SC-200 Mock Exam 90 — 25 Questions

Question 1

You are a SOC analyst at Contoso. The environment includes Microsoft Sentinel in a single workspace, Microsoft Defender XDR (including Defender for Endpoint, Defender for Office 365, Defender for Identity, and Defender for Cloud Apps), Microsoft Entra ID, and Microsoft Intune. You need to design a solution to automatically triage and respond to phishing incidents detected by Defender for Office 365. The requirements are: 1) When a phishing alert is generated with high confidence, an incident should be automatically created in Sentinel. 2) The incident should be assigned to the 'Phishing' team and have a severity of High. 3) A playbook should run that will send a Teams message to the Phishing team and also block the sender in Exchange Online. 4) The incident should be automatically closed if the playbook successfully executes. What should you do?

Accepted Answer

Enable the Microsoft 365 Defender connector to synchronize incidents, create an automation rule triggered on incident creation with conditions for 'Phishing' and high confidence, assigning to 'Phishing' team, running a playbook, and enabling auto-closure.. Option B is correct because it leverages the Microsoft 365 Defender connector to synchronize incidents from Defender for Office 365 into Microsoft Sentinel, which is the recommended approach for ingesting high-confidence phishing alerts. An automation rule triggered on incident creation with conditions for 'Phishing' and high confidence can assign the incident to the 'Phishing' team, run a playbook to send a Teams message and block the sender in Exchange Online, and enable auto-closure upon successful playbook execution.

Answer

Use the Office 365 connector to ingest alerts, then create an analytics rule to generate incidents, and use automation rules to assign and run playbooks.

Answer

Use a Logic App to continuously poll Defender for Office 365 APIs for alerts, create incidents via the Sentinel API, and assign them.

Answer

Create a custom analytics rule with KQL to detect phishing in Defender for Office 365 logs, generate incidents, and use automation rules.

Question 2

Your organization, Fabrikam, has a hybrid environment with on-premises Active Directory and Microsoft Entra ID. You are using Microsoft Sentinel and Microsoft Defender XDR. You have enabled Microsoft Defender for Identity (MDI) to protect on-premises Active Directory. Recently, you received an incident in Microsoft Sentinel indicating a potential DCSync attack from a domain controller. The incident was generated from an MDI alert. You need to investigate the incident and determine if the attack was successful. You have the following options: A) Use the Microsoft Sentinel incident investigation graph to view entities and relationships. Then query the IdentityDirectoryEvents table for the domain controller to see if any directory replication requests were made. B) Use the Microsoft Defender XDR advanced hunting to query the IdentityLogonEvents table for the domain controller. C) Use the Microsoft Sentinel workbook for MDI to visualize the attack timeline. D) Use the Microsoft Defender for Cloud Apps activity log to review the domain controller's activities. Which option should you choose?

Accepted Answer

Use the Microsoft Sentinel incident investigation graph to view entities and relationships. Then query the IdentityDirectoryEvents table for the domain controller to see if any directory replication requests were made.. Option C is correct because a DCSync attack involves an attacker impersonating a domain controller to request directory replication via the MS-DRSR protocol. The IdentityDirectoryEvents table in Microsoft Defender for Identity captures directory service replication activities, including the DirectoryReplication request action. Querying this table for the domain controller allows you to confirm if unauthorized replication requests were made, directly indicating a successful DCSync attack.

Answer

Use the Microsoft Sentinel workbook for MDI to visualize the attack timeline.

Answer

Use the Microsoft Defender XDR advanced hunting to query the IdentityLogonEvents table for the domain controller.

Answer

Use the Microsoft Defender for Cloud Apps activity log to review the domain controller's activities.

Question 3

Your company uses Microsoft Defender for Cloud Apps to monitor cloud applications. You have discovered that a user is accessing a sanctioned cloud storage app from an IP address that belongs to a known malicious botnet. You need to automatically block the user's access to the app and require them to re-authenticate. You have already configured session policies in Defender for Cloud Apps. What should you do next?

Accepted Answer

Configure a session policy in Defender for Cloud Apps with the action 'Block' and 'Require re-authentication'.. Session policies in Defender for Cloud Apps can enforce real-time controls on sanctioned apps. By configuring a session policy with the actions 'Block' and 'Require re-authentication', you can immediately terminate the user's session and force them to re-authenticate, which effectively blocks access from the malicious IP while ensuring the user re-verifies their identity.

Answer

Create an access policy in Defender for Cloud Apps to block the user.

Answer

Create an app governance policy in Microsoft Purview to block the app.

Answer

Create a device compliance policy in Microsoft Intune to block the device.

Question 4

You are a security analyst for a company that uses Microsoft Defender for Office 365. You receive an incident indicating that a user reported a phishing email. You need to investigate the email and determine if it was delivered to other users. You also need to ensure that similar emails are blocked in the future. What should you do?

Accepted Answer

Use Threat Explorer to search for similar emails and delete them.. Threat Explorer in Microsoft Defender for Office 365 allows you to search for and take bulk action on emails matching specific criteria, such as sender, subject, or URL. By using Threat Explorer, you can identify all instances of the reported phishing email across your tenant and delete them from user mailboxes, which directly addresses the need to determine if the email was delivered to other users and to remediate it. This tool is designed for hunting and remediation, making it the correct choice for this investigation.

Answer

Submit the email to Microsoft for analysis and quarantine it.

Answer

Create a Safe Links policy to block URLs in the email.

Answer

Run a simulated phishing attack to test user awareness.

Question 5

Your organization has Microsoft Sentinel deployed in a single workspace. You need to implement role-based access control (RBAC) so that only senior analysts can modify analytics rules, while junior analysts can only view incidents. You have created custom roles in Azure. You assign the junior analysts the 'Microsoft Sentinel Reader' role. However, you find that junior analysts can still create and modify analytics rules. What is the most likely reason?

Accepted Answer

The junior analysts have been assigned the 'Contributor' role on the resource group containing the workspace.. Option D is correct because RBAC assignments can be overridden if the user is also assigned a higher role at a higher scope (e.g., subscription). Option A is incorrect because there is no 'Analytics Rules' specific role. Option B is incorrect because custom roles are allowed. Option C is incorrect because inherited permissions do not automatically grant write access.

Answer

The 'Microsoft Sentinel Reader' role does not exist; you used the wrong role.

Answer

The junior analysts are members of a group that has a role assignment on the workspace.

Answer

You need to create a custom role instead of using built-in roles.

Question 6

Your organization, Contoso, uses Microsoft Sentinel in a single Log Analytics workspace. You have ingested logs from Microsoft Defender XDR, Microsoft Entra ID, and Azure Firewall. The SOC team needs to investigate an incident where a user's account was compromised and used to access sensitive data from an external IP address. The incident was created from a Microsoft Defender for Cloud Apps alert. The SOC team wants to automatically block the user from further access and disable the user account in Microsoft Entra ID. You need to design an automated response using Microsoft Sentinel playbooks. The solution must minimize manual intervention. You have the following options: A) Create a playbook that triggers on the incident and uses the Microsoft Graph API to disable the user account and revoke sessions. Configure the playbook to run automatically from an automation rule. B) Create a playbook that triggers on the alert and uses the Defender for Cloud Apps API to suspend the user. Configure the automation rule to run the playbook on incident creation. C) Create a playbook that sends an email to the SOC team to manually disable the user. D) Create an automation rule that automatically changes the incident status to 'Active' and assigns it to a senior analyst. Which option should you choose?

Accepted Answer

Create a playbook that triggers on the incident and uses the Microsoft Graph API to disable the user account and revoke sessions. Configure the playbook to run automatically from an automation rule.. Option D is correct because it uses a playbook triggered on incident creation and leverages the Microsoft Graph API to disable the user account and revoke sessions, which directly addresses the compromised account in Microsoft Entra ID. This approach minimizes manual intervention by automating the entire response within Microsoft Sentinel, aligning with the requirement to block further access and disable the account automatically.

Answer

Create an automation rule that automatically changes the incident status to 'Active' and assigns it to a senior analyst.

Answer

Create a playbook that sends an email to the SOC team to manually disable the user.

Answer

Create a playbook that triggers on the alert and uses the Defender for Cloud Apps API to suspend the user. Configure the automation rule to run the playbook on incident creation.

Question 7

You are a security operations analyst for a company that uses Microsoft Sentinel. You need to create a custom analytics rule that detects when a user account is created and then deleted within 24 hours, which could indicate a test account used for malicious purposes. The rule should only run on the SecurityEvent table. You have written the KQL query and now need to configure the rule settings. Which alert scheduling configuration should you set to minimize latency while ensuring that the rule catches the pattern?

Accepted Answer

Run query every 1 hour with a 1-hour lookback.. Option A is correct because running the query every 1 hour with a 1-hour lookback ensures that any account creation and deletion occurring within a 24-hour window is captured with minimal latency. The 1-hour lookback allows the rule to detect events that span across the current and previous execution windows, which is essential for catching the creation and deletion pattern without missing events due to scheduling gaps.

Answer

Run query every 24 hours with a 24-hour lookback.

Answer

Run query every 1 hour with no lookback.

Answer

Run query every 5 minutes with a 5-minute lookback.

Question 8

You are a security operations architect for a company that uses Microsoft Sentinel in a hybrid environment with multiple workspaces. The company has a central SOC team that needs to view incidents from all workspaces in a single pane of glass. Each workspace belongs to a different business unit and has its own retention and access policies. You need to design a solution that provides centralized incident management without duplicating data or requiring users to switch workspaces. You also need to ensure that the SOC team can perform actions on incidents across workspaces. What should you do?

Accepted Answer

Use Microsoft Sentinel incident multi-view to connect all workspaces.. Microsoft Sentinel incident multi-view allows SOC teams to view and manage incidents across multiple workspaces from a single interface without duplicating data. This feature provides a centralized pane of glass while respecting each workspace's independent retention and access policies, and it enables cross-workspace incident actions without requiring users to switch contexts.

Answer

Create a playbook that copies incidents from all workspaces to a central workspace.

Answer

Use the Microsoft Sentinel data connector to connect all workspaces to a central workspace.

Answer

Create a new Log Analytics workspace that ingests data from all workspaces via diagnostic settings.

Question 9

You are a security operations analyst for a company that uses Microsoft Sentinel. You need to create a workbook that displays the top 10 most common alert types over the last 7 days. The workbook will be used by the SOC manager to identify trends. You have already created a new workbook and added a query step. Which KQL query should you use in the query step?

Accepted Answer

AlertInfo | where TimeGenerated > ago(7d) | summarize Count = count() by AlertName | top 10 by Count desc | render barchart. Option C is correct because it uses the `summarize` operator to count alerts by `AlertName`, then `top 10 by Count desc` to return the ten most frequent alert types, and `render barchart` to visualize the data in the workbook. This directly meets the requirement to display the top 10 most common alert types over the last 7 days.

Answer

AlertInfo | where TimeGenerated > ago(7d) | project AlertName

Answer

AlertInfo | where TimeGenerated > ago(7d) | project AlertName, count()

Answer

AlertInfo | where TimeGenerated > ago(7d) | summarize count() by bin(TimeGenerated, 1d) | render timechart

Question 10

Your SOC team uses Microsoft Sentinel. You need to ensure that all incidents are classified and resolved within 72 hours. Currently, analysts manually update the incident status and classification. You want to automate the following: 1) If an incident is not updated within 48 hours, send a reminder to the assigned analyst via email. 2) If an incident remains open after 72 hours, automatically escalate it to the SOC manager and increase its severity. What should you implement?

Accepted Answer

Create automation rules with triggers on 'incident updated' and scheduled conditions to run playbooks for reminders and escalation.. Option B is correct because automation rules in Sentinel can be configured to trigger on a schedule (e.g., every 1 hour) and check incident properties. Using conditions on 'last update time' and 'status', you can send reminders via playbooks and escalate. Option A is wrong because analytics rules are for creating incidents, not for post-creation actions. Option C is wrong because playbooks are triggered by automation rules or alerts, not directly on a schedule for existing incidents. Option D is wrong because a separate Logic App would require custom polling, which is more complex than built-in automation rules.

Answer

Create an analytics rule that runs every hour and queries for old incidents.

Answer

Use Azure Logic Apps with a recurrence trigger to query the Sentinel API and update incidents.

Answer

Create a single playbook that runs on a schedule and checks all incidents.

Question 11

Your organization has a Microsoft Sentinel workspace in the East US region. You have deployed the Microsoft Defender XDR connector and are ingesting incidents from Microsoft Defender for Endpoint, Defender for Office 365, and Defender for Identity. The SOC team reports that some incidents from Defender for Office 365 are missing in Sentinel, but all incidents from the other sources appear correctly. You have verified that the connector is enabled and that there are no ingestion errors. The missing incidents are related to phishing emails that were detected by Defender for Office 365 and automatically remediated (soft deleted) by the system. The incidents are visible in the Microsoft 365 Defender portal. What should you do to ensure these incidents appear in Sentinel?

Accepted Answer

Create a new analytics rule using the Office 365 connector to generate incidents from Defender for Office 365 alerts.. Option D is correct because Defender for Office 365 incidents that are automatically resolved (e.g., soft delete) may not be sent to Sentinel by default. You need to create an analytics rule in Sentinel using the Office 365 connector to generate incidents for those alerts. Option A is wrong because the connector is already enabled. Option B is wrong because the incidents are present in Defender, so the connector should be ingesting them; the issue is with auto-resolved incidents. Option C is wrong because an automation rule cannot generate incidents from alerts that are not ingested.

Answer

Create an automation rule that triggers on missing incidents and creates them manually.

Answer

Create a new Microsoft Defender XDR connector in a different region to capture all incidents.

Answer

Re-enable the Microsoft Defender XDR connector and restart the data ingestion.

Question 12

You are the security operations analyst for a large enterprise that uses Microsoft Sentinel and Microsoft Defender XDR. The environment includes:

- 10,000 Windows 11 devices managed by Microsoft Intune
- 5,000 macOS devices managed by Jamf Pro
- 2,000 Linux servers running Ubuntu 22.04
- Microsoft 365 E5 licenses for all users
- Microsoft Sentinel in the East US region
- Microsoft Defender for Cloud Apps enabled
- Microsoft Defender for Identity deployed
- Microsoft Defender for Office 365 configured

You need to design a solution to meet the following requirements:

1. Ingest security events from all devices (Windows, macOS, Linux) into Microsoft Sentinel.
2. Ensure that all alerts from Microsoft Defender XDR components (including Defender for Endpoint, Defender for Identity, Defender for Office 365, and Defender for Cloud Apps) are automatically correlated into incidents in Microsoft Sentinel.
3. Minimize latency between alert generation in Defender XDR and incident creation in Sentinel.
4. Use the least amount of administrative overhead.

What should you implement?

Accepted Answer

Enable the Microsoft Defender XDR connector for incident correlation. For Windows devices, use the Windows Security Events via AMA connector. For Linux and macOS, use the Syslog via AMA connector.. The Microsoft Defender XDR connector streams incidents from all Defender products into Sentinel with low latency and minimal overhead. For device logs, the Windows Security Events via AMA (Azure Monitor Agent) connector ingests Windows events, and Syslog via AMA ingests Linux and macOS logs (since Jamf Pro can forward logs via Syslog). Option A is correct because it uses the native connectors. Option B is wrong because Log Analytics agent is deprecated and not recommended. Option C is wrong because a Logic App adds latency and overhead. Option D is wrong because direct API ingestion is complex and not scalable.

Answer

Enable the Microsoft Defender XDR connector for incident correlation. Deploy the Log Analytics agent on all devices to collect events.

Answer

Use a Logic App to fetch incidents from Microsoft Defender XDR and create incidents in Sentinel. Install the Azure Monitor Agent on all devices.

Answer

Enable the Microsoft Defender XDR connector and use the Microsoft Graph API to ingest logs from all devices directly into Sentinel.

Question 13

Your company has a hybrid identity environment with Microsoft Entra ID and on-premises Active Directory. You recently deployed Microsoft Defender for Identity (MDI) to monitor on-premises domain controllers. The SOC team needs to receive alerts from MDI in Microsoft Sentinel. You have already installed the MDI sensor on all domain controllers and confirmed that the MDI portal shows alerts. However, no MDI alerts appear in Sentinel. The Microsoft Defender for Identity data connector in Sentinel shows 'Connected'. What should you do next?

Accepted Answer

Enable the Microsoft 365 Defender connector in Sentinel, as MDI alerts are ingested through that connector.. Option B is correct because MDI alerts are ingested into Sentinel via the Microsoft 365 Defender connector, not the MDI connector directly. The MDI connector is for other data. Option A is not needed; Option C is for health; Option D is incorrect because the connector is already connected.

Answer

Update the MDI sensor to the latest version.

Answer

Reconfigure the MDI data connector to select all alert severities.

Answer

Check the MDI sensor health status on each domain controller.

Question 14

Your organization uses Microsoft Sentinel and has a requirement to retain log data for two years for compliance purposes. You have configured the Log Analytics workspace with a retention policy of 90 days. You need to extend the retention to two years while minimizing costs. The data must remain queryable. What should you do?

Accepted Answer

Configure an archive policy to move older data to Azure Storage hot tier and use Log Analytics workspace archive retention.. Option D is correct because long-term retention with queryability is best achieved by configuring archive to Azure Storage with hot access. Option A is costly; Option B is costly; Option C is for cold storage and not queryable.

Answer

Increase the workspace retention to 730 days.

Answer

Export logs to Azure Blob Storage with cool access tier.

Answer

Enable unlimited retention for the workspace.

Question 15

Your organization uses Microsoft Sentinel. The SOC manager wants to track the average time to triage incidents. You need to create a report that shows this metric. What should you use?

Accepted Answer

Create a workbook that uses KQL to query incident data and display the average time.. Option C is correct because workbooks can query the SecurityIncident table and compute average time. Option A is wrong because analytics rules generate alerts, not reports. Option B is wrong because automation rules don't create reports. Option D is wrong because playbooks are for automation, not reporting.

Answer

Create a playbook that sends a report via email.

Answer

Create an automation rule that logs the triage time to a custom table.

Answer

Create an analytics rule that calculates the time to triage.

Question 16

Your SOC team uses Microsoft Sentinel workbooks to monitor the security posture. One workbook shows a chart of incidents by severity over the last 7 days. The workbook uses a KQL query that queries the SecurityIncident table. Recently, the workbook stopped displaying data. You check the workspace and confirm that incidents are being created and are visible in the Sentinel portal. You also verify that the workbook has not been modified. What is the most likely cause?

Accepted Answer

The Log Analytics workspace linked to the workbook has been moved or renamed.. Option B is correct because workbooks rely on the Log Analytics workspace for queries. If the workspace was moved to a different resource group or subscription, the workbook may lose its connection. Option A is wrong because the workbook hasn't been modified. Option C is wrong because the query is fine; data is being ingested. Option D is wrong because a different license doesn't affect workbook functionality.

Answer

The workbook was accidentally deleted and needs to be re-created.

Answer

The workspace has been switched to a different pricing tier that does not support workbooks.

Answer

The KQL query in the workbook has a syntax error.

Question 17

Your organization has multiple offices across the globe and uses Microsoft Sentinel as the primary SIEM. You have deployed Azure Arc on all on-premises servers to manage them centrally. The security team needs to collect Windows Security Events from all servers, including domain controllers, and forward them to Sentinel using the Windows Security Events via AMA connector. The team also wants to minimize administrative overhead when adding new servers. The current environment includes: 500 on-premises Windows servers (200 domain controllers, 300 member servers) managed via Azure Arc, 200 Azure VMs running Windows Server, and a centralized Log Analytics workspace named 'LAW-Security' in the East US region. You have already installed the Azure Monitor Agent (AMA) on all servers via Azure Arc and Azure VMs. However, you notice that security events from domain controllers are not appearing in Sentinel. You have verified that the AMA agent is running and the data collection rule (DCR) is correctly configured to collect Security events. No other issues are present. You need to ensure that security events from domain controllers are collected. What should you do?

Accepted Answer

Check the network connectivity from the domain controllers to the Log Analytics workspace endpoint. Ensure that the domain controllers can reach the required URLs.. Option A is correct because domain controllers often have restricted network access; they need to be able to reach the Log Analytics workspace endpoint. Option B is wrong because the DCR is already correctly configured. Option C is wrong because restarting the agent is not the solution. Option D is wrong because the connector is already working for other servers.

Answer

Reinstall the Windows Security Events via AMA connector in Sentinel.

Answer

Restart the Azure Monitor Agent on all domain controllers.

Answer

Recreate the data collection rule with a different namespace.

Question 18

Your organization uses Microsoft Sentinel and Microsoft Defender for Cloud. You have a requirement to automatically tag incidents that involve resources from a specific subscription with the label 'Critical Subscription'. The subscription ID is stored in a watchlist. Incidents are created from multiple data sources. What is the most efficient way to apply the tag?

Accepted Answer

Create an automation rule that runs when an incident is created, queries the watchlist, and if the subscription matches, applies the label.. Option D is correct because an automation rule can check the watchlist and apply the label. Option A is wrong because analytics rules don't tag incidents. Option B is wrong because it would require individual rules for each data source. Option C is wrong because playbooks are more complex than needed.

Answer

Create a playbook that runs on all incidents and checks the watchlist to apply the label.

Answer

Modify each analytics rule to include the subscription ID in the incident title.

Answer

Create a separate analytics rule for the subscription that generates incidents with the label.

Question 19

Your company uses Microsoft Sentinel and has connected Microsoft 365 Defender. You have configured an automation rule that, when an incident is created with a high severity, triggers a playbook that sends an email to the SOC manager and creates a ticket in ServiceNow. Recently, the automation rule stopped triggering the playbook. You check the automation rule and see it is enabled. You also check the playbook and see it is enabled. However, the playbook's run history shows no new runs for the last 24 hours, even though high-severity incidents have been created. You verify that the incidents are indeed high severity and that the automation rule's conditions match. What is the most likely cause?

Accepted Answer

The automation rule has reached its maximum number of actions (trigger limit) and has been automatically disabled by Sentinel.. Option A is correct because automation rules have a trigger limit (number of actions per rule) that might be exceeded if many incidents are created. Once the limit is reached, the rule stops triggering. Option B is wrong because the rule is enabled. Option C is wrong because the incidents are high severity, so conditions match. Option D is wrong because the playbook is not the issue; the automation rule is not triggering it.

Answer

The incident severity was changed after creation, so the rule condition no longer matches.

Answer

The playbook has been deleted and needs to be re-created.

Answer

The automation rule was accidentally disabled by another administrator.

Question 20

You are a security operations analyst for a large enterprise with a hybrid environment. Your organization uses Microsoft Sentinel as the central SIEM, Microsoft Defender for Cloud for Azure workloads, Microsoft Defender for Endpoint for endpoints, and Microsoft Defender for Identity for on-premises Active Directory. Recently, the security team has been overwhelmed by a high volume of low-severity incidents from Defender for Cloud that are not actionable. These incidents are generated from the built-in 'ASC Default' policy initiative. You need to reduce the noise without disabling the entire policy. The security team still wants to be alerted on high-severity incidents. You have been asked to implement a solution that automatically suppresses low-severity incidents from Defender for Cloud but still allows high-severity ones to be created in Sentinel. You must not modify the policy initiative itself. What should you do?

Accepted Answer

Create an automation rule that triggers when an incident is created from Defender for Cloud with severity Low or Medium, and set the status to Closed.. Option B is correct because creating an automation rule that automatically closes low-severity incidents from Defender for Cloud will reduce noise while still allowing high-severity incidents to be created. Option A is wrong because modifying the analytics rule is not possible for built-in rules; also it would affect all severities. Option C is wrong because creating a separate analytics rule does not suppress the existing ones. Option D is wrong because turning off the connector would stop all incidents.

Answer

Create a new analytics rule that creates incidents only for high-severity alerts from Defender for Cloud.

Answer

Modify the 'ASC Default' analytics rule in Sentinel to only trigger on high-severity alerts.

Answer

Turn off the Defender for Cloud data connector in Sentinel.