using the 'summarize' operator over a longer period) enables detection of anomalies compared to each user's normal behavior.

Answer

Use the HuntingBookmark table to search for user activity

Answer

Query the CommonSecurityLog table for SharePoint events and look for high volumes of outbound traffic

Answer

Query the SecurityAlert table for alerts related to data exfiltration

Question 15

You are threat hunting for indicators of compromise related to a known malware family. Which data source in Microsoft Defender XDR would provide the most direct evidence of malware execution on endpoints?

Accepted Answer

DeviceProcessEvents. DeviceProcessEvents captures process creation events, which directly indicate malware execution. Option A is incorrect because EmailEvents only covers email data, not execution events. Option C (IdentityLogonEvents) focuses on authentication events, not process execution. Option D (DeviceNetworkEvents) shows network connections that may occur after execution, but does not directly show execution itself.

Answer

EmailEvents

Answer

IdentityLogonEvents

Answer

DeviceNetworkEvents

Question 16

A security engineer is configuring Microsoft Defender for Cloud in a hybrid environment that includes on-premises servers connected via Azure Arc. The engineer wants to enable the Defender for Cloud plans for servers (including vulnerability assessment) on all Azure Arc-enabled machines. What is the correct method to deploy the Log Analytics agent (or Azure Monitor Agent) and the Microsoft Defender for Endpoint (MDE) integration?

Accepted Answer

Enable Azure Policy 'Configure Azure Arc machines to run Azure Monitor Agent' with a DeployIfNotExists policy that also installs the MDE extension.. It leverages Azure Policy with a DeployIfNotExists effect to automatically deploy the Azure Monitor Agent (AMA) and the Microsoft Defender for Endpoint (MDE) extension on Azure Arc-enabled servers. This ensures compliance at scale without manual intervention, and it is the recommended method in Defender for Cloud for hybrid machines. The policy also handles the vulnerability assessment integration by enabling the Defender for Cloud plans for servers.

Answer

Manually install the agents on each server via Group Policy.

Answer

Use the Azure Automation Update Management to deploy agents.

Answer

Enable the 'Log Analytics agent for Windows' extension on each Arc machine via Azure Arc management.

Question 17

Your company uses Microsoft Defender XDR. A critical server is exhibiting signs of a potential ransomware attack, with files being encrypted and a ransom note appearing. The incident has been escalated to the security operations center (SOC). What is the most immediate action to contain the threat and prevent further spread?

Accepted Answer

Initiate the 'Contain device' action from Microsoft Defender XDR. Initiate the 'Contain device' action from Microsoft Defender XDR. This action immediately isolates the compromised device from the network, preventing the ransomware from spreading to other systems. Option A is incorrect because collecting an investigation package is for forensic analysis, not containment. Option B is incorrect because disabling the user account does not stop the ransomware process that is already running on the server. Option D is incorrect because running a full antivirus scan takes time and does not contain the threat; containment must happen first.

Answer

Collect an investigation package for analysis

Answer

Disable the user account that was logged on

Answer

Run a full antivirus scan on the server

Question 18

Your organization uses Microsoft Sentinel with the Microsoft Defender XDR connector to ingest alerts and incidents from Defender for Endpoint, Defender for Office 365, and Defender for Identity. As a threat hunter, you want to proactively search for devices that may be communicating with known malicious IP addresses that have not yet triggered an alert. You have a list of known malicious IP addresses from an external threat intelligence feed. Which approach should you take to perform this hunt efficiently?

Accepted Answer

Create a Watchlist in Microsoft Sentinel containing the IP addresses, then write a KQL query in the Hunting blade that joins the Watchlist with DeviceNetworkEvents from Defender for Endpoint.. The most efficient approach. By creating a Watchlist in Microsoft Sentinel containing the list of known malicious IP addresses, you can write a KQL query in the Hunting blade that joins the Watchlist with the DeviceNetworkEvents table from Defender for Endpoint. This allows you to proactively query for any devices that have communicated with those IPs, even if no alert was generated. Option A is inefficient because Logic App is designed for automation and orchestration, not for ad-hoc hunting queries. Option C would require configuring a Threat Intelligence - TAXII connector with the specific feed, and the ThreatIntelligenceIndicator table may not contain the custom IP list. Option D is impractical for a large number of IPs and devices.

Answer

Create a Logic App that runs hourly and checks each IP against DeviceNetworkEvents, then creates incidents.

Answer

Use the ThreatIntelligenceIndicator table in Microsoft Sentinel, which automatically ingests the feed if you configure a Threat Intelligence - TAXII connector.

Answer

Manually add each IP address as a custom detection rule in Microsoft Sentinel for each device.

Question 19

Which TWO data sources in Microsoft Sentinel are most valuable for hunting for command-and-control (C2) communications? (Choose two.)

Accepted Answer

DNS logs (e.g., from DNS servers or Azure DNS Analytics). DNS logs (C) are highly valuable for C2 hunting because malware frequently uses DNS for domain generation algorithms (DGA), DNS tunneling, and resolving C2 domains, and Sentinel can ingest DNS server logs or Azure DNS Analytics to detect anomalous queries. Network traffic logs (E) from firewalls or NSGs are equally valuable because they reveal outbound connections to known malicious IPs, beaconing patterns, unusual ports, and data exfiltration flows that characterize C2 channels. Windows Event Logs (A) focus on host-level authentication, process, and service activity rather than the network communication patterns central to C2 detection. Azure Activity log (B) records control-plane operations on Azure resources, not C2 traffic. Syslog from Linux servers (D) provides host and application events but does not directly expose the DNS or network connection metadata most useful for identifying C2.

Answer

Windows Event Logs (e.g., Security, System)

Answer

Azure Activity log

Answer

Syslog from Linux servers

Question 20

Your organization has multiple offices across the globe and uses Microsoft Sentinel as the primary SIEM. You have deployed Azure Arc on all on-premises servers to manage them centrally. The security team needs to collect Windows Security Events from all servers, including domain controllers, and forward them to Sentinel using the Windows Security Events via AMA connector. The team also wants to minimize administrative overhead when adding new servers. The current environment includes: 500 on-premises Windows servers (200 domain controllers, 300 member servers) managed via Azure Arc, 200 Azure VMs running Windows Server, and a centralized Log Analytics workspace named 'LAW-Security' in the East US region. You have already installed the Azure Monitor Agent (AMA) on all servers via Azure Arc and Azure VMs. However, you notice that security events from domain controllers are not appearing in Sentinel. You have verified that the AMA agent is running and the data collection rule (DCR) is correctly configured to collect Security events. No other issues are present. You need to ensure that security events from domain controllers are collected. What should you do?

Accepted Answer

Check the network connectivity from the domain controllers to the Log Analytics workspace endpoint. Ensure that the domain controllers can reach the required URLs.. Domain controllers often have more restrictive network policies, and they must be able to reach the Log Analytics workspace endpoint (the data collection endpoint and the Log Analytics service) to send events. The AMA agent is running and the DCR is configured, but if domain controllers cannot connect to the required URLs (e.g., *.ods.opinsights.azure.com, *.oms.opinsights.azure.com, etc.), events will not be collected. Option A is incorrect because the connector configuration is not the issue; the connector is already working for other servers. Option B is incorrect because restarting the agent does not address network issues. Option C is incorrect because the DCR namespace is irrelevant; the DCR configuration is correct for other servers.

Answer

Reinstall the Windows Security Events via AMA connector in Sentinel.

Answer

Restart the Azure Monitor Agent on all domain controllers.

Answer

Recreate the data collection rule with a different namespace.