SC-200 Mock Exam 77 — 25 Questions

Question 1

You are hunting for signs of ransomware using Microsoft Defender XDR's advanced hunting. Which query pattern would best identify a process that encrypts many files in a short time?

Accepted Answer

DeviceFileEvents | where ActionType == 'FileModified' | summarize Count = count() by DeviceName, InitiatingProcessFileName, bin(Timestamp, 5m) | where Count > 100. It counts the number of file modifications per initiating process per 5-minute window using DeviceFileEvents, and then filters for those with more than 100 modifications. This directly detects a process that is rapidly encrypting many files, which is a strong indicator of ransomware. Option A is wrong because it measures the duration between the first and last file event by a process, not the count; a process could encrypt files over a longer period and still be suspicious, but this query would miss high-density encryption in a short burst. Option C is wrong because it only looks at process creation events for specific script interpreters (powershell.exe, wscript.exe), not at file modifications, and it fails to identify encryption activity from other executables. Option D is wrong because it counts all file events per device without grouping by process, so it cannot pinpoint which process is responsible for the encryption.

Answer

DeviceFileEvents | summarize Duration = max(Timestamp)-min(Timestamp) by DeviceName, InitiatingProcessFileName | where Duration < 1h

Answer

DeviceProcessEvents | where FileName in ('powershell.exe', 'wscript.exe') | summarize by DeviceName

Answer

DeviceFileEvents | summarize Count = count() by DeviceName | where Count > 1000

Question 2

Your organization uses Microsoft Sentinel with UEBA (User and Entity Behavior Analytics) enabled. The SOC team notices that UEBA is not generating any anomalies for a specific user group. What is the most likely cause?

Accepted Answer

The data history for that user group is less than the required baseline period.. UEBA in Microsoft Sentinel requires a baseline period of historical data (typically 14 days minimum, often up to 30 days) before it can establish normal behavior patterns and generate meaningful anomalies. If a user group was recently added or their identity data has only been ingested for a short time, Sentinel lacks the behavioral baseline needed to flag deviations, so no anomalies appear. This is expected behavior, not a misconfiguration.

Answer

The user group is excluded from Identity Protection.

Answer

The user group is not being monitored by any data connector.

Answer

The analytics rules for UEBA are not enabled.

Question 3

Your organization uses Microsoft Sentinel for security operations. You need to ensure that critical alerts are automatically assigned to the appropriate SOC tier for investigation. What should you configure in Microsoft Sentinel?

Accepted Answer

Create an automation rule that sets the incident owner. Automation rules in Microsoft Sentinel allow you to automatically assign incidents to specific owners based on conditions like severity or alert type. This ensures critical alerts are routed to the appropriate SOC tier without manual intervention, directly meeting the requirement.

Answer

Create a playbook that assigns the incident to a user

Answer

Use a watchlist to map alert types to owners

Answer

Configure an analytics rule to set the owner

Question 4

Which TWO actions can you perform using Microsoft Sentinel automation rules? (Select two.)

Accepted Answer

Create a task on an incident. Option A is correct because Microsoft Sentinel automation rules support the "Create task" action, which adds a task to an incident for analyst follow-up. Option B is correct because automation rules can trigger a playbook (Logic App) to run against an incident, which is one of their primary purposes. Option C is not correct because incident creation is handled by analytics rules, not automation rules. Option D is not correct because automation rules cannot create other automation rules. Option E is not correct because sending an email is done by a playbook, not directly by an automation rule action.

Answer

Create an incident automatically

Answer

Create a new automation rule

Answer

Send an email notification

Question 5

Your organization uses Microsoft Sentinel. You need to automatically assign incidents to the appropriate SOC tier based on severity. What should you create?

Accepted Answer

An automation rule with an owner assignment action. Automation rules in Microsoft Sentinel allow you to automatically assign incidents to specific owners based on conditions like severity, using the 'Assign owner' action. This directly meets the requirement to route incidents to the appropriate SOC tier without manual intervention, leveraging Sentinel's native incident management capabilities.

Answer

A data connector to Microsoft Teams

Answer

A scheduled analytics rule

Answer

A playbook in Microsoft Power Automate

Question 6

Your security team receives an alert from Microsoft Defender for Endpoint indicating a suspicious PowerShell command was executed on a device. The command attempted to download a payload from a known malicious IP. After confirming the alert is a true positive, what should be your first containment step?

Accepted Answer

Isolate the device from the network using Microsoft Defender for Endpoint. Isolating the device via Microsoft Defender for Endpoint is the correct first containment step because it immediately cuts the endpoint off from the network while preserving the Defender agent's communication channel for further investigation and remediation. This stops lateral movement and C2 traffic from the compromised host without destroying forensic evidence. It is the standard 'contain first, investigate second' playbook for confirmed endpoint compromise.

Answer

Search for similar commands across all devices using advanced hunting

Answer

Disable the user account in Microsoft Entra ID

Answer

Reset the user's password

Question 7

You are a Microsoft Sentinel analyst investigating an incident that contains several related alerts about a compromised user account. Your incident response runbook requires you to temporarily prevent the attacker from using the account while preserving the ability to restore access after remediation. You need to disable the account in Microsoft Entra ID directly from the incident investigation experience. What should you do?

Accepted Answer

Open the user entity page in the incident, select the Disable user account action, and confirm the operation.. Microsoft Sentinel surfaces user entities inside incidents and provides entity actions that reach into Microsoft Entra ID. Disabling the account immediately blocks authentication for the compromised identity while leaving the object intact, so it can be re-enabled once containment and remediation are verified. Watchlists, Conditional Access, and deletion either do not change account state directly or introduce unnecessary disruption and recovery complexity.

Answer

Delete the user object in Microsoft Entra ID and restore it from the deleted users list after remediation.

Answer

Add the user entity to a watchlist, then configure an automation rule that disables accounts on the watchlist.

Answer

Assign the user a Conditional Access policy that blocks all cloud apps, then close the incident.

Question 8

You are a security operations analyst for a company that uses Microsoft Sentinel. The SOC manager wants to reduce alert fatigue by automatically closing incidents that are created by a specific analytics rule and contain only low-severity alerts. You need to configure this behavior with the least administrative effort. What should you do?

Accepted Answer

Create an automation rule that runs when an incident is created, with a condition on the analytics rule name and severity, and an action to change the incident status to Closed.. Microsoft Sentinel automation rules are designed for lightweight incident handling and can trigger when an incident is created. By scoping conditions to the analytics rule name and severity, the rule targets only the intended low-severity incidents and uses the built-in status change action to close them. This avoids custom code, reduces manual triage, and meets the least-effort requirement.

Answer

Configure a workbook that filters incidents by severity and analytics rule, and instruct analysts to manually close matching incidents during each shift.

Answer

Create a playbook that queries the Microsoft Sentinel incidents table with a KQL query for low-severity incidents and then calls the Microsoft Sentinel API to close them on a schedule.

Answer

Modify the analytics rule to set the incident creation setting to Disabled so that no incident is created for low-severity alerts.

Question 9

You are a Microsoft Sentinel administrator for a company that ingests Microsoft Defender XDR incidents into Microsoft Sentinel. You create an automation rule to automatically assign incidents to a specific analyst. The rule uses the condition 'Analytics rule name contains 'Suspicious'' and the action 'Assign owner'. After deployment, you notice that incidents from Microsoft Defender XDR are not being assigned. What is the most likely cause?

Accepted Answer

The condition 'Analytics rule name' is not populated for incidents that originate from Microsoft Defender XDR, so the rule condition never matches.. The automation rule failed because incidents from Microsoft Defender XDR do not have an 'Analytics rule name' property. That property is only set for incidents created by Sentinel analytics rules. To assign these incidents, the condition should be based on a property that exists, such as 'Product name' or 'Title'. This is a common pitfall when mixing incidents from different sources.

Answer

Automation rules in Microsoft Sentinel can only be triggered by incidents created by analytics rules, not by incidents ingested from Microsoft Defender XDR.

Answer

The automation rule must be enabled for each Microsoft Defender XDR connector separately.

Answer

Automation rules require a playbook to be attached to perform the assignment action.

Question 10

You are a security operations analyst for a company that uses Microsoft Defender XDR. You need to ensure that when a high-severity alert is generated in Microsoft Defender for Endpoint, an incident is automatically created in Microsoft Defender XDR and appears in the incident queue. What should you do?

Accepted Answer

Verify that the alert is not suppressed and that incident creation is enabled in the Microsoft Defender XDR settings.. Microsoft Defender XDR automatically creates incidents from alerts generated by its component services, including Defender for Endpoint, when incident creation is enabled and alerts are not suppressed. Checking these settings ensures that high-severity alerts result in incidents. The other options involve unnecessary customizations or misconfigured features that do not directly control incident creation in Defender XDR.

Answer

Enable the Microsoft Defender for Endpoint integration in Microsoft Defender XDR and set the alert severity threshold to High.

Answer

Create a custom detection rule in Microsoft Defender for Endpoint that triggers on high-severity alerts.

Answer

Configure a Microsoft Sentinel analytics rule to ingest high-severity alerts from Defender for Endpoint and create incidents.

Question 11

You are a SOC analyst using Microsoft Defender XDR. An incident named 'Suspicious PowerShell download' is assigned to you. You need to quickly determine the initial entry point and the scope of affected devices. Which action should you perform first within the incident?

Accepted Answer

Review the incident timeline to identify the first alert and related entities.. The incident timeline in Microsoft Defender XDR provides a chronological view of alerts and activities, allowing analysts to quickly identify the initial alert and affected entities. This is critical for understanding the entry point and scope before taking further action. Other options, while valid later, do not directly address the immediate need for triage.

Answer

Export the incident details to a CSV file for offline analysis.

Answer

Initiate an automated investigation to remediate the threat.

Answer

Run an advanced hunting query to list all devices with PowerShell events.

Question 12

You are a security operations analyst for a company that uses Microsoft Sentinel. The SOC manager wants to reduce alert fatigue by automatically closing incidents that are known false positives. The incidents are created from a custom analytics rule that generates a specific alert name, 'Suspicious PowerShell Download'. You need to create an automation rule that automatically closes these incidents with a classification of 'BenignPositive'. What should you do?

Accepted Answer

Create an automation rule with the condition 'Alert name' contains 'Suspicious PowerShell Download', and set the action to 'Close incident' with classification 'BenignPositive'.. Automation rules in Microsoft Sentinel are designed to automate incident handling tasks such as assignment, status changes, and classification. By creating an automation rule that triggers on incident creation and uses a condition based on the alert name, you can automatically close incidents with the desired classification. This is the most efficient and native method to achieve the SOC manager's objective.

Answer

Use a workbook to monitor incidents with that alert name and manually close them in bulk.

Answer

Modify the analytics rule to set the incident severity to 'Informational' and enable automatic closure after 24 hours.

Answer

Create a playbook that uses the 'Close incident' action and attach it to the analytics rule that generates the alert.

Question 13

You are investigating a potential compromise of a service account in Microsoft Sentinel. You need to identify all actions performed by this account across Azure and Microsoft 365. Which Sentinel feature should you use?

Accepted Answer

Logs query with KQL. Logs query with KQL in Microsoft Sentinel enables analysts to search across multiple data sources for activities related to a specific account. This is essential for identifying all actions performed by a compromised service account. Other features like UEBA, Workbooks, and Automation rules serve different purposes and do not provide the detailed, cross-service activity list needed.

Answer

Entity behavior analytics

Answer

Automation rules

Answer

Workbooks

Question 14

You are a security operations analyst for a company that uses Microsoft Sentinel. You need to enable User and Entity Behavior Analytics (UEBA) to identify anomalous behavior. You have already enabled the UEBA setting in Microsoft Sentinel. What else must you do to ensure UEBA data is available for investigation?

Accepted Answer

Configure data sources to send logs to the Microsoft Sentinel workspace and enable entity behavior data sources in UEBA settings.. After enabling UEBA in Microsoft Sentinel, you must configure the data sources that provide entity behavior information. This includes connecting sources like Microsoft Entra ID sign-in logs and enabling them in the UEBA settings. Without this, UEBA tables remain empty and anomaly detection cannot function. The other options either confuse detection with data population or involve unrelated configurations.

Answer

Create a custom analytics rule that runs on the BehaviorAnalytics table to generate incidents.

Answer

Assign the Microsoft Sentinel Contributor role to the UEBA service account.

Answer

Enable the Microsoft Defender XDR connector to import UEBA data from Defender services.

Question 15

You are a security operations analyst for a company that uses Microsoft Sentinel. The SOC wants to receive a Microsoft Teams notification whenever a high-severity incident is created. You need to configure this with the least administrative effort. What should you do?

Accepted Answer

Create an automation rule that triggers on incident creation, with a condition on severity, and an action to run a playbook that posts a message to Microsoft Teams.. The most efficient way to notify Teams on high-severity incident creation is to use an automation rule that triggers on incident creation, filters by severity, and runs a playbook. The playbook can use the Microsoft Teams connector to post a message. This is event-driven, immediate, and uses native integration, minimizing administrative effort.

Answer

Use the Microsoft Sentinel incident page and manually configure each analytics rule to send an email to a Teams channel.

Answer

Create a scheduled playbook that queries the SecurityIncident table for high-severity incidents every 5 minutes and posts new ones to Microsoft Teams.

Answer

Configure a Microsoft Sentinel workbook that displays high-severity incidents and set up a scheduled email subscription to the workbook.

Question 16

You are a security operations analyst using Microsoft Sentinel. You need to configure a workbook that displays a map of failed sign-in attempts by location over the last 24 hours. The data is stored in the SigninLogs table. Which two elements must you include in the workbook to achieve this?

Accepted Answer

A query that summarizes failed sign-ins by location and a map visualization.. To create a map in a Microsoft Sentinel workbook, you need a query that returns location data (such as latitude and longitude or country) and a map visualization that interprets that data. The query should filter for failed sign-ins in the last 24 hours and summarize by location. Other visualizations like pie charts or time charts do not display geographic information effectively.

Answer

A query that counts failed sign-ins by user and a time chart visualization.

Answer

A query that joins SigninLogs with Heartbeat and a grid visualization.

Answer

A query that lists all sign-in events and a pie chart visualization.

Question 17

You are a security operations analyst for a company that uses Microsoft Defender XDR. You need to configure a custom detection rule that will trigger an alert when a specific process is executed on any device. The process name is 'malicious.exe'. You want the alert to be generated only when the process is executed with a command line containing '--encrypt'. Which query language should you use to define the custom detection rule?

Accepted Answer

Kusto Query Language (KQL) against the DeviceProcessEvents table.. Custom detection rules in Microsoft Defender XDR are created by writing KQL queries against advanced hunting tables. For process execution events, the DeviceProcessEvents table is appropriate. By filtering on the process file name and command line, you can precisely trigger alerts for the specified condition.

Answer

SQL against the SecurityEvent table in Microsoft Sentinel.

Answer

PowerShell script that queries the Windows Event Log for process creation events.

Answer

Azure Resource Graph query against the Microsoft Defender for Endpoint resources.

Question 18

You are a security operations analyst using Microsoft Sentinel. You need to configure a playbook that automatically posts a message to a Microsoft Teams channel when a high-severity incident is created. Which two actions must you perform? (Choose two.)

Accepted Answer

Create an automation rule that triggers when an incident is created and has a condition for severity equals High.. To automatically post a message to Microsoft Teams when a high-severity incident is created in Microsoft Sentinel, you need an automation rule that triggers on incident creation, checks the severity, and runs a playbook. The playbook must use the Microsoft Teams connector to post the message to the desired channel. The automation rule provides the trigger and condition, while the playbook performs the action.

Answer

Create a playbook that uses the Office 365 Outlook connector and sends an email to the SOC team.

Answer

Create a playbook that uses the Microsoft Sentinel connector and retrieves incident details.

Answer

Create an automation rule that triggers when an incident is updated and has a condition for severity equals High.

Question 19

You are a threat hunter in Microsoft Sentinel. You suspect an attacker is using the Windows utility certutil.exe to download malicious payloads from an external URL. You want to write a hunting query that detects command lines where certutil.exe is used with the -urlcache or -verifyctl arguments. Which KQL query should you use?

Accepted Answer

DeviceProcessEvents | where FileName == "certutil.exe" | where ProcessCommandLine has_any ("-urlcache", "-verifyctl"). The correct query uses DeviceProcessEvents to capture process creation events and filters for certutil.exe with the suspicious arguments -urlcache or -verifyctl. This directly matches the hunting hypothesis. Other tables either lack command-line data or use incorrect fields. DeviceProcessEvents is the authoritative source for process command lines in Microsoft Defender XDR, making it the right choice for detecting this living-off-the-land binary abuse.

Answer

DeviceNetworkEvents | where InitiatingProcessFileName == "certutil.exe" | where RemoteUrl contains "http"

Answer

DeviceEvents | where ActionType == "CertUtilDownload" | where AdditionalFields contains "urlcache"

Answer

DeviceFileEvents | where FileName == "certutil.exe" | where FolderPath contains "urlcache"

Question 20

You are a security operations analyst for a company that uses Microsoft Sentinel. You need to ensure that when an incident is created from a Microsoft Defender for Identity alert, the incident is automatically assigned to the 'Identity Protection' team and a specific tag 'Identity' is added. You have already created an automation rule that triggers on incident creation and has the condition 'Product name' contains 'Azure Advanced Threat Protection'. What should you do next to meet the requirement?

Accepted Answer

Add actions to the automation rule: 'Assign owner' with the Identity Protection team, and 'Add tags' with 'Identity'.. Automation rules in Microsoft Sentinel can perform multiple actions on incidents, including assigning an owner and adding tags. Since the automation rule already triggers on the correct incidents, adding these actions directly satisfies the requirement without the need for additional playbooks or manual intervention.

Answer

Create a playbook that uses the Microsoft Sentinel API to assign the incident and add tags, then attach it to the automation rule.

Answer

Use a workbook to monitor incidents and manually assign them to the Identity Protection team and add tags.

Answer

Modify the analytics rule that generates the incident to include the assignment and tagging logic in its query.