SC-200 Practice Test 9 — 10 Questions

Question 1

A security analyst in Microsoft 365 Defender is investigating an incident that contains multiple alerts from different sources (e.g., Microsoft Defender for Endpoint, Microsoft 365 Defender for Office). The analyst wants to see a consolidated list of all alerts associated with the incident, including their severity, status, and detection source. Which tab within the incident details page should the analyst use?

Accepted Answer

Alerts tab. The Alerts tab on the incident details page in Microsoft 365 Defender provides a consolidated, filterable list of all alerts linked to the incident, regardless of their source (e.g., Microsoft Defender for Endpoint, Microsoft Defender for Office 365). This tab displays each alert's severity, status, and detection source, allowing the analyst to triage and correlate alerts from different workloads in a single view. The other tabs focus on specific entities (devices, users, mailboxes) rather than the unified alert list.

Answer

Devices tab

Answer

Users tab

Answer

Mailboxes tab

Question 2

In Microsoft 365 Defender, an analyst is investigating an incident involving a malicious script. The analyst wants to see the command-line arguments executed by the script on a specific device. Which Advanced Hunting table should the analyst query?

Accepted Answer

DeviceProcessEvents. The DeviceProcessEvents table in Advanced Hunting captures process creation events, including the command-line arguments used to execute a process. Since the analyst needs to see the command-line arguments executed by a malicious script on a specific device, querying DeviceProcessEvents is the correct approach because it records the ProcessCommandLine column for each process creation event.

Answer

DeviceNetworkEvents

Answer

DeviceFileEvents

Answer

DeviceEvents

Question 3

A security administrator wants to ensure that all existing and future Azure virtual machines have Microsoft Defender for Cloud's built-in vulnerability assessment solution (Qualys or Microsoft) installed without manual intervention. Which feature should the administrator configure?

Accepted Answer

Auto-provisioning of the vulnerability assessment solution. Auto-provisioning of the vulnerability assessment solution ensures that Microsoft Defender for Cloud automatically installs either the Qualys or Microsoft built-in vulnerability assessment extension on all existing and future Azure VMs without manual intervention. This feature is specifically designed to enable continuous vulnerability scanning by deploying the agent at scale, covering both new and existing resources as they are provisioned or discovered.

Answer

Continuous export of security findings to Log Analytics

Answer

Just-in-time VM access

Answer

Regulatory compliance dashboard

Question 4

A cloud security administrator receives an alert from Microsoft Defender for Cloud indicating that a virtual machine has been compromised. The administrator wants to quickly isolate the VM from the network to prevent further spread while preserving the disk for forensic analysis. Which action should the administrator take?

Accepted Answer

Use the "Isolate VM" action in the security alert.. The 'Isolate VM' action in Microsoft Defender for Cloud is designed specifically for compromised VMs. It applies a network security group (NSG) rule that denies all inbound and outbound traffic to the VM, effectively quarantining it from the network while leaving the disk intact for forensic analysis. This is the fastest and most direct method to contain the threat without altering the VM's configuration or disk state.

Answer

Apply a just-in-time (JIT) access policy to the VM.

Answer

Enable the Azure Security Benchmark initiative for the VM.

Answer

Configure a custom Azure Policy to deny network access.

Question 5

A company has enabled Microsoft Defender for Cloud on its Azure subscription. The security team wants to ensure that all existing virtual machines have a vulnerability assessment solution installed. Which Defender for Cloud feature can automatically deploy a vulnerability assessment agent to supported VMs?

Accepted Answer

Vulnerability assessment recommendations. The Vulnerability Assessment (VA) recommendations in Microsoft Defender for Cloud can automatically deploy a vulnerability assessment agent (such as the Qualys or Microsoft Defender Vulnerability Management agent) to supported Azure VMs. When a VM is found to be missing a VA solution, Defender for Cloud can enable the 'Auto-provision' setting for the VA recommendation, which triggers the agent installation without manual intervention. This directly meets the requirement to ensure all existing VMs have a vulnerability assessment solution installed.

Answer

Defender for Servers plan

Answer

Security policies

Answer

Workload protections

Question 6

A company uses Microsoft Defender for Cloud to protect their Azure resources. They have enabled the enhanced security features on a subscription that contains several Azure SQL databases. They want to be alerted if a user attempts to perform SQL injection attacks against these databases. Which Defender for Cloud plan specifically enables SQL injection detection alerts?

Accepted Answer

Defender for SQL. Defender for SQL is the specific Microsoft Defender for Cloud plan that provides SQL-specific threat detection, including alerts for SQL injection attacks. This plan monitors SQL databases for anomalous activities such as SQL injection attempts, brute-force attacks, and unusual access patterns by analyzing query logs and audit records. Enabling Defender for SQL on the subscription activates these detection capabilities for Azure SQL databases, making it the correct choice for the scenario.

Answer

Defender for Servers

Answer

Defender for App Service

Answer

Defender for Storage

Question 7

A Microsoft Sentinel incident contains alerts from multiple analytics rules. The analyst suspects the same compromised account performed impossible travel followed by suspicious mailbox access. Which two actions best help correlate identity and mailbox activity?

Accepted Answer

Query SigninLogs for the account around the alert timestamps. Option A is correct because querying SigninLogs for the account around the alert timestamps directly retrieves Azure AD authentication events, which are essential for identifying the source IP addresses, locations, and timestamps that define the impossible travel pattern. This data is the primary evidence for the first part of the suspected compromise.

Answer

Delete the incident to force it to regenerate

Answer

Disable all analytics rules that contributed alerts

Question 8

A security administrator needs to ensure that only approved applications can run on a set of Windows Server virtual machines. The administrator has already enabled Microsoft Defender for Cloud's enhanced security features. Which Defender for Cloud feature should the administrator configure to define a list of allowed applications and get alerts when unapproved applications are executed?

Accepted Answer

Adaptive Application Controls. Adaptive Application Controls (AAC) is the correct feature because it uses machine learning to establish a baseline of known-safe processes on your Windows Server VMs, then enforces an allowlist so that only those approved applications can run. When an unapproved application is executed, AAC generates a security alert in Microsoft Defender for Cloud, meeting the requirement to both define allowed applications and receive alerts on violations.

Answer

File Integrity Monitoring (FIM)

Answer

Just-in-Time VM Access (JIT)

Answer

Vulnerability Assessment

Question 9

A security administrator wants to see the overall security posture of all their Azure subscriptions in a single numerical score. Which dashboard in Microsoft Defender for Cloud provides this score based on implemented security controls?

Accepted Answer

Secure Score. The Secure Score dashboard in Microsoft Defender for Cloud aggregates the security posture across all Azure subscriptions into a single numerical score. This score is calculated based on the implementation of security controls and recommendations, reflecting the percentage of completed security measures. The administrator needs this consolidated view, which is exactly what Secure Score provides.

Answer

Regulatory Compliance

Answer

Inventory

Answer

Recommendations

Question 10

A security analyst is building a custom detection rule in Microsoft 365 Defender to identify ransomware activity. The rule should trigger when files with specific extensions (e.g., .encrypted, .locked) are created on multiple devices within a short time frame, suggesting a widespread attack. Which combination of advanced hunting tables should be used to obtain both file creation events and device information?

Accepted Answer

DeviceFileEvents and DeviceInfo. Option A is correct because DeviceFileEvents captures file creation events, including the specific extensions like .encrypted and .locked, while DeviceInfo provides device metadata such as device name, OS platform, and device group. Joining these tables on DeviceId allows the analyst to correlate file creation events across multiple devices, enabling detection of widespread ransomware activity within a short time frame.

Answer

DeviceProcessEvents and DeviceInfo

Answer

DeviceFileEvents and DeviceNetworkEvents

Answer

DeviceFileEvents and DeviceLogonEvents