SC-200 Mock Exam 71 — 25 Questions

Question 1

Your organization uses Microsoft Sentinel and Microsoft Defender XDR. An incident in Microsoft Defender XDR is automatically synchronized to Microsoft Sentinel. The incident in Sentinel is closed by the SOC team, but the corresponding incident in Defender remains open. What should you do to ensure that closing an incident in Sentinel also closes its linked incident in Defender?

Accepted Answer

Configure an automation rule in Microsoft Sentinel that triggers on incident closure and runs a playbook that closes the corresponding incident in Microsoft Defender XDR.. Microsoft Sentinel can be configured to sync incident status back to Microsoft Defender XDR using automation rules. Option B is correct. Option A is wrong because the bi-directional sync is not automatic and requires configuration. Option C is wrong because the Defender portal does not automatically sync with Sentinel. Option D is wrong because the integration settings in Defender do not control Sentinel's incident closure.

Answer

In the Microsoft Defender XDR portal, enable the setting to automatically close incidents when the linked Sentinel incident is closed.

Answer

Use the Microsoft Defender XDR API to set up a webhook that listens for Sentinel incident closure.

Answer

Enable the bi-directional sync in the Microsoft Sentinel data connector for Microsoft Defender XDR.

Question 2

Your company uses Microsoft Defender for Cloud Apps. You discover that a user's account is compromised and used to access a sensitive SharePoint site from an unfamiliar IP. You need to immediately revoke the user's session and force them to re-authenticate. Which action should you take?

Accepted Answer

Apply a policy with the 'Revoke session' action.. Option B is correct because the 'Revoke session' policy action in Defender for Cloud Apps terminates the user's current session and forces re-authentication. Option A (Suspend user) is too drastic and may disrupt legitimate access. Option C (Block IP) would block all users from that IP, which may not be desired. Option D (Notify user) is not immediate and does not stop the session.

Answer

Add the IP to the blocked IP addresses list.

Answer

Create a governance action to suspend the user.

Answer

Send a notification to the user to change their password.

Question 3

Your organization uses Microsoft Sentinel and Microsoft Defender for Identity. An incident is generated for a potential lateral movement attack. The incident is linked to multiple alerts involving a domain controller and several workstations. You need to understand the attack path and identify the initial compromised account. Which feature should you use to visualize the attack chain? A) The incident graph in Microsoft Sentinel. B) The entity timeline in Microsoft Defender for Identity. C) The Microsoft 365 Defender attack story. D) The Microsoft Purview compliance portal. Which option provides the best visual representation of the attack path?

Accepted Answer

The incident graph in Microsoft Sentinel.. Option A is correct because the Microsoft Sentinel incident graph provides a visual representation of entities and their relationships, showing the attack path. Option B (Entity timeline) is linear and not a graph. Option C (Attack story) is in Defender XDR but focuses on alerts. Option D (Purview) is for compliance, not security incidents.

Answer

The Microsoft Purview compliance portal.

Answer

The entity timeline in Microsoft Defender for Identity.

Answer

The Microsoft 365 Defender attack story.

Question 4

Which TWO actions should a security analyst take to contain a ransomware outbreak on a Windows server that has Microsoft Defender for Endpoint installed?

Accepted Answer

Run a full scan with Microsoft Defender Antivirus. Options B and D are correct. B isolates the device to prevent lateral movement, and D runs a scan to remove the ransomware. Option A is wrong because resetting the password does not stop the ransomware. Option C is wrong because uninstalling would remove protection. Option E is wrong because a full restore might reintroduce the malware.

Answer

Reset the local administrator password

Answer

Uninstall Microsoft Defender for Endpoint and reinstall

Answer

Restore the system from a backup

Question 5

A SOC analyst in your organization is investigating an incident in Microsoft Defender XDR that involves a compromised user account. The analyst needs to gather more information about the user's recent activities. Which THREE actions can the analyst take directly from the incident page?

Accepted Answer

Run an advanced hunting query related to the user.. From the incident page, the analyst can view the user's timeline, run advanced hunting queries, and take action like disabling the account. Option A is correct because the user timeline is accessible. Option B is correct because advanced hunting can be initiated from the incident. Option D is correct because the analyst can trigger a playbook from the incident. Option C is wrong because resetting password typically requires going to Microsoft Entra ID admin center. Option E is wrong because deleting the user account is not a standard action from the incident page.

Answer

Delete the user account.

Answer

Reset the user's password directly from the incident.

Question 6

Your organization uses Microsoft Sentinel. You have an incident that involves multiple alerts. You want to automatically assign the incident to the appropriate analyst based on the alert type. What should you use?

Accepted Answer

Create an automation rule with an 'Assign incident to owner' action.. Option A is correct because automation rules in Microsoft Sentinel can perform actions like assigning incidents to specific owners based on conditions. Option B (Playbooks) are for complex automation but not ideal for simple assignment. Option C (Workbooks) are for visualization. Option D (Analytics rules) define alert conditions, not incident management.

Answer

Create a playbook that assigns the incident.

Answer

Configure the analytics rule to set the incident owner.

Answer

Use a workbook to filter incidents by alert type.

Question 7

During an incident response, a forensic investigator needs to collect a memory dump from a compromised Windows server that is still running. The server has Microsoft Defender for Endpoint installed but is not connected to the internet. Which method should the investigator use?

Accepted Answer

Use Live Response to run a memory dump collector on the device. Option D is correct because Live Response allows a live memory dump from an offline device via a connected channel. Option A is wrong because the device is offline, so the portal cannot initiate a dump. Option B is wrong because snapshot collection requires the device to be online. Option C is wrong because Sysinternals is not part of Microsoft's recommended forensic toolkit for this scenario.

Answer

Collect a system memory snapshot from the Microsoft 365 Defender portal

Answer

Initiate a memory dump from the Microsoft Defender for Endpoint portal

Answer

Use Sysinternals Suite to capture a memory dump locally

Question 8

Which TWO options are valid ways to create an incident in Microsoft Sentinel?

Accepted Answer

From an alert generated by an analytics rule. Options A and B are correct. Analytics rules generate alerts that become incidents, and Microsoft Defender XDR incidents are synchronized. Option C is wrong because workbooks are read-only. Option D is wrong because watchlists are for enrichment. Option E is wrong because hunting queries require manual creation of incidents.

Answer

By creating a workbook

Answer

By importing data from a watchlist

Answer

By running a hunting query

Question 9

Your company uses Microsoft Defender for Endpoint. A device shows signs of compromise with suspicious PowerShell execution. You need to collect forensic evidence before performing remediation. Which action should you use?

Accepted Answer

Collect investigation package.. Option B is correct because 'Collect investigation package' gathers a comprehensive set of forensic data from the device, including files, processes, and registry. Option A (Run antivirus scan) is a remediation step. Option C (Initiate live response) allows real-time investigation but does not collect a full package. Option D (Isolate device) is a containment measure.

Answer

Isolate the device from the network.

Answer

Run a full antivirus scan.

Answer

Initiate a live response session.

Question 10

An organization uses Microsoft Sentinel for security operations. A security engineer needs to automatically disable a compromised user account in Microsoft Entra ID when a high-severity incident is created in Sentinel. Which feature should the engineer use?

Accepted Answer

Automation rule with a playbook. Option B is correct because automation rules in Sentinel trigger playbooks on incident creation. Option A is wrong because analytics rules only create alerts, not actions on users. Option C is wrong because workbooks are for visualization, not automation. Option D is wrong because hunting queries are manual.

Answer

Analytics rule

Answer

Workbook

Answer

Hunting query

Question 11

Your organization has Microsoft Sentinel deployed in a central Log Analytics workspace. You have a custom analytics rule that detects brute-force attacks against Azure AD by counting failed sign-ins from the same IP address within 5 minutes. The rule currently generates an incident for every 10 failed attempts. During a recent incident, a single IP address generated over 200 failed sign-ins in 10 minutes, resulting in 20 separate incidents. The SOC team is overwhelmed and wants to reduce the number of incidents without lowering the detection threshold. You need to modify the rule to generate only one incident per IP address within a 1-hour window. What should you do?

Accepted Answer

Modify the analytics rule to group alerts by IP address with a 1-hour window. Option A is correct because grouping alerts by IP address and setting a 1-hour window will consolidate all alerts from that IP into one incident. Option B is wrong because suppression only suppresses alerts after an incident is created, it doesn't group them. Option C is wrong because a separate analytics rule would still generate multiple incidents. Option D is wrong because an automation rule cannot change incident grouping after alerts are created.

Answer

Enable alert suppression in the analytics rule for 1 hour

Answer

Create a new analytics rule that triggers only when failed sign-ins exceed 200 in 5 minutes

Answer

Create an automation rule that closes duplicate incidents from the same IP

Question 12

Your organization uses Microsoft Defender XDR. You are investigating an incident that involves a malware infection on a Windows 10 device. The device is currently isolated from the network. The incident shows that the malware attempted to communicate with a command-and-control (C2) server. You have collected an investigation package. Now you need to remediate the device and bring it back to a clean state. The device has critical data that must not be lost. Which remediation action should you take? A) Run a full antivirus scan and remove threats. B) Perform a factory reset of the device. C) Reimage the device from a clean backup. D) Initiate a live response to manually remove the malware. Which option best balances thorough remediation with data preservation?

Accepted Answer

Reimage the device from a clean backup.. Option C is correct because reimaging from a clean backup ensures the malware is completely removed while preserving data from the backup. Option A (Full scan) may not detect all malware. Option B (Factory reset) loses all data. Option D (Live response) may miss persistent threats and is not as thorough as reimaging.

Answer

Initiate a live response to manually remove the malware.

Answer

Run a full antivirus scan and remove threats.

Answer

Perform a factory reset of the device.

Question 13

A SOC analyst receives a phishing alert in Microsoft Defender for Office 365. The analyst needs to quickly determine if any users clicked the malicious link. Which action should the analyst take first?

Accepted Answer

Open the email entity page to view click details. Option B is correct because the email entity page in Defender for Office 365 shows click verdicts. Option A is wrong because the user entity page does not show email-specific actions. Option C is wrong because Threat Explorer is useful but slower. Option D is wrong because a hunting query is manual and slower.

Answer

Use Threat Explorer to search for the email subject

Answer

Open the user entity page for each recipient

Answer

Run a hunting query in Microsoft Sentinel

Question 14

Your organization uses Microsoft Sentinel. You need to design a solution that automatically responds to incidents with severity High and enriches them with threat intelligence from Microsoft Defender Threat Intelligence. Which TWO actions should you include?

Accepted Answer

Create an automation rule that triggers when an incident is created with severity High and runs a playbook to enrich the incident with threat intelligence.. To respond to incidents automatically, you use automation rules. Option A is correct because automation rules run playbooks. Option D is correct because automation rules can also change severity. Option B is wrong because playbooks are triggered by automation rules, not directly. Option C is wrong because automation rules cannot modify queries. Option E is wrong because analytics rules do not automatically run playbooks without an automation rule.

Answer

Set the automation rule to modify the analytics rule's query to include threat intelligence.

Answer

Configure the playbook to run directly from the analytics rule that generates the incident.

Answer

Use the analytics rule's incident configuration to automatically run the playbook.

Question 15

A security operations center (SOC) team uses Microsoft Defender XDR and Microsoft Sentinel. An incident is created in Defender XDR that involves a malicious email and a compromised device. The team wants the incident to automatically sync to Sentinel. What is the minimum configuration required?

Accepted Answer

Configure the Microsoft Defender XDR connector in Sentinel. Option A is correct because the connector for Microsoft Defender XDR automatically syncs incidents to Sentinel. Option B is wrong because the connector for Microsoft 365 Defender is the same. Option C is wrong because the connector for Microsoft Defender for Office 365 only syncs email-related alerts. Option D is wrong because the connector for Azure AD Identity Protection only syncs identity alerts.

Answer

Configure the Microsoft Defender for Office 365 connector in Sentinel

Answer

Configure the Azure AD Identity Protection connector in Sentinel

Answer

Configure the Microsoft 365 Defender connector in Sentinel

Question 16

Your company uses Microsoft Defender for Endpoint (MDE) on all Windows 10 devices. You are investigating a machine that is suspected of being part of a botnet. The machine is communicating with a known C2 server at IP 203.0.113.55. You have confirmed that the IP is malicious. You need to block all outbound traffic from the machine to that IP immediately, and also ensure that no other devices in the organization can communicate with that IP. The solution must be implemented without deploying additional network appliances. What should you do?

Accepted Answer

Create a custom network indicator in Microsoft Defender for Endpoint with action 'Alert and block'. Option B is correct because custom network indicators in MDE can block IPs at the device level, and the action applies to all MDE-enrolled devices. Option A is wrong because MDE network protection does not support custom IP blocking via policy. Option C is wrong because Windows Defender Firewall rules would need to be deployed via GPO or Intune, which is slower and more complex. Option D is wrong because the MDE portal does not have a global IP blocklist feature.

Answer

Create a network protection policy in Microsoft Intune to block the IP

Answer

Use the Microsoft Defender for Endpoint portal to block the IP globally

Answer

Create a firewall rule in Windows Defender Firewall to block outbound traffic to the IP, and deploy via Group Policy

Question 17

An incident in Microsoft Sentinel involves multiple alerts indicating a potential data exfiltration via SharePoint Online. You need to respond and remediate. Which THREE actions should be taken?

Accepted Answer

Remove external sharing permissions on SharePoint sites.. Blocking the user in Microsoft Entra ID (A) stops further access. Removing external sharing (B) prevents further data leaks. Isolating the user's device (C) is a containment step. Changing passwords (D) is less immediate than blocking. Running a hunting query (E) is investigative, not containment.

Answer

Reset the user's password and enforce MFA.

Answer

Create a custom detection rule for similar activity.

Question 18

Your company uses Microsoft Sentinel and Microsoft Defender for Cloud Apps (MCAS). A security analyst detects that a user is accessing a sanctioned cloud app from an unusual location. The analyst creates an incident in Sentinel. You need to automatically apply a session policy in MCAS to block downloads from that user for the next hour. You have an existing playbook that can apply session policies. What is the most efficient way to automate this response?

Accepted Answer

Create an automation rule in Sentinel that triggers when an incident is created with the relevant conditions and runs the playbook.. To automate the response, you can create an automation rule that triggers on incident creation and runs the playbook. Option A is correct. Option B is wrong because analytics rules do not run playbooks directly. Option C is wrong because the incident creation rule is not for automated response. Option D is wrong because manual actions are not automated.

Answer

Instruct the analyst to run the playbook manually from the incident page each time.

Answer

Configure the incident creation rule in MCAS to automatically run the playbook.

Answer

Modify the analytics rule that detected the anomaly to run the playbook as an automated response.

Question 19

Your organization uses Microsoft Sentinel and has deployed the Microsoft Defender XDR connector. You notice that some incidents from Defender XDR are not being synchronized to Sentinel. You verify that the connector is enabled and healthy. You also check that the relevant Defender XDR alerts are being generated. What could be the cause of the missing incidents?

Accepted Answer

The Microsoft Defender XDR connector has a filter that only syncs incidents with severity High or Medium, and the missing incidents are Low severity.. Incidents from Defender XDR are synchronized to Sentinel based on the connector's filtering settings. Option A is correct because the connector might be configured to only sync incidents of certain severities. Option B is wrong because alert grouping is not a connector setting. Option C is wrong because the data connector is for incidents, not raw data. Option D is wrong because diagnostic settings are for logs, not incidents.

Answer

The Microsoft Defender XDR connector is configured to group alerts by entity, which prevents individual incidents from being created.

Answer

The diagnostic settings in Microsoft Defender XDR are not configured to send incidents to Sentinel.

Answer

The data connector is set to ingestion mode 'Raw data' instead of 'Incidents'.

Question 20

A security analyst is using KQL in Microsoft Sentinel to hunt for potential data exfiltration by a user who has been sending unusually large amounts of data to an external IP address. Which KQL operator should the analyst use to identify the top source IP addresses and total bytes sent over the last 7 days?

Accepted Answer

... | summarize TotalBytes=sum(SentBytes) by SourceIP | top 10 by TotalBytes desc. The summarize operator with sum() aggregation computes total bytes per source IP, and top 10 limits to the top results. Option A is correct. Option B (where) filters but does not aggregate. Option C (project) only selects columns. Option D (extend) adds computed columns without aggregation.

Answer

... | where SentBytes > 1000000 | project SourceIP, SentBytes

Answer

... | extend TotalBytes=SentBytes | summarize count() by SourceIP

Answer

... | project SourceIP, SentBytes | sort by SentBytes desc