SC-200 Mock Exam 71 — 25 Questions

Question 1

An organization uses Microsoft Purview Communication Compliance to detect insider trading. An alert is generated for a user who sent a message containing sensitive financial data. The compliance officer needs to initiate a legal hold on the user's mailbox to preserve evidence. Which role must the officer have to perform this action?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

eDiscovery Manager (Legal Hold). Legal hold requires the 'Legal Hold' role in Microsoft Purview (eDiscovery). Communication Compliance roles alone do not include hold capabilities. Exchange Online roles may not have cross-functional hold.

Answer

Communication Compliance admin

Answer

Compliance Administrator (Global)

Answer

Exchange Online Mailbox Search role

Question 2

During a threat hunt, you find an alert for a suspicious PowerShell script that encoded a payload. You want to decode the script to understand its intent. Which Microsoft Sentinel feature can assist with this task?

Accepted Answer

Hunting blade with KQL using base64_decode_tostring(). Microsoft Sentinel's Hunting blade allows security analysts to run KQL queries across logged data. The function base64_decode_tostring() can decode Base64-encoded strings, such as those found in obfuscated PowerShell scripts. This enables threat hunters to reveal the script's intent. Playbooks are for automation, Workbooks for visualization, and Analytics rules for alert generation, none of which directly decode payloads.

Answer

Playbooks

Answer

Workbooks

Answer

Analytics rules

Question 3

You have detected a suspicious PowerShell command running on several workstations. The command appears to be downloading a payload from a known malicious URL. What is the most effective immediate response using Microsoft Defender for Endpoint?

Accepted Answer

Add the URL to the custom threat indicator list in Microsoft Defender for Endpoint.. Adding the URL to the custom threat indicator list in Microsoft Defender for Endpoint is the most effective immediate response because it creates a block indicator that applies to all endpoints in the organization. This action prevents any further downloads from that malicious URL across all workstations, stopping the attack in its tracks without disrupting user productivity or requiring manual intervention on each machine.

Answer

Quarantine the affected workstations.

Answer

Enable attack surface reduction rule to block PowerShell scripts.

Answer

Initiate a Live Response session to investigate each workstation.

Question 4

An incident in Microsoft Sentinel involves a phishing campaign that delivered a malicious macro-enabled document. The document was opened by 15 users. Which playbook action should be triggered automatically to contain the threat?

Accepted Answer

Block the file hash using Microsoft Defender for Endpoint. The automatic playbook action should block the file hash at the endpoint to prevent further execution. Isolating devices may be too aggressive. Blocking sender IP is not effective against phishing. Disabling user accounts is not direct.

Answer

Isolate all affected devices from the network

Answer

Block the sender's IP address on the email gateway

Answer

Disable the user accounts of those who opened the document

Question 5

Your organization uses Microsoft Sentinel. You have a playbook that sends an email notification to the SOC team when a new incident is created. The playbook is currently triggered manually. You want the playbook to run automatically every time an incident of severity High is created. What should you do?

Accepted Answer

Create an automation rule that triggers when an incident is created with severity High and runs the playbook.. Automation rules in Sentinel can automatically trigger playbooks based on incident conditions. Option A is correct. Option B is wrong because automation rules are created in the Automation blade. Option C is wrong because the analytics rule does not directly run playbooks. Option D is wrong because the playbook trigger is not configured in Logic Apps designer.

Answer

Edit the analytics rule that generates the incident to include the playbook as an automated response.

Answer

Modify the playbook to add a trigger of 'When an incident is created' and set the severity condition.

Answer

Configure the playbook's Logic Apps designer to use an HTTP trigger that polls Sentinel for new incidents.

Question 6

During an investigation, you need to check if any user has been assigned privileged roles in Microsoft Entra ID outside of normal business hours. Which data source would provide this information?

Accepted Answer

AuditLogs (Microsoft Entra ID). AuditLogs in Microsoft Entra ID (formerly Azure AD) capture all directory-level changes, including privileged role assignments (e.g., Global Administrator, Privileged Role Administrator) along with the timestamp and user who performed the action. This allows you to filter for role assignments occurring outside normal business hours, making it the correct data source for this investigation.

Answer

OfficeActivity (Office 365)

Answer

SecurityEvent (Windows Event Logs)

Answer

SigninLogs (Microsoft Entra ID)

Question 7

Your organization uses Microsoft Sentinel with the Microsoft Defender XDR connector. During a hunt, you notice that some alerts from Microsoft Defender for Identity are not appearing in Sentinel. You have verified the connector is enabled and data is flowing for other Defender products. What is the most likely cause?

Accepted Answer

Your tenant does not have the required Microsoft Entra ID P2 license for Microsoft Defender for Identity alerts.. Microsoft Defender for Identity alerts require a premium Microsoft Entra ID P2 license to be ingested via the connector. Option A is wrong because the connector is enabled. Option B is wrong because data ingestion is working for other products. Option C is wrong because the data types are not disabled.

Answer

The Microsoft Sentinel pricing tier is set to Free, which limits data ingestion.

Answer

The 'IdentityLogonEvents' data type is disabled in the Microsoft Sentinel connector configuration.

Answer

The Microsoft Sentinel workspace is in a different region than Microsoft Defender for Identity.

Question 8

Your security team uses Microsoft Sentinel to hunt for signs of credential theft. They want to correlate Azure AD sign-in logs with Microsoft Defender for Cloud Apps alerts. Which KQL operator should they use to join the two tables on the user principal name?

Accepted Answer

join. The 'join' operator merges rows from two tables based on a matching key. Option A is incorrect because 'union' appends rows, not correlates. Option C is incorrect because 'lookup' is a type of join but is less common for this scenario. Option D is incorrect because 'evaluate' is used for plugin execution, not joining tables.

Answer

union

Answer

lookup

Answer

evaluate

Question 9

As part of a threat hunt, you want to find instances where a user successfully authenticated to multiple applications within a short time using different IP addresses. Which Microsoft 365 Defender data source would be most appropriate?

Accepted Answer

IdentityLogonEvents. IdentityLogonEvents contains authentication events for cloud apps, with columns like Application, IP address, and Timestamp.

Answer

CloudAppEvents

Answer

DeviceLogonEvents

Answer

AlertInfo

Question 10

Which TWO of the following are valid methods to initiate a threat hunting session in Microsoft Sentinel?

Accepted Answer

Start from a specific detection rule. Starting from a specific detection rule and using a predefined hunting query are both valid methods. Live mode is not a feature; custom analytics rules are for detection, not hunting; and watchlists are used for enrichment, not for initiating hunting.

Answer

Create a custom analytics rule

Answer

Import a watchlist as a hunting query

Answer

Enable live mode on a hunting query

Question 11

A security analyst is performing threat hunting in Microsoft Sentinel and wants to identify anomalous outbound network traffic from a compromised virtual machine. Which data source should be prioritized for this hunt?

Accepted Answer

Azure Network Watcher flow logs. Azure Network Watcher flow logs provide detailed information about IP traffic through Azure networks, making them ideal for detecting anomalous outbound traffic patterns. Option A (Azure Activity Log) focuses on control plane events, not network flows. Option C (Windows Event Logs) is for host-level events, not network traffic. Option D (Microsoft Entra ID sign-in logs) is for authentication events.

Answer

Azure Activity Log

Answer

Windows Event Logs (Security, System)

Answer

Microsoft Entra ID sign-in logs

Question 12

Which TWO actions should you take to ensure that Microsoft Sentinel can properly ingest logs from a Linux server running rsyslog? (Choose two.)

Accepted Answer

Install the Log Analytics agent (or Azure Monitor Agent) on the Linux server. The Log Analytics agent (or Azure Monitor Agent) must be installed on the Linux server to receive and forward syslog data to Microsoft Sentinel. Without the agent, Sentinel has no direct mechanism to collect logs from the server. The agent listens for syslog messages forwarded by rsyslog and then sends them to the Log Analytics workspace.

Answer

Install and configure syslog-ng instead of rsyslog

Answer

Configure rsyslog to forward logs to the agent on TCP 514

Answer

Configure Windows Event Forwarding (WEF) to collect logs from the Linux server

Question 13

Which TWO actions are effective when threat hunting for lateral movement using remote desktop protocol (RDP) in Microsoft Defender XDR?

Accepted Answer

Query DeviceNetworkEvents for inbound connections on port 3389. Option A is correct because RDP uses TCP port 3389, so querying DeviceNetworkEvents for inbound connections on port 3389 in Microsoft Defender XDR surfaces potential RDP sessions initiated by an attacker moving laterally to a target device. Option C is correct because a successful RDP logon generates Windows Security Event ID 4624 with LogonType 10 (RemoteInteractive), so correlating those logon events with RDP network connections confirms actual interactive remote sessions rather than mere port scans or blocked attempts. Option B is not relevant because CloudAppEvents covers cloud application activity, not on-premises RDP lateral movement. Option D is unrelated since unusual email forwarding rules indicate mailbox exfiltration or persistence, not RDP lateral movement. Option E is incorrect because SMB file share connections use ports 445/139 and represent a different lateral movement technique than RDP.

Answer

Review CloudAppEvents for access to cloud apps from multiple IPs

Answer

Check for unusual email forwarding rules

Answer

Search for SMB file share connections

Question 14

You are investigating a low-severity incident in Microsoft Sentinel where a user reported receiving a phishing email. The email was not blocked by the email security solution. The user did not click any links. What should you do first?

Accepted Answer

Report the email for analysis using the Microsoft 365 Defender portal. The first step is to report the email for analysis using the Microsoft 365 Defender portal. Since the email was not blocked and the user did not click any links, the immediate priority is to submit the message to Microsoft for analysis (via the Submissions page or the Report button) so that detections can be tuned and the sender/URLs can be blocked if malicious. This preserves evidence and improves organizational protection before taking remediation actions.

Answer

Delete the phishing email from the user's inbox

Answer

Reset the user's password as a precaution

Answer

Isolate the user's device from the network

Question 15

A SOC analyst wants to ensure that multiple alerts from the same analytics rule that occur within a 1-hour window for the same user are automatically merged into a single incident. Which configuration setting should the analyst adjust in the analytics rule?

Accepted Answer

Incident grouping settings. The Incident grouping settings in a Microsoft Sentinel analytics rule control whether multiple alerts from the same rule are automatically merged into a single incident. By configuring the grouping to 'Group alerts into a single incident if they match the specified conditions' and setting the time window to 1 hour, the SOC analyst ensures that alerts triggered for the same user within that window are combined, reducing alert noise and improving incident management efficiency.

Answer

Entity mapping

Answer

Alert details

Answer

Query scheduling

Question 16

Which THREE techniques would you use in Microsoft Sentinel to hunt for data exfiltration over DNS?

Accepted Answer

Analyze DNS query logs for high volume or long subdomains. Option A is correct because DNS tunneling and exfiltration typically manifest as unusually high query volumes to a single domain or abnormally long subdomain labels that encode stolen data, so analyzing DNS query logs for these patterns is a core hunting technique in Microsoft Sentinel. Option C is correct because correlating DNS events with process creation events (for example via SecurityEvent 4688 or Sysmon Event ID 1) lets you identify which executable or script is generating the suspicious queries, distinguishing malicious tooling from legitimate resolvers. Option E is correct because ASIM (Advanced Security Information Model) DNS parsers normalize DNS logs from multiple sources into a common schema, enabling consistent anomaly detection and cross-source correlation across the workspace. Option B is not part of DNS exfiltration hunting since it focuses on large transfers to cloud storage IPs, which is HTTP/HTTPS exfiltration rather than DNS-based. Option D is also unrelated, as email forwarding rules address exfiltration via email (for example Exchange transport rules) and not DNS tunneling.

Answer

Examine network traffic logs for large data transfers to known cloud storage IPs

Answer

Review email forwarding rules for external domains

Question 17

Your threat hunting hypothesis is that a user's credentials were used to sign in from two geographically distant locations within a short time. In Microsoft Defender for Cloud Apps, which log type would you query in Microsoft Sentinel to detect impossible travel?

Accepted Answer

SigninLogs. Impossible travel detection relies on analyzing sign-in events with their source IP geolocation and timestamps. In Microsoft Sentinel, Microsoft Entra ID (Entra ID) sign-in events are stored in the SigninLogs table, which contains fields like IPAddress, Location, and TimeGenerated needed to compute whether a user signed in from two distant locations within an implausible timeframe. Defender for Cloud Apps surfaces these as impossible travel alerts, but the underlying Sentinel query targets SigninLogs.

Answer

AuditLogs

Answer

CommonSecurityLog

Answer

OfficeActivity

Question 18

Match each Kusto Query Language (KQL) operator to its function.

Accepted Answer

where: Filters rows based on a condition. These are fundamental KQL operators used in Microsoft Sentinel and Defender queries.

Answer

where: Aggregates rows into groups

Answer

summarize: Filters rows based on a condition

Question 19

Your organization uses Microsoft Defender for Cloud to monitor hybrid workloads. You need to ensure that security alerts from on-premises servers are sent to Microsoft Sentinel. What should you configure?

Accepted Answer

Connect the on-premises servers to Azure Arc and deploy the Log Analytics agent.. Azure Arc enables on-premises servers to be managed as Azure resources, allowing the Log Analytics agent to be deployed and configured to forward security alerts to a Log Analytics workspace integrated with Microsoft Sentinel. This is the standard method for ingesting security events from hybrid workloads into Sentinel without requiring third-party connectors or complex network configurations.

Answer

Install a third-party SIEM connector on the servers and forward logs to Sentinel.

Answer

Deploy Azure Policy on the servers to audit security settings.

Answer

Configure a site-to-site VPN to Azure and enable network logging.

Question 20

Which TWO data sources in Microsoft Sentinel are commonly used for threat hunting related to lateral movement?

Accepted Answer

DeviceNetworkEvents. Options A and C are correct. DeviceNetworkEvents (Microsoft Defender for Endpoint) logs network connections, which can reveal lateral movement attempts between devices. SecurityEvent (Windows Event Logs) contains Event ID 4624 (logon) and 4688 (process creation), both critical for identifying lateral movement. Option B (Syslog) is a general logging protocol not specific to lateral movement. Option D (DnsEvents) is more relevant to command and control or data exfiltration. Option E (AzureActivity) tracks Azure resource operations, not lateral movement within the environment.

Answer

Syslog

Answer

DnsEvents

Answer

AzureActivity