SC-200 Mock Exam 82 — 25 Questions

Question 1

A security analyst is investigating a ransomware incident in Microsoft 365 Defender. The analyst wants to view all processes that initiated outbound network connections to known malicious IPs on a specific device. Which advanced hunting table should the analyst query?

Accepted Answer

DeviceNetworkEvents. The DeviceNetworkEvents table in Microsoft 365 Defender captures network connection events, including outbound connections to IP addresses, ports, and protocols. To investigate processes that initiated outbound connections to known malicious IPs on a specific device, this table provides the necessary data, such as the initiating process ID, remote IP, and port. The DeviceProcessEvents table only logs process creation events, not network activity, making it unsuitable for this query.

Answer

DeviceProcessEvents

Answer

DeviceFileEvents

Answer

DeviceRegistryEvents

Question 2

A SOC team uses Microsoft Sentinel. They receive a large volume of low-severity incidents from a specific analytics rule that causes alert fatigue. They want to automatically close incidents that match certain criteria (e.g., originating from a known test IP). Which feature should they configure?

Accepted Answer

Automation rules with a condition to close incidents. Automation rules in Microsoft Sentinel allow you to automatically close incidents based on specific conditions, such as a known test IP address. This directly addresses alert fatigue by suppressing low-severity incidents without manual intervention. Unlike playbooks, automation rules are lightweight and run natively within Sentinel without requiring a Logic Apps instance.

Answer

Playbook with a timer trigger

Answer

Watchlist integration

Answer

Fusion rule

Question 3

A security analyst needs to connect a Palo Alto Networks firewall to Microsoft Sentinel to ingest logs. The firewall supports Syslog and Common Event Format (CEF). Which data connector should the analyst use?

Accepted Answer

Palo Alto Networks (via Syslog CEF). The Palo Alto Networks firewall supports sending logs in Common Event Format (CEF) over Syslog, and Microsoft Sentinel provides a dedicated data connector specifically for Palo Alto Networks (via Syslog CEF). This connector parses the CEF-formatted syslog messages using a Log Analytics agent or AMA, normalizing fields into the CommonSecurityLog table for seamless ingestion. Using the vendor-specific connector ensures proper field mapping and schema alignment, unlike a generic CEF connector which may not handle Palo Alto's specific CEF extensions correctly.

Answer

Common Event Format (CEF) via Syslog (generic)

Answer

Syslog (without CEF)

Answer

Custom Text Logs

Question 4

A SOC team wants to use Microsoft Sentinel to detect when a user logs in from a new country not previously seen for that user. They have the SigninLogs table. Which KQL function is most appropriate to build this anomaly detection?

Accepted Answer

make_set() with lookup. The `make_set()` function creates a dynamic array of distinct values (e.g., countries) per user over a specified time window. By using `lookup` to compare the current sign-in's country against the historical set, you can flag logins from countries not previously seen. This directly implements the 'new country' anomaly detection pattern in KQL.

Answer

timechart()

Answer

dcount()

Answer

startofday()

Question 5

Refer to the exhibit. You have an automation rule defined as shown. The rule is enabled but never triggers. What is the most likely reason?

Accepted Answer

The condition requires incident status 'Active', but incidents start as 'New'.. The automation rule triggers on incident creation, but the condition requires the incident status to be 'Active'. In Microsoft Sentinel, incidents are created with a status of 'New', not 'Active'. Therefore, the condition is never met, and the rule never triggers. To fix this, the condition should either be removed or changed to include 'New' status.

Answer

The playbook resource ID is incomplete.

Answer

The trigger type should be 'AlertCreated' instead of 'IncidentCreated'.

Answer

The rule order is set to 1, which is too low.

Question 6

A SOC analyst is creating a scheduled analytics rule in Microsoft Sentinel to detect brute-force attacks on Microsoft Entra ID. The rule should generate an incident when a single user account fails to authenticate more than 10 times in 5 minutes from the same IP address. Which KQL operator is most appropriate to aggregate the count of failed sign-ins?

Accepted Answer

summarize. The `summarize` operator is the correct choice because it aggregates data into groups based on specified criteria, such as counting the number of failed sign-ins per user and IP address within a time window. In this scenario, you need to count events where `ResultType` indicates failure (e.g., 50053 or 50057), grouped by `UserPrincipalName` and `IPAddress`, and then filter for counts exceeding 10. The `summarize` operator with `count()` directly provides this aggregation, enabling the rule to trigger an incident when the threshold is met.

Answer

extend

Answer

project

Answer

where

Question 7

A SOC analyst wants to create a scheduled analytics rule in Microsoft Sentinel that detects when a user is added to a privileged Microsoft Entra ID role (e.g., Global Administrator). Which data table is essential for the query?

Accepted Answer

AuditLogs. The AuditLogs table in Microsoft Sentinel captures all directory-level audit activities, including modifications to Microsoft Entra ID (formerly Azure AD) role assignments. When a user is added to a privileged role like Global Administrator, the event is logged as an 'Add member to role' activity in the AuditLogs table. This makes AuditLogs the essential data source for detecting such privileged role changes.

Answer

SigninLogs

Answer

SecurityEvent

Answer

CommonSecurityLog

Question 8

A SOC analyst wants to create a scheduled analytics rule in Microsoft Sentinel that runs every 5 minutes and alerts when a single IP address fails to authenticate more than 10 times in that time window using the Microsoft Entra ID SigninLogs table. Which KQL function should be used to group the results into 5-minute intervals?

Accepted Answer

bin(). The `bin()` function is the correct choice because it is specifically designed to group time-series data into fixed-size buckets (e.g., 5-minute intervals) for aggregation. In this scenario, you need to align each authentication event to its corresponding 5-minute window so that you can count failures per IP address per window. Without `bin()`, the `summarize` operator would not automatically create these fixed intervals; it would group by the raw timestamp values, which would not produce the required 5-minute buckets.

Answer

summarize

Answer

count

Answer

where

Question 9

You are threat hunting for credential dumping activity. Which Windows event ID is commonly associated with the use of tools like Mimikatz?

Accepted Answer

4688 (Process Creation). Option C is correct because Windows Event ID 4688 (Process Creation) logs every new process spawned on the system, including the execution of tools like Mimikatz. When Mimikatz runs, it creates a process (e.g., mimikatz.exe), and the 4688 event captures the command line, parent process, and user context, which are critical for detecting credential dumping activity.

Answer

4624 (Successful Logon)

Answer

4768 (Kerberos Authentication Ticket Request)

Answer

4672 (Special Logon)

Question 10

Your organization uses Microsoft Purview Compliance Manager to manage compliance activities. You need to assign a specific improvement action to a colleague for implementation. What should you do?

Accepted Answer

In the 'Improvement actions' tab, select the action and click 'Assign'. In Microsoft Purview Compliance Manager, improvement actions are the specific tasks that need to be completed to meet compliance controls. Each improvement action can be directly assigned to a colleague by selecting the action in the 'Improvement actions' tab and clicking the 'Assign' button, which allows you to specify the assignee and due date. This is the intended workflow for delegating implementation responsibilities within Compliance Manager.

Answer

Create a new alert policy to notify the colleague

Answer

Modify the assessment to include the colleague as an owner

Answer

Use the 'Assessments' tab to delegate tasks

Question 11

Your SOC team uses Microsoft Sentinel incident investigation. An analyst needs to quickly see all related entities (users, IPs, machines) for an incident. Which feature should the analyst use?

Accepted Answer

Incident investigation graph. The Incident investigation graph in Microsoft Sentinel provides a visual, interactive map of all entities (users, IPs, machines) linked to an incident, allowing analysts to quickly see relationships and pivot between entities. This is the dedicated feature for entity-centric incident exploration, unlike other options that serve different purposes.

Answer

Incident timeline

Answer

Hunting blade

Answer

Entity behavior analytics page

Question 12

You are reviewing an analytics rule in Microsoft Sentinel. The rule is supposed to alert when a Confidential sensitivity label file is accessed. However, no alerts have been generated despite known accesses. What is the most likely reason?

Accepted Answer

The required data connector for Microsoft Purview Information Protection is not connected.. Microsoft Sentinel relies on data connectors to ingest logs from external sources. For alerts based on sensitivity labels (e.g., Confidential), the required data source is Microsoft Purview Information Protection (formerly Azure Information Protection). If this connector is not connected, Sentinel has no way to receive the label-related events, so no alerts can be generated regardless of the rule logic.

Answer

The suppression duration is set to 5 hours, which suppresses alerts.

Answer

The query frequency and period are too short to capture the events.

Answer

The trigger condition is set to 'GreaterThan' 0, which should fire on any event.

Question 13

Refer to the exhibit. You are reviewing a Microsoft Sentinel automation rule created via ARM template. You notice that the rule is not triggering the playbook when a high-severity incident is created. What is the most likely cause?

Accepted Answer

The condition syntax is invalid; automation rules in ARM templates require specific operator properties.. Option D is correct because automation rules in ARM templates require explicit operator properties (e.g., 'Equals', 'Contains') in the condition syntax. If the condition is written without these operators or uses invalid JSON structure, the rule will fail to evaluate triggers correctly, preventing the playbook from being invoked when a high-severity incident is created.

Answer

The playbook resource ID is missing the 'locations' parameter.

Answer

The automation rule is disabled by default and needs to be enabled.

Answer

The playbook does not have a trigger for Microsoft Sentinel.

Question 14

Which TWO actions can you perform using Microsoft Sentinel automation rules?

Accepted Answer

Assign an incident to a specific analyst.. Option B is correct because Microsoft Sentinel automation rules can directly assign an incident to a specific analyst using the 'Assign owner' action. This allows security operations teams to automatically route incidents to the appropriate personnel based on criteria such as severity, tactic, or entity, improving response efficiency.

Answer

Create a new analytics rule based on an incident.

Answer

Modify the data connector's polling interval.

Answer

Automatically create an incident from a log event.

Question 15

You are a security analyst for a company that uses Microsoft Defender XDR. You receive a high-severity incident indicating that a user's device has been compromised with a remote access trojan (RAT). The incident is automatically generated by Microsoft Defender XDR. You need to contain the threat immediately while preserving forensic data. You also need to ensure that the user can continue working with minimal disruption. What should you do?

Accepted Answer

Initiate device isolation from Microsoft Defender XDR.. Option A is correct because initiating device isolation from Microsoft Defender XDR immediately disconnects the device from the network while preserving forensic data on the device. This contains the RAT's command-and-control communication without disrupting the user's ability to work offline, and it allows the security team to investigate the compromised device without risk of lateral movement or data exfiltration.

Answer

Restore the device from a recent backup.

Answer

Run a full antivirus scan on the device.

Answer

Reset the user's password and force a sign-out.

Question 16

You are the security operations lead for a multinational company using Microsoft Sentinel. You have deployed a custom analytics rule that uses a KQL query to detect anomalous outbound network traffic. The rule runs every hour and looks back 24 hours. Recently, the rule has been generating a high number of false positives. You need to tune the rule to reduce false positives without missing genuine threats. The rule currently triggers when the count of outbound connections to a single IP exceeds 100 in an hour. You analyze the data and find that legitimate cloud services often trigger the rule. What should you do?

Accepted Answer

Modify the KQL query to exclude traffic to known benign IP ranges.. Option A is correct because adding known benign IPs to the exclusion list directly reduces false positives from legitimate cloud services while keeping the detection logic intact. Option B is incorrect because suppressing alerts only hides them, not reducing false positives. Option C is incorrect because increasing the threshold may miss real threats. Option D is incorrect because disabling the rule is not tuning.

Answer

Disable the rule and create a new one with a different query.

Answer

Increase the threshold to 200 connections per hour.

Answer

Configure a suppression rule to automatically close incidents from those IPs.

Question 17

You are a security operations engineer for a company that uses Microsoft Defender XDR. You need to create a custom detection rule that alerts when a user performs more than 10 failed logon attempts within 5 minutes from different IP addresses. The rule should use the IdentityLogonEvents table. You have written the KQL query and now need to configure the rule settings in Microsoft 365 Defender. Which configuration should you use for the rule frequency and lookback period to minimize false positives while ensuring timely detection?

Accepted Answer

Run every 5 minutes with a 5-minute lookback.. Option A is correct because running every 5 minutes with a 5-minute lookback ensures the rule catches the pattern within the same window and minimizes false positives by not aggregating over longer periods. Option B is incorrect because a 1-hour lookback may capture multiple sessions. Option C is incorrect because a 24-hour run period is too coarse. Option D is incorrect because no lookback misses past events.

Answer

Run every 5 minutes with a 1-hour lookback.

Answer

Run every 1 hour with no lookback.

Answer

Run every 24 hours with a 24-hour lookback.

Question 18

Your organization uses Microsoft Defender XDR to protect endpoints. You need to ensure that all endpoints are reporting to the Defender for Endpoint service and that any devices that have not checked in for more than 7 days are flagged. You have created a custom detection rule in Microsoft Sentinel that queries the DeviceInfo table and generates an incident for devices with a last check-in time older than 7 days. After a week, you notice that no incidents have been generated, even though you know there are some inactive devices. You verify that the DeviceInfo table is populated with data. What is the most likely issue?

Accepted Answer

The KQL query has a logic error, such as using 'where LastSeen > ago(7d)' instead of 'where LastSeen < ago(7d)'.. Option B is correct because the time filter in the query (LastSeen > 7 days) might be incorrectly applied. For example, using 'ago(7d)' instead of 'ago(7d)' in the wrong direction. Option A is wrong because data is being ingested. Option C is wrong because the rule is enabled. Option D is wrong because the table is populated.

Answer

The Microsoft Defender XDR connector is not configured to send DeviceInfo data.

Answer

The DeviceInfo table requires a special license to query.

Answer

The analytics rule is not enabled.

Question 19

You are a Microsoft Security Operations Analyst for a large enterprise with 50,000 users. Your organization uses Microsoft Defender XDR, Microsoft Sentinel, and Microsoft Defender for Cloud Apps. The security team has observed an increase in alerts related to SaaS applications (e.g., Box, Salesforce) accessed from unusual locations. You need to design a solution to automatically investigate and respond to these alerts. The solution should: (1) correlate user activity across multiple SaaS apps, (2) automatically isolate a user's account if the risk score exceeds 90, and (3) create an incident in Sentinel. Which approach should you use?

Accepted Answer

Configure Microsoft Defender for Cloud Apps to use session policies that require reauthentication or block access when risk is high, and stream alerts to Sentinel.. Option B is correct because Defender for Cloud Apps provides session policies that can block or isolate access based on risk, and it integrates with Sentinel. Option A is not cross-app; Option C is for endpoints; Option D is not automated.

Answer

Use Microsoft Sentinel UEBA to detect anomalies and manually trigger a playbook to block the user.

Answer

Deploy Microsoft Defender for Endpoint on all devices and use device risk as a factor for conditional access.

Answer

Create analytics rules in Sentinel for each SaaS app and a playbook to isolate accounts using Microsoft Entra ID conditional access.

Question 20

Your organization uses Microsoft Sentinel and Microsoft Defender XDR. You are responsible for managing the security operations environment. Recently, the SOC team reported that incidents from Microsoft Defender for Endpoint are not appearing in Microsoft Sentinel. You have already configured the data connector for Microsoft Defender XDR and verified that logs are flowing into the 'SecurityAlert' table. However, incidents are not being created in Sentinel. What should you do?

Accepted Answer

Enable 'Create incidents from Microsoft 365 Defender' in the Microsoft Defender XDR data connector.. Option A is correct because incident creation from Defender XDR requires enabling the 'Microsoft 365 Defender' incident creation in the data connector. Option B is wrong because analytics rules are not needed; incidents come from the connector. Option C is wrong because that connector is for alerts, not incidents. Option D is wrong because streaming is not the issue.

Answer

Create an analytics rule that queries the SecurityAlert table and generates incidents.

Answer

Verify the Azure Sentinel solution is installed and enable the streaming of incidents.

Answer

Configure the Microsoft Defender for Endpoint data connector.