SC-200 Mock Exam 78 — 25 Questions

Question 1

A SOC analyst is investigating a Microsoft Sentinel incident involving a compromised service principal. The analyst needs to enrich the incident with information from an external threat intelligence platform that exposes a REST API and requires an API key. The enrichment must run automatically each time a matching incident is created and must not require manual steps. Which Microsoft Sentinel component should the analyst use to implement this enrichment?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

A Microsoft Sentinel playbook triggered by an automation rule. Automated enrichment using an external API with an API key requires a Logic Apps-based playbook, which can securely store secrets, make HTTP calls, and write results back to the incident. Automation rules provide the trigger mechanism when an incident is created, ensuring the playbook runs without manual intervention. Analytics rules, workbooks, and data connectors serve different purposes and cannot fulfill the automated external enrichment requirement.

Answer

A data connector for the threat intelligence platform

Answer

A workbook with a custom parameter

Answer

A scheduled analytics rule with entity mapping

Question 2

You are a SOC analyst in Microsoft Defender XDR. An incident has been created that includes alerts from Microsoft Defender for Endpoint and Microsoft Defender for Office 365. You need to assign the incident to a colleague and add a note about initial findings. What should you do?

Accepted Answer

Open the incident, use the 'Assign to' option to select your colleague, and add a comment in the incident's activity log.. Microsoft Defender XDR provides built-in incident assignment and commenting. Assigning the incident to a colleague from the incident page ensures they are notified and can take ownership. Adding a comment in the activity log documents initial findings without altering the incident's alert correlation. This maintains a clear audit trail and supports efficient collaboration.

Answer

Export the incident to a CSV file and email it to your colleague, then close the incident.

Answer

Use the 'Manage incident' option to change the status to 'In progress' and set the 'Assigned to' field to your colleague's email address.

Answer

Create a new incident manually and copy the alerts from the original incident, then assign the new incident to your colleague.

Question 3

You are a threat hunter in a Microsoft Sentinel environment that ingests both Microsoft Defender XDR and third-party network logs. You want to build a reusable hunting query that surfaces failed authentication attempts from IP addresses that have never before been associated with successful sign-ins in your tenant. Which KQL operator should you use to correlate the two datasets and return only the novel source IPs?

Accepted Answer

leftanti join between SigninLogs and the successful sign-in set. The hunt hypothesis depends on identifying source IPs that generate failures but have no history of successful authentication. A leftanti join preserves the left-side failed sign-in rows and drops any whose IP key appears in the right-side success set, yielding the novel addresses the analyst wants to investigate further.

Answer

union of SigninLogs and the successful sign-in set

Answer

summarize count() by IPAddress on SigninLogs only

Answer

inner join between SigninLogs and the successful sign-in set

Question 4

You are investigating a security incident in Microsoft Sentinel. You need to identify which user account was used to perform a suspicious Azure Resource Manager operation that deleted a virtual machine. The operation was logged in Azure Activity logs. Which Kusto Query Language (KQL) query should you use to find the user identity associated with the deletion?

Accepted Answer

AzureActivity | where OperationName == 'Delete Virtual Machine' | project Caller. The AzureActivity table is the correct source for Azure Resource Manager operations, including VM deletions. The Caller field provides the identity of the user or service principal that performed the action. Filtering by OperationName ensures you isolate the deletion event. Other tables like SecurityEvent, SigninLogs, and AuditLogs do not contain ARM control plane operations, so they would not yield the required user identity.

Answer

SecurityEvent | where Activity == 'Delete Virtual Machine' | project Account

Answer

AuditLogs | where OperationName == 'Delete Virtual Machine' | project InitiatedBy

Answer

SigninLogs | where OperationName == 'Delete Virtual Machine' | project UserPrincipalName

Question 5

Your SOC uses Microsoft Sentinel. An analytics rule produces an incident, and your runbook requires that when a specific high-severity incident is created, a playbook must automatically post a summary to a Microsoft Teams channel and create a tracking task. You need the playbook to run without a human clicking anything. What should you configure?

Accepted Answer

An automation rule with the trigger When incident is created and an action that runs the playbook.. Automation rules are the Microsoft Sentinel component that watches for incident creation or update events and can launch playbooks automatically when conditions match. Pairing an incident-created trigger with a playbook action delivers the unattended Teams notification and task creation the runbook demands. Analytics rules, workbooks, and manual triggers either detect, display, or require human initiation, so none provides the event-driven response.

Answer

A scheduled analytics rule that calls the playbook from within its query logic.

Answer

A workbook that refreshes on a schedule and triggers the playbook through a data connector.

Answer

A playbook with an HTTP trigger that an analyst runs manually from the incident page.

Question 6

During a threat hunt in Microsoft Sentinel, you want to find hosts that began communicating with a newly registered domain shortly after a suspicious process executed on the same host. Your data is in DeviceProcessEvents and DeviceNetworkEvents. Which approach best correlates process execution and subsequent network connections on the same device within a time window?

Accepted Answer

Join DeviceProcessEvents and DeviceNetworkEvents on DeviceId with a time-window condition that places the network event after the process event. Correlating execution to later network activity requires a device-scoped join with a temporal constraint. Joining on DeviceId and requiring the network timestamp to be later than the process timestamp, within a bounded window, preserves causality and keeps unrelated hosts out of the result, which is what the hunt hypothesis needs.

Answer

Union DeviceProcessEvents and DeviceNetworkEvents and filter by timestamp

Answer

Summarize each table by DeviceId and compare the resulting counts

Answer

Join the two tables on the process name and remote IP address

Question 7

You are investigating a compromised user account in Microsoft Sentinel. You have identified that the attacker used the account to send phishing emails internally. You need to contain the threat by disabling the account and revoking all active sessions. Which Microsoft Sentinel feature should you use to perform these actions directly from the incident?

Accepted Answer

Entity action. Microsoft Sentinel's entity actions allow analysts to take direct containment steps on entities like users, devices, and IP addresses. For a user entity, actions include disabling the account in Microsoft Entra ID and revoking all active sessions. These actions are available from the incident investigation graph or entity pane, enabling rapid response without switching to the Entra portal.

Answer

Automation rule

Answer

Workbook

Answer

Hunting query

Question 8

You are a threat hunter in a Microsoft Sentinel workspace. You hypothesize that an attacker is using the legitimate tool PsExec to move laterally, but you want to detect it without relying on process names that are easily renamed. Which hunting approach using KQL best identifies PsExec-like lateral movement by examining named pipes?

Accepted Answer

Search SecurityEvent for EventID 5145 where ShareName contains "IPC$" and RelativeTargetName matches "*psexesvc*".. PsExec creates a named pipe called 'psexesvc' on the target system during execution. Hunting for Event ID 5145 with ShareName IPC$ and RelativeTargetName containing 'psexesvc' detects this behavior regardless of the source binary name, making it a reliable method for identifying lateral movement with PsExec-like tools. Other options either rely on easily changed process names or produce high false positives.

Answer

Search DeviceNetworkEvents for connections to TCP port 445 where InitiatingProcessFileName is "psexec.exe".

Answer

Search SecurityEvent for EventID 4624 with LogonType 3 and a SubjectUserName ending with "$".

Answer

Search SecurityEvent for EventID 4688 where NewProcessName ends with "psexec.exe" or "psexesvc.exe".

Question 9

You are a Security Operations Analyst using Microsoft Sentinel. An incident has been created from an analytics rule. You need to assign the incident to a specific analyst and change its status to 'Active' so that it appears in their queue. Which action should you perform in the Microsoft Sentinel incident page?

Accepted Answer

Use the 'Assign to' field and set the status to 'Active'. In Microsoft Sentinel, incident assignment and status are managed directly on the incident page. The 'Assign to' field sets the owner, and the status field (New, Active, Closed) controls the workflow state. Setting both assigns the incident to the analyst and marks it Active, ensuring it appears in their queue. Other actions like tagging or modifying rules do not achieve the required assignment and activation.

Answer

Create a new automation rule to set the owner and status

Answer

Edit the incident's tags to include the analyst's name

Answer

Modify the analytics rule that generated the incident

Question 10

A Microsoft Defender XDR incident involves a compromised endpoint. Your containment policy requires isolating the device from the network while still allowing you to run live response commands to collect evidence. You need to choose the appropriate device isolation type in Microsoft Defender for Endpoint. Which isolation type should you select?

Accepted Answer

Selective isolation, which blocks most network traffic but permits the Defender for Endpoint service and live response.. Selective isolation in Microsoft Defender for Endpoint cuts the device off from normal network communication while allowing the Defender for Endpoint service channel and live response. That preserves the analyst's ability to collect evidence through live response commands during containment. Full isolation, perimeter firewall rules, and hash-based indicators either over-restrict, fail to contain roaming devices, or address only a single artifact instead of the host.

Answer

Device containment via a firewall rule that blocks the device's IP address at the perimeter.

Answer

Full isolation, which blocks all network traffic to and from the device.

Answer

App execution restriction via an indicator that blocks the malicious process hash.

Question 11

You are a Microsoft Sentinel analyst handling an incident where a compromised user account is being used to access cloud applications. Your response plan requires you to both terminate the attacker's active sessions and review what the account accessed. Which two actions should you perform? (Choose two.)

Accepted Answer

Use the Microsoft Entra ID user entity action to revoke sessions or reset the password so existing refresh tokens are invalidated.. Terminating an attacker's access requires invalidating tokens, not just blocking new sign-ins, so revoking sessions or resetting the password is essential. Reviewing sign-in and audit logs reconstructs what the account touched, which the response plan explicitly requires. Destroying the mailbox, disabling detection, or prematurely closing the incident would either damage evidence, create visibility gaps, or misrepresent the incident's severity.

Answer

Change the incident status to Closed and add a benign positive classification.

Answer

Disable the analytics rule that generated the incident so it does not retrigger.

Answer

Delete the user's mailbox to prevent further email-based data theft.

Question 12

You are a threat hunter at Contoso. You suspect that an attacker is using the 'net user' command to create local accounts on compromised machines. You need to write a KQL query in Microsoft Defender XDR advanced hunting to find all instances of 'net user' being executed. Which operator should you use to search for the command line containing 'net user'?

Accepted Answer

contains. To detect the 'net user' command, you need to search for the substring within the command line. The contains operator is designed for this purpose and will match any command line that includes 'net user', regardless of position. Other operators like startswith or endswith are too position-specific and would miss common variations.

Answer

has

Answer

startswith

Answer

endswith

Question 13

You are a threat hunter using Microsoft Defender XDR. You want to identify all devices that have communicated with a known malicious IP address 203.0.113.10 in the last 30 days. Which Advanced Hunting query should you run?

Accepted Answer

DeviceNetworkEvents | where RemoteIP == "203.0.113.10" and Timestamp > ago(30d). DeviceNetworkEvents is the correct Advanced Hunting table for network connection data. It includes fields such as RemoteIP, RemotePort, and LocalIP. By filtering for the specific malicious IP address and limiting to the last 30 days using Timestamp > ago(30d), you can retrieve all devices that communicated with that IP. This query provides the necessary visibility for threat hunting network-based indicators.

Answer

DeviceFileEvents | where RemoteIP == "203.0.113.10" and Timestamp > ago(30d)

Answer

DeviceEvents | where RemoteIP == "203.0.113.10" and Timestamp > ago(30d)

Answer

DeviceLogonEvents | where RemoteIP == "203.0.113.10" and Timestamp > ago(30d)

Question 14

You are a Security Operations Analyst investigating a potential insider threat. A user's account was flagged for downloading a large number of files from SharePoint Online. You need to review the user's activity and determine if the behavior is malicious. You have Microsoft Defender for Cloud Apps and Microsoft Sentinel configured. Which Microsoft Sentinel data source should you query to analyze the user's file download activities in SharePoint?

Accepted Answer

OfficeActivity table. The OfficeActivity table is the correct data source for SharePoint Online file download activities. It captures detailed audit events such as FileDownloaded, including user, file name, and client IP, enabling you to assess the scale and nature of the downloads and determine if the behavior is suspicious.

Answer

AuditLogs table

Answer

CloudAppEvents table

Answer

SigninLogs table

Question 15

You are a threat hunter in Microsoft Sentinel. You want to identify all devices that have communicated with a known malicious IP address (e.g., 203.0.113.5) over the past week. Which data source should you query to find network connection events?

Accepted Answer

DeviceNetworkEvents. DeviceNetworkEvents is the correct data source because it captures endpoint network connections, including remote IP addresses, and is available in Microsoft Sentinel through the Microsoft Defender XDR connector. Querying it for the malicious IP will reveal all devices that communicated with it. Other sources like CommonSecurityLog or Syslog may have some network data but are not as comprehensive or endpoint-focused.

Answer

AzureNetworkAnalytics_CL

Answer

CommonSecurityLog

Answer

Syslog

Question 16

You are building a threat hunting query in Microsoft Sentinel to detect potential lateral movement via Windows Management Instrumentation (WMI). You want to identify processes that were created remotely using WMI, which often indicates an attacker moving laterally. Which two data sources or fields should you use in your query to detect this activity? (Choose two.)

Accepted Answer

DeviceEvents with ActionType == 'WmiProcessCreate'. To detect WMI-based lateral movement, you need process creation events where the parent is wmiprvse.exe (indicating WMI spawned the process) or events explicitly logged as WmiProcessCreate. DeviceProcessEvents with InitiatingProcessFileName 'wmiprvse.exe' and DeviceEvents with ActionType 'WmiProcessCreate' both directly capture this behavior. Other sources like network events or logon events are too generic and do not confirm WMI process execution.

Answer

DeviceRegistryEvents with RegistryKey contains 'WMI'

Answer

DeviceNetworkEvents with RemotePort == 135

Answer

DeviceLogonEvents with LogonType == 3

Question 17

You are a security operations analyst for a company that uses Microsoft Sentinel. The SOC manager wants to ensure that only incidents with a severity of High or Critical are automatically assigned to the on-call analyst, while all other incidents remain unassigned. You need to create an automation rule that meets this requirement. What should you do first?

Accepted Answer

Create a new automation rule and set the trigger to "When incident is created". Add a condition that checks if the incident severity is High or Critical. Then add an action to assign the incident to the on-call analyst.. Automation rules in Microsoft Sentinel are designed to automate incident handling tasks such as assignment, tagging, and status changes. They can be triggered when an incident is created and include conditions based on incident properties. This makes them the ideal solution for conditionally assigning incidents based on severity without custom development.

Answer

Create a playbook that runs on incident creation, parses the incident severity, and if High or Critical, assigns the incident using the Microsoft Sentinel API.

Answer

Create a scheduled query rule that detects High and Critical incidents and then triggers a Logic App to assign them.

Answer

Modify the incident settings in Microsoft Sentinel to automatically assign all High and Critical incidents to the on-call analyst by default.

Question 18

You are a SOC analyst using Microsoft Defender for Endpoint. A device is flagged as compromised and you need to isolate it from the network while still allowing you to remotely investigate it. Which action should you take?

Accepted Answer

Isolate the device using the 'Isolate device' action.. Microsoft Defender for Endpoint's 'Isolate device' action provides network containment by blocking all network traffic except for the Defender for Endpoint cloud service. This allows analysts to remotely connect to the device, run investigations, and remediate threats without the attacker being able to communicate externally or move laterally. It is the standard response for a compromised device.

Answer

Restrict app execution on the device.

Answer

Collect an investigation package from the device.

Answer

Run a full antivirus scan on the device.

Question 19

You are investigating a Microsoft Defender XDR incident where a user's device is showing signs of compromise. The incident includes alerts from Microsoft Defender for Endpoint and Microsoft Defender for Identity. You need to isolate the device from the network while preserving forensic evidence. Which action should you take?

Accepted Answer

Run the 'Isolate device' action in Microsoft Defender for Endpoint, selecting the 'Full isolation' option.. Full isolation in Microsoft Defender for Endpoint is the correct action to contain a compromised device while preserving forensic evidence. It restricts network communication to only the Defender for Endpoint service, preventing lateral movement and C2 traffic, and allows investigators to perform live response and collect evidence. Other options either misstate capabilities or do not achieve isolation. Disabling a user account does not isolate the device, and antivirus scans do not contain the threat.

Answer

Initiate a full antivirus scan on the device and then reboot it to remove the threat.

Answer

Use Microsoft Defender for Identity to disable the user account and then isolate the device from the Defender for Identity portal.

Answer

Run the 'Live response' session and execute the 'isolate' command.

Question 20

A Microsoft Defender XDR incident shows a malicious email delivered to a user, and the analyst confirms the message contains a credential-harvesting link. Before the user clicks, you need to remove the message from all mailboxes in the tenant and block the sender and URL for the future. Which Microsoft Defender for Office 365 capability should you use from the incident?

Accepted Answer

The email entity page action to soft delete, hard delete, or move to junk, plus submitting the sender and URL for blocking.. When a malicious email is confirmed, Microsoft Defender for Office 365 provides email entity remediation actions that purge the message tenant-wide and let you block the associated sender and URL. This combines cleanup of the delivered threat with prevention of recurrence. Tools that only investigate, or controls that only affect future mail, leave the delivered message reachable and do not satisfy both halves of the requirement.

Answer

Threat Explorer with a message trace filter to identify and delete matching messages.

Answer

Automated investigation and response with the soft delete action on the email entity.

Answer

A mail flow transport rule in the Exchange admin center that rejects messages from the sender domain.