SC-200 Practice Test 7 — 10 Questions

Question 1

An organization uses Microsoft 365 Defender. A security analyst is investigating an incident where a user's device was compromised. The analyst wants to determine if the attacker attempted to access sensitive files stored in SharePoint Online from that device. Which advanced hunting table should the analyst query to find file access events from cloud apps?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

CloudAppEvents. The CloudAppEvents table in Microsoft 365 Defender captures audit logs for cloud applications, including SharePoint Online. It records file access events such as viewing, downloading, or modifying files, making it the correct table to query when investigating attacker attempts to access sensitive files from a compromised device.

Answer

IdentityLogonEvents

Answer

DeviceFileEvents

Answer

EmailEvents

Question 2

Your organization uses Microsoft Sentinel. An incident is created from a fusion detection that combines multiple signals. You need to ensure that when the incident is resolved, all related alerts are also resolved automatically. What should you do?

Accepted Answer

Create an automation rule triggered when an incident is closed, with the action 'Close alert'. An automation rule triggered when an incident is closed can include the action 'Close alert', which automatically closes all alerts linked to that incident. This ensures that when the incident is resolved, all related alerts are also resolved without manual intervention.

Answer

Create a playbook triggered on incident creation that closes alerts

Answer

Create an automation rule triggered when an alert is created

Answer

Configure the analytics rule to close alerts when the incident is resolved

Question 3

A SOC analyst wants to create a visual dashboard in Microsoft Sentinel to monitor sign-in activity trends over the past 30 days. Which feature should the analyst use?

Accepted Answer

Workbooks. Workbooks in Microsoft Sentinel provide a flexible canvas for creating custom visual dashboards using Azure Monitor Workbooks. They allow the analyst to query Log Analytics workspaces (e.g., SigninLogs table) and render time-series charts, trend lines, and other visualizations to monitor sign-in activity over the past 30 days. This is the correct feature for building a visual dashboard.

Answer

Analytics rules

Answer

Playbooks

Answer

Threat Intelligence

Question 4

Your organization uses Microsoft Sentinel and wants to ensure that all incident-related data is retained for at least 90 days for compliance purposes. Which configuration should you check?

Accepted Answer

Log Analytics workspace retention settings. Log Analytics workspace retention settings directly control how long raw data ingested into Microsoft Sentinel is stored. For compliance requiring 90-day retention of incident-related data, you must configure the workspace retention period to at least 90 days (or use archive policies for longer retention). Incident data in Sentinel is derived from this underlying workspace data, so retention settings at the workspace level ensure the data persists for the required duration.

Answer

Watchlist settings

Answer

Analytics rule settings

Answer

Incident settings in Sentinel

Question 5

Your organization uses Microsoft Defender for Identity (MDI) and Microsoft Sentinel. You notice that MDI alerts are not appearing in Sentinel. You have already installed the MDI data connector and configured the workspace. What is the most likely cause?

Accepted Answer

The data connector is not enabled, even though it is installed. The most likely cause is that the MDI data connector, although installed, is not enabled. In Microsoft Sentinel, installing a data connector only makes it available; you must explicitly enable it to start ingesting data. Without enabling the connector, alerts from Microsoft Defender for Identity will not flow into Sentinel, even if the workspace is correctly configured.

Answer

The workspace is in a different region than MDI

Answer

The Microsoft 365 Defender connector is not installed

Answer

Microsoft Defender for Identity is not licensed

Question 6

Your organization uses Microsoft Sentinel. You have been asked to configure automated responses to security incidents. Which TWO of the following can be used to automate responses in Microsoft Sentinel?

Accepted Answer

Playbooks (Azure Logic Apps). Playbooks in Microsoft Sentinel are built on Azure Logic Apps, allowing you to automate complex, multi-step response workflows triggered by security incidents. They can execute actions like blocking IPs, resetting passwords, or enriching alerts with threat intelligence, making them a core automation tool for incident response.

Answer

Workbooks

Answer

Power Automate flows

Answer

Custom connectors

Question 7

The exhibit shows the output of a Microsoft Defender for Endpoint API call to get machine information. What does the isolationStatus value indicate?

Accepted Answer

The device has been isolated from the network.. The isolationStatus value in Microsoft Defender for Endpoint indicates whether a device has been isolated from the network. When the value is 'Isolated', it means the device is blocked from communicating with other devices or the internet, typically as a response to a security incident. Option D is correct because this status directly reflects that the device is isolated from the network.

Answer

The device is healthy and has no issues.

Answer

The device is currently being scanned for malware.

Answer

The device is not isolated and is fully connected.

Question 8

You are configuring Microsoft Sentinel to ingest syslog data from a network appliance. After configuring the data connector, you notice that no data is appearing in the CommonSecurityLog table. The syslog server is sending data to the Azure Monitor Agent (AMA) on the log collector. What should you verify first?

Accepted Answer

Verify that a Data Collection Rule is defined to collect the syslog facilities.. The Azure Monitor Agent (AMA) requires a Data Collection Rule (DCR) to specify which syslog facilities and severity levels to collect. Without a DCR, the AMA will not forward syslog data to the CommonSecurityLog table, even if the syslog server is sending data to the collector. This is the most common missing configuration step after setting up the data connector.

Answer

Check the Heartbeat table for the log collector.

Answer

Ensure the syslog appliance can reach the collector on UDP port 514.

Answer

Check the data connector health status in Sentinel.

Question 9

The exhibit shows a partial playbook trigger configuration in Microsoft Sentinel. When will this playbook be triggered?

Accepted Answer

When an incident of severity High is created.. The playbook trigger configuration shown in the exhibit specifies that the playbook runs when an incident is created, and it includes a condition that filters for incidents with a severity of High. In Microsoft Sentinel, playbook triggers can be set on incident creation or alert creation, and conditions like severity are evaluated at the time of the trigger event. Here, the trigger is explicitly set to 'When an incident is created' with a severity condition of 'High', so the playbook only fires when a new incident with High severity is created.

Answer

When an incident is updated with severity High.

Answer

When an alert is generated with severity High.

Answer

When any incident is created.

Question 10

A Microsoft Sentinel scheduled analytics rule detects impossible travel but creates too many duplicate incidents for the same user within a short period. Which two rule settings should you tune? (Choose 2.)

Accepted Answer

Configure event grouping or incident grouping by user entity.. Configuring event grouping or incident grouping by user entity consolidates multiple alerts for the same user into a single incident, reducing duplicate incidents. In Microsoft Sentinel, this setting controls how alerts are aggregated into incidents based on entity fields like user account, ensuring that a burst of impossible travel alerts for the same user generates one incident instead of many.

Answer

Disable the data connector.

Answer

Delete the Log Analytics workspace.