SC-200 Mock Exam 91 — 25 Questions

Question 1

Your company uses Microsoft Sentinel as its SIEM and has enabled User and Entity Behavior Analytics (UEBA) to detect insider threats. The UEBA timeline for a user shows several high-risk events, including unusual data exfiltration to an external site and multiple failed logons from a new geographic location. You are asked to create a custom analytics rule that generates an incident when a user exhibits both high-risk behaviors within a 24-hour period. You have the necessary KQL skills. However, when you test the rule, it does not generate any incidents even though the behavior exists. You have confirmed that the UEBA tables (BehaviorAnalytics, IdentityInfo) are populated and that the rule is enabled with a frequency of 1 hour. What is the most likely reason the rule is not firing?

Accepted Answer

The UEBA data has not yet been fully processed and may take up to 24 hours to appear in the tables.. Option D is correct because UEBA data may not be immediately available for querying; there can be a delay (up to 24 hours) before behavior data is fully processed and available in the tables. Option A is wrong because the rule is enabled and the tables are populated. Option B is wrong because the rule is set to run every hour. Option C is wrong because the rule is using the correct tables.

Answer

The analytics rule is not enabled for the correct workspace.

Answer

The KQL query is referencing the wrong tables.

Answer

The rule's frequency is too long; it should be set to 5 minutes.

Question 2

Your organization uses Microsoft Sentinel and Microsoft Defender XDR. You need to configure a solution that automatically escalates incidents that have been in 'New' status for more than 4 hours. The escalation should change the status to 'Active' and assign the incident to a senior analyst. What should you do?

Accepted Answer

Create an automation rule that triggers when an incident is created, with a condition 'Time since created > 4 hours' and actions to set status and owner.. Option C is correct because automation rules can be created with a condition 'Incident created time older than 4 hours' and actions to change status and owner. Option A is wrong because playbooks need to be triggered by an automation rule. Option B is wrong because analytics rules don't run on existing incidents. Option D is wrong because Microsoft Defender XDR doesn't manage Sentinel incidents.

Answer

Modify the analytics rule to update the incident after 4 hours.

Answer

Configure Microsoft Defender XDR to escalate incidents older than 4 hours.

Answer

Create a playbook that runs every hour and updates incidents.

Question 3

Your organization has deployed Microsoft Sentinel and Microsoft Defender XDR. You have enabled bi-directional incident synchronization. The SOC team uses Microsoft Teams to collaborate on incidents. They have configured a playbook that posts incident details to a Teams channel whenever an incident is created. Recently, the playbook stopped posting messages. You check the playbook's run history in Azure Logic Apps and see that the run was successful with a 200 status code from the Teams connector. However, no message appears in the channel. You verify that the Teams webhook URL is correct and that the channel is active. What is the most likely cause?

Accepted Answer

The service principal or managed identity used by the Logic App has lost permissions to post messages in the Teams channel.. Option D is correct because the Teams connector may require specific permissions that were changed or expired. Even though the HTTP request succeeded, the message might be blocked by Teams permissions. Option A is wrong because the run history shows success. Option B is wrong because the webhook URL is correct. Option C is wrong because the connector is working (HTTP 200).

Answer

The Microsoft Teams connector is not installed in the Logic Apps environment.

Answer

The playbook is disabled and needs to be re-enabled.

Answer

The Teams channel has been deleted and re-created with a different ID.

Question 4

Your organization uses Microsoft Sentinel and Microsoft Defender XDR (including Defender for Endpoint, Defender for Office 365, Defender for Identity, and Defender for Cloud Apps). You have an incident response team that operates 24/7. Recently, there have been multiple incidents involving users receiving phishing emails that lead to credential theft. The phishing emails are sophisticated and bypass Exchange Online Protection (EOP) and Defender for Office 365's built-in phishing filters. The emails contain links to fake login pages that harvest credentials. Once credentials are stolen, the attacker uses them to sign in from anonymous IP addresses and attempts to access sensitive data in SharePoint Online. You need to design a response strategy that includes automated containment and investigation. The solution must:
- Automatically disable user accounts when a phishing incident is confirmed.
- Automatically trigger an investigation into the user's activity in Microsoft Defender for Cloud Apps.
- Send a notification to the incident response team with a summary of the incident.
- Minimize manual effort.

You have the following components available:
- Microsoft Sentinel with automation rules and playbooks.
- Microsoft Defender XDR with advanced hunting.
- Microsoft Power Automate.

What is the most efficient way to achieve these requirements?

Accepted Answer

Create a playbook in Microsoft Sentinel that uses the Microsoft Graph API to disable the user account in Microsoft Entra ID, trigger an investigation in Microsoft Defender for Cloud Apps, and send an email notification. Associate the playbook with an automation rule that runs when the incident is created.. Creating a playbook in Microsoft Sentinel that uses the Microsoft Graph API to disable the user in Microsoft Entra ID, triggers an investigation in Defender for Cloud Apps, and sends an email notification, then associating it with an automation rule that runs automatically when the incident is created, meets all requirements with minimal manual effort. Option B is incorrect because it requires manual triggering. Option C is incorrect because Power Automate is not as tightly integrated as a Sentinel playbook. Option D is incorrect because it still requires manual investigation steps.

Answer

Use Microsoft Defender XDR's automated investigation and response (AIR) to automatically disable the user account.

Answer

Create an automation rule in Microsoft Sentinel that triggers a webhook to a third-party system, which then disables the user account.

Answer

Configure a Playbook in Power Automate that monitors Microsoft Sentinel incidents and automatically disables the user account.

Question 5

Your organization uses Microsoft 365 Defender. An incident is created for a user who received a phishing email that contained a link to a malicious website. The user clicked the link but did not enter any credentials. The incident includes the alert 'Phishing delivered' from Microsoft Defender for Office 365. You need to remediate the incident and prevent future occurrences. The user is in the Finance department and frequently receives emails from external vendors. What is the best course of action?

Accepted Answer

Use Threat Explorer to delete the email from the user's mailbox and create a Safe Links policy to block the malicious URL.. Option B is correct because using Threat Explorer to delete the email from the user's mailbox removes the threat, and creating a Safe Links policy blocks future similar links. Option A is wrong because reporting to Microsoft does not clean the mailbox. Option C is wrong because training alone does not remove the current email. Option D is wrong because allowing the domain would increase risk.

Answer

Report the email to Microsoft for analysis and block the sender domain.

Answer

Provide security awareness training to the user and mark the incident as resolved.

Answer

Add the sender's domain to the Tenant Allow/Block List as allowed to avoid future false positives.

Question 6

You are investigating a low-severity incident in Microsoft Sentinel where a user reported receiving a phishing email. The email was not blocked by the email security solution. The user did not click any links. What should you do first?

Accepted Answer

Report the email for analysis using the Microsoft 365 Defender portal. Option B is correct because reporting the email for analysis helps improve email security and determine if it was a false negative. Option A is wrong because deleting the email destroys evidence. Option C is wrong because resetting password is unnecessary as no credentials were compromised. Option D is wrong because no device isolation is needed.

Answer

Delete the phishing email from the user's inbox

Answer

Reset the user's password as a precaution

Answer

Isolate the user's device from the network

Question 7

You are a security analyst at Contoso. A user reports that they received a suspicious email with an attachment named "Invoice.pdf.exe". The user did not open the attachment. You need to investigate this potential threat using Microsoft Defender XDR. You want to determine if any other users received the same email, and whether the attachment was detonated in a sandbox. You also want to block the sender domain and the attachment hash across the organization if it is malicious. You have the email message ID from the user. You have appropriate permissions to use advanced hunting and take action. Which set of actions should you take in Microsoft 365 Defender?

Accepted Answer

Use Advanced hunting to query EmailEvents for the message ID to find other recipients, then query EmailAttachmentInfo to get the attachment hash. Use the sandbox data in EmailUrlInfo to check detonation. Then create an indicator block rule for the sender domain and file hash in the Settings > Indicators.. Option C is correct because advanced hunting can identify other recipients and sandbox detonation results, and indicators can block the sender domain and file hash. Option A is wrong because email trace is from Exchange admin center, not Defender XDR. Option B is wrong because quarantine finder doesn't show sandbox results. Option D is wrong because it does not use indicators for blocking.

Answer

Use the Exchange admin center to run a message trace for the email, then use the Malware section to block the attachment hash.

Answer

Use the Email & collaboration > Explorer to find the email, then use the Quarantine section to block the sender domain.

Answer

Use the Threat Explorer to find the email, then manually block the sender domain in the Exchange Online PowerShell.

Question 8

Your organization uses Microsoft Sentinel. You are responsible for responding to incidents. A new 'MFA Denied' incident is created from Microsoft Entra ID sign-in logs, indicating that a user in your organization had multiple MFA denials from a suspicious IP address (203.0.113.5). The user is a sales representative who frequently travels. The incident severity is Medium. The incident contains entities: user 'jsmith@contoso.com', IP address 203.0.113.5, and a device running Windows 11. You need to investigate and determine if this is a true positive. The user is currently on a business trip in Europe, but the sign-in attempts originated from an IP address in a different region. What should you do first?

Accepted Answer

Contact the user to confirm if they attempted to sign in at the time of the alerts.. Option B is correct because verifying with the user if they attempted to sign in is the fastest way to confirm if the MFA denials were legitimate. Option A is wrong because changing the password prematurely may lock out the user without confirmation. Option C is wrong because containing the device may disrupt the user's work. Option D is wrong because blocking the IP may be premature if the user's IP changes frequently.

Answer

Immediately reset the user's password and revoke sessions.

Answer

Block the suspicious IP address in the Conditional Access policy.

Answer

Isolate the user's device using Microsoft Defender for Endpoint.

Question 9

Your organization has deployed Microsoft Sentinel with the Microsoft Defender XDR connector. A high-severity incident is created for a user who received a phishing email that contained a malicious link. The user clicked the link, and the attacker gained access to the user's mailbox. The security team needs to remove the attacker's access and prevent future occurrences. What should you do first?

Accepted Answer

Remove any mailbox forwarding rules and delegated access. Option A is correct because the immediate priority is to revoke the attacker's access to the mailbox by removing the delegated access or forwarding rule. Option B is wrong while password reset is important, it may not remove the attacker's existing session. Option C is wrong because running antivirus is not applicable for mailbox compromise. Option D is wrong because reporting the incident is secondary.

Answer

Run a full antivirus scan on the user's device

Answer

Reset the user's password immediately

Answer

Report the incident to Microsoft for further investigation

Question 10

Your organization uses Microsoft Sentinel as its SIEM and Microsoft Defender XDR for endpoint protection. You have a custom analytics rule that triggers on suspicious PowerShell activity. The rule uses the following KQL query:

```kql
DeviceProcessEvents
| where Timestamp > ago(1h)
| where FileName == "powershell.exe"
| where ProcessCommandLine contains "-EncodedCommand"
| where InitiatingProcessFileName != "explorer.exe"
| project Timestamp, DeviceName, AccountName, ProcessCommandLine
```

The rule generates incidents that are assigned to the SOC team for investigation. However, analysts report that they are spending too much time manually collecting additional process details for each alert. You need to automate the enrichment of these incidents with additional context, such as parent process details, network connections, and file creation events from the same device within the last hour. The enrichment should be triggered automatically when an incident is created, and the results should be added as a comment to the incident. You have access to Azure Logic Apps and Azure Automation. Which approach should you use?

Accepted Answer

Create an automation rule in Microsoft Sentinel that triggers a Logic App playbook when an incident is created. The playbook uses the Microsoft 365 Defender connector to run advanced hunting queries for parent process, network connections, and file creation events from the same device in the last hour, then adds the results as a comment to the incident.. Option A is correct because an automation rule can trigger a playbook (Logic App) when an incident is created. The Logic App can use the advanced hunting connector to query Defender XDR for additional context and add a comment. Option B is wrong because watchlists are for static data, not dynamic queries. Option C is wrong because analytics rules do not trigger playbooks; automation rules do. Option D is wrong because power automate is not integrated in Sentinel.

Answer

Create a second analytics rule that triggers on the same events and sends the additional context to a watchlist, then use a playbook to read the watchlist and add comments.

Answer

Use Microsoft Power Automate to create a flow that is triggered when a new incident appears in Sentinel, then use the flow to query Defender XDR and update the incident.

Answer

Modify the analytics rule query to join with additional tables to include parent process details, network connections, and file creation events directly in the alert.

Question 11

Your organization uses Microsoft Defender for Cloud Apps and Microsoft Sentinel. You receive an alert indicating that a user from the finance department accessed a sensitive SharePoint file from an IP address associated with a known malicious Tor exit node. The file contains payment information. The user's account has not been disabled. What should you do first to contain the incident?

Accepted Answer

Suspend the user's account in Microsoft Entra ID. Option C is correct because the first step is to suspend the user's access to the compromised account to prevent further data exfiltration. Option A is wrong because blocking the IP is less effective as the attacker can change IPs. Option B is wrong because deleting the file may destroy evidence. Option D is wrong because notifying the user could alert the attacker.

Answer

Delete the SharePoint file from the site

Answer

Notify the user of the suspicious activity

Answer

Block the IP address in Microsoft Defender for Cloud Apps

Question 12

Your company uses Microsoft Sentinel with the Microsoft Defender XDR connector. You receive an incident: 'Suspicious mailbox forwarding rule created.' The incident indicates that a user's mailbox in Exchange Online has a forwarding rule to an external email address. The user's account shows no other suspicious activity. You need to respond to the incident. The company policy requires preserving evidence for 30 days. Which action should you take FIRST?

Accepted Answer

Remove the mailbox forwarding rule.. Option B is correct: removing the forwarding rule stops data exfiltration immediately. Option A is wrong because resetting password is not needed if account is not compromised. Option C is wrong because blocking the external domain may be too broad. Option D is wrong because running a playbook is investigative, not immediate.

Answer

Run an automated playbook to collect additional evidence.

Answer

Reset the user's password and require MFA.

Answer

Block the external email domain in Exchange Online.

Question 13

Your organization uses Microsoft Sentinel and Microsoft Defender for Cloud Apps. You receive a high-severity incident indicating that a user's credentials were used to access a sensitive SharePoint site from an unmanaged device. The user, 'jdoe@contoso.com', is a senior executive. The IP address is from a public Wi-Fi hotspot. The incident includes a recommendation to apply session policy to block download of sensitive files. You need to create a policy in Microsoft Defender for Cloud Apps that blocks downloads from unmanaged devices for this specific user when accessing the sensitive site. The policy should trigger only when the user accesses the specific SharePoint site named 'ExecConfidential'. What should you do?

Accepted Answer

Create an app connector for SharePoint and a session policy that targets the user, site, and device tag 'Unmanaged' with the action 'Block download'.. Option D is correct because creating an app connector for SharePoint, then a session policy that targets the specific site, user, and device tag 'Unmanaged' with the action 'Block download' meets all requirements. Option A is wrong because a device compliance policy is in Intune, not Defender for Cloud Apps. Option B is wrong because an access policy in Microsoft Entra ID does not have the granularity to block downloads. Option C is wrong because a file policy monitors file sharing, not session control.

Answer

Create a device compliance policy in Microsoft Intune to block unmanaged devices from accessing SharePoint.

Answer

Create a Conditional Access policy in Microsoft Entra ID to require compliant device for the SharePoint site.

Answer

Create a file policy in Defender for Cloud Apps to quarantine files downloaded from the site.

Question 14

You are investigating a security incident in Microsoft Sentinel involving a series of failed logon attempts followed by a successful logon from a different geographic location. The user's account is a privileged administrator. The incident is assigned a medium severity. What should you do first to contain the potential breach?

Accepted Answer

Disable the user's account immediately. Option B is correct because disabling the privileged account prevents any further malicious activity. Option A is wrong because resetting the password alone may not terminate existing sessions. Option C is wrong because reviewing logs is analysis, not containment. Option D is wrong because creating a rule is preventative, not immediate containment.

Answer

Reset the user's password

Answer

Review the audit logs for the user's activity

Answer

Create a new analytics rule to detect similar attempts

Question 15

Your organization uses Microsoft Sentinel and Microsoft Defender for Cloud. You receive an alert from Defender for Cloud that a virtual machine has a high severity vulnerability: 'CVE-2023-XXXX' with a CVSS score of 9.8. The virtual machine is running a critical application for the finance department. You need to remediate the vulnerability as quickly as possible while minimizing downtime. The application vendor has not yet released a patch but has provided a workaround. What should you do?

Accepted Answer

Implement the workaround provided by the vendor and create a custom remediation task in Defender for Cloud to track the issue.. Option C is correct because applying the vendor-provided workaround reduces the risk while waiting for a patch. Option A is wrong because shutting down the VM causes downtime. Option B is wrong because network isolation may not be sufficient. Option D is wrong because ignoring the alert is not acceptable.

Answer

Dismiss the alert as a false positive because no patch is available.

Answer

Shut down the virtual machine until a patch is available.

Answer

Apply a network security group to block all inbound traffic to the VM.

Question 16

Your organization uses Microsoft Sentinel as its SIEM and Microsoft Defender XDR for endpoint detection. A critical incident has been generated: 'Possible ransomware activity detected on multiple endpoints.' The incident includes alerts from Microsoft Defender for Endpoint (MDE) about file encryption behaviors and from Microsoft Defender for Identity (MDI) about anomalous service account logins. You have been assigned the incident and need to contain the threat effectively. You have Microsoft Sentinel automation rules that can trigger playbooks, and you have Microsoft Defender XDR actions available. The environment includes 500 Windows 10 devices managed by Microsoft Intune, and 50 servers on-premises. Some servers are domain controllers. Which of the following is the BEST first course of action?

Accepted Answer

Isolate the affected devices using Microsoft Defender for Endpoint device isolation.. Option C is correct: isolating the affected devices in MDE immediately stops the ransomware from spreading while preserving forensic data. Option A is wrong because disabling service accounts alone does not stop the encryption already in progress. Option B is wrong because running a playbook that collects data is investigative, not urgent containment. Option D is wrong because resetting passwords on domain controllers is time-consuming and does not halt active encryption.

Answer

Disable all compromised service accounts in Microsoft Entra ID and reset their passwords.

Answer

Reset passwords for all domain administrator accounts and enforce MFA.

Answer

Trigger a Microsoft Sentinel playbook to collect forensic evidence from affected endpoints before remediation.

Question 17

Your organization uses Microsoft Sentinel and Microsoft Defender XDR. An incident is generated for a user who received a phishing email that bypassed Exchange Online Protection. The user clicked the link and entered credentials on a fake login page. The incident includes alerts from Microsoft Defender for Office 365 and Microsoft Entra ID. You need to respond to the incident. The affected user has administrative privileges. Which of the following should you do FIRST?

Accepted Answer

Reset the user's password and revoke sessions in Microsoft Entra ID.. Option D is correct: resetting the user's password and revoking sessions immediately prevents attacker use of stolen credentials. Option A is wrong because reporting the email is not urgent. Option B is wrong because deleting the email is good but does not address compromised credentials. Option C is wrong because creating a rule is a longer-term action.

Answer

Report the phishing email to Microsoft for analysis.

Answer

Create a transport rule to block similar phishing emails.

Answer

Delete the phishing email from the user's mailbox.

Question 18

You are a security analyst at Contoso. Microsoft Sentinel is deployed with the Microsoft Defender for Cloud Apps connector. An incident is generated for a high-risk sign-in from a user named JaneDoe@contoso.com. The incident severity is Medium. The incident details show that the sign-in originated from an IP address in a country where Contoso has no business presence, and the user recently changed their password. You suspect account compromise. You need to take immediate action to contain the threat and prevent further unauthorized access. The user is currently active in Microsoft Entra ID. You have the following options: A) Force the user to re-authenticate by revoking their sessions in Microsoft Entra ID. B) Disable the user account in Microsoft Entra ID. C) Block the IP address in Microsoft Defender for Cloud Apps. D) Create a Sentinel automation rule to automatically disable accounts on similar alerts. Which action should you take first to contain the current incident?

Accepted Answer

Disable the user account in Microsoft Entra ID.. Option B is correct because disabling the user account immediately stops any further access using that account, which is the most direct containment action. Option A (Revoke sessions) would end current sessions but the user could still authenticate again if credentials are compromised. Option C (Block IP) is less effective as the attacker may use other IPs. Option D (Create automation rule) is a long-term solution, not immediate containment.

Answer

Force the user to re-authenticate by revoking their sessions.

Answer

Block the IP address in Microsoft Defender for Cloud Apps.

Answer

Create a Sentinel automation rule to automatically disable accounts on similar alerts.

Question 19

Your organization uses Microsoft Sentinel and has several analytics rules that generate incidents from various data sources. The SOC team is overwhelmed by the number of incidents. You need to implement a triage system that automatically assigns incidents to different analysts based on the incident's tactics and severity. You also want to send a notification to the assigned analyst via Teams. What should you do?

Accepted Answer

Create multiple automation rules that trigger on incident creation, each with conditions for specific tactics and severity, and then run a playbook that assigns the incident to an analyst and sends a Teams notification.. Automation rules can be used to assign incidents and run playbooks. Option A is correct because multiple automation rules can handle different conditions. Option B is wrong because playbooks cannot assign incidents directly. Option C is wrong because analytics rules do not assign incidents. Option D is wrong because workbooks are for visualization, not automation.

Answer

Use a workbook to create a triage dashboard and instruct analysts to manually claim incidents from the dashboard.

Answer

Modify each analytics rule to include a custom details field that specifies the analyst, and use a playbook to send Teams notification based on that field.

Answer

Create a single playbook that checks the incident's tactics and severity, assigns it to the appropriate analyst, and sends a Teams notification, then configure that playbook to run automatically on all new incidents.

Question 20

Fabrikam uses Microsoft Sentinel, Microsoft Defender XDR, and Microsoft Purview Compliance Manager. An incident is generated: 'Insider risk - user deleting large volumes of files from SharePoint Online.' The incident is from Microsoft Purview Insider Risk Management. The user is a senior executive, and disabling the account is not an option without board approval. You need to contain the data deletion. Which of the following is the BEST immediate action?

Accepted Answer

Apply a retention hold to the user's OneDrive and SharePoint sites.. Option D is correct: applying a retention hold to the user's OneDrive and SharePoint sites preserves the data without affecting the user's access. Option A is wrong: blocking the user disrupts work. Option B is wrong: deleting permissions may not stop the deletion if the user is the owner. Option C is wrong: creating a DLP policy does not stop current deletion.

Answer

Remove the user's permissions to the SharePoint sites.

Answer

Block the user's access in Microsoft Entra ID temporarily.

Answer

Create a DLP policy to block deletion of files.