SC-200 Mock Exam 73 — 25 Questions

Question 1

Your SOC team uses Microsoft Sentinel incident management. They want to automatically assign high-severity incidents to a senior analyst and send a notification to Microsoft Teams. What should you use?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Create an automation rule that triggers on incident creation, assigns the incident, and runs a playbook to post to Teams.. Automation rules in Microsoft Sentinel can trigger on incident creation (e.g., when severity is 'High'), automatically assign the incident to a specific owner (senior analyst), and then invoke a playbook (Azure Logic App) to post a message to Microsoft Teams. This combines assignment logic with automated notification in a single, manageable rule.

Answer

Create a playbook and attach it directly to the analytics rule.

Answer

Create a watchlist to define assignment rules and configure a workbook for notifications.

Answer

Create an analytics rule with incident grouping and assignment.

Question 2

Your organization uses Microsoft Defender for Endpoint and Microsoft Sentinel. As part of a threat hunting exercise, you need to detect potential lateral movement using remote desktop protocol (RDP). You want to identify devices that have initiated multiple RDP connections to different internal IP addresses within a short time frame. Which hunting query should you use in Microsoft Sentinel's Log Analytics workspace?

Accepted Answer

DeviceNetworkEvents | where RemotePort == 3389 and ActionType == 'ConnectionSuccess' | summarize dcount(RemoteIP) by DeviceName. DeviceNetworkEvents is the Microsoft Defender for Endpoint table that records network connection telemetry, including the RemotePort and ActionType fields. Filtering on RemotePort == 3389 (the RDP port) with ActionType == 'ConnectionSuccess' and then using dcount(RemoteIP) by DeviceName surfaces devices that successfully connected to many distinct internal IPs — the classic signature of RDP-based lateral movement. This is the query pattern Microsoft recommends in Sentinel hunting workbooks for detecting RDP fan-out behavior.

Answer

Syslog | where Facility == 'auth' and Message contains 'RDP' | summarize count() by HostName

Answer

DeviceProcessEvents | where ProcessCommandLine contains 'mstsc.exe' | summarize count() by DeviceName

Answer

IdentityLogonEvents | where LogonType == 'RemoteInteractive' | summarize dcount(IPAddress) by DeviceName

Question 3

A security analyst is investigating a malware outbreak and needs to find all devices where a specific malicious file with a known SHA1 hash has been observed in the last 24 hours. Which Advanced Hunting table in Microsoft 365 Defender should be the primary source for this query?

Accepted Answer

DeviceFileEvents. DeviceFileEvents is the correct table because it specifically records file creation, modification, and deletion events on endpoints, including the SHA1 hash of files. To find all devices where a specific malicious file with a known SHA1 hash has been observed, this table provides the direct file-level telemetry needed for the query.

Answer

EmailAttachmentInfo

Answer

DeviceProcessEvents

Answer

DeviceNetworkEvents

Question 4

Which TWO Microsoft Sentinel features allow you to organize and prioritize incidents for better triage?

Accepted Answer

Incident assignment to analysts.. Incident assignment allows security operations center (SOC) analysts to take ownership of specific incidents, ensuring accountability and preventing duplicate work. This feature directly supports triage by routing incidents to the appropriate team member based on skills or workload. Option E is correct because classification and tagging let analysts categorize incidents by severity, attack type, or status, enabling efficient filtering and prioritization across the incident queue.

Answer

Entity mapping in analytics rules.

Answer

Automation rules with incident creation triggers.

Answer

Workbooks for dashboard reporting.

Question 5

Your company uses Microsoft Defender for Office 365. You want to automatically take action on malicious emails that bypass the filter. What should you configure?

Accepted Answer

Configure automated investigation and response (AIR) policies.. Automated investigation and response (AIR) policies in Microsoft Defender for Office 365 are specifically designed to automatically take action on malicious emails that bypass initial filters. AIR uses playbooks to investigate threats and automatically remediate, such as deleting or moving emails, without manual intervention. This directly addresses the requirement to automatically act on bypassed malicious emails.

Answer

Enable anti-phishing policy.

Answer

Enable Safe Attachments policy.

Answer

Create a transport rule in Exchange.

Question 6

An organization uses Microsoft Defender XDR. During an incident investigation, the security team needs to determine if a specific file was executed on any devices in the organization over the past 30 days. They have the file hash. What is the most efficient way to get this information?

Accepted Answer

Use advanced hunting to query for file execution events. Advanced hunting in Microsoft Defender XDR provides a Kusto Query Language (KQL) interface to query raw event data across all workloads, including DeviceProcessEvents, DeviceFileEvents, and DeviceEvents. By querying for the specific file hash (e.g., SHA256) in process creation events over the past 30 days, the team can efficiently determine if and where the file executed. This is the most direct and scalable method for historical, organization-wide file execution searches.

Answer

Use the action center to search for the file

Answer

Review the incident timeline for the file

Answer

Check the device inventory for the file

Question 7

Your organization uses Microsoft Defender for Cloud. You need to remediate a security recommendation that indicates a virtual machine is missing critical security updates. Which TWO actions should you take to remediate this recommendation?

Accepted Answer

Connect to the VM and install the missing updates.. Installing the missing updates directly on the VM resolves the underlying vulnerability that Defender for Cloud identified. Option D is correct because configuring automatic updates ensures the VM receives future critical security patches without manual intervention, which proactively remediates the recommendation over time.

Answer

Add a network security group to block inbound traffic to the VM.

Answer

Create an exemption for the recommendation in Defender for Cloud.

Answer

Restart the VM to trigger update installation.

Question 8

You are hunting for privileged account abuse in Microsoft Entra ID. Which table in Microsoft Sentinel contains audit logs for changes to directory roles?

Accepted Answer

AuditLogs. AuditLogs in Microsoft Sentinel contain audit data from Microsoft Entra ID, including changes to directory roles. Option A (IdentityLogonEvents) is incorrect as it contains identity protection events. Option C (SigninLogs) is incorrect because it contains user sign-in events. Option D (DeviceLogonEvents) is incorrect as it logs device logon events.

Answer

IdentityLogonEvents

Answer

SigninLogs

Answer

DeviceLogonEvents

Question 9

A security analyst receives a Microsoft Defender for Identity alert about a suspicious Kerberos attack. The analyst needs to contain the compromised account immediately. What should the analyst do?

Accepted Answer

Disable the user account in Microsoft Entra ID.. Disabling the user account in Microsoft Entra ID immediately prevents any further authentication and access, containing the compromised account. This is the fastest and most direct containment action for a suspicious Kerberos attack alert in Microsoft Defender for Identity.

Answer

Remove the user from all privileged groups.

Answer

Require the user to change their password at next sign-in.

Answer

Reset the user's password and notify the user.

Question 10

Which TWO techniques are commonly used in threat hunting to identify potential malicious activity? (Choose two.)

Accepted Answer

Searching for known indicators of compromise (IoCs).. Option A is correct because threat hunting commonly begins with searching for known indicators of compromise (IoCs) such as malicious IP addresses, file hashes, domain names, and registry keys, which can reveal evidence of past or ongoing attacks. Option C is correct because analyzing anomalies in baseline behavior—deviations from normal user, endpoint, or network activity—helps hunters uncover unknown or evasive threats that signature-based tools may miss. Disabling security controls (B) is not a threat-hunting technique; it weakens defenses and is unsafe. Waiting for alerts from automated detection tools (D) is reactive monitoring rather than proactive hunting. Automatically blocking all suspicious traffic (E) is a prevention/response action, not an investigative hunting method.

Answer

Disabling security controls to observe attacker behavior.

Answer

Waiting for alerts from automated detection tools.

Answer

Automatically blocking all suspicious traffic.

Question 11

You are investigating a potential data exfiltration using Microsoft Defender for Cloud Apps. You find that a user downloaded a large number of files from SharePoint Online to a personal device. Which anomaly detection policy type would have detected this?

Accepted Answer

Activity anomaly detection policy. Activity anomaly detection policies detect unusual download volumes. Option B is wrong because File anomaly policies focus on file types and metadata. Option C is wrong because Cloud Discovery anomaly policies focus on shadow IT. Option D is wrong because OAuth app anomaly policies focus on app permissions.

Answer

File anomaly detection policy

Answer

Cloud Discovery anomaly detection policy

Answer

OAuth app anomaly detection policy

Question 12

A security analyst is investigating a potential data exfiltration incident in Microsoft Sentinel. The analyst needs to identify which users may have been compromised. Which THREE data sources should be queried to gather the most relevant evidence?

Accepted Answer

SigninLogs and AuditLogs from Microsoft Entra ID.. SigninLogs and AuditLogs from Microsoft Entra ID (C) are essential because SigninLogs reveal authentication anomalies such as impossible-travel or risky sign-ins tied to compromised accounts, while AuditLogs capture directory changes like new credentials or permission grants made by an attacker. OfficeActivity from Microsoft 365 (D) is correct because it records user and admin actions across Exchange, SharePoint, OneDrive, and Teams, exposing mail-forwarding rules, mass downloads, or file-sharing activity typical of exfiltration. CloudAppEvents from Microsoft Defender for Cloud Apps (E) is correct because it provides granular SaaS activity, including file downloads, uploads, and sharing events across connected cloud apps that reveal data movement. WindowsEvent from Defender for Endpoint (A) is endpoint telemetry focused on device-level process and file events, not user identity or cloud-service activity, so it is less directly relevant to identifying compromised users. AzureActivity from Azure Monitor (B) logs control-plane operations on Azure resources (e.g., role assignments, resource deployments) and does not capture the identity, mail, or SaaS activity needed here.

Answer

WindowsEvent from Microsoft Defender for Endpoint.

Answer

AzureActivity from Azure Monitor.

Question 13

Which TWO actions should an analyst take when a confirmed ransomware incident is detected on multiple endpoints? (Choose TWO.)

Accepted Answer

Isolate affected endpoints using Microsoft Defender for Endpoint.. Microsoft Defender for Endpoint's device isolation feature immediately severs all network communication (both inbound and outbound) from the affected endpoint while keeping the device powered on for forensic analysis. This containment action prevents lateral movement and further encryption of data across the network, which is critical during a ransomware incident.

Answer

Run a full antivirus scan on all endpoints.

Answer

Disconnect network cables but leave endpoints powered on.

Answer

Shut down all affected endpoints to prevent data loss.

Question 14

A SOC team uses Microsoft Sentinel. They receive a large volume of low-severity incidents from a specific analytics rule that causes alert fatigue. They want to automatically close incidents that match certain criteria (e.g., originating from a known test IP). Which feature should they configure?

Accepted Answer

Automation rules with a condition to close incidents. Automation rules in Microsoft Sentinel allow you to automatically close incidents based on specific conditions, such as a known test IP address. This directly addresses alert fatigue by suppressing low-severity incidents without manual intervention. Unlike playbooks, automation rules are lightweight and run natively within Sentinel without requiring a Logic Apps instance.

Answer

Playbook with a timer trigger

Answer

Watchlist integration

Answer

Fusion rule

Question 15

A company uses Microsoft Defender for Cloud with Defender for Containers enabled. The security team wants to view security alerts generated for their Azure Kubernetes Service (AKS) clusters. Where should they navigate to see these alerts?

Accepted Answer

In the Microsoft Defender for Cloud 'Security alerts' page.. Microsoft Defender for Cloud is the central console for security alerts generated by Defender for Containers, including those for AKS clusters. The 'Security alerts' page within Defender for Cloud aggregates all cloud workload protection alerts, making it the correct location to view AKS-specific alerts. Alerts from Defender for Containers are automatically surfaced here without additional configuration.

Answer

In Microsoft Sentinel incidents.

Answer

In the Microsoft 365 Defender portal.

Answer

In Azure Monitor alerts.

Question 16

Which TWO of the following are valid approaches to perform threat hunting using Microsoft Sentinel? (Choose two.)

Accepted Answer

Using the Hunting blade and Livestream. The Hunting blade in Microsoft Sentinel provides a dedicated interface for proactive threat hunting, allowing analysts to run KQL queries and pivot through results. Livestream extends this by enabling continuous, real-time query execution against incoming data, which is essential for detecting patterns that evolve over minutes or hours. Both features are explicitly designed for iterative, hypothesis-driven threat hunting rather than automated detection.

Answer

Using Fusion analytics rule

Answer

Using Automation rules to trigger playbooks

Answer

Using Azure Policy to enforce compliance

Question 17

A security analyst is reviewing a threat hunting query in Microsoft Sentinel that uses the Kusto Query Language (KQL) to identify potential lateral movement. The query returns a large number of false positives. What is the most effective way to reduce false positives while maintaining detection coverage?

Accepted Answer

Add allowlist conditions to exclude known administrative tools.. Adding allowlist conditions, such as excluding known administrative tools or approved remote management traffic, directly reduces false positives without removing the core logic. Option A is wrong because increasing the threshold may miss true positives. Option C is wrong because reducing the time range may miss true positives and does not address false positives. Option D is wrong because changing the data source may reduce detection coverage and does not necessarily reduce false positives in the current query.

Answer

Increase the threshold for the anomaly score in the query.

Answer

Reduce the time range of the query to the last 1 hour.

Answer

Replace the query with a different data source that has less noise.

Question 18

You are configuring Microsoft Sentinel to ingest logs from Azure Active Directory (now Microsoft Entra ID). Which of the following connectors should you use to collect sign-in logs and audit logs?

Accepted Answer

Microsoft Entra ID connector.. The Microsoft Entra ID connector (formerly Azure AD connector) is the correct choice because it is specifically designed to ingest sign-in logs, audit logs, and provisioning logs from Microsoft Entra ID into Microsoft Sentinel. This connector uses the Microsoft Graph API to pull these logs, enabling security monitoring of user authentication and administrative activities.

Answer

Microsoft Defender for Cloud connector.

Answer

Office 365 connector.

Answer

Azure Activity connector.

Question 19

A threat hunter wants to use Microsoft Defender for Cloud Apps to hunt for suspicious OAuth app permissions. Which activity type should the analyst investigate?

Accepted Answer

OAuth app granting permissions. Suspicious OAuth app permissions are directly indicated by the activity type 'OAuth app granting permissions'. Option A (Failed logon attempts) is incorrect because it relates to authentication failures, not OAuth permissions. Option B (File download from SharePoint) is incorrect because it concerns data access, not permission grants. Option C (Mailbox forwarding rule created) is incorrect because it involves email rules, not OAuth authorizations.

Answer

Failed logon attempts

Answer

File download from SharePoint

Answer

Mailbox forwarding rule created

Question 20

Your organization uses Microsoft Sentinel and Microsoft Defender for Cloud Apps. You receive a high-severity incident indicating that a user's credentials were used to access a sensitive SharePoint site from an unmanaged device. The user, 'jdoe@contoso.com', is a senior executive. The IP address is from a public Wi-Fi hotspot. The incident includes a recommendation to apply session policy to block download of sensitive files. You need to create a policy in Microsoft Defender for Cloud Apps that blocks downloads from unmanaged devices for this specific user when accessing the sensitive site. The policy should trigger only when the user accesses the specific SharePoint site named 'ExecConfidential'. What should you do?

Accepted Answer

Create an app connector for SharePoint and a session policy that targets the user, site, and device tag 'Unmanaged' with the action 'Block download'.. Blocking downloads from unmanaged devices for a specific user and site requires a Defender for Cloud Apps session policy, which is enforced through Conditional Access app control and requires the SharePoint app connector to be configured. The session policy can be scoped to the user, the specific site 'ExecConfidential', and the 'Unmanaged' device tag, with the action set to block download. This is the only option that combines the app connector, session control, and the precise scoping the requirement demands.

Answer

Create a device compliance policy in Microsoft Intune to block unmanaged devices from accessing SharePoint.

Answer

Create a Conditional Access policy in Microsoft Entra ID to require compliant device for the SharePoint site.

Answer

Create a file policy in Defender for Cloud Apps to quarantine files downloaded from the site.