SC-200 Mock Exam 86 — 25 Questions

Question 1

You are configuring a Microsoft Sentinel analytics rule to detect failed logons from multiple IP addresses. The rule should trigger an incident only when the same user account has failed logons from more than three distinct IP addresses within 5 minutes. Which rule setting should you configure?

Accepted Answer

Set the 'Alert threshold' to 'Custom' and define a condition on distinct IP count.. Option A is correct because the requirement is to trigger an incident only when the same user account has failed logons from more than three distinct IP addresses within 5 minutes. In Microsoft Sentinel analytics rules, the 'Alert threshold' set to 'Custom' allows you to define a condition on the count of distinct values (e.g., distinct IP addresses) aggregated over the rule's query window, which directly matches the scenario.

Answer

Set the 'Group by' field to 'Account' and 'IP address'.

Answer

Set the 'Event grouping' to 'Group all events into a single alert'.

Answer

Set the 'Suppression' to '5 minutes' after an alert is generated.

Question 2

Your organization uses Microsoft Defender for Cloud Apps to monitor SaaS applications. You discover that a user is downloading a large number of files from SharePoint Online to an unmanaged device. You need to automatically block the download and require the user to acknowledge a policy violation. Which action should you configure in a session policy?

Accepted Answer

Set the action to 'Block' and enable 'Notify user' with a customized message.. Option C is correct because a session policy in Microsoft Defender for Cloud Apps can enforce real-time controls on SaaS app traffic. Setting the action to 'Block' stops the download immediately, and enabling 'Notify user' with a customized message both blocks the action and requires the user to acknowledge the policy violation, satisfying the requirement to automatically block and obtain acknowledgment.

Answer

Set the action to 'Monitor only'.

Answer

Set the action to 'Redirect to Microsoft Entra ID conditional access'.

Answer

Set the action to 'Block' and enable 'Custom block message'.

Question 3

Your organization uses Microsoft Defender for Cloud Apps. You need to block downloads from unmanaged devices for a specific cloud app. What should you configure?

Accepted Answer

Create a session policy with device tag condition.. Option B is correct because session policies in Microsoft Defender for Cloud Apps allow you to control user activities in real time based on device tags. By configuring a session policy with a device tag condition (e.g., 'Device tag equals Unmanaged'), you can enforce actions like blocking downloads from unmanaged devices for a specific cloud app, leveraging reverse proxy architecture to inspect and control traffic.

Answer

Create a file policy with a governance action.

Answer

Create an app permissions policy.

Answer

Create an anomaly detection policy.

Question 4

Which TWO actions can a Microsoft Sentinel automation rule perform when an incident is created?

Accepted Answer

Run a playbook. Microsoft Sentinel automation rules can trigger actions when an incident is created, including running a playbook (Option C) and changing the incident severity (Option D). Playbooks are automated workflows based on Azure Logic Apps that can perform complex response actions, while severity changes allow dynamic triage based on incident properties.

Answer

Create a new analytics rule

Answer

Query Log Analytics workspaces

Answer

Ingest data from a new source

Question 5

Your organization has a hybrid identity environment with Microsoft Entra ID and on-premises Active Directory. You are configuring Microsoft Defender for Identity to protect against lateral movement attacks. Which configuration should you prioritize to detect pass-the-hash attacks?

Accepted Answer

Enable 'Capture NTLM hashes' in the Microsoft Defender for Identity sensor configuration. Option D is correct because enabling 'Capture NTLM hashes' in the Microsoft Defender for Identity sensor configuration allows the sensor to extract NTLM hashes from network traffic. Pass-the-hash attacks rely on capturing and reusing NTLM hashes to authenticate laterally; by capturing these hashes, Defender for Identity can detect anomalies such as a hash being used from a different source or for suspicious logon attempts, directly identifying the attack.

Answer

Configure port mirroring for domain controllers

Answer

Enable 'SAM-R' (Remote SAM) in the Microsoft Defender for Identity sensor configuration

Answer

Configure Windows Event Forwarding (WEF) for domain controllers

Question 6

Your security team is investigating an incident in Microsoft Defender XDR where a user received multiple phishing emails. The team needs to create an automated response that blocks the sender's email address across all mailboxes in the organization. Which action should you configure in an automated investigation and response (AIR) playbook?

Accepted Answer

Add a 'Block sender' action in Microsoft Defender for Office 365.. Option C is correct because blocking a sender's email address across all mailboxes is a native capability of Microsoft Defender for Office 365. The 'Block sender' action in an AIR playbook directly adds the sender to the tenant's block list, which is enforced at the transport layer for all inbound email, effectively preventing any further delivery from that address.

Answer

Add a 'Block IP address' action in Microsoft Defender for Cloud Apps.

Answer

Create a custom detection rule in Microsoft Sentinel.

Answer

Deploy a configuration profile in Microsoft Intune.

Question 7

Your organization has deployed Microsoft Sentinel and Microsoft Defender XDR. You need to ensure that all Defender XDR incidents are automatically synchronized into Microsoft Sentinel for a single pane of glass. What should you configure?

Accepted Answer

Enable the Microsoft Sentinel data connector for Microsoft Defender XDR. Option A is correct because the Microsoft Sentinel data connector for Microsoft Defender XDR is the native integration that automatically synchronizes all Defender XDR incidents into Sentinel. This connector ingests incidents, alerts, and evidence from Defender XDR into the Sentinel workspace, enabling a single pane of glass without requiring custom scripting or manual workflows.

Answer

Use Microsoft Graph API to sync incidents daily

Answer

Create an automation rule in Microsoft Sentinel to create incidents from Defender XDR alerts

Answer

Configure Microsoft Defender XDR to forward incidents to Sentinel using a webhook

Question 8

Your security team receives alerts from Microsoft Defender for Cloud. You need to configure automated response to remediate a specific alert type. What should you create in Microsoft Sentinel?

Accepted Answer

An automation rule. In Microsoft Sentinel, automation rules are the correct mechanism to define automated responses triggered by alerts, including those from Microsoft Defender for Cloud. They allow you to run playbooks, change incident severity, assign ownership, or add comments when a specific alert type fires, enabling remediation without manual intervention.

Answer

An analytics rule

Answer

A workbook

Answer

A watchlist

Question 9

A security operations center (SOC) uses Microsoft Sentinel for log management. The SOC manager wants to reduce storage costs by automatically archiving logs that are older than 90 days to long-term retention, but retains the ability to search them if needed. What should the manager configure?

Accepted Answer

Configure a data archiving policy in the Log Analytics workspace to archive logs after 90 days. Option C is correct because configuring a data archiving policy in the Log Analytics workspace automatically moves logs older than 90 days to long-term, low-cost storage while keeping them searchable via the search job or restore feature. This directly meets the SOC manager's requirement to reduce costs without losing the ability to query archived data.

Answer

Change the table plan to Basic Logs for logs older than 90 days

Answer

Create a retention policy that deletes logs older than 90 days

Answer

Export logs older than 90 days to an Azure Storage account

Question 10

Your team uses Microsoft Sentinel workbooks to visualize security data. You want to allow team members to customize a workbook without affecting the original. What should you do?

Accepted Answer

Create a copy of the workbook and save it as a custom workbook. Option C is correct because creating a copy of the workbook and saving it as a custom workbook allows team members to modify their own version without altering the original. In Microsoft Sentinel, workbooks are based on Azure Monitor Workbooks, and saving a copy creates an independent resource with its own settings and queries. This preserves the original workbook for reference or reuse while enabling customization.

Answer

Edit the original workbook to add personalization

Answer

Assign the team the Microsoft Sentinel Reader role

Answer

Share the workbook directly with the team

Question 11

Your Microsoft Sentinel workspace is ingesting data from multiple sources. You need to ensure that data from a specific source is retained for 2 years while other data remains at the default retention. What should you do?

Accepted Answer

Create a custom table for that source and set its retention to 2 years.. In Microsoft Sentinel, retention is set at the table level. By creating a custom table for the specific data source and configuring its retention period to 2 years, you can override the default workspace retention for that table only. This allows other tables to retain the default retention setting while the custom table retains data for the required duration.

Answer

Adjust the data ingestion settings for that source.

Answer

Set the workspace retention to 2 years.

Answer

Configure archiving for that source's data.

Question 12

Your organization uses Microsoft Sentinel with Azure Monitor Agent (AMA) to collect Windows security events. You need to collect process creation events (Event ID 4688) and include command-line information. The current Data Collection Rule (DCR) collects only basic security events. What should you modify?

Accepted Answer

Enable the 'Include command line in process creation events' policy in Windows Group Policy.. Option B is correct because Event ID 4688 (process creation) can include command-line arguments, but this data is not captured by default. The 'Include command line in process creation events' Group Policy setting must be enabled on the Windows machines to populate the CommandLine field in the security event log. Without this policy, the AMA and DCR will collect the event but the command-line information will be empty.

Answer

Upgrade the AMA to the latest version.

Answer

Modify the DCR to include Event ID 4688 in the data source.

Answer

Switch to the Windows Security Events via Legacy Agent connector.

Question 13

You are responsible for Microsoft Sentinel pricing. You notice that data ingestion costs are high due to verbose logs from Windows security events. You need to reduce costs while still collecting critical security events. What should you do?

Accepted Answer

Configure Windows Security Events via AMA connector with event filtering. Option D is correct because the Azure Monitor Agent (AMA) connector for Windows Security Events allows granular filtering of event IDs and levels, enabling you to collect only critical security events (e.g., 4624, 4625) while excluding verbose logs like Event ID 5156 (Windows Filtering Platform permit connections). This reduces ingestion volume and cost without losing essential security visibility.

Answer

Use Common Event Format (CEF) connector instead of Windows Events

Answer

Change the table plan to Basic Logs

Answer

Increase the workspace retention period to archive warm data

Question 14

Which TWO are valid methods to connect a non-Azure Windows server to Microsoft Sentinel? (Choose two.)

Accepted Answer

Install the Azure Monitor Agent (AMA). Option A is correct because the Azure Monitor Agent (AMA) is the current, recommended agent for collecting data from non-Azure Windows servers and sending it to Microsoft Sentinel. It replaces the older Log Analytics agent and supports data collection via Data Collection Rules (DCRs), which allow granular control over which events and performance counters are ingested. Option D is correct because the Log Analytics agent (MMA) was the original method to connect Windows servers to Sentinel, and while it is being phased out in favor of AMA, it remains a valid supported method for existing deployments.

Answer

Install the Azure Security Center agent

Answer

Configure Windows Event Forwarding (WEF) and point it to Sentinel

Answer

Configure the server to forward syslog to Sentinel

Question 15

Refer to the exhibit. You are analyzing a KQL query in Microsoft Sentinel that returns accounts with more than 10 failed logins within 5 minutes. The query is not returning any results even though you know there have been multiple failed logins. What is the most likely reason?

Accepted Answer

The filter condition 'Account !startswith "ANONYMOUS LOGON"' is case-sensitive and may be excluding valid results. Option D is correct because the `!startswith` operator in KQL is case-sensitive by default. If the actual account name in the SecurityEvent table is stored as 'ANONYMOUS LOGON' with a different case (e.g., 'Anonymous Logon' or 'anonymous logon'), the filter will exclude those rows, causing the query to return no results even though failed logins occurred. This is a common pitfall when using string comparison operators in KQL without considering case sensitivity.

Answer

The 'startswith' operator is not a valid KQL operator

Answer

The 'bin' function is used incorrectly

Answer

The query syntax requires a 'let' statement

Question 16

You need to ensure that critical incidents in Microsoft Sentinel are automatically assigned to a senior security analyst. What should you configure?

Accepted Answer

Create an automation rule that assigns the incident to the analyst.. Automation rules in Microsoft Sentinel allow you to automatically assign incidents to specific users or groups based on conditions like severity or title. By creating an automation rule that triggers on incident creation and sets the owner to the senior security analyst, you ensure critical incidents are assigned without manual intervention.

Answer

Create an analytics rule with a custom schedule.

Answer

Configure a workbook to filter incidents by owner.

Answer

Add the analyst to a watchlist used in analytics rules.

Question 17

A SOC analyst suspects a user account is compromised based on anomalous sign-in activity detected by Microsoft Entra ID Protection. The analyst needs to confirm and contain the threat. What is the first action the analyst should take?

Accepted Answer

Review the user's risk level and sign-in logs in Microsoft Entra ID Protection. Option B is correct because the first step when investigating a potential account compromise is to review the user's risk level and sign-in logs in Microsoft Entra ID Protection. This allows the analyst to confirm the threat by examining risk detections, sign-in patterns, and contextual details before taking any containment actions. Prematurely resetting passwords or disabling accounts could disrupt legitimate user activity or alert the attacker without a full understanding of the scope.

Answer

Reset the user's password immediately

Answer

Disable the user account in Microsoft Entra ID

Answer

Block the user's sign-in from all locations

Question 18

You are configuring an automated investigation and response (AIR) playbook in Microsoft Sentinel. The playbook should automatically block a user in Microsoft Entra ID when a high-severity incident is created. Which action should you include in the playbook?

Accepted Answer

Call the Microsoft Graph API to update the user's accountEnabled property to false.. Option B is correct because the 'Block user' action is not available in the Microsoft Entra ID connector for Azure Logic Apps; instead, you must call the Microsoft Graph API to update the user's `accountEnabled` property to `false`. This directly disables the user account in Microsoft Entra ID, effectively blocking their access. The playbook in Microsoft Sentinel uses Azure Logic Apps, and the Graph API is the appropriate method to perform this action programmatically.

Answer

Use the 'Block user' action from the Microsoft Entra ID connector in Azure Logic Apps.

Answer

Add a 'Block IP' action from the Azure Firewall connector.

Answer

Add a 'Change incident status' action to close the incident.

Question 19

Refer to the exhibit. You are reviewing an Azure Security Center automation (now Microsoft Defender for Cloud) that should automatically trigger a Logic App when an alert is generated. However, the automation is not triggering. What is the most likely cause?

Accepted Answer

The automation is missing the 'triggers' property to filter on specific alert types. Option D is correct because Microsoft Defender for Cloud automation requires a 'triggers' property to define which alert types should invoke the Logic App. Without this property, the automation is created but never fires, as it has no conditions to match incoming alerts. The exhibit shows the automation resource is configured, but missing the triggers array means no alerts will trigger the Logic App.

Answer

The action type is incorrect; it should be 'EventHub'

Answer

The logicAppResourceId is missing

Answer

The apiVersion is invalid

Question 20

You are configuring automated responses in Microsoft Sentinel. You have created an automation rule that runs a playbook when an incident is created. The playbook performs actions in Microsoft Entra ID and Microsoft Defender for Cloud. However, the playbook fails with a permissions error. What should you do?

Accepted Answer

Assign the managed identity of the playbook the required roles in Microsoft Entra ID and Defender for Cloud.. The playbook fails with a permissions error because it uses a managed identity to authenticate to Microsoft Entra ID and Microsoft Defender for Cloud, but that identity has not been granted the necessary Azure RBAC roles (e.g., Security Reader, Security Admin) on the target resources. Assigning the required roles to the managed identity directly resolves the authorization failure.

Answer

Enable 'Allow playbooks to use managed identity' in the Sentinel settings.

Answer

Configure the Microsoft Entra ID connector in Sentinel with delegated permissions.

Answer

Grant the security analyst's account Contributor permissions on the automation rule.