SC-200 Practice Test 9 — 10 Questions

Question 1

A security analyst receives a Microsoft Defender for Cloud Apps alert about a suspicious sign-in from an IP address in a sanctioned app. The analyst needs to immediately prevent further access from that IP. What should the analyst do?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Create an IP address-based access policy in Microsoft Defender for Cloud Apps.. Microsoft Defender for Cloud Apps provides native IP address-based access policies that can immediately block traffic from a specific IP address for a sanctioned app. This action is taken directly within Defender for Cloud Apps, without needing to modify Entra ID Conditional Access policies, and it applies in real time to the app session. The analyst can create a policy that blocks access from the suspicious IP, preventing further sign-ins from that address.

Answer

Create a mailbox rule to delete emails from that IP.

Answer

Create a Conditional Access policy in Microsoft Entra ID to block the IP.

Answer

Reset the user's password and require MFA re-registration.

Question 2

You are a SOC analyst using Microsoft Defender XDR. You notice that a user's account has been compromised and is being used to send phishing emails. You need to prevent the user from sending any more emails while preserving the ability to receive emails for investigation. What should you do?

Accepted Answer

Restrict the user from sending email using Microsoft Defender for Office 365 mailbox restrictions.. Microsoft Defender for Office 365 mailbox restrictions allow you to block a user from sending email while still permitting them to receive messages. This is done via the 'Restrict user from sending email' policy in the Microsoft 365 Defender portal, which applies a transport rule that rejects outbound mail from the user but leaves inbound delivery intact, enabling forensic analysis of incoming phishing responses.

Answer

Remove the user's Microsoft 365 license.

Answer

Disable the user account in Microsoft Entra ID.

Answer

Delete the user's mailbox in Exchange Online.

Question 3

Your organization uses Microsoft Sentinel with Azure Monitor Agent (AMA) to collect Windows security events. You need to collect process creation events (Event ID 4688) and include command-line information. The current Data Collection Rule (DCR) collects only basic security events. What should you modify?

Accepted Answer

Enable the 'Include command line in process creation events' policy in Windows Group Policy.. Event ID 4688 (process creation) can include command-line arguments, but this data is not captured by default. The 'Include command line in process creation events' Group Policy setting must be enabled on the Windows machines to populate the CommandLine field in the security event log. Without this policy, the AMA and DCR will collect the event but the command-line information will be empty.

Answer

Upgrade the AMA to the latest version.

Answer

Modify the DCR to include Event ID 4688 in the data source.

Answer

Switch to the Windows Security Events via Legacy Agent connector.

Question 4

Your organization uses Microsoft Sentinel with a Log Analytics workspace in the East US region. You need to ensure that incident investigation data is retained for two years for compliance. What should you configure?

Accepted Answer

Adjust the Interactive retention period to 730 days in the Log Analytics workspace.. Log Analytics workspaces allow you to configure the Interactive retention period independently from the Total retention period. Setting Interactive retention to 730 days ensures that incident investigation data remains available for interactive queries for the full two-year compliance requirement, without needing to enable archive or change log types.

Answer

Configure a data retention policy in Microsoft Purview.

Answer

Set the Total retention period to 730 days and enable Archive.

Answer

Enable Basic Logs and set retention to 730 days.

Question 5

In Microsoft 365 Defender, what is the primary function of the Action center?

Accepted Answer

View and manage pending and completed remediation actions from automated investigations.. The Action center in Microsoft 365 Defender is the centralized console for tracking and managing remediation actions generated by automated investigations. It consolidates both pending actions (requiring approval) and completed actions (e.g., quarantining a file, blocking an IP) across Defender for Endpoint, Office 365, Identity, and Cloud Apps, ensuring security teams can review and approve or reject responses without switching contexts.

Answer

Manage user roles and permissions for the security portal.

Answer

Create custom detection rules using advanced hunting queries.

Answer

Manage threat intelligence feeds and indicators.

Question 6

Your organization uses Microsoft Defender for Office 365. You need to configure a policy that automatically moves emails detected as 'Bulk' to the user's Junk Email folder. However, users must be able to override this by adding the sender to their Safe Senders list. What should you configure?

Accepted Answer

Anti-spam policy with Bulk email threshold set to a value that triggers junk action. The Bulk email threshold setting in an anti-spam policy allows you to specify a Bulk Complaint Level (BCL) value that, when exceeded, triggers a specific action such as moving the email to the Junk Email folder. This action respects the user's Safe Senders list, meaning if the sender is added to that list, the email will bypass the junk folder and be delivered to the inbox. Other policy types like anti-phishing, malware filter, or connection filter do not provide this granular control over bulk email classification and user override behavior.

Answer

Anti-phishing policy

Answer

Malware filter policy

Answer

Connection filter policy

Question 7

A security analyst in Microsoft Sentinel wants to create a scheduled analytics rule to detect repeated failed HTTP requests to an Azure Application Gateway, indicating a possible brute force attack. Which Azure Monitor table should the analyst query to capture the access and error logs from the Application Gateway?

Accepted Answer

AzureDiagnostics. AzureDiagnostics is the correct table because it stores resource-level logs for Azure services, including Application Gateway access and error logs. These logs contain detailed HTTP request data (e.g., client IP, URI, status code) necessary to detect repeated failed requests indicative of a brute force attack. Other tables like AzureActivity, AzureMetrics, or SecurityEvent do not capture this specific HTTP-level telemetry.

Answer

AzureActivity

Answer

AzureMetrics

Answer

SecurityEvent

Question 8

Your team uses Microsoft Defender XDR to manage incidents. You need to ensure that all incidents with a severity of 'High' are automatically assigned to a specific SOC analyst group. What should you configure?

Accepted Answer

Create an automation rule in Microsoft Defender XDR to automatically assign incidents.. Microsoft Defender XDR's automation rules allow you to define conditions (e.g., severity equals 'High') and actions (e.g., assign to a specific SOC analyst group) that are executed automatically when incidents are created or updated. This is the native, built-in mechanism for incident assignment without requiring external scripts, playbooks, or email-based workflows.

Answer

Set up an advanced hunting query to detect high severity incidents and send email.

Answer

Configure a playbook in Microsoft Sentinel triggered by incidents.

Answer

Use the 'New-MTPIncidentAssignment' cmdlet in a scheduled task.

Question 9

A security analyst is investigating a suspected lateral movement attack in Microsoft 365 Defender. The analyst wants to identify all devices where a specific user account (user@contoso.com) had an interactive logon, and then check which of those devices subsequently made outbound RDP connections to other internal IP addresses. Which KQL query approach is most efficient to find this chain?

Accepted Answer

Join DeviceLogonEvents (where AccountName == 'user@contoso.com' and LogonType == 'Interactive') with DeviceNetworkEvents (where RemotePort == 3389) on DeviceName, and filter for NetworkEvents timestamp > LogonEvents timestamp. It directly correlates interactive logon events (DeviceLogonEvents with LogonType == 'Interactive') for the specific user with subsequent outbound RDP connections (DeviceNetworkEvents with RemotePort == 3389) on the same device, using a join on DeviceName and a timestamp filter to ensure the network event occurs after the logon. This approach efficiently identifies the lateral movement chain by linking the initial compromise device to the target device via RDP, leveraging the native schema of Microsoft 365 Defender.

Answer

Use IdentityLogonEvents to find the user's logons and join with DeviceNetworkEvents on IP address

Answer

Query EmailEvents to find emails sent from the user and then check DeviceNetworkEvents on the sender device

Answer

Union DeviceLogonEvents and DeviceNetworkEvents, then summarize by DeviceName and filter for the user

Question 10

A security analyst is reviewing an incident in Microsoft 365 Defender where malware was detected on multiple endpoints. The analyst wants to see a visual representation of the attack progression, including the initial entry point and all affected devices. Which feature in the Microsoft 365 Defender portal should the analyst use?

Accepted Answer

Incident graph. The incident graph in Microsoft 365 Defender provides a visual, interactive map of the entire attack progression, showing the initial entry point, lateral movement, and all affected devices and users. It correlates alerts and evidence into a single timeline, enabling the analyst to understand the full scope of the incident at a glance. This directly meets the requirement for a visual representation of the attack progression.

Answer

Advanced hunting

Answer

Threat analytics

Answer

Action center