SC-200 Mock Exam 72 — 25 Questions

Question 1

Your threat hunting team uses Microsoft Sentinel. They want to search for anomalous network connections to known malicious IP addresses over the past 7 days. Which KQL operator should they use to match the source IP addresses against a watchlist containing the malicious IPs?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

in. The 'in' operator is the correct choice because it checks whether a value (the source IP) exists within a specified set — here, the dynamic list of malicious IPs pulled from a Sentinel watchlist via _GetWatchlist(). This is the idiomatic KQL pattern for matching against watchlists and produces an efficient membership test rather than a substring search.

Answer

where

Answer

has

Answer

contains

Question 2

You are analyzing sign-in logs in Microsoft Sentinel. The KQL query shown in the exhibit returns a list of users who have signed into Office 365 Exchange Online more than 10 times in the last 24 hours. You need to identify potential brute-force attacks. What additional information should you add to the query to improve detection?

Accepted Answer

Include both successful and failed sign-in attempts, then filter for users with a high number of failed attempts and at least one successful attempt.. To detect brute-force attacks, you need to look for multiple failed sign-in attempts followed by a success. The current query only shows successful sign-ins. Option A is correct because adding a condition to include failed attempts (ResultType != 0) and then filtering for users with many failures and at least one success would better indicate brute-force. Option B (changing the time window to 1 hour) may help detect rapid attempts but does not consider the success pattern. Option C (filtering by unusual geographic locations) may reduce false positives but does not directly detect brute-force. Option D (excluding users with MFA) is not relevant because MFA reduces risk but does not prevent brute-force detection.

Answer

Change the time window to 1 hour to detect rapid attempts.

Answer

Add a condition to only include sign-ins from unusual geographic locations.

Answer

Add a condition to exclude users who have multi-factor authentication (MFA) enabled.

Question 3

An analyst is using advanced hunting in Microsoft 365 Defender. A device made outbound RDP connections shortly after a suspicious PowerShell process started. Which join is most useful to identify the initiating process for those network connections?

Accepted Answer

Join DeviceNetworkEvents with DeviceProcessEvents by device and process identifiers/time window. It joins DeviceNetworkEvents (which contain outbound RDP connection details) with DeviceProcessEvents (which contain process creation data like the suspicious PowerShell process) using device ID, process ID, and a time window. This join allows the analyst to directly correlate the network connection to the initiating process, identifying whether the PowerShell process spawned the RDP connection.

Answer

Join EmailEvents with UrlClickEvents

Answer

Join IdentityInfo with SecureScoreControls

Answer

Join CloudAppEvents with AlertEvidence only

Question 4

Refer to the exhibit. You are reviewing a Microsoft Sentinel automation rule created via ARM template. You notice that the rule is not triggering the playbook when a high-severity incident is created. What is the most likely cause?

Accepted Answer

The condition syntax is invalid; automation rules in ARM templates require specific operator properties.. Automation rules in ARM templates require explicit operator properties (e.g., 'Equals', 'Contains') in the condition syntax. If the condition is written without these operators or uses invalid JSON structure, the rule will fail to evaluate triggers correctly, preventing the playbook from being invoked when a high-severity incident is created.

Answer

The playbook resource ID is missing the 'locations' parameter.

Answer

The automation rule is disabled by default and needs to be enabled.

Answer

The playbook does not have a trigger for Microsoft Sentinel.

Question 5

A SOC team ingests Microsoft 365 Defender advanced hunting data into Microsoft Sentinel. They want to create a scheduled analytics rule that detects when a user receives more than 5 emails from an external sender containing a specific attachment name within 1 hour. Which KQL tables and approach should the analyst use?

Accepted Answer

EmailEvents and EmailAttachmentInfo; summarize count() by AccountUpn, AttachmentFileName, bin(Timestamp,1h). The detection requires joining EmailEvents (which contains sender/recipient metadata) with EmailAttachmentInfo (which contains attachment file names) to filter by external senders and a specific attachment name, then using summarize count() with bin(Timestamp,1h) to group events into 1-hour windows and identify users receiving more than 5 such emails. This approach directly maps to the requirement: external sender, attachment name, user identity (AccountUpn), and time-based aggregation.

Answer

EmailEvents and EmailUrlInfo; summarize count() by SenderObjectId

Answer

EmailEvents only; filter by AttachmentFileName

Answer

EmailPostDeliveryEvents; summarize count() by RecipientEmailAddress

Question 6

Your SOC team uses Microsoft Sentinel to manage incidents. You want to categorize incidents based on the MITRE ATT&CK technique. You notice that some incidents are not being tagged with the correct technique. What should you check first?

Accepted Answer

The analytics rule that generated the incident has the correct MITRE ATT&CK technique selected.. MITRE ATT&CK technique tags on a Microsoft Sentinel incident are inherited directly from the analytics (detection) rule that generated the incident. If the rule was created without the correct technique mapped — or the mapping was later edited — every incident it produces will carry the wrong or missing tag. The first place to verify is therefore the analytics rule's 'Incident settings' / 'MITRE ATT&CK' mapping, not downstream automation.

Answer

The playbook assigned to the incident is overriding the technique tag.

Answer

The incident creation rule in the automation section is misconfigured.

Answer

The data connector for the source service is not ingesting the required fields.

Question 7

Which TWO Microsoft 365 Defender advanced hunting tables would you use together to investigate a potential data exfiltration via email?

Accepted Answer

EmailEvents. EmailEvents is correct because it is the advanced hunting table that records email message-level metadata and delivery/security verdicts (sender, recipient, subject, timestamps, delivery action, and threat types), which is essential to identify suspicious outbound messages tied to exfiltration. EmailAttachmentInfo is correct because it provides per-attachment details for those messages (file name, SHA-256 hash, file type, and size), letting you pivot from an EmailEvents record via NetworkMessageId to inspect what data was actually attached and sent. Together they correlate the message context with the payload, which is the core of an email-based exfiltration investigation. DeviceNetworkEvents, CloudAppEvents, and DeviceProcessEvents are not the right pairing here: they cover endpoint network connections, cloud app/service activity, and process execution respectively, none of which directly expose email message and attachment metadata for an email exfiltration scenario.

Answer

DeviceNetworkEvents

Answer

CloudAppEvents

Answer

DeviceProcessEvents

Question 8

You have been tasked with creating an automated response in Microsoft Sentinel for incidents involving lateral movement. Which Azure service allows you to run a playbook to automatically isolate a compromised VM?

Accepted Answer

Azure Logic Apps. Azure Logic Apps is the correct answer because it provides the workflow automation engine that powers Microsoft Sentinel playbooks. When a lateral movement incident is detected, a Logic Apps-based playbook can execute automated actions such as isolating a compromised VM via Azure Network Security Groups (NSGs) or Azure Firewall rules, using connectors like the Azure VM or Azure Resource Manager. This enables a no-code or low-code response directly from Sentinel without manual intervention.

Answer

Kusto Query Language (KQL)

Answer

Microsoft Defender XDR advanced hunting

Answer

Azure Event Hubs

Question 9

Your security team uses Microsoft Sentinel automation rules to respond to incidents. You need to ensure that critical incidents are automatically assigned to a senior analyst in the Americas time zone and that a Teams message is sent to a specific channel. Which configuration should you use?

Accepted Answer

Create a playbook that assigns the incident and sends a Teams message, then attach it to a automation rule. Automation rules in Microsoft Sentinel can trigger a playbook when an incident is created or updated. By creating a playbook that assigns the incident to a specific senior analyst (using Microsoft Entra ID or a watchlist for mapping) and sends a Teams message via the Teams connector, then attaching that playbook to an automation rule with conditions for critical severity, you meet both requirements. This approach leverages native Sentinel automation without custom connectors or manual email triggers.

Answer

Use a watchlist to map critical incidents to senior analysts and trigger an email

Answer

Configure the analytics rule to set the incident owner and add a playbook action

Answer

Create a custom connector in Power Automate to monitor Sentinel incidents

Question 10

You are reviewing the KQL query shown in the exhibit. What is the purpose of this query?

Accepted Answer

Identify high-severity alert names that occurred more than 10 times in the last 24 hours. The query uses `summarize` with `count()` on `AlertName`, then filters with `where count_ > 10`. This groups high-severity alerts by name and returns only those names that appear more than 10 times in the last 24 hours. The `project` statement outputs only the `AlertName` and its count, confirming the purpose is to identify frequently occurring high-severity alert names.

Answer

Count the number of high-severity alerts per hour

Answer

Return the timestamp of each high-severity alert

Answer

List all high-severity incidents in the last 24 hours

Question 11

Your organization uses Microsoft Defender for Cloud. You need to view a list of all security recommendations for your Azure subscriptions. Which blade should you use?

Accepted Answer

Recommendations. The Recommendations blade in Microsoft Defender for Cloud is the centralized hub that lists all security recommendations for your Azure subscriptions, including those from Azure Security Benchmark and custom initiatives. It provides a prioritized view of security posture improvements, such as remediating vulnerabilities or enabling encryption, directly actionable from the blade.

Answer

Workbooks

Answer

Regulatory Compliance

Answer

Inventory

Question 12

Which TWO actions are part of the threat hunting process in Microsoft Sentinel?

Accepted Answer

Creating custom hunting queries based on hypotheses.. Option A is correct because threat hunting in Microsoft Sentinel is hypothesis-driven: analysts write custom hunting queries (KQL) in the Hunting blade to proactively search ingested data for signs of compromise that existing detections may have missed. Option B is correct because bookmarks let hunters capture and preserve interesting query results, entities, and findings so they can be retained, shared, and later promoted into incidents or used to build new analytics rules. The other options are not part of the hunting process itself: C (data connectors) is a data ingestion/onboarding task, D (severity tuning) is detection tuning, and E (scheduled analytics rules) is detection engineering, all of which support but are distinct from proactive threat hunting.

Answer

Setting up data connectors to ingest logs.

Answer

Fine-tuning the severity of analytical rules.

Answer

Configuring scheduled analytics rules.

Question 13

You are hunting for signs of credential dumping using Mimikatz. Which process events in Microsoft Defender for Endpoint would most likely indicate this activity?

Accepted Answer

A process opening lsass.exe with access to process memory (e.g., PROCESS_VM_READ). Mimikatz typically opens lsass.exe with specific access permissions like PROCESS_VM_READ to read process memory and dump credentials. Options B, C, and D are not specific indicators: PowerShell making network connections is too broad, svchost spawning from explorer is a normal pattern, and cmd executing whoami is not credential dumping.

Answer

A process named powershell.exe making network connections to an external IP

Answer

A process named svchost.exe spawning from explorer.exe

Answer

A process named cmd.exe executing whoami

Question 14

A threat hunter wants to proactively search for signs of ransomware activity in the environment using Microsoft Sentinel. Which data source is most likely to provide early indicators of ransomware, such as mass file renaming or encryption?

Accepted Answer

Microsoft Defender for Endpoint advanced hunting tables like DeviceFileEvents and DeviceProcessEvents. (Microsoft Defender for Endpoint) provides advanced hunting on endpoint processes and file events, which can detect mass file modifications indicative of ransomware. Option A (Microsoft Entra ID sign-in logs) logs authentication events. Option C (Azure Activity Log) logs control plane operations. Option D (Office 365 audit logs) logs cloud app activities.

Answer

Azure AD sign-in logs

Answer

Azure Activity Log

Answer

Office 365 audit logs (UnifiedAuditLog)

Question 15

Which TWO of the following are common techniques used by attackers to bypass security controls that a threat hunter should look for?

Accepted Answer

Process injection into trusted processes. Process injection into trusted processes (A) is a classic defense-evasion technique where an attacker writes malicious code into the memory space of a legitimate, trusted process (e.g., via CreateRemoteThread, APC injection, or process hollowing), allowing the payload to inherit the host process's privileges and blend into normal activity, which is exactly the kind of control bypass a threat hunter should detect. DLL sideloading (E) is another common evasion method in which a legitimate executable loads a malicious DLL from an attacker-controlled location due to insecure search-order or path resolution, hijacking trusted execution flow without triggering obvious alerts. By contrast, enabling multi-factor authentication (B), applying regular software updates (C), and enforcing strong password policies (D) are defensive hardening measures that strengthen security controls rather than techniques used to bypass them, so they are not attacker evasion methods.

Answer

Enabling multi-factor authentication

Answer

Regular software updates

Answer

Enforcing strong password policies

Question 16

Your SOC uses Microsoft Sentinel and Microsoft Defender for Identity (MDI). You have configured MDI to send alerts to Microsoft 365 Defender. From there, Microsoft Sentinel ingests the alerts via the Microsoft 365 Defender connector. You want to ensure that when MDI detects a suspicious activity, the incident in Microsoft Sentinel is created within 5 minutes. Which factors should you consider?

Accepted Answer

The latency depends on the Microsoft 365 Defender connector's polling interval and the analytics rule's frequency.. The incident creation latency in this architecture depends on two factors: the Microsoft 365 Defender connector's polling interval (which retrieves alerts from Microsoft 365 Defender) and the frequency of the Microsoft Sentinel analytics rule that creates incidents from those ingested alerts. Even if MDI sends alerts quickly to Microsoft 365 Defender, the connector polls at a configurable interval (default every 5 minutes), and the analytics rule runs on its own schedule (typically every 5 minutes). Thus, the total time to incident creation is the sum of these intervals, not a fixed 5 minutes.

Answer

The latency is determined solely by the MDI sensor health and network speed.

Answer

The incident creation time is controlled by the Microsoft Defender for Cloud Apps connector.

Answer

The incident will be created within 5 minutes because MDI writes directly to Microsoft Sentinel.

Question 17

A company uses Microsoft Defender for Cloud to protect an Azure Kubernetes Service (AKS) cluster. The security team wants to receive security alerts about suspicious activities within the cluster, such as a container running with root privileges or attempts to read sensitive host paths. Which Defender for Cloud plan must be enabled to generate these alerts?

Accepted Answer

Defender for Containers. Defender for Containers is the specific plan that provides threat detection for Azure Kubernetes Service (AKS) clusters, including alerts for suspicious activities such as containers running with root privileges or attempts to read sensitive host paths. This plan monitors the Kubernetes control plane and container runtime to generate security alerts based on Kubernetes audit logs and container-specific signals.

Answer

Defender for Servers

Answer

Defender for Cloud Apps

Answer

Defender for SQL

Question 18

Your incident response team uses Microsoft Sentinel. You need to automatically assign incidents to the appropriate analyst based on the type of alert. What should you create?

Accepted Answer

An automation rule with an 'Assign owner' action. Automation rules in Microsoft Sentinel allow you to define conditions (e.g., alert type) and corresponding actions, including 'Assign owner' to automatically route incidents to the appropriate analyst. This is the native, no-code mechanism for incident assignment based on alert properties, making it the correct choice for this requirement.

Answer

A playbook that runs when an incident is created

Answer

A watchlist containing analyst names

Answer

A hunting bookmark to track assignments

Question 19

Your organization uses Microsoft Sentinel as its SIEM and Microsoft Defender XDR for endpoint detection. A critical incident has been generated: 'Possible ransomware activity detected on multiple endpoints.' The incident includes alerts from Microsoft Defender for Endpoint (MDE) about file encryption behaviors and from Microsoft Defender for Identity (MDI) about anomalous service account logins. You have been assigned the incident and need to contain the threat effectively. You have Microsoft Sentinel automation rules that can trigger playbooks, and you have Microsoft Defender XDR actions available. The environment includes 500 Windows 10 devices managed by Microsoft Intune, and 50 servers on-premises. Some servers are domain controllers. Which of the following is the BEST first course of action?

Accepted Answer

Isolate the affected devices using Microsoft Defender for Endpoint device isolation.. For active ransomware encrypting files across multiple endpoints, the priority is to stop the spread immediately. Microsoft Defender for Endpoint device isolation cuts network communication while preserving the Defender sensor channel for investigation, containing the threat before lateral movement or further encryption. Forensic collection and account remediation are important but secondary to stopping active encryption.

Answer

Disable all compromised service accounts in Microsoft Entra ID and reset their passwords.

Answer

Reset passwords for all domain administrator accounts and enforce MFA.

Answer

Trigger a Microsoft Sentinel playbook to collect forensic evidence from affected endpoints before remediation.

Question 20

Your organization uses Microsoft Sentinel with the Microsoft Defender XDR connector. You have a critical incident that involves multiple alerts across different services. The incident is being updated with new alerts. You need to ensure that a specific playbook runs only when the incident severity is updated to High. How should you configure the automation rule?

Accepted Answer

Set the trigger to 'When incident is updated' and add a condition on severity equals High.. The requirement is to run the playbook only when the incident severity is updated to High, so the automation rule must trigger on 'When incident is updated' and include a condition that severity equals High. This ensures the playbook fires on the severity change event rather than on creation or alert events.

Answer

Set the trigger to 'When an alert is created' and filter for alerts with High severity.

Answer

Set the trigger to 'When incident is created' and add a condition on severity equals High.

Answer

Configure the condition inside the playbook to check severity and exit if not High.