SC-200 Practice Test 8 — 10 Questions

Question 1

A security analyst is using Microsoft 365 Defender advanced hunting to investigate a ransomware incident. The analyst wants to find all processes that were created with a specific parent process ID. Which column in the DeviceProcessEvents table should the analyst use to filter the parent process?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

ParentProcessId. The ParentProcessId column in the DeviceProcessEvents table stores the process ID (PID) of the parent process that created a given process. By filtering on this column, the analyst can identify all child processes spawned by a specific parent, which is critical for tracing ransomware execution chains in advanced hunting queries.

Answer

ProcessId

Answer

InitiatingProcessId

Answer

LogonId

Question 2

Your organization uses Microsoft Defender for Identity (MDI) to monitor on-premises Active Directory. You want to forward MDI alerts to Microsoft Sentinel. What should you configure?

Accepted Answer

Microsoft Defender for Identity connector. Microsoft Defender for Identity (MDI) alerts are forwarded to Microsoft Sentinel by configuring the Microsoft Defender for Identity data connector. This connector ingests MDI security alerts, such as suspicious Kerberos activity or lateral movement attempts, directly into Sentinel for advanced correlation and incident response. The connector uses the Microsoft Graph Security API to pull alerts from the MDI service, enabling seamless integration without additional agents.

Answer

Microsoft 365 Defender connector

Answer

Azure Advanced Threat Protection connector

Answer

Microsoft Defender for Cloud Apps connector

Question 3

Your organization uses Microsoft Defender for Cloud Apps and Microsoft Sentinel. You notice that a large number of log entries from Defender for Cloud Apps are being dropped at ingestion due to 'malformed data' errors. The data connector shows a healthy status. What is the most likely cause?

Accepted Answer

The data volume exceeds the workspace's ingestion capacity, causing data truncation.. When the data volume exceeds the Log Analytics workspace's ingestion capacity, Defender for Cloud Apps log entries can be truncated mid-record, causing them to be malformed and dropped. The connector status remains healthy because the connector itself is still connected and receiving data, but the workspace's ingestion rate limit (typically 500 MB/min per workspace or 2 GB/min per workspace depending on pricing tier) causes truncation, not a connectivity or authentication failure.

Answer

The log type is not supported by Sentinel.

Answer

The Log Analytics workspace key has expired.

Answer

The Defender for Cloud Apps connector is blocked by a firewall.

Question 4

Your SOC team uses Microsoft Sentinel and Microsoft Defender XDR. You have configured automated responses using playbooks. However, some playbooks fail to execute when triggered from Microsoft Defender XDR incidents. You need to ensure that the playbooks run successfully. What should you verify?

Accepted Answer

Ensure that the automation rule that triggers the playbook has the correct 'incident provider' set to 'Microsoft Defender XDR'.. Microsoft Defender XDR incidents that are synchronized to Microsoft Sentinel include an 'incident provider' property. Automation rules in Sentinel must have the 'incident provider' set to 'Microsoft Defender XDR' to trigger playbooks specifically for those incidents. If this property is not configured correctly, the automation rule will not match the incoming incidents, causing the playbook to fail to execute.

Answer

Confirm that the playbook is stored in the same resource group as Microsoft Sentinel.

Answer

Verify that the playbook is connected to Microsoft Teams for approval.

Answer

Check that the service principal has global administrator role in Microsoft Entra ID.

Question 5

Your security operations center uses Microsoft Sentinel and Microsoft Defender XDR. A new type of attack involves a user receiving a malicious email that triggers a macro, which then executes PowerShell to download a payload. You need to create a detection that correlates email, process creation, and network connection events from multiple Microsoft 365 Defender sources. What should you use?

Accepted Answer

Advanced hunting in Microsoft 365 Defender. Advanced hunting in Microsoft 365 Defender is the correct choice because it allows you to write Kusto Query Language (KQL) queries that can join data across multiple tables from different Microsoft 365 Defender sources, such as EmailEvents, DeviceProcessEvents, and DeviceNetworkEvents. This enables correlation of the email receipt, macro-triggered PowerShell process creation, and subsequent network connection to a malicious IP or domain in a single query, which is exactly what the scenario requires.

Answer

Scheduled query rule in Microsoft Sentinel

Answer

Custom detection rule in Microsoft 365 Defender

Answer

Fusion rule in Microsoft Sentinel

Question 6

Your organization has Microsoft Sentinel with UEBA enabled. An incident is generated for a user with high risk score. You need to identify if the user's recent behavior deviates from their baseline. Which Sentinel feature should you use?

Accepted Answer

The UEBA timeline in the entity page.. The UEBA timeline in the entity page is the correct feature because it provides a chronological view of a user's activities, including deviations from their established behavioral baseline. When UEBA is enabled, Sentinel profiles normal behavior for each user and flags anomalies; the timeline directly visualizes these deviations, such as unusual login times, locations, or resource access, which aligns with the need to identify if recent behavior deviates from the baseline.

Answer

A custom hunting query using the BehaviorAnalytics table.

Answer

The user's Azure AD sign-in logs.

Answer

The incident investigation graph.

Question 7

You are responding to an incident where a user's credentials were used to access a federated SaaS application from an IP address associated with a known threat actor. The user's account is not disabled. Which action is most effective to prevent further unauthorized access?

Accepted Answer

Reset the user's password and revoke active sessions. Resetting the user's password and revoking active sessions immediately invalidates the compromised credentials and terminates any existing authenticated sessions, including the session used by the threat actor. This directly addresses the root cause—credential compromise—without unnecessarily disrupting the user's account permanently. In a federated SaaS scenario, password reset combined with session revocation ensures the threat actor cannot re-authenticate even if they possess the previous password hash or tokens.

Answer

Create a Conditional Access policy to block the IP

Answer

Disable the user's account

Answer

Block the source IP address on the firewall

Question 8

Your organization uses Microsoft Sentinel with User and Entity Behavior Analytics (UEBA) enabled. You notice that the UEBA is not generating any anomalies for a particular user who has been inactive for 30 days. You have verified that the user's data is being ingested into the workspace. What is the most likely reason?

Accepted Answer

UEBA requires a minimum of 14 days of activity to establish a baseline.. UEBA in Microsoft Sentinel requires a minimum of 14 days of historical data to build a behavioral baseline for each user. If a user has been inactive for 30 days, the baseline may have expired or never been established, so no anomalies are generated. The data ingestion is confirmed, but without recent activity, UEBA cannot compare current behavior against a meaningful profile.

Answer

The user's license does not include UEBA.

Answer

UEBA only works with Active Directory data, not Microsoft Entra ID.

Answer

UEBA is not enabled for the workspace.

Question 9

Your organization uses Microsoft Defender for Cloud. You receive a security alert about a suspicious process on a virtual machine. You want to investigate the process further. What should you do?

Accepted Answer

Initiate a live response session on the VM from Microsoft Defender for Cloud.. Microsoft Defender for Cloud's live response capability allows you to remotely connect to a VM and perform real-time forensic actions, such as running commands, examining running processes, and collecting artifacts. This is the most direct way to investigate a suspicious process on a specific VM, as it provides interactive access without needing to install additional agents or reboot the machine.

Answer

Create a custom detection rule to alert on similar processes.

Answer

Run a vulnerability assessment scan on the VM.

Answer

Initiate an automated investigation on the VM.

Question 10

A SOC analyst creates a scheduled analytics rule in Microsoft Sentinel with the following KQL query: SigninLogs | where TimeGenerated > ago(1h) | summarize StartTime = min(TimeGenerated), EndTime = max(TimeGenerated) by UserPrincipalName, IPAddress | where EndTime - StartTime < 5m and count_IPAddress > 1 The intended purpose is to detect users logging in from multiple IP addresses in a short time (impossible travel). However, the rule does not generate any alerts. What is the most likely cause?

Accepted Answer

The query references a column 'count_IPAddress' that does not exist. The summarize operator does not create a column with that name.. The query uses `summarize ... by UserPrincipalName, IPAddress` which groups by both fields, so it does not create a column named `count_IPAddress`. The `where` clause then references `count_IPAddress`, which does not exist, causing the query to fail silently or return no results. This is why no alerts are generated.

Answer

The query does not filter for failed sign-ins (e.g., ResultType == 0).

Answer

The rule should use a longer time range, such as 24 hours.

Answer

The rule needs to use the 'make_set' function to correctly count distinct IP addresses.