SC-200 Practice Exam 70 — 20 Questions

Question 1

Which THREE of the following are valid methods to archive logs in Microsoft Sentinel to reduce costs?

Accepted Answer

Configure continuous export to Azure Data Lake Storage Gen2. Microsoft Sentinel supports continuous export of logs to Azure Data Lake Storage Gen2, which allows you to retain raw log data at lower storage costs while still being able to query it using Azure Synapse or other analytics tools. This method reduces the cost of high-volume log retention in Sentinel's native workspace by moving data to a cheaper long-term storage tier.

Answer

Set the workspace to free tier

Answer

Enable Basic Logs ingestion for all tables

Question 2

You are investigating a series of failed logon attempts across multiple on-premises servers. You want to use Microsoft Sentinel to hunt for patterns of brute-force attacks. Which data source should you ingest to capture detailed authentication events from domain controllers?

Accepted Answer

Windows Security Events via Windows Event Forwarding. Windows Security Events from domain controllers, collected via Windows Event Forwarding (WEF) or directly, include Event ID 4625 (failed logon) and other authentication events necessary for brute-force hunting. Option A is incorrect because Syslog from domain controllers does not capture Windows Security Events; Syslog is typically used for network devices or Linux systems. Option C is incorrect because Azure Activity Log records Azure resource management operations, not on-premises authentication events. Option D is incorrect because Microsoft 365 Defender events cover cloud and endpoint alerts but not detailed authentication logs from on-premises domain controllers.

Answer

Syslog from domain controllers

Answer

Azure Activity Log

Answer

Microsoft 365 Defender events

Question 3

Which TWO actions should you take when responding to a confirmed ransomware incident in Microsoft Defender for Endpoint?

Accepted Answer

Run a full antivirus scan on the affected devices.. Running a full antivirus scan on affected devices helps identify and remove any remaining ransomware artifacts or secondary payloads that may not have been detected during the initial response. In Microsoft Defender for Endpoint, a full scan leverages the cloud-delivered protection and behavior monitoring to thoroughly examine all files and processes, reducing the risk of reinfection.

Answer

Allow the ransomware executable in the firewall.

Answer

Collect an investigation package from the affected devices.

Answer

Initiate a live response session to delete files.

Question 4

An organization uses Microsoft Defender for Endpoint (MDE) to hunt for signs of credential dumping. An analyst runs a custom advanced hunting query that searches for processes accessing LSASS.exe. The query uses DeviceProcessEvents and DeviceFileEvents. The analyst notices that some known credential dumping tools are detected, but they want to find previously unknown variants. Which approach should the analyst take to improve the hunt?

Accepted Answer

Look for anomalous LSASS access patterns using process lineage and call stacks.. To catch previously unknown credential-dumping variants, the analyst must move beyond signature and file-reputation indicators and instead hunt for behavioral anomalies in how processes access LSASS. Analyzing process lineage (which parent spawned the accessing process) and call stacks (which modules and functions are invoking LSASS) surfaces suspicious patterns like unsigned binaries, unusual parent-child relationships, or direct syscalls that signature-based detections miss. This is the essence of hypothesis-driven, behavior-based hunting in MDE advanced hunting.

Answer

Enable LSASS auditing via Windows Security Event Log.

Answer

Focus on file reputation data to exclude clean files.

Answer

Add more signature-based indicators to the query.

Question 5

Your organization uses Microsoft Sentinel and has enabled UEBA. A security analyst observes that a user account with no prior administrative activity performed a high volume of Azure Resource Manager operations. The analyst wants to investigate further. Which Microsoft Sentinel feature should the analyst use to quickly identify if this behavior is anomalous based on the user's historical profile?

Accepted Answer

User and Entity Behavior Analytics (UEBA). UEBA is the correct feature because it builds a behavioral baseline for each user over time, including typical Azure Resource Manager activity patterns. When a user with no prior administrative history suddenly performs a high volume of ARM operations, UEBA can flag this as anomalous by comparing the current activity against the user's historical profile, surfacing the deviation in the UEBA investigation pane without requiring custom query creation.

Answer

Hunting queries

Answer

Workbooks

Answer

Analytics rules

Question 6

During a threat hunt, you notice an anomalous number of failed logon attempts from a single IP address across multiple user accounts in Microsoft Entra ID sign-in logs. What is the most effective next step to determine if this is a brute-force attack?

Accepted Answer

Correlate with successful logon events from the same IP for those accounts. Correlating failed logon attempts with successful logon events from the same IP address for the same accounts is the most effective next step. If a successful logon occurs shortly after failures, it strongly indicates a brute-force attack succeeded. This evidence justifies further action like blocking the IP or resetting the compromised account. Option A (blocking IP immediately) may be premature without confirming success. Option B (resetting all affected passwords) is disruptive and may not address the root cause if no breach occurred. Option C (disabling accounts) could block legitimate users unnecessarily.

Answer

Immediately block the IP address in the firewall

Answer

Reset passwords for all affected accounts

Answer

Disable the accounts that had failed logons

Question 7

Which TWO actions are essential for configuring Microsoft Sentinel to support effective threat hunting?

Accepted Answer

Connect Microsoft 365 data sources (e.g., Office 365, Entra ID, Defender for Cloud Apps). Enabling User and Entity Behavior Analytics (UEBA) provides baselines for hunting anomalies, and connecting Microsoft 365 data sources provides rich data for hunting. Customizing analytics rules is for detection, not hunting; Sysmon is not required; Watchlists are helpful but not essential for basic hunting setup.

Answer

Create a Watchlist that maps user names to email addresses

Answer

Configure custom analytics rules for every MITRE ATT&CK technique

Answer

Install Sysmon on all domain controllers

Question 8

Your organization uses Microsoft Sentinel and Microsoft Defender XDR. You need to ensure that all incidents from Microsoft Defender XDR are synchronized to Microsoft Sentinel with the same status (e.g., 'Active', 'Resolved'). What should you configure?

Accepted Answer

Connect Microsoft Defender XDR to Microsoft Sentinel using the official data connector.. The official Microsoft Defender XDR data connector in Microsoft Sentinel automatically synchronizes incidents, including their status (e.g., 'Active', 'Resolved'), bidirectionally. This ensures that any status change in either system is reflected in the other without manual intervention or custom scripting. Option B is correct because it leverages the built-in integration that handles the synchronization natively.

Answer

Create a custom playbook to poll Defender XDR API and update Sentinel incidents.

Answer

Manually update status in both systems.

Answer

Disable the Microsoft Defender XDR connector and use separate connectors for each workload.

Question 9

Your organization uses Microsoft Sentinel. You need to ensure that an incident is automatically assigned to the appropriate team based on the type of alert. What should you configure?

Accepted Answer

Automation rule. Automation rules in Microsoft Sentinel allow you to automatically assign incidents to specific teams based on conditions such as alert type or severity. This is the correct configuration because automation rules can trigger actions like incident assignment, tagging, or status changes without requiring a complex logic app or custom code.

Answer

Workbook

Answer

Playbook

Answer

Analytics rule

Question 10

Your organization uses Microsoft Defender for Cloud Apps. You need to receive alerts when a user accesses a cloud app from a location that is not whitelisted. What should you configure?

Accepted Answer

Create an activity policy in Microsoft Defender for Cloud Apps.. An activity policy in Microsoft Defender for Cloud Apps monitors user activities and can trigger alerts based on specific conditions, such as access from non-whitelisted locations. This policy type evaluates activities against defined criteria (e.g., IP address ranges) and generates alerts without blocking access, which matches the requirement to receive alerts.

Answer

Create a conditional access policy in Microsoft Entra ID.

Answer

Set up a session policy in Microsoft Defender for Cloud Apps.

Answer

Configure an access policy in Microsoft Defender for Cloud Apps.

Question 11

Your organization uses Microsoft Defender for Identity. You receive an alert about a suspicious Kerberos ticket request. What is the most appropriate first step?

Accepted Answer

Investigate the alert in the Microsoft 365 Defender portal.. The first step when receiving any security alert, including a suspicious Kerberos ticket request from Microsoft Defender for Identity, is to investigate the alert in the Microsoft 365 Defender portal. This portal provides the unified security operations console where you can view the full alert details, related entities, and the MITRE ATT&CK mapping to understand the scope and severity before taking any remediation actions. Prematurely disabling accounts or resetting passwords without investigation can destroy forensic evidence and potentially disrupt legitimate user activity.

Answer

Disable the user account.

Answer

Reset the user's password.

Answer

Reset the krbtgt account password.

Question 12

Your organization has recently deployed Microsoft Sentinel and Microsoft Defender XDR. You are tasked with configuring the environment to ensure that incidents created by Microsoft Defender for Cloud Apps are automatically synchronized to Microsoft Sentinel. The security operations team wants to manage all incidents from within Sentinel. You have already connected the Microsoft Defender XDR connector to Sentinel. However, you notice that incidents from Defender for Cloud Apps are not appearing in Sentinel. You verify that the Defender for Cloud Apps connector is not listed in the data connectors blade. What should you do to resolve this issue?

Accepted Answer

Ensure the Microsoft Defender XDR connector is configured to include Defender for Cloud Apps incidents.. When Microsoft Defender XDR connector is enabled in Sentinel, it can ingest incidents from all Microsoft Defender products, including Defender for Cloud Apps, provided the connector's configuration includes the option to synchronize those incidents. Since the Defender for Cloud Apps connector is not listed separately, the correct approach is to verify and adjust the Microsoft Defender XDR connector's settings to include Defender for Cloud Apps incidents. Option D directly addresses this by ensuring the existing connector is configured to forward those incidents.

Answer

Enable the Microsoft Sentinel integration in the Defender for Cloud Apps portal.

Answer

Configure a data collection rule in Microsoft Purview to forward alerts to Sentinel.

Answer

Install the Microsoft Defender for Cloud Apps connector from Sentinel data connectors.

Question 13

Your organization has Microsoft Defender for Office 365 enabled. Users report that phishing emails are being delivered to their inboxes. You need to improve the filtering. What should you do first?

Accepted Answer

Review phishing emails in Threat Explorer and adjust anti-phishing policies.. Reviewing the Threat Explorer in Defender for Office 365 allows you to analyze detected phishing emails and understand why they were delivered, then adjust policies accordingly. Option A is wrong because increasing spam confidence level might block legitimate email. Option C is wrong because disabling third-party connectors doesn't help. Option D is wrong because enabling secure by default is already enabled.

Answer

Increase the spam confidence level threshold.

Answer

Disable third-party email connectors.

Answer

Enable the 'Secure by default' setting in Exchange Online.

Question 14

You are a security analyst for a company that uses Azure Firewall. You are reviewing a custom rule deployed via Azure Firewall Manager. The exhibit shows the rule configuration. The rule is intended to block inbound traffic from known Tor exit nodes. However, a recent incident involved an attacker using a Tor exit node with IP 138.197.5.5 to access an internal web server on port 8080. The log shows the traffic was ALLOWED. What is the most likely reason the rule did not block the traffic?

Accepted Answer

The destination port 8080 is not listed in the rule.. The rule is configured to block traffic on destination port 80, but the attacker used port 8080. Azure Firewall rules are explicit; if the destination port in the traffic does not match any port specified in the rule, the rule is not applied, and the traffic is evaluated by subsequent rules or default allow logic. Since the rule only lists port 80, traffic to port 8080 is not matched, and thus the rule does not block it.

Answer

The source address range does not include 138.197.5.5.

Answer

The rule type is 'Prevention' but should be 'Detection'.

Answer

The rule priority is too low and is overridden by a higher priority rule.

Question 15

You are configuring Microsoft Sentinel to ingest logs from a third-party firewall via Syslog. After configuring the data connector, you notice that no logs are appearing. You verify that the firewall is sending logs to the Syslog collector. What is the most likely cause?

Accepted Answer

The syslog daemon on the collector is not configured to forward logs to the Log Analytics workspace.. The most common reason logs fail to appear in Microsoft Sentinel after configuring a Syslog data connector is that the Syslog daemon (e.g., rsyslog or syslog-ng) on the collector VM is not configured to forward logs to the Log Analytics workspace. Even if the firewall sends logs to the collector, the Azure Monitor Agent (AMA) or legacy Log Analytics agent relies on the local Syslog daemon to listen on UDP port 514 (or TCP 6514) and forward those events to the agent, which then sends them to the workspace. Without proper daemon configuration (e.g., adding rules in /etc/rsyslog.d/ to forward facility/severity levels), the agent never receives the logs.

Answer

The firewall is sending logs in a format incompatible with the Azure Monitor Agent.

Answer

The ingestion cost is too high and Sentinel throttled the connection.

Answer

The data connector is disabled in the Log Analytics workspace.

Question 16

Your organization uses Microsoft Sentinel and Microsoft Defender XDR. You want to use a Microsoft Copilot for Security to summarize an incident in Microsoft Defender XDR. What is the minimum role required?

Accepted Answer

Security Reader. The minimum role required to use Microsoft Copilot for Security to summarize an incident in Microsoft Defender XDR is Security Reader. This role grants read-only access to security data, including incidents and alerts, which is sufficient for Copilot to retrieve and summarize incident details without requiring write permissions. Higher-privileged roles like Security Administrator or Global Administrator are unnecessary for this read-only operation.

Answer

Security Administrator

Answer

Reader

Answer

Global Administrator

Question 17

A security analyst receives an alert from Microsoft Defender for Identity about a suspicious Kerberos ticket request. What is the first step the analyst should take?

Accepted Answer

Validate the alert by checking the user's recent activity. When Microsoft Defender for Identity alerts on a suspicious Kerberos ticket request, the first step is to validate the alert by checking the user's recent activity. This ensures the alert is not a false positive caused by legitimate behavior (e.g., scheduled tasks or application service tickets) before taking any disruptive action. Defender for Identity uses network traffic and event logs to detect anomalies like overpass-the-hash or Kerberoasting, but initial validation prevents unnecessary account lockouts or password resets.

Answer

Disable the user account

Answer

Reset the user's password

Answer

Run a full antivirus scan on the user's device

Question 18

Your company uses Microsoft Sentinel as its SIEM. You are investigating an incident where a user reported receiving a phishing email that appeared to come from the CEO requesting a wire transfer. The user did not respond. However, the incident also contains alerts from Microsoft Defender for Office 365 indicating that other users clicked on a malicious link in a similar email. The email was sent to 100 users. The company has Microsoft Defender for Endpoint deployed on all devices. The incident requires immediate containment to prevent further compromise. What should you do first?

Accepted Answer

Block the malicious URL using Microsoft Defender for Cloud Apps.. Blocking the malicious URL using Microsoft Defender for Cloud Apps (now part of Microsoft 365 Defender) immediately prevents all users from accessing the phishing link, stopping further compromise at the network level. This is the fastest containment action as it applies a URL block across the tenant without requiring individual mailbox or device actions. The incident involves multiple users clicking the link, so a URL block is the most efficient first step to halt the attack chain.

Answer

Run a threat hunting query to find all users who clicked the link.

Answer

Isolate the device of the user who reported the email.

Answer

Delete the email from all users' mailboxes using Microsoft 365 Defender.

Question 19

Your Microsoft Sentinel workspace receives logs from multiple sources. You need to ensure that an incident response playbook is triggered automatically when a specific alert is generated. What should you create?

Accepted Answer

An automation rule.. An automation rule in Microsoft Sentinel is specifically designed to trigger incident response playbooks automatically when an alert is generated. It allows you to define conditions based on alert properties and then invoke a Logic App playbook without manual intervention. This is the correct mechanism for automating incident response actions in Sentinel.

Answer

A data connector.

Answer

An analytics rule.

Answer

A new Logic App.

Question 20

Which TWO actions are appropriate when responding to a confirmed malware outbreak on multiple workstations identified by Microsoft Defender for Endpoint?

Accepted Answer

Collect investigation packages from the affected devices for analysis.. Collecting investigation packages and isolating affected devices are appropriate response actions. Running a full scan is reactive and not immediate. Resetting passwords may be needed later but not first. Blocking indicators is proactive but doesn't contain already infected devices.

Answer

Add the malware hash to the custom threat indicator list.

Answer

Run a full antivirus scan on all workstations.

Answer

Reset passwords of all users who logged into the affected devices.