SC-200 Mock Exam 75 — 25 Questions

Question 1

Your organization has a hybrid identity environment with Microsoft Entra ID (Azure AD) and on-premises Active Directory. You are using Microsoft Defender for Identity (MDI) integrated with Microsoft Defender XDR. An incident is raised indicating that a user account has been compromised because of an anomaly in Kerberos protocol activity. The incident severity is High. You need to contain the incident immediately by disabling the user account across both on-premises and cloud. However, you also want to preserve the account for forensic analysis. What is the recommended course of action?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

From Microsoft Defender XDR incident, use the action to disable the user account in Microsoft Entra ID and also disable the on-premises account using a playbook that runs a PowerShell script.. Microsoft Defender XDR provides a built-in action to disable a user account in Microsoft Entra ID directly from the incident. For on-premises AD, a playbook with a PowerShell script can disable the account, preserving it for forensic analysis. This approach contains the incident across both environments without deleting the account.

Answer

Delete the user account from Microsoft Entra ID and on-premises AD immediately.

Answer

Reset the user's password in Microsoft Entra ID and force a password change at next logon on-premises.

Answer

Enable conditional access policy to require MFA for the user and revoke all refresh tokens.

Question 2

Your organization uses Microsoft Sentinel and Microsoft Defender for Cloud. You receive an alert from Defender for Cloud that a virtual machine has a high severity vulnerability: 'CVE-2023-XXXX' with a CVSS score of 9.8. The virtual machine is running a critical application for the finance department. You need to remediate the vulnerability as quickly as possible while minimizing downtime. The application vendor has not yet released a patch but has provided a workaround. What should you do?

Accepted Answer

Implement the workaround provided by the vendor and create a custom remediation task in Defender for Cloud to track the issue.. When no vendor patch exists but a workaround is available, applying the workaround immediately mitigates the risk while a custom remediation task in Defender for Cloud tracks the issue until a permanent patch arrives. This balances urgency (CVSS 9.8 is critical) with the business need to keep the finance application running.

Answer

Dismiss the alert as a false positive because no patch is available.

Answer

Shut down the virtual machine until a patch is available.

Answer

Apply a network security group to block all inbound traffic to the VM.

Question 3

You are investigating a potential ransomware incident in Microsoft Defender XDR. The incident has a high severity alert indicating that a user installed a suspicious application. Which initial response action should you take to contain the threat while preserving evidence?

Accepted Answer

Isolate the device using Microsoft Defender for Endpoint.. Isolating the device using Microsoft Defender for Endpoint immediately stops lateral movement and data exfiltration while preserving forensic data. Option B is wrong because resetting the password and enforcing MFA does not contain the threat on the device itself. Option C is wrong because uninstalling the suspicious application may remove evidence needed for investigation. Option D is wrong because disabling the user account does not stop malware already running on the device.

Answer

Reset the user's password and enforce MFA.

Answer

Uninstall the suspicious application via Intune.

Answer

Disable the user account in Microsoft Entra ID.

Question 4

A threat hunter in Microsoft Sentinel wants to detect attempts to disable security logging on Windows servers using a KQL query. Which Windows Event ID should the query filter on to capture security log clearing events?

Accepted Answer

1102. Event ID 1102 in the Windows Security log indicates the security log was cleared, which is a common technique used by attackers to cover their tracks. Option A (4688) is for process creation. Option B (4624) is for successful logon. Option C (5145) is for network share access. Therefore, only Option D (1102) correctly captures security log clearing events.

Answer

4688

Answer

4624

Answer

5145

Question 5

Your organization uses Microsoft Defender for Cloud to assess the security posture of Azure subscriptions. You receive an alert that a critical vulnerability exists on a virtual machine. What is the BEST immediate action to validate the alert and contain the threat?

Accepted Answer

Review the alert details in Microsoft Defender for Cloud to identify the vulnerability and follow the remediation steps.. The best immediate action is to review the alert details in Microsoft Defender for Cloud because it provides the specific vulnerability, affected resource, and recommended remediation steps. This validation step ensures you understand the threat before taking containment actions, which is critical for an effective and proportionate response. Defender for Cloud's alerts include contextual information such as severity, MITRE tactics, and remediation guidance, enabling informed decision-making.

Answer

Contact Microsoft support to request a vulnerability assessment.

Answer

Immediately apply the latest security patches to the VM using Azure Update Manager.

Answer

Isolate the VM from the network by applying a network security group rule.

Question 6

Refer to the exhibit. You run this KQL query in Microsoft Defender XDR to detect suspicious PowerShell activity. Why might this query generate many false positives?

Accepted Answer

Legitimate administrators often use encoded PowerShell commands.. Legitimate administrators often use encoded PowerShell commands, which would match this query and generate false positives. Option A is wrong because the time range shown in the exhibit (e.g., 7 days) is not excessively broad for hunting. Option B is wrong because the query is specific to encoded commands, but it does not miss attacks; it targets a specific technique. Option D is wrong because, while filtering by user could reduce noise, the main reason for false positives is that encoded commands are used legitimately, not because of the absence of user filtering.

Answer

The time range is too broad.

Answer

The query is too specific and misses many attacks.

Answer

The query does not filter by user.

Question 7

Your organization has deployed Microsoft Sentinel with the Microsoft Defender XDR connector. A high-severity incident is created for a user who received a phishing email that contained a malicious link. The user clicked the link, and the attacker gained access to the user's mailbox. The security team needs to remove the attacker's access and prevent future occurrences. What should you do first?

Accepted Answer

Remove any mailbox forwarding rules and delegated access. The first step should be to remove any mailbox forwarding rules and delegated access because attackers often set up persistence mechanisms to maintain access even after password resets. Removing these ensures the attacker cannot continue to receive emails or access the mailbox. This is a critical containment step before other remediation actions.

Answer

Run a full antivirus scan on the user's device

Answer

Reset the user's password immediately

Answer

Report the incident to Microsoft for further investigation

Question 8

Your Microsoft Sentinel workspace is receiving a high volume of false positive alerts from a specific analytics rule. You need to suppress these alerts without disabling the rule. Which feature should you use?

Accepted Answer

Configure alert suppression in the analytics rule. Alert suppression in a Microsoft Sentinel analytics rule lets you define conditions (such as matching entity, IP address, or account) under which subsequent matching alerts are suppressed for a configurable time window. This stops the false-positive noise without turning off the rule, so genuine detections from other entities or conditions still fire. It is configured directly on the analytics rule's 'Incident settings' / suppression section, making it the precise tool for this requirement.

Answer

Create an automation rule to close incidents

Answer

Adjust the alert threshold in the analytics rule

Answer

Disable incident creation for the rule

Question 9

After a security incident, you need to preserve evidence from a compromised Microsoft 365 tenant. What is the best method to preserve data?

Accepted Answer

Place the user's mailbox and OneDrive on litigation hold. Placing the user's mailbox and OneDrive on litigation hold is the best method for preserving evidence because it preserves all data in its original state, preventing deletion or modification. Option A (backup of entire tenant) is excessive and not immediate. Option B (eDiscovery) is for search and export, not preservation. Option C (export to PST and delete) destroys the original evidence, which is inadvisable.

Answer

Take a backup of the entire tenant

Answer

Use Microsoft Purview eDiscovery to search and export

Answer

Export the data to a PST file and delete the original

Question 10

You are threat hunting in Microsoft Defender for Cloud Apps. You want to identify users who have enabled mailbox forwarding rules to external domains, which could indicate data exfiltration. Which log source should you query?

Accepted Answer

Office 365 audit logs. Microsoft Defender for Cloud Apps can ingest Office 365 audit logs, which include Exchange mailbox audit events for forwarding rules. Options B, C, and D are incorrect: Microsoft Entra ID sign-in logs (B) do not contain mailbox forwarding events, Windows Event logs from domain controllers (C) are device-focused and do not include Exchange mailbox rules, and Azure Network Watcher logs (D) are for network monitoring and do not include mailbox rules.

Answer

Microsoft Entra ID sign-in logs

Answer

Windows Event logs from domain controllers

Answer

Azure Network Watcher logs

Question 11

A company uses Microsoft Defender for Cloud with enhanced security features enabled. The security team wants to view a consolidated list of all security recommendations across multiple Azure subscriptions in a single view. Which blade should they navigate to in the Microsoft Defender for Cloud portal?

Accepted Answer

Security posture. The Security posture blade in Microsoft Defender for Cloud provides a consolidated view of all security recommendations across multiple Azure subscriptions, enabling the security team to assess and prioritize improvements. This blade aggregates recommendations from various security controls and displays them in a single, unified interface, directly addressing the requirement for a consolidated list.

Answer

Regulatory compliance

Answer

Workload protections

Answer

Inventory

Question 12

Your organization is responding to a ransomware incident. Which TWO actions should be taken first to contain the incident while preserving forensic evidence?

Accepted Answer

Isolate affected devices using Microsoft Defender for Endpoint.. Option A is correct because isolating affected devices through Microsoft Defender for Endpoint (using the "Isolate device" action) severs network communication while keeping the device powered on, so volatile memory and forensic artifacts remain intact for investigation. Option C is correct because disabling compromised user accounts in Microsoft Entra ID immediately blocks the attacker's ability to authenticate, move laterally, or access cloud resources, and it is a reversible containment step that preserves sign-in and audit logs as evidence. Option B is not appropriate as a first action because a blanket password reset across all users is disruptive, does not stop an active session or token-based access, and can destroy or complicate evidence of which accounts were actually compromised. Option D is wrong because a factory reset wipes the device and destroys the forensic evidence needed for the investigation. Option E is wrong because shutting down network switches disrupts the entire segment and business operations, and powering off systems can lose volatile evidence, making it a disproportionate and evidence-destructive containment measure.

Answer

Reset passwords for all users in the organization.

Answer

Perform a factory reset on all affected devices.

Answer

Shut down network switches to isolate the network segment.

Question 13

During an incident, you need to isolate a compromised device from the network while allowing communication with Microsoft Defender for Endpoint cloud services. Which isolation type should you choose in Microsoft Defender XDR?

Accepted Answer

Selective isolation. Selective isolation (E) is the correct choice because it restricts network communication to only Microsoft Defender for Endpoint cloud services, blocking all other inbound and outbound traffic. This allows the compromised device to remain manageable and receive security updates while preventing lateral movement and further compromise. Full isolation would block all network traffic, including Defender services, rendering the device unmanageable.

Answer

Controlled folder access

Answer

Network protection

Answer

Block file

Answer

Full isolation

Question 14

Your SOC is investigating an incident in Microsoft Sentinel. You need to quickly identify all related alerts and entities across the timeline. What Microsoft Sentinel feature should you use?

Accepted Answer

Open the incident investigation graph.. The incident investigation graph in Microsoft Sentinel provides a visual, interactive map of all alerts, entities (such as users, IP addresses, hosts), and their relationships linked to a specific incident. This allows SOC analysts to quickly see the full scope of an incident across the timeline without manually correlating data, making it the correct tool for this scenario.

Answer

Run a hunting query.

Answer

Review the analytics rule that generated the incident.

Answer

Use the Incident workbook.

Question 15

Your organization uses Microsoft Sentinel. You need to configure a playbook that automatically responds to incidents by creating a support ticket in ServiceNow. Which connector should you use?

Accepted Answer

ServiceNow connector. The ServiceNow connector is the correct choice because it provides a direct, pre-built integration between Microsoft Sentinel and ServiceNow, enabling automated creation of incidents or tickets in ServiceNow when a Sentinel incident is triggered. This connector uses the ServiceNow REST API to map Sentinel fields to ServiceNow ticket fields, eliminating the need for custom HTTP calls or additional middleware.

Answer

HTTP connector

Answer

Azure Monitor connector

Answer

Office 365 Outlook connector

Question 16

Your organization uses Microsoft Defender for Cloud to manage security posture. You need to assign a custom initiative to a specific management group to track compliance. Which two components must you create?

Accepted Answer

A policy definition and an initiative definition.. To track compliance for a custom initiative in Microsoft Defender for Cloud, you must first create a custom policy definition that specifies the rules or effects to enforce. Then, you must create an initiative definition (a group of policy definitions) that can be assigned to a management group. This assignment enables Defender for Cloud to evaluate resources against the custom initiative and report compliance.

Answer

An Azure Blueprint and a role assignment.

Answer

An Azure RBAC role and a Log Analytics workspace.

Answer

An Azure Monitor workbook and an alert rule.

Question 17

Your organization has Microsoft Defender for Cloud Apps (MDA) connected to Microsoft Sentinel. The SOC team wants to receive alerts when a user accesses a sanctioned cloud app from an anonymous IP address. What should you configure?

Accepted Answer

Create an activity policy in Defender for Cloud Apps and connect it to Sentinel.. An activity policy in Defender for Cloud Apps can be configured to trigger alerts on specific user activities, such as accessing a sanctioned app from an anonymous IP address. This policy can then be connected to Microsoft Sentinel via the Defender for Cloud Apps data connector, which ingests alerts as incidents for SOC review. File policies (A) focus on file-level actions like sharing or malware detection, not user access events, while session policies (D) control real-time access but do not generate alerts for historical or post-access monitoring.

Answer

Create a file policy in Defender for Cloud Apps.

Answer

Enable the Defender for Cloud Apps connector in Sentinel without additional configuration.

Answer

Create a session policy in Defender for Cloud Apps.

Question 18

You are configuring a Microsoft Sentinel automation rule to automatically assign incidents to a specific owner based on a custom property. Which action type should you use?

Accepted Answer

Assign owner. The 'Assign owner' action type is specifically designed to change the owner of an incident in Microsoft Sentinel. When you need to automatically assign incidents to a specific owner based on a custom property (e.g., a tag or custom field), this action directly modifies the incident's 'Owner' property. Other action types serve different purposes: 'Run playbook' executes a logic app, 'Change status' updates the incident's status (e.g., New, Active, Closed), and 'Create ticket (preview)' creates an external ticket in a connected ticketing system.

Answer

Run playbook

Answer

Change status

Answer

Create ticket (preview)

Question 19

A SOC team uses Microsoft Sentinel and needs to ingest custom logs from an on-premises Linux server that writes events to a local text file. The team installs the Azure Monitor Agent (AMA) on the Linux server. Which configuration step is required in Sentinel to collect the custom log file?

Accepted Answer

Create a custom table in the Log Analytics workspace and configure a Data Collection Rule (DCR) to ingest the file. Azure Monitor Agent (AMA) requires a Data Collection Rule (DCR) to define the data source (custom log file path) and the destination table in the Log Analytics workspace. Since the log is a custom text file (not syslog or a standard Windows event), you must first create a custom table (using the workspace's schema or via the 'Create custom log' wizard) and then configure the DCR to ingest the file into that table. This is the only supported method for AMA-based custom log ingestion.

Answer

Use the Syslog connector and map the file to a facility

Answer

Install the Log Analytics agent (MMA) and configure Custom Logs in the agent settings

Answer

Create a scheduled analytics rule that reads the file via an API

Question 20

A SOC team uses Microsoft Sentinel and wants to automatically enrich incidents with threat intelligence from a third-party feed. Which feature should they configure to ingest the threat intelligence and correlate it with alerts?

Accepted Answer

Threat intelligence connectors. Threat intelligence connectors in Microsoft Sentinel allow ingestion of TI feeds and enable correlation with alerts. The other options do not provide this capability.

Answer

Analytics rules

Answer

Data connectors

Answer

Watchlists