SC-200 Mock Exam 84 — 25 Questions

Question 1

Your organization has deployed Microsoft Sentinel and configured a workspace with data connectors for Microsoft 365 Defender, Azure Activity, and Office 365. You need to ensure that security incidents are automatically assigned to the appropriate analyst based on the incident type. What should you configure?

Accepted Answer

Create an automation rule that runs when an incident is created, with conditions on the incident title, and an action to assign the incident to a specific owner.. Option C is correct because automation rules in Microsoft Sentinel allow you to define conditions (e.g., incident title containing specific keywords) and actions (e.g., assign incident to a specific owner) that run automatically when an incident is created. This directly meets the requirement to assign incidents to the appropriate analyst based on incident type without manual intervention.

Answer

Create a playbook triggered by incident creation that assigns the incident to a user based on the incident title.

Answer

Add a watchlist that maps incident types to analyst email addresses and configure a scheduled analytics rule.

Answer

Configure a Microsoft 365 Defender incident assignment rule in the Microsoft 365 Defender portal.

Question 2

Your SOC uses Microsoft Sentinel and Microsoft Defender for Cloud Apps. You need to configure a policy that triggers when a user downloads a large number of files from SharePoint Online within a short period. Which policy type should you use?

Accepted Answer

Activity policy. An activity policy in Microsoft Defender for Cloud Apps is designed to monitor and respond to specific user activities, such as downloading a large number of files from SharePoint Online within a short period. This policy type allows you to set thresholds and triggers based on user actions, making it the correct choice for detecting anomalous download behavior.

Answer

Session policy

Answer

File policy

Answer

Anomaly detection policy

Question 3

Your organization uses Microsoft Sentinel in a multi-workspace environment with a central SOC. You need to create a single incident view across all workspaces while minimizing latency. What should you deploy?

Accepted Answer

Enable incident across workspaces in Microsoft Sentinel. Option B is correct because Microsoft Sentinel's 'Incident across workspaces' feature (enabled via the 'SecurityIncident' table union) provides a single incident view across multiple workspaces with minimal latency by leveraging built-in cross-workspace incident synchronization. This avoids the overhead of manual queries or external orchestration, ensuring near-real-time incident correlation for a central SOC.

Answer

Use cross-workspace queries in a workbook

Answer

Merge all workspaces into one Log Analytics workspace

Answer

Set up Azure Lighthouse and connect workspaces

Question 4

Your organization uses Microsoft Defender XDR and Microsoft Sentinel. You need to create a custom detection rule that triggers when a user is added to a privileged role in Microsoft Entra ID and within 5 minutes performs a mass download from SharePoint. Which approach should you use?

Accepted Answer

Create a scheduled query rule in Microsoft Sentinel. Option D is correct because the detection requires correlating events across Microsoft Entra ID (privileged role assignment) and SharePoint (mass download) within a 5-minute window. Microsoft Sentinel's scheduled query rules can ingest data from multiple sources (e.g., AuditLogs for Entra ID and SharePoint via Office 365 connector) and use KQL to join these events with a time constraint, making it the only native solution for cross-domain, time-bound custom detections.

Answer

Create an advanced hunting query in Microsoft Defender XDR

Answer

Use a custom detection rule in Microsoft 365 Defender

Answer

Use a Microsoft Purview insider risk policy

Question 5

Your organization uses Microsoft Sentinel and has deployed the Microsoft Sentinel Solution for Microsoft Defender XDR. You need to correlate alerts from Microsoft Defender for Endpoint with Microsoft Defender for Office 365 in a single incident. What is the recommended approach?

Accepted Answer

Use the Microsoft 365 Defender connector to ingest unified incidents from Microsoft 365 Defender, which already correlates alerts from both products.. Option B is correct because the Microsoft 365 Defender connector ingests unified incidents from Microsoft 365 Defender, which natively correlates alerts from Microsoft Defender for Endpoint and Microsoft Defender for Office 365 into a single incident. This is the recommended approach as it leverages the built-in correlation engine in Microsoft 365 Defender, eliminating the need for custom analytics rules or manual correlation.

Answer

Ingest alerts from both products separately and use a KQL query in an analytics rule to correlate them.

Answer

Create a workbook that displays alerts from both products side by side.

Answer

Use a Microsoft Sentinel fusion rule to correlate the alerts.

Question 6

You are a security analyst at a company that uses Microsoft Defender for Cloud Apps. You receive an alert that an anomalous activity was detected from a user's device. You need to investigate the activity to determine if it is a true positive. What should you do first?

Accepted Answer

In the Microsoft Defender for Cloud Apps portal, open the alert and then click 'View activity' to see the detailed activity log.. Option B is correct because the first step in investigating an anomalous activity alert in Microsoft Defender for Cloud Apps is to open the alert and click 'View activity' to examine the detailed activity log. This log provides the raw telemetry—such as IP address, user agent, timestamp, and activity type—needed to determine if the behavior is malicious or benign. Without reviewing this evidence, you cannot make an informed judgment about the alert's validity.

Answer

Use Microsoft Power BI to analyze user activity data.

Answer

Open the user's page in Microsoft Entra ID to review sign-in logs.

Answer

Create an IP address range policy to block the user's IP.

Question 7

Refer to the exhibit. You are a security analyst reviewing a KQL query in Microsoft Sentinel. The query is intended to show the count of high-severity malware alerts in the last 24 hours. However, the query returns results only for alerts with exact severity string 'High', but you also need to include 'Informational' severity alerts that are related to malware. What should you modify?

Accepted Answer

Change the 'where AlertSeverity == "High"' to 'where AlertSeverity in ("High", "Informational")'.. Option C is correct because the query currently filters only for alerts where AlertSeverity equals 'High', but the requirement is to also include 'Informational' severity alerts related to malware. By changing the condition to 'where AlertSeverity in ("High", "Informational")', the query will return both severity levels while keeping the malware-related filter and the 24-hour time window intact.

Answer

Remove the 'summarize' and 'order by' clauses.

Answer

Remove the 'where AlertName contains "malware"' condition.

Answer

Change 'ago(24h)' to 'ago(48h)'.

Question 8

Your SOC uses Microsoft Defender for Office 365. You need to configure a policy that automatically moves malicious email attachments to quarantine before they reach user mailboxes. What should you configure?

Accepted Answer

Create a Safe Attachments policy in the Microsoft 365 Defender portal.. Safe Attachments is a Microsoft Defender for Office 365 feature specifically designed to detonate email attachments in a virtual sandbox environment before delivery. By creating a Safe Attachments policy in the Microsoft 365 Defender portal, you can automatically quarantine malicious attachments, preventing them from reaching user mailboxes. This directly addresses the requirement to handle malicious attachments, not phishing or spam.

Answer

Create an anti-phishing policy to detect phishing attempts.

Answer

Create an anti-spam policy with a high confidence spam filter.

Answer

Create an anti-malware policy in the Microsoft 365 Defender portal.

Question 9

Your security team uses Microsoft Defender XDR to investigate incidents. You have a custom detection rule that runs a KQL query every hour. Recently, the rule stopped generating alerts. You verify that the query syntax is correct and that data is being ingested. What is the most likely cause?

Accepted Answer

The alert suppression threshold is configured too high.. The custom detection rule uses an alert suppression threshold, which prevents alerts from being generated unless the query results exceed a specified count. If this threshold is set too high, the rule may stop generating alerts even though the query returns valid results, because the number of matching events no longer meets the suppression limit. This is the most likely cause given that the query syntax is correct and data is being ingested.

Answer

The Microsoft Defender XDR license has expired.

Answer

An automation rule is deleting the alerts.

Answer

The query is not returning any results.

Question 10

Which THREE components are required to ingest Microsoft Entra ID (Azure AD) audit logs into Microsoft Sentinel?

Accepted Answer

A user account with Security Administrator or Global Administrator role to configure the connector.. Option B is correct because configuring the Microsoft Entra ID (Azure AD) data connector in Microsoft Sentinel requires a user account with at least the Security Administrator role (or Global Administrator) to grant the necessary permissions for the connector to read audit logs and sign-in logs from Microsoft Entra ID via the Microsoft Graph API. Without this role, the connector cannot authenticate and retrieve the required data.

Answer

A Log Analytics workspace in the same region as Microsoft Entra ID.

Answer

A playbook to parse the audit logs.

Question 11

Which TWO of the following are required to enable user and entity behavior analytics (UEBA) in Microsoft Sentinel?

Accepted Answer

Windows Security Events via AMA must be ingested.. Option C is correct because Windows Security Events ingested via the Azure Monitor Agent (AMA) provide the necessary user and entity activity data (e.g., logon events, process creation) that UEBA analyzes to establish behavioral baselines and detect anomalies. Without this data source, UEBA lacks the raw security events required for user and entity profiling.

Answer

Microsoft Entra ID diagnostic logs must be streamed.

Answer

Azure subscription diagnostic logs must be enabled.

Answer

Microsoft Defender XDR connector must be configured.

Question 12

Your organization uses Microsoft Sentinel and Microsoft Defender XDR. An incident is triggered: 'Lateral movement detected - pass-the-hash attack.' The incident includes alerts from Microsoft Defender for Identity (MDI) showing anomalous NTLM authentication attempts from a compromised workstation to multiple servers. The compromised workstation is a Windows 10 device. You need to contain the incident. Which of the following actions should you take FIRST?

Accepted Answer

Isolate the compromised workstation using Microsoft Defender for Endpoint.. Option A is correct: isolating the compromised workstation stops lateral movement. Option B is wrong: resetting passwords on servers does not stop the attack from the workstation. Option C is wrong: disabling NTLM globally may cause disruption. Option D is wrong: resetting the krbtgt account is for Kerberos, not NTLM.

Answer

Reset the krbtgt account password twice.

Answer

Disable NTLM authentication across the domain.

Answer

Reset passwords on all servers that received anomalous authentication attempts.

Question 13

You need to ensure that Microsoft Sentinel can access threat intelligence feeds from external sources like AlienVault OTX. Which data connector should you use?

Accepted Answer

Threat Intelligence - TAXII data connector. The Threat Intelligence - TAXII data connector is the correct choice because it enables Microsoft Sentinel to ingest threat intelligence feeds from external sources that support the TAXII (Trusted Automated eXchange of Indicator Information) protocol, such as AlienVault OTX. This connector uses the STIX (Structured Threat Information Expression) standard to pull indicators of compromise (IOCs) like IP addresses, domains, and hashes directly into Sentinel for correlation and alerting.

Answer

Microsoft 365 Defender data connector

Answer

Microsoft Entra ID data connector

Answer

Amazon Web Services data connector

Question 14

Your Microsoft Sentinel environment uses multiple workspaces. You need to centrally manage incidents from all workspaces in a single interface. What should you use?

Accepted Answer

Use cross-workspace queries in Sentinel incidents.. Cross-workspace queries in Microsoft Sentinel allow you to include multiple workspaces in a single query by using the `workspace()` expression. When you create an incident rule that uses such a query, Sentinel can centrally manage incidents generated from data across all specified workspaces, providing a unified incident queue in the Sentinel interface.

Answer

Create an Azure Monitor workbook.

Answer

Use the Microsoft 365 Defender portal.

Answer

Use Azure Logic Apps to aggregate incidents.

Question 15

Which TWO data connectors can be used to ingest Microsoft 365 audit logs into Microsoft Sentinel? (Choose two.)

Accepted Answer

Microsoft 365 Defender connector.. The Microsoft 365 Defender connector (Option B) ingests unified audit logs from Microsoft 365 Defender, which includes security-related events from Microsoft 365 services. The Office 365 connector (Option C) directly ingests audit logs from Exchange Online, SharePoint Online, and Microsoft Teams, which are part of the Microsoft 365 audit log. Both connectors are designed to bring Microsoft 365 audit log data into Microsoft Sentinel.

Answer

Microsoft Defender for Cloud Apps connector.

Answer

Azure Activity connector.

Answer

Azure AD connector (sign-in logs).

Question 16

Your SOC team needs to ensure that all high-severity Microsoft Sentinel incidents are automatically assigned to the senior analyst on call. The team uses Microsoft Teams for communication. Which configuration should you implement?

Accepted Answer

Create an automation rule that runs when an incident is created with severity High, sets the owner to the senior analyst, and then runs a playbook to post a message to Teams.. Option D is correct because automation rules in Microsoft Sentinel can directly set the incident owner when an incident is created, and then trigger a playbook to post a message to Microsoft Teams. This two-step configuration ensures high-severity incidents are automatically assigned to the senior analyst on call and the SOC team is notified via Teams without manual intervention.

Answer

Configure an analytics rule to set the incident owner to the senior analyst and enable Teams integration in Sentinel settings.

Answer

Create a playbook that reassigns incidents and posts to Teams, and attach it to an automation rule triggered by high-severity incidents.

Answer

Create a workbook that filters high-severity incidents and configure a Teams webhook in the workbook settings.

Question 17

Your organization has Microsoft Defender for Cloud Apps enabled. You need to generate an alert when a user downloads more than 100 files from SharePoint in one hour. What should you create?

Accepted Answer

An anomaly detection policy in Microsoft Defender for Cloud Apps.. An anomaly detection policy in Microsoft Defender for Cloud Apps is designed to detect unusual user behavior, such as mass file downloads, by establishing a baseline and triggering alerts when activity deviates from the norm. This policy type specifically supports the scenario of detecting a user downloading more than 100 files from SharePoint in one hour, as it can be configured with custom thresholds for file download activity.

Answer

A data loss prevention (DLP) policy in Microsoft Purview.

Answer

A custom alert in Microsoft Sentinel using the CloudAppEvents table.

Answer

An app governance policy in Microsoft Defender for Cloud Apps.

Question 18

You run the PowerShell command shown in the exhibit to enable diagnostics on an Azure VM. The VM is running Windows Server 2022. You want to collect security events and send them to a Log Analytics workspace. What should you include in the diagnostics.json configuration file?

Accepted Answer

A WindowsEventLog element with ProviderName set to 'Security' and a query of '*'.. Option B is correct because the Azure Diagnostics extension for Windows VMs uses a WindowsEventLog element in the diagnostics.json configuration to specify which Windows Event Log channels to collect. Setting ProviderName to 'Security' and query to '*' collects all security events from the Security log, which are then forwarded to the Log Analytics workspace.

Answer

An EtwProvider element with provider GUID for Microsoft-Windows-Security-Auditing.

Answer

A Syslog element with facility set to 'auth' and severity set to 'info'.

Answer

A PerformanceCounter element with a counter for security incidents.

Question 19

Your organization uses Microsoft Sentinel and Microsoft Defender for Office 365. You have configured incident creation from Microsoft Defender for Office 365 alerts in Microsoft Sentinel. However, you notice that some alerts are not creating incidents. Which step should you take to troubleshoot this issue?

Accepted Answer

Examine the analytics rule that creates incidents from Microsoft Defender for Office 365 alerts and verify the severity threshold.. Option A is correct because the analytics rule that maps Microsoft Defender for Office 365 alerts to incidents in Microsoft Sentinel includes a severity threshold filter. If the rule is configured to only create incidents for alerts with a severity of 'High' or 'Medium', alerts with 'Low' severity or 'Informational' will be silently dropped and not generate incidents. Verifying and adjusting this threshold directly addresses the root cause of missing incidents.

Answer

Check the Microsoft 365 Defender portal to confirm that the alerts are being generated.

Answer

Review the Microsoft Sentinel workbooks for any visualization errors.

Answer

Verify that the Microsoft Defender for Office 365 data connector in Microsoft Sentinel is connected and data is ingested.

Question 20

Your company deploys Microsoft Sentinel in a multi-workspace environment. You need to centralize incident management across workspaces while maintaining data residency. You configure Sentinel workspaces in each region. What additional configuration is required to view all incidents from a single pane?

Accepted Answer

Use an incident manager with a cross-workspace view.. Option D is correct because Microsoft Sentinel supports cross-workspace incident management through the incident manager, which can be configured to display incidents from multiple workspaces in a single view. This is achieved by using the 'cross-workspace view' feature, which leverages Azure Resource Graph to query incidents across workspaces without moving data, thus maintaining data residency requirements.

Answer

Deploy the Microsoft Sentinel solution across workspaces.

Answer

Assign the same Azure RBAC roles to all users in each workspace.

Answer

Merge the workspaces into a single workspace.