SC-200 Mock Exam 83 — 25 Questions

Question 1

Your organization uses Microsoft Sentinel for security operations. The SOC team receives an incident that was generated from a Microsoft Defender for Cloud Apps alert. The incident involves a user who is downloading a large number of files from SharePoint Online. The analyst needs to suspend the user's account immediately to stop the potential data exfiltration. The organization has a Microsoft Sentinel playbook that can suspend a user in Microsoft Entra ID. However, the playbook is not triggering automatically. You need to ensure that the playbook runs automatically whenever a Defender for Cloud Apps alert generates an incident in Sentinel. What should you configure?

Accepted Answer

Create an automation rule that triggers the playbook when an incident is created from Defender for Cloud Apps. Option C is correct because an automation rule can be created to trigger a playbook on incident creation, specifically for incidents from Defender for Cloud Apps. Option A is wrong because analytics rules are for scheduled queries, not for alerts from other services. Option B is wrong because the playbook itself doesn't determine triggering; it's the automation rule. Option D is wrong because the connector syncs alerts, but automation is needed to run the playbook.

Answer

Create a scheduled analytics rule that detects large file downloads

Answer

Enable the Microsoft Defender for Cloud Apps connector to sync alerts

Answer

Modify the playbook to run on alert creation

Question 2

You are a security analyst at a company that uses Microsoft Sentinel and Microsoft Defender for Identity (now part of Microsoft Defender XDR). During a threat hunt, you need to identify potential golden ticket attacks. You have Windows Security Events (Event ID 4672: Special Logon) and Kerberos service ticket events (Event ID 4769) ingested. A golden ticket attack often involves service ticket requests with unusual encryption types or ticket options. You want to find service ticket requests (4769) that have TicketOptions containing '0x40810000' (forwardable, renewable, canonicalize) and TicketEncryptionType == '0x17' (RC4), which are common in attacks. You need to write a KQL query that returns the top 10 accounts requesting such tickets in the last 7 days. Which query should you use?

Accepted Answer

SecurityEvent | where EventID == 4769 | where TicketOptions == "0x40810000" and TicketEncryptionType == "0x17" | summarize count() by AccountName | top 10 by count_. Option A correctly filters for EventID 4769, the specific TicketOptions and encryption type, and summarizes by AccountName. Option B uses wrong event ID. Option C uses wrong field. Option D does not filter encryption type.

Answer

SecurityEvent | where EventID == 4769 | where TicketOptions == "0x40810000" | summarize count() by AccountName | top 10 by count_

Answer

SecurityEvent | where EventID == 4672 | where TicketOptions == "0x40810000" and TicketEncryptionType == "0x17" | summarize count() by AccountName | top 10 by count_

Answer

SecurityEvent | where EventID == 4769 | where TicketOptions contains "0x40810000" and TicketEncryptionType contains "0x17" | summarize count() by AccountName | top 10 by count_

Question 3

You are a security analyst at Fabrikam. The company uses Microsoft Defender for Cloud Apps and Microsoft Sentinel. During a threat hunt, you need to identify users who are accessing cloud applications from multiple geographic locations in a short time, which could indicate credential theft or token replay. You want to create a hunting query in Microsoft Sentinel using the CloudAppEvents table. Which approach should you take?

Accepted Answer

Query CloudAppEvents, summarize by AccountDisplayName and bin(TimeGenerated, 1h), then use dcount(CountryCode) > 1. Option A is correct because CloudAppEvents contains location data (CountryCode or IPLocation). By summarizing per user and bin by time, you can group activities by user and time window, then filter for those with multiple distinct countries. Option B is incorrect because SecurityAlert contains alerts, not raw events. Option C is incorrect because OfficeActivity only covers Office 365, not all cloud apps. Option D is incorrect because CommonSecurityLog is for on-premises network devices, not cloud apps.

Answer

Query CommonSecurityLog for VPN connections

Answer

Query OfficeActivity for sign-in logs

Answer

Query SecurityAlert for location-related alerts

Question 4

Your organization uses Microsoft Sentinel as the primary SIEM. The SOC team reports that many low-severity incidents are overwhelming the queue. You need to reduce noise while ensuring that high-severity incidents are not missed. Which two actions should you take? (Choose two.)

Accepted Answer

Adjust the analytics rule settings to only create incidents for alerts with a severity of Medium or higher.. Option A helps automatically close low-severity incidents that are false positives. Option D sets a severity threshold for alerts to be created as incidents. Option B is incorrect because creating more analytics rules would increase noise. Option C is incorrect because increasing retention does not reduce noise. Option E is incorrect because playbooks do not suppress incidents.

Answer

Increase the data retention period for low-severity alerts.

Answer

Use playbooks to manually review each low-severity incident.

Answer

Create additional analytics rules to better differentiate between true and false positives.

Question 5

In Microsoft Sentinel, an incident is created from a Fusion rule that correlates multiple alerts. The incident has a high severity. What should the analyst do first?

Accepted Answer

Triage the incident by reviewing the evidence. Option C is correct because the first step in incident response within Microsoft Sentinel is to triage the incident by reviewing the evidence. A Fusion rule correlates multiple alerts into a single incident, and the analyst must examine the correlated alerts, entities, and timeline to validate the incident's legitimacy and understand the scope before taking any action. Automated playbooks or escalations should only occur after triage confirms the incident is a genuine threat.

Answer

Run an automated playbook to contain the threat

Answer

Close the incident as false positive

Answer

Escalate the incident to senior management

Question 6

During an incident, you need to isolate a compromised device from the network while allowing communication with Microsoft Defender for Endpoint cloud services. Which isolation type should you choose in Microsoft Defender XDR?

Accepted Answer

Selective isolation. Selective isolation (E) is the correct choice because it restricts network communication to only Microsoft Defender for Endpoint cloud services, blocking all other inbound and outbound traffic. This allows the compromised device to remain manageable and receive security updates while preventing lateral movement and further compromise. Full isolation would block all network traffic, including Defender services, rendering the device unmanageable.

Answer

Controlled folder access

Answer

Network protection

Answer

Block file

Answer

Full isolation

Question 7

Which Microsoft Sentinel feature allows you to automatically respond to incidents by running a playbook when an incident is created?

Accepted Answer

Automation rules. Automation rules in Microsoft Sentinel allow you to define automated responses to incidents, including running a playbook when an incident is created. They provide a centralized way to trigger actions based on incident properties such as severity, status, or specific tactics, without needing to embed automation logic directly in analytics rules.

Answer

Analytics rules

Answer

Playbooks

Answer

Watchlists

Answer

Workbooks

Question 8

Your organization uses Microsoft Defender for Cloud Apps. You receive an alert about an impossible travel activity for a user. What is the best first step to validate if this is a true positive?

Accepted Answer

Review the user's sign-in logs in Microsoft Entra ID. Option D is correct because impossible travel alerts in Microsoft Defender for Cloud Apps are generated based on sign-in activity and user location data. The most direct way to validate whether the alert is a true positive is to review the user's sign-in logs in Microsoft Entra ID (formerly Azure AD), which provides detailed information about each sign-in attempt, including IP addresses, locations, timestamps, and authentication details. This allows you to confirm whether the two sign-ins occurred within an unrealistic time frame for the geographic distance, or if there are anomalies such as VPN usage or IP spoofing that indicate a false positive.

Answer

Block the user immediately

Answer

Run an advanced hunting query in Microsoft Sentinel

Answer

Contact the user's manager

Answer

Check the user's device compliance in Microsoft Intune

Question 9

During an incident investigation in Microsoft Sentinel, you need to gather related events from multiple data sources into a single view for analysis. Which feature should you use?

Accepted Answer

Investigation graph. The Investigation graph in Microsoft Sentinel is specifically designed to visually correlate and explore related entities and events across multiple data sources within a single investigation. It allows you to pivot from an alert or entity to see connected users, hosts, IP addresses, and other events, providing a unified view for analysis. This feature directly addresses the need to gather related events from disparate sources into one cohesive view during incident response.

Answer

Workbooks

Answer

Watchlists

Answer

Logs blade

Answer

Analytics rules

Question 10

Which TWO of the following are valid approaches to perform threat hunting using Microsoft Sentinel? (Choose two.)

Accepted Answer

Using the Hunting blade and Livestream. The Hunting blade in Microsoft Sentinel provides a dedicated interface for proactive threat hunting, allowing analysts to run KQL queries and pivot through results. Livestream extends this by enabling continuous, real-time query execution against incoming data, which is essential for detecting patterns that evolve over minutes or hours. Both features are explicitly designed for iterative, hypothesis-driven threat hunting rather than automated detection.

Answer

Using Fusion analytics rule

Answer

Using Automation rules to trigger playbooks

Answer

Using Azure Policy to enforce compliance

Question 11

Which THREE of the following are valid methods to reduce the cost of Microsoft Sentinel data ingestion?

Accepted Answer

Configure Basic logs for high-volume, low-value data sources.. A is correct because Basic logs offer a lower ingestion cost (approximately 25% of the cost of Analytics logs) for high-volume, low-value data sources such as verbose firewall logs or debug events. By routing these logs to the Basic log table tier, you reduce the per-GB ingestion charge while still retaining the data for security investigations when needed.

Answer

Enable Sentinel on premium storage accounts.

Answer

Increase the data retention period to 90 days.

Question 12

Your organization uses Microsoft 365 Defender. A security analyst detects a malware infection on a single endpoint named 'SalesPC01'. The malware is identified as 'Trojan:Win32/Emotet'. The endpoint is currently isolated from the network by the automatic response. You need to remediate the infection. The malware has been detected and the endpoint is isolated. What should you do next?

Accepted Answer

Initiate a full antivirus scan using Microsoft Defender Antivirus.. Option B is correct because running a full scan or using Microsoft Defender for Endpoint's 'Run antivirus scan' action can remove the malware. Option A is wrong because the endpoint is already isolated. Option C is wrong because reimaging is a last resort. Option D is wrong because deleting the user account is not necessary.

Answer

Delete the user account that was logged in when the malware was detected.

Answer

Disconnect the endpoint from the network manually.

Answer

Reimage the endpoint to ensure complete removal.

Question 13

Which THREE actions are recommended practices for managing Microsoft Sentinel costs?

Accepted Answer

Set daily caps on high-volume tables.. Setting daily caps on high-volume tables is a recommended practice because it prevents unexpected cost overruns by limiting the amount of data ingested into expensive tables like SecurityEvent or CommonSecurityLog. Microsoft Sentinel bills per GB ingested, so capping tables that generate large volumes of noise (e.g., verbose Windows event logs) directly controls costs without necessarily impacting security visibility, as critical alerts can still be generated from other sources.

Answer

Ingest all logs to ensure complete visibility.

Answer

Increase retention period to 1 year for all tables.

Question 14

Which TWO are legitimate sources of threat intelligence that can be ingested into Microsoft Sentinel?

Accepted Answer

STIX/TAXII threat intelligence feeds. A is correct because STIX/TAXII is an open-source standard for sharing cyber threat intelligence (CTI). Microsoft Sentinel can ingest threat indicators from any TAXII 2.0 or 2.1 server using the built-in Threat Intelligence - TAXII data connector, allowing organizations to consume structured threat feeds (e.g., from MITRE ATT&CK or third-party providers) directly into Sentinel for correlation and alerting.

Answer

Exchange Online Protection

Answer

Microsoft Intune

Answer

Microsoft Purview Compliance Manager

Question 15

Which TWO actions should be taken immediately when a compromised user account is detected in Microsoft Entra ID?

Accepted Answer

Revoke all current sessions.. Revoking all current sessions (Option A) is a critical immediate action because it terminates all active authentication tokens and sessions for the compromised account, preventing the attacker from continuing to use existing tokens to access resources. This action leverages Microsoft Entra ID's token revocation capabilities, which invalidate refresh tokens and access tokens issued before the revocation, effectively cutting off the attacker's current access without waiting for password changes or other mitigations.

Answer

Notify the user's manager.

Answer

Reset the user's password.

Answer

Block sign-ins from the user's IP address.

Question 16

Which TWO data sources can you connect to Microsoft Sentinel to ingest security logs? (Select TWO.)

Accepted Answer

Azure Active Directory (Microsoft Entra ID) audit logs. Azure Active Directory (Microsoft Entra ID) audit logs are a native data source for Microsoft Sentinel. They can be connected directly via the Azure AD connector, which ingests sign-in logs, audit logs, and provisioning logs into the Log Analytics workspace. This integration is essential for monitoring identity-related security events and is a standard requirement for SC-200 scenarios.

Answer

Google Cloud Platform audit logs

Answer

Trello activity logs

Answer

GitHub Actions logs

Question 17

Your organization uses Microsoft Defender for Cloud Apps and Microsoft Sentinel. An alert indicates that an external IP address is downloading large amounts of data from a SharePoint site containing confidential documents. The activity is coming from a valid user account that appears to be compromised. What should you do first to stop the data exfiltration?

Accepted Answer

Suspend the user account in Microsoft Entra ID. Option A is correct because suspending the user account immediately stops the download. Option B is wrong because blocking the IP may not be effective if the attacker uses multiple IPs. Option C is wrong because changing permissions is slower. Option D is wrong because deleting files destroys evidence.

Answer

Delete the confidential documents from SharePoint

Answer

Block the external IP address in Microsoft Defender for Cloud Apps

Answer

Change the SharePoint site permissions to deny access

Question 18

Your organization has Microsoft Sentinel with UEBA enabled. An incident is generated for a user with high risk score. You need to identify if the user's recent behavior deviates from their baseline. Which Sentinel feature should you use?

Accepted Answer

The UEBA timeline in the entity page.. The UEBA timeline in the entity page is the correct feature because it provides a chronological view of a user's activities, including deviations from their established behavioral baseline. When UEBA is enabled, Sentinel profiles normal behavior for each user and flags anomalies; the timeline directly visualizes these deviations, such as unusual login times, locations, or resource access, which aligns with the need to identify if recent behavior deviates from the baseline.

Answer

A custom hunting query using the BehaviorAnalytics table.

Answer

The user's Azure AD sign-in logs.

Answer

The incident investigation graph.

Question 19

You need to grant a junior analyst the ability to view and investigate incidents in Microsoft Sentinel, but not make any changes. Which built-in role should you assign?

Accepted Answer

Microsoft Sentinel Reader. The Microsoft Sentinel Reader role provides read-only access to Sentinel resources, including incidents, workbooks, and analytics rules, without allowing any modifications. This aligns with the requirement to view and investigate incidents without making changes, as the role explicitly denies write, delete, or action permissions on Sentinel data.

Answer

Microsoft Sentinel Responder

Answer

Microsoft Sentinel Contributor

Answer

Microsoft Sentinel Automation Contributor

Question 20

Your company uses Microsoft Defender for Cloud to monitor multi-cloud resources. You want to ensure that all critical security recommendations are automatically assigned to the appropriate team leads based on the resource's tags. Which feature should you configure?

Accepted Answer

Use the 'Assign ownership' feature in Microsoft Defender for Cloud to map tags to owners.. Option C is correct because the 'Assign ownership' feature in Microsoft Defender for Cloud allows you to map resource tags to specific owners (e.g., team leads) via an automated rule. When a critical security recommendation is generated for a resource with a matching tag, the recommendation is automatically assigned to the designated owner, ensuring accountability without manual intervention.

Answer

Configure a regulatory compliance standard to send email notifications.

Answer

Create a workbook that lists recommendations and manually assign them.

Answer

Create a governance rule that automatically applies a compliance standard.