SC-200 Mock Exam 74 — 25 Questions

Question 1

During a threat hunt in Microsoft Sentinel, you find a query that returns a high number of false positives. Which action should you take to refine the hunt?

Accepted Answer

Add additional filters to the query to exclude known benign activity. Adding filters to exclude known benign activity directly reduces false positives by narrowing the result set to only suspicious events. In Microsoft Sentinel, KQL queries are refined iteratively during threat hunts, and excluding known-good indicators (e.g., service accounts, approved IP ranges, signed binaries) is the standard tuning technique. This preserves the hunt's detection intent while improving signal-to-noise ratio.

Answer

Increase the query time range to gather more data

Answer

Create a scheduled alert rule based on the query

Answer

Remove columns from the result set to simplify analysis

Question 2

As a threat hunter, you want to use MITRE ATT&CK techniques to categorize detected behaviors. In Microsoft Sentinel, which feature allows you to map alerts to MITRE techniques automatically?

Accepted Answer

Analytics rules. Analytics rules in Microsoft Sentinel allow you to map alerts to MITRE ATT&CK techniques automatically. When creating or editing an analytics rule, you can select the relevant MITRE ATT&CK tactic and technique, which enriches the alert with threat intelligence context. Workbooks (Option D) are for visualization, not mapping. Playbooks (Option B) are for automated response. Watchlists (Option C) are for reference data. Therefore, Option A is correct.

Answer

Playbooks

Answer

Watchlists

Answer

Workbooks

Question 3

Your organization uses Microsoft Defender for Cloud Apps and Microsoft Sentinel. During a threat hunt, you find that a user accessed a sensitive SharePoint site from an anonymous IP address. Which hunting method would best identify all users who accessed the same site from similar anonymous IPs?

Accepted Answer

Query CloudAppEvents in Advanced hunting for the SharePoint site URL and filter by IP category 'AnonymousProxy'. Using KQL to query CloudAppEvents for the specific SharePoint site and filtering by IP address categories (e.g., AnonymousProxy) is the most direct method. Option D (Microsoft Entra ID sign-in logs) may not include SharePoint site-level access. Option B (Microsoft Defender for Endpoint) is for endpoint activities. Option C (Microsoft Purview) focuses on data classification and governance.

Answer

Query DeviceEvents for network connections from the anonymous IP

Answer

Use Microsoft Purview to scan for sensitive data accessed from anonymous IPs

Answer

Search Azure AD sign-in logs for the same IP

Question 4

Which TWO KQL operators are commonly used in threat hunting to join tables based on a key?

Accepted Answer

lookup. Option A, lookup, is correct because it enriches events by joining a fact table with a dimension table on a matching key column, returning only the columns from the lookup table and is optimized for this common threat-hunting enrichment pattern. Option B, join, is correct because it combines rows from two tables based on matching values of a specified key column (e.g., join kind=inner on Account), which is the general-purpose operator for correlating tables in KQL. Option C, extend, is not a join operator; it adds or computes new columns on a single table. Option D, summarize, aggregates rows into groups using functions like count() or dcount(), not a key-based table join. Option E, union, appends rows from multiple tables into one result set without matching on a key.

Answer

extend

Answer

summarize

Answer

union

Question 5

During a security incident response, you need to collect forensic evidence from a Windows 10 device that is suspected to be compromised. The device is not domain-joined and is located in a remote office. You have remote administrative access. Which Microsoft 365 tool should you use to acquire a memory dump of the device?

Accepted Answer

Microsoft Defender for Endpoint. Microsoft Defender for Endpoint includes live response and the ability to collect forensic artifacts, including memory dumps, from onboarded devices. It supports remote acquisition from non-domain-joined Windows 10 devices as long as they are onboarded and you have the appropriate permissions. Sentinel, Purview eDiscovery, and Intune do not provide memory dump acquisition.

Answer

Microsoft Sentinel

Answer

Microsoft Purview eDiscovery

Answer

Microsoft Intune

Question 6

Your organization uses Microsoft Sentinel. You need to create an incident response playbook that automatically isolates a compromised device when a high-severity incident is created. The playbook should only run during business hours (9 AM - 5 PM local time). How should you configure this?

Accepted Answer

Add a condition in the playbook to check the current time. Microsoft Sentinel automation rules cannot evaluate conditions based on the time of day (e.g., creation hour). The appropriate method is to add a condition in the playbook itself (Azure Logic Apps) to check the current time and proceed only during business hours. This approach gives you full control over the playbook's execution schedule without relying on unsupported automation rule conditions.

Answer

Configure the analytics rule to only create incidents during business hours

Answer

Use a workbook to schedule the playbook

Answer

Create an automation rule with a condition on the incident creation time

Question 7

Which TWO actions can be performed using automation rules in Microsoft Sentinel? (Select TWO.)

Accepted Answer

Assign an incident to a specific owner.. Option C is correct because Microsoft Sentinel automation rules can perform incident management actions such as changing the owner, status, severity, or adding tags to an incident when their conditions are met. Option E is correct because automation rules can invoke a playbook (Logic App) in response to an incident being created, which is a core use case for orchestrating automated responses. Option A is not correct because incidents are generated from alerts by analytics rules, not by automation rules. Option B is not correct because automation rules cannot modify the query or logic of an existing analytics rule. Option D is not correct because automation rules do not support deleting incidents; they can close or change incident properties but not remove the incident record.

Answer

Create a new incident from an alert.

Answer

Modify the query of an existing analytics rule.

Answer

Delete an incident automatically.

Question 8

Your organization uses Microsoft Sentinel. You have an incident that involves multiple alerts. You want to automatically assign the incident to the appropriate analyst based on the alert type. What should you use?

Accepted Answer

Create an automation rule with an 'Assign incident to owner' action.. An automation rule with an 'Assign incident to owner' action is the correct mechanism to automatically assign incidents based on alert type. Automation rules in Microsoft Sentinel support conditions on incident properties (including alert type/analytics rule) and can assign the incident to a specific owner or group. This directly fulfills the requirement.

Answer

Create a playbook that assigns the incident.

Answer

Configure the analytics rule to set the incident owner.

Answer

Use a workbook to filter incidents by alert type.

Question 9

During an incident response, your team identifies a suspicious PowerShell command executed on multiple devices. Which Microsoft Defender XDR feature should you use to block the command across all endpoints immediately?

Accepted Answer

Indicators of compromise (IoC). Microsoft Defender XDR's Indicators of compromise (IoC) allow creating custom indicators to block file hashes, IPs, URLs, or commands across endpoints. Option A is wrong because Potentially Unwanted Application (PUA) protection targets unwanted software, not specific commands. Option C is wrong because Attack Surface Reduction (ASR) rules are designed to block common attack patterns, not ad-hoc commands. Option D is wrong because Device Control policies manage peripheral devices like USB drives.

Answer

Potentially Unwanted Application (PUA) protection

Answer

Attack Surface Reduction (ASR) rules

Answer

Device Control policies

Question 10

Your company uses Microsoft Defender for Endpoint. A device shows signs of compromise with suspicious PowerShell execution. You need to collect forensic evidence before performing remediation. Which action should you use?

Accepted Answer

Collect investigation package.. In Microsoft Defender for Endpoint, the 'Collect investigation package' action gathers a forensic snapshot of the device — including running processes, network connections, autoruns, scheduled tasks, and recent files — without altering the system state. This is the correct first step when you need to preserve evidence before remediation, because it captures volatile data that would be lost if you isolated or remediated the device. Isolation and live response are separate actions that serve different purposes.

Answer

Isolate the device from the network.

Answer

Run a full antivirus scan.

Answer

Initiate a live response session.

Question 11

Your organization uses Microsoft Sentinel with Microsoft Defender XDR integrated. A critical incident has been raised involving a user account that was used to access a confidential SharePoint site from an unusual location at 2:00 AM. The incident includes alerts from Microsoft Defender for Cloud Apps, Microsoft Defender for Identity, and Microsoft Defender for Office 365. The analyst needs to contain the incident, investigate the scope, and begin remediation. The environment has the following: Microsoft Entra ID with conditional access policies, Microsoft Intune for device management, and Microsoft Defender for Endpoint on all devices. The analyst has identified the user account and the device used. Which course of action should the analyst take first?

Accepted Answer

Disable the user account in Microsoft Entra ID and revoke all sessions.. Disabling the user account in Microsoft Entra ID and revoking all sessions is the immediate containment step because it stops the compromised account from being used for any further access, including the suspicious SharePoint access and any lateral movement. This action directly addresses the core of the incident—the user account—and is the fastest way to cut off the attacker's current authentication tokens and sessions, preventing further damage while the investigation proceeds.

Answer

Create a conditional access policy to block the user.

Answer

Isolate the user's device using Microsoft Defender for Endpoint.

Answer

Run a KQL query to find all resources accessed by the user.

Question 12

Your organization uses Microsoft Defender for Endpoint. A user reports that their device is running slowly and exhibiting unusual network activity. You run a live response session and find a suspicious process running. Which action should you take first to contain the threat?

Accepted Answer

Isolate the device from the network.. The first containment action in a live response session should be to isolate the device from the network. Isolation stops lateral movement, command-and-control communication, and data exfiltration while preserving the device state for forensic investigation. Terminating the process or collecting a memory dump can wait until the device is contained, because the threat may respawn or the attacker may pivot.

Answer

Collect a full memory dump for analysis.

Answer

Terminate the suspicious process.

Answer

Add a firewall rule to block outbound traffic from the device.

Question 13

You are configuring Microsoft Sentinel analytics rules. Which THREE of the following are valid types of analytics rules in Microsoft Sentinel?

Accepted Answer

Fusion rule. In Microsoft Sentinel, the analytics rule types available when creating a rule include Scheduled query rules (D), which run KQL queries on a defined frequency and trigger alerts based on results; Fusion rules (A), which use Microsoft's machine-learning correlation engine to detect multi-stage attacks across signals; and Microsoft Security rules (B), which create incidents from alerts generated by Microsoft security products like Defender and Microsoft 365. These three are the standard rule types offered in the Sentinel analytics rule wizard. Watchlist rule (C) is not a rule type — watchlists are data sources used to enrich queries and can be referenced inside scheduled rules, not a standalone analytics rule. Playbook rule (E) is also not a rule type — playbooks are Logic Apps used for automated response and are triggered by automation rules or analytics rules, not created as analytics rules themselves.

Answer

Watchlist rule

Answer

Playbook rule

Question 14

A threat hunter is using Microsoft Sentinel and wants to leverage machine learning to detect anomalous behavior in Azure subscription activity. Which analytics rule template should the hunter use?

Accepted Answer

Anomalous Azure Operations. The 'Anomalous Azure Operations' analytics rule template in Microsoft Sentinel uses machine learning to baseline Azure subscription activity and flag unusual operations, which directly matches the hunter's goal of detecting anomalous Azure activity. It is purpose-built for Azure control-plane events.

Answer

Anomalous Sign-In Locations

Answer

Anomalous User Behavior

Answer

Lateral Movement Detection

Question 15

While hunting in Microsoft Sentinel, you find a KQL query that uses the `evaluate` operator with `bag_unpack` to expand JSON properties. The query runs slowly and times out. What is the best practice to optimize this query?

Accepted Answer

Add a `where` clause to filter rows before applying `bag_unpack`.. The best practice for optimizing KQL queries that use bag_unpack is to filter rows with a where clause before applying the expansion. bag_unpack is expensive because it dynamically expands JSON properties into columns, so reducing the row set first minimizes the work. This is the correct optimization because it addresses the root cause: processing too many rows through an expensive operator.

Answer

Increase the cluster's concurrency and nodes.

Answer

Remove the `evaluate` operator and use `extend` with `parse_json`.

Answer

Use the `materialize` function to cache the entire table before expansion.

Question 16

Which TWO actions can you perform in Microsoft Defender XDR as part of incident response?

Accepted Answer

Collect an investigation package from a device. Option D is correct because Microsoft Defender XDR's device response actions include collecting an investigation package, which gathers forensic artifacts (such as running processes, network connections, and event logs) from an endpoint for offline analysis. Option E is correct because isolating a device from the network is a core Defender XDR live response action that cuts off an endpoint's network connectivity (while optionally allowing Defender communications) to contain a compromised host during incident response. The other options fall outside Defender XDR's native incident response capabilities: Microsoft Sentinel workbooks (A) are authored in Microsoft Sentinel, modifying an Entra ID conditional access policy (B) is done in the Microsoft Entra admin center, and running a KQL query in Azure Data Explorer (C) is an Azure Data Explorer operation, not a Defender XDR response action.

Answer

Create a Microsoft Sentinel workbook

Answer

Modify a Microsoft Entra ID conditional access policy

Answer

Run a KQL query in Azure Data Explorer

Question 17

While hunting, you notice a user account has been created and then immediately added to the Domain Admins group. Which table in Microsoft 365 Defender should you query to find this event?

Accepted Answer

IdentityDirectoryEvents. IdentityDirectoryEvents is the correct table because it records directory-service and identity-management events in Microsoft Defender XDR, including account creation, group membership changes, and role assignments such as adding a user to Domain Admins. This table captures the 'who did what to which identity object' details needed to hunt for privilege escalation via group membership. IdentityLogonEvents covers authentication activity, not directory object changes, so it would not show the group addition.

Answer

IdentityQueryEvents

Answer

IdentityLogonEvents

Answer

DeviceEvents

Question 18

Which TWO actions should a SOC analyst take immediately after confirming a ransomware incident in Microsoft Defender XDR?

Accepted Answer

Isolate affected devices from the network.. Option A is correct because isolating affected devices in Microsoft Defender XDR (via the device isolation action) immediately stops lateral movement, command-and-control communication, and further encryption by cutting the host off from the network while preserving the ability to investigate remotely. Option D is correct because ransomware actors commonly obtain and reuse compromised credentials, so resetting passwords for affected accounts and enforcing MFA revokes the attacker's access and prevents re-entry or persistence through valid accounts. Option B is not an immediate containment action; restoring from backups should occur only after the threat is contained and the environment is verified clean, otherwise restored data can be re-encrypted. Option C is too broad and destructive — disabling all mailboxes organization-wide is not a proportionate or standard ransomware response and would disrupt business without addressing the root compromise. Option E, collecting a full memory dump, is a forensic step that may be valuable later but is not one of the two immediate containment and credential-remediation actions required upon confirmation.

Answer

Begin restoring data from backups.

Answer

Disable all mailboxes in the organization.

Answer

Collect a full memory dump from each affected device.

Question 19

A threat hunter is using Microsoft Sentinel and Microsoft Defender XDR to hunt for a potential cross-domain attack where an attacker compromised an on-premises server and then used a privileged account to sign into Microsoft 365 from a new IP. The hunter wants to identify the server using a query that combines Windows Event Logs from the server with Microsoft 365 sign-in logs. Which approach should the hunter take to correlate the data?

Accepted Answer

Ingest Windows Security Event logs (Event ID 4624) from the server into a Log Analytics workspace, and join with SigninLogs on account name and timestamp. To correlate on-premises Windows logons with Microsoft 365 sign-ins, the hunter must ingest Windows Security Event ID 4624 (successful logon) from the server into a Log Analytics workspace, then join with the SigninLogs table on account name and timestamp. This is the standard Sentinel correlation pattern for cross-domain attacks. Event ID 4624 captures the account and logon type, enabling linkage to cloud sign-ins.

Answer

Create a Sentinel watchlist of known attacker IPs and compare with server logs

Answer

Enable Sysmon on the server and use its Event ID 3 (network connection) to find the IP

Answer

Use the DeviceLogonEvents table in Microsoft Defender XDR advanced hunting

Question 20

You are investigating a suspicious sign-in to a privileged account. You need to determine if the sign-in was from a known malicious IP address. Which Microsoft Sentinel data source should you query?

Accepted Answer

ThreatIntelligenceIndicator. The ThreatIntelligenceIndicator table in Microsoft Sentinel stores threat intelligence indicators (IPs, domains, URLs, file hashes) imported from TI providers or uploaded via API. To determine if a sign-in originated from a known malicious IP, you query this table for the IP address and check for matches.

Answer

SecurityEvent

Answer

SigninLogs

Answer

AuditLogs