SC-200 Practice Exam 68 — 20 Questions

Question 1

Your organization uses Microsoft Sentinel. A security analyst receives an alert from a custom analytics rule that triggers on a specific sequence of failed logon attempts followed by a successful logon from an unusual location. The incident is generated but the analyst is not sure if the activity is malicious or a user error. What should the analyst do first to quickly gather additional context?

Accepted Answer

Use the Investigation graph to explore related entities and events. Option C is correct because using the Investigation graph in Microsoft Sentinel allows the analyst to visually explore related entities and events to understand the scope and context of the incident. Option A is wrong because creating a new analytics rule would not help with immediate investigation. Option B is wrong because running a KQL query across the entire workspace is time-consuming and less efficient. Option D is wrong because modifying the existing rule is not appropriate for investigating a single incident.

Answer

Run a KQL query across the entire workspace to find all related events

Answer

Create a new analytics rule to detect similar patterns

Answer

Modify the existing analytics rule to add more conditions

Question 2

Which THREE actions are appropriate when investigating a potential data exfiltration incident in Microsoft Defender for Cloud Apps?

Accepted Answer

Use the app dashboard to view unusual behavior alerts. Options A, B, and D are correct. Option A: Reviewing the activity log helps identify the scope of exfiltration. Option B: Using the app dashboard to see unusual behavior provides context. Option D: Checking the file policy matches shows which files were flagged. Option C is wrong because suspending the user is a containment action, not investigation. Option E is wrong because checking device inventory does not apply to cloud apps.

Answer

Check the device inventory for suspicious applications

Answer

Suspend the user's account immediately

Question 3

An organization uses Microsoft Purview Communication Compliance to detect insider trading. An alert is generated for a user who sent a message containing sensitive financial data. The compliance officer needs to initiate a legal hold on the user's mailbox to preserve evidence. Which role must the officer have to perform this action?

Accepted Answer

eDiscovery Manager (Legal Hold). Legal hold requires the 'Legal Hold' role in Microsoft Purview (eDiscovery). Communication Compliance roles alone do not include hold capabilities. Exchange Online roles may not have cross-functional hold.

Answer

Communication Compliance admin

Answer

Compliance Administrator (Global)

Answer

Exchange Online Mailbox Search role

Question 4

You are investigating a security incident in Microsoft Sentinel where a user reported receiving a phishing email with a malicious attachment. You need to identify all users who received the same email within the last 24 hours. Which KQL query should you use?

Accepted Answer

EmailEvents | where SenderFromAddress == 'attacker@example.com' and Subject == 'Invoice' and Timestamp > ago(24h) | project RecipientEmailAddress. The correct query uses EmailEvents table and filters by sender and subject. Option A is wrong because EmailAttachmentInfo does not contain recipient info. Option B is wrong because it would only show the specific user. Option D is wrong because EmailUrlInfo is for URLs, not attachments.

Answer

EmailEvents | where RecipientEmailAddress == 'user@contoso.com' and Timestamp > ago(24h) | project SenderFromAddress, Subject

Answer

EmailUrlInfo | where Url == 'http://malicious.com' | project RecipientEmailAddress

Answer

EmailAttachmentInfo | where FileName == 'malicious.doc' | project RecipientEmailAddress

Question 5

Which TWO data sources should you enable in Microsoft Sentinel to improve detection of credential theft attacks?

Accepted Answer

Windows Security Events (via AMA). Option A is correct because Windows Security Events contain credential theft logs. Option B is correct because Azure AD Sign-in logs show authentication patterns. Option C is wrong because firewall logs are network-level. Option D is wrong because DNS logs are not directly credential theft. Option E is wrong because performance counters are not security-related.

Answer

DNS logs

Answer

Windows Firewall logs

Answer

Performance counters

Question 6

You are responding to a security incident involving a user who clicked on a malicious link in an email. The link led to a website that downloaded a file to the user's device. Microsoft Defender for Endpoint (MDE) detected the file as malware and blocked it. However, the user reports that the device is running slowly. You need to verify if there are any remnants of the malware. Which action should you take?

Accepted Answer

Initiate a live response session and run a PowerShell script to check for persistence mechanisms.. Option A is correct because MDE's live response allows you to run commands and scripts on the device to check for remnants. Option B is wrong because the malware was already blocked, so an antivirus scan may not find anything new. Option C is wrong because the device is already onboarded to MDE. Option D is wrong because a full OS reinstall is too drastic and not necessary.

Answer

Re-onboard the device to MDE to ensure it's fully managed.

Answer

Run a full antivirus scan using Microsoft Defender Antivirus.

Answer

Perform a full OS reinstall to ensure the device is clean.

Question 7

You are investigating a potential ransomware incident detected by Microsoft Defender XDR. The incident shows multiple machines with suspicious encryption activity. You need to contain the threat immediately. What should you do first?

Accepted Answer

Initiate device isolation on affected machines from Microsoft Defender XDR. Option A is correct because isolating devices from the network stops the spread of ransomware immediately. Option B is wrong because running antivirus scan is reactive and may not stop encryption in progress. Option C is wrong because disabling user accounts does not stop the malware on endpoints. Option D is wrong because resetting passwords does not contain the active infection.

Answer

Reset the passwords of all users on the affected machines

Answer

Run a full antivirus scan on all endpoints

Answer

Disable the user accounts associated with the affected machines

Question 8

Which TWO are immediate containment actions in Microsoft Sentinel for a compromised Azure VM? (Choose two.)

Accepted Answer

Apply an NSG to block all inbound and outbound traffic. Option A is correct: Applying a network security group (NSG) to block traffic can be automated via playbook. Option C is correct: Stopping the VM prevents further malicious activity. Option B is wrong because VM extensions may not stop the attack. Option D is wrong because resetting password does not stop processes. Option E is wrong because initiating backup is not containment.

Answer

Install anti-malware extension

Answer

Reset the VM administrator password

Answer

Initiate a VM backup

Question 9

Your incident response team has identified a phishing campaign targeting your organization. The emails contain a link to a malicious site. Which Microsoft Defender for Office 365 feature should you use to block the URL across all users?

Accepted Answer

Tenant Allow/Block List. Option C is correct because Tenant Allow/Block List in Defender for Office 365 allows blocking URLs at the tenant level. Option A is wrong because Safe Attachments scans attachments, not URLs. Option B is wrong because Safe Links can block URLs but is policy-based; Tenant Allow/Block List is immediate. Option D is wrong because Anti-Phish policies protect against impersonation, not specific URLs.

Answer

Safe Links policy

Answer

Anti-Phish policy

Answer

Safe Attachments policy

Question 10

Your company uses Microsoft Defender XDR. A critical server is exhibiting signs of a potential ransomware attack, with files being encrypted and a ransom note appearing. The incident has been escalated to the security operations center (SOC). What is the most immediate action to contain the threat and prevent further spread?

Accepted Answer

Initiate the 'Contain device' action from Microsoft Defender XDR. Option B is correct because deploying the 'Contain device' action in Microsoft Defender XDR immediately isolates the device from the network, stopping the ransomware from spreading. Option A is wrong because running a full antivirus scan takes time and does not contain the threat. Option C is wrong because collecting an investigation package is for analysis, not containment. Option D is wrong because removing the user's access does not stop the ransomware already running on the device.

Answer

Collect an investigation package for analysis

Answer

Disable the user account that was logged on

Answer

Run a full antivirus scan on the server

Question 11

Which TWO sources of evidence should a security analyst examine first when investigating a user-reported phishing email in Microsoft Defender XDR?

Accepted Answer

The email entity page. Options B and C are correct. Option B: The email entity page provides details about the email, including sender and links. Option C: The user's mailbox audit log shows if the user interacted with the email. Option A is wrong because the device timeline is not relevant for email. Option D is wrong because the action center is for response. Option E is wrong because advanced hunting is for complex queries, not first step.

Answer

The action center

Answer

The user's device timeline

Answer

Advanced hunting for email events

Question 12

During an incident response, an analyst runs a live response command on a Windows device using Microsoft Defender for Endpoint. The command 'Get-Service -Name BITS' returns no output. What is the most likely cause?

Accepted Answer

The command is blocked due to PowerShell ConstrainedLanguage mode.. Live response uses a restricted PowerShell language mode (ConstrainedLanguage) which blocks many commands. Get-Service may not be available. The service might be stopped but still exist; permissions are usually fine.

Answer

The live response session has insufficient privileges.

Answer

The BITS service is disabled and hidden.

Answer

The BITS service is not installed on the device.

Question 13

During a ransomware response in Microsoft Defender XDR, you identify that multiple devices are communicating with a known C2 server over port 443. You need to block this communication across all devices immediately. What is the most effective course of action?

Accepted Answer

Create a firewall rule to block outbound traffic to the C2 server IP address. Option C is correct because blocking the IOC at the firewall is immediate and network-wide. Option A is wrong because ISE actions are endpoint-only and may not cover all devices. Option B is wrong because this only affects endpoints, not network traffic. Option D is wrong because it only blocks at the proxy level, not all traffic.

Answer

Add the C2 server domain to the Microsoft Defender for Office 365 Tenant Allow/Block List

Answer

Create an indicator of compromise (IoC) in Microsoft Defender for Endpoint with action 'Alert and block'

Answer

Add the C2 server URL to the custom indicator list in Microsoft Defender for Cloud Apps

Question 14

Which THREE steps are part of the containment phase of incident response in a hybrid environment using Microsoft Defender XDR?

Accepted Answer

Disable compromised user accounts in Microsoft Entra ID. Option A is correct because isolation prevents spread. Option B is correct because disabling accounts stops credential misuse. Option D is correct because blocking IoCs is a containment action. Option C is wrong because this is eradication. Option E is wrong because this is recovery.

Answer

Remove malware from affected systems

Answer

Restore data from backups

Question 15

Your organization uses Microsoft Sentinel and has enabled User and Entity Behavior Analytics (UEBA). During an incident investigation, you identify that a user account has been exhibiting anomalous behavior, such as logging in from multiple countries within a short time. You need to determine if the account is compromised and take appropriate action. What should you do first?

Accepted Answer

Review the UEBA insights for the user to understand the anomaly.. Option C is correct because UEBA provides risk scores and peer comparisons that can help determine if the behavior is truly anomalous. Option A is wrong because resetting the password without investigation may not be necessary if the behavior is legitimate. Option B is wrong because disabling the account is premature. Option D is wrong because creating an automation rule is a response step, not an investigation step.

Answer

Disable the user account in Microsoft Entra ID.

Answer

Create a custom automation rule in Sentinel to disable the account on similar alerts.

Answer

Reset the user's password immediately.

Question 16

During a security incident, the Microsoft Sentinel workspace is receiving high volume of low-severity alerts causing analyst fatigue. You need to reduce noise while ensuring critical alerts are not missed. What should you configure?

Accepted Answer

Modify the incident creation rule to only create incidents for alerts with severity High or Medium. Option C is correct because incident creation rules can filter by alert severity to only create incidents for high and medium severity, reducing noise. Option A is wrong because disabling analytics rules would stop all alerts. Option B is wrong because automation rules trigger after incident creation, not before. Option D is wrong because setting severity to Informational would not help filter.

Answer

Disable analytics rules for low-severity alerts

Answer

Change the severity of low-severity alerts to Informational in the analytics rule

Answer

Create an automation rule to close low-severity incidents automatically

Question 17

Which THREE resources can be used as data sources for Microsoft Sentinel to detect security incidents? (Choose three.)

Accepted Answer

Microsoft 365 Defender. Option A, C, and D are correct: Azure Activity Log provides subscription-level events; Microsoft Defender for Cloud provides security alerts; Microsoft 365 Defender provides integrated signals. Option B is wrong because Azure Advisor provides recommendations, not security events. Option E is wrong because Azure Cost Management is cost-related.

Answer

Azure Cost Management

Answer

Azure Advisor

Question 18

Based on the ARM template snippet, what is the purpose of this analytics rule?

Accepted Answer

To detect multiple failed logon attempts within a time window. Option C is correct because the query counts failed logon events (EventID 4625) and triggers when count > 5, indicating brute force attempts. Option A is wrong because EventID 4625 is failed logon, not success. Option B is wrong because the query does not include multiple event IDs. Option D is wrong because the query does not check for account lockouts.

Answer

To detect successful logins by account

Answer

To detect account lockouts

Question 19

Which TWO actions should a security analyst take when responding to a confirmed malware outbreak in Microsoft Defender for Endpoint?

Accepted Answer

Isolate the affected device. Options A and C are correct. Option A: Isolating the affected device prevents lateral movement. Option C: Running a full scan on the device helps ensure all malware components are detected. Option B is wrong because resetting the user password does not stop active malware. Option D is wrong because the hunter is for proactive threat hunting, not immediate response. Option E is wrong because deleting the user account is too drastic and does not address the malware.

Answer

Create a custom detection rule for the malware

Answer

Delete the user account

Answer

Reset the user's password

Question 20

A security operations center (SOC) analyst is investigating an incident involving a user who received a phishing email with a malicious macro. The analyst needs to determine if any other users received the same email. Which Microsoft 365 Defender feature should the analyst use?

Accepted Answer

Threat Explorer (Investigation). Threat Explorer in Microsoft 365 Defender allows hunting for email messages by sender, subject, or other attributes. Advanced Hunting is for raw queries; Email entity page shows one email; Alert queue filters by alert not email.

Answer

Advanced Hunting

Answer

Alert queue filtering

Answer

Email entity page