SC-200 Timed Hard Questions — 25 Difficult Questions

Question 1

Your organization uses Microsoft 365 Defender. An incident is created for a user who received a phishing email that contained a link to a malicious website. The user clicked the link but did not enter any credentials. The incident includes the alert 'Phishing delivered' from Microsoft Defender for Office 365. You need to remediate the incident and prevent future occurrences. The user is in the Finance department and frequently receives emails from external vendors. What is the best course of action?

15 minute time limit — choose an answer to begin.

Accepted Answer

Use Threat Explorer to delete the email from the user's mailbox and create a Safe Links policy to block the malicious URL.. The best remediation combines immediate containment with prevention: Threat Explorer (or the unified action center) lets you soft-delete or hard-delete the phishing email from the user's mailbox, and a Safe Links policy blocks the malicious URL so future clicks are neutralized. This addresses both the current incident and the recurring risk from external vendors, which is the correct incident-response sequence of contain, eradicate, and prevent.

Answer

Report the email to Microsoft for analysis and block the sender domain.

Answer

Provide security awareness training to the user and mark the incident as resolved.

Answer

Add the sender's domain to the Tenant Allow/Block List as allowed to avoid future false positives.

Question 2

A SOC analyst in Microsoft Sentinel is creating a scheduled analytics rule to detect a possible password spray attack. The rule must trigger when a single source IP address has more than 10 failed logon attempts on different user accounts within a 30-minute window. The analyst writes a KQL query starting with 'SigninLogs | where ResultType == 50057' (failed logon). Which operator should the analyst use to group events by source IP and count distinct user accounts, then filter for counts above 10?

Accepted Answer

summarize. The `summarize` operator is required to group events by source IP address and count distinct user accounts using `dcount()` or `count()`. After summarizing, you apply a `where` clause to filter for counts above 10, which meets the rule's threshold. This is the standard pattern for aggregation in KQL.

Answer

where

Answer

extend

Answer

project

Question 3

A SOC team wants to use Microsoft Sentinel to detect when a user logs in from a new country not previously seen for that user. They have the SigninLogs table. Which KQL function is most appropriate to build this anomaly detection?

Accepted Answer

make_set() with lookup. The `make_set()` function creates a dynamic array of distinct values (e.g., countries) per user over a specified time window. By using `lookup` to compare the current sign-in's country against the historical set, you can flag logins from countries not previously seen. This directly implements the 'new country' anomaly detection pattern in KQL.

Answer

timechart()

Answer

dcount()

Answer

startofday()

Question 4

Wide World Importers uses Microsoft Sentinel, Microsoft Defender XDR, and Microsoft Purview for data loss prevention (DLP). An incident is generated: 'DLP policy violation - sensitive data shared externally.' The incident shows that a user shared a document containing credit card numbers via SharePoint Online with an external guest. The user is a finance department employee. You need to respond to the incident. The organization wants to minimize business disruption while protecting data. Which of the following is the BEST immediate action?

Accepted Answer

Remove the external guest's access to the document in SharePoint Online.. Removing the external guest's access to the document stops data exposure without affecting the user's work. Option A is wrong: disabling the user prevents all work and may be too drastic. Option B is wrong: deleting the document destroys evidence. Option D is wrong: DLP policy change takes time and does not stop current exposure.

Answer

Delete the document from SharePoint Online.

Answer

Modify the DLP policy to block sharing of credit card numbers.

Answer

Disable the user's account in Microsoft Entra ID and investigate.

Question 5

Your organization uses Microsoft Defender XDR for threat detection and response. The security team wants to automatically isolate a compromised device when a specific malware alert is triggered, but only if the device is not a critical server. What is the most efficient way to achieve this?

Accepted Answer

Configure an automation rule in Microsoft Defender XDR. Automation rules in Microsoft Defender XDR allow you to define conditions (e.g., malware alert triggered) and actions (e.g., isolate device) with scoping filters (e.g., exclude devices tagged as 'critical server'). This provides a no-code, built-in mechanism that runs automatically without manual intervention or external scripting, making it the most efficient approach for conditional automated response.

Answer

Use advanced hunting to find devices and then manually isolate

Answer

Use PowerShell scripts in a playbook

Answer

Create a custom detection rule

Question 6

A security analyst receives a high-severity incident in Microsoft Sentinel for a user who is suspected of lateral movement. The analyst wants to automatically run a playbook that isolates the user's machine and disables their account when such an incident is created. What is the most efficient way to achieve this?

Accepted Answer

Create an automation rule that triggers the playbook when the incident is created. Automation rules in Microsoft Sentinel are designed to trigger playbooks automatically when an incident is created, based on conditions like severity or rule name. This provides the most efficient, event-driven response without polling or manual intervention, directly addressing the requirement to isolate the machine and disable the account upon incident creation.

Answer

Configure a Logic Apps trigger to poll for new incidents every minute

Answer

Train analysts to manually run the playbook when they see the incident

Answer

Create an analytics rule that runs a playbook as part of its alert generation

Question 7

Your security team uses Microsoft Defender XDR (formerly Microsoft 365 Defender) to investigate incidents. You notice that some alerts from Microsoft Defender for Endpoint are not being automatically correlated into incidents as expected. You have confirmed that the relevant alert sources are enabled in the Microsoft Defender XDR portal. What is the most likely cause?

Accepted Answer

Incident correlation rules are not enabled for the relevant alert sources.. Microsoft Defender XDR uses built-in correlation logic to automatically group related alerts from different sources (e.g., Defender for Endpoint, Defender for Office 365) into incidents. If alerts from a specific source, such as Defender for Endpoint, are not being correlated, the most likely cause is that the incident correlation rules for that source are not enabled in the Microsoft Defender XDR portal. Enabling the alert source alone is insufficient; the correlation engine must be explicitly activated for each source to aggregate alerts into incidents.

Answer

Alert tuning rules are causing the alerts to be excluded.

Answer

Automation rules in Microsoft Sentinel are deleting the alerts.

Answer

Alert suppression rules are blocking the alerts.

Question 8

During a ransomware incident, Microsoft Defender for Cloud Apps alerts indicate that a user is uploading large volumes of data to an external cloud storage provider not approved by your organization. Which two actions should you take first? (Choose two.)

Accepted Answer

Block the unapproved cloud storage app. Blocking the unapproved cloud storage app in Microsoft Defender for Cloud Apps immediately stops the ongoing data exfiltration by preventing further uploads to that external provider. This is a direct, real-time containment action that leverages Defender for Cloud Apps's app governance and conditional access controls to enforce organizational policies without disrupting the user's access to other resources.

Answer

Notify the user about the policy violation

Answer

Initiate a legal hold on the user's data

Question 9

You are investigating an incident where a user reported receiving a suspicious email with a malicious attachment. Microsoft Defender for Office 365 did not block it. The email originated from a known malicious sender domain. What configuration should you check first?

Accepted Answer

Anti-phishing policy in Microsoft Defender for Office 365. The anti-phishing policy in Microsoft Defender for Office 365 is the primary configuration that evaluates sender reputation, impersonation attempts, and spoof intelligence. Since the email originated from a known malicious sender domain and was not blocked, the anti-phishing policy's spoof settings or impersonation protection may be misconfigured or not applied to the affected user. This policy directly controls how Defender handles emails from malicious domains, making it the first place to check.

Answer

User-reported message settings

Answer

SPF record for the sender domain

Answer

Safe Attachments policy

Question 10

Your organization has a hybrid identity environment with Microsoft Entra ID and on-premises Active Directory. You suspect a compromised on-premises admin account that has been used to modify security groups. You want to quickly contain the threat. What should you do first?

Accepted Answer

Revoke the user's sessions in Microsoft Entra ID and reset the password in both on-premises AD and Entra ID.. When a hybrid identity admin account is compromised and has modified security groups, the fastest containment is to revoke the user's sessions in Microsoft Entra ID and reset the password in both on-premises AD and Entra ID. Revoking sessions invalidates refresh tokens and active sessions, while resetting in both directories ensures the attacker cannot re-authenticate via either identity plane. This addresses both cloud and on-premises access paths.

Answer

Move the user account to an Organizational Unit (OU) with blocked logon hours.

Answer

Reset the user's password in on-premises Active Directory.

Answer

Disable the user account in Microsoft Entra ID.

Question 11

As a threat hunter at Contoso, you are investigating a potential advanced persistent threat (APT) that may have compromised multiple Azure subscriptions. You have Microsoft Defender for Cloud enabled and Microsoft Sentinel collecting data from all subscriptions. You suspect the attacker is using Azure Resource Manager operations to create malicious resources. You need to create a hunting query that identifies anomalous Azure management operations, specifically focusing on operations that create new resources (e.g., virtual machines, storage accounts) from unusual IP addresses or at unusual times. Which approach should you take?

Accepted Answer

Use the AzureActivity table to filter for operations where HttpMethod == 'PUT' (create/update), then summarize by CallerIpAddress and bin(TimeGenerated, 1h) to find spikes or unusual caller IPs.. Azure Resource Manager write operations are logged in the AzureActivity table, and create/update operations use HTTP PUT (or sometimes PATCH). Filtering for HttpMethod == 'PUT' isolates resource-creation activity, and summarizing by CallerIpAddress with a time bin (e.g., 1h) surfaces spikes or unusual source IPs that indicate anomalous management-plane activity. This directly targets the APT's resource-creation behavior from unusual IPs or times.

Answer

Use the CommonSecurityLog table to analyze network traffic from management tools.

Answer

Use the AzureActivity table in Microsoft Sentinel to query for any operation where the OperationNameValue contains 'write' and then manually review each result.

Answer

Query the SigninLogs table in Microsoft Sentinel for all interactive sign-ins to the Azure portal, then cross-reference with Azure Activity logs.

Question 12

A security analyst is investigating a sophisticated attack where an attacker used a compromised account to send a phishing email. The analyst wants to correlate the email event with the subsequent sign-in activity from the same sender's mailbox using Advanced Hunting. Which two tables should the analyst join to link the email sender to the sign-in IP address?

Accepted Answer

EmailEvents and AADSignInEventsBeta. To correlate the email sender with the sign-in IP address, the analyst needs a table that captures sender metadata from the initial email event. EmailEvents contains the sender address and is directly related to the email send activity. AADSignInEventsBeta provides sign-in logs with IP addresses. Joining these two tables on user principal name or other identifiers allows linking the sending mailbox to the sign-in IP. EmailPostDeliveryEvents records actions after delivery (like ZAP or manual remediation) and does not include the original sender metadata needed for this correlation, making option B incorrect. The correct join is only A.

Answer

EmailPostDeliveryEvents and AADSignInEventsBeta

Answer

EmailEvents and CloudAppEvents

Answer

EmailAttachmentInfo and AADSignInEventsBeta

Question 13

Which THREE of the following are recommended practices for creating effective threat hunting queries in Microsoft Sentinel? (Select three.)

Accepted Answer

Include known indicators of compromise from threat feeds. Option C is correct because incorporating known indicators of compromise (IOCs) such as malicious IP addresses, domains, file hashes, and URLs from threat intelligence feeds lets hunting queries directly surface activity tied to known adversaries, which is a core recommended practice in Microsoft Sentinel. Option D is correct because mapping queries to MITRE ATT&CK techniques aligns hunting with specific adversary tactics and techniques, enabling coverage tracking, prioritization of gaps, and consistent query design across the kill chain. Option E is correct because constraining a query to a specific, relevant time range improves performance and reduces noise, ensuring the hunt focuses on the window of interest rather than scanning the entire retention period. Option A is not recommended because overly broad patterns generate excessive false positives and dilute the signal, and Option B is not recommended because excessive wildcard use degrades KQL query performance and precision, making results harder to triage.

Answer

Use only broad patterns to avoid missing anything

Answer

Use wildcards extensively to capture variations

Question 14

You are reviewing a hunting query. What is the primary purpose of this query?

Accepted Answer

Find users with medium-risk sign-ins that share IP addresses with service principal sign-ins, indicating possible token theft or lateral movement. The query filters for users with medium risk sign-ins and joins with service principal sign-ins on IP address, then counts occurrences per user exceeding 5, indicating potential compromise involving both user and service principal activity from the same IP. Option A is wrong because it does not focus on service principal compromise alone. Option B is wrong because it does not look for admin consent grants. Option D is wrong because it uses only medium risk, not high.

Answer

List all users with any risk level during sign-in in the last 7 days

Answer

Detect users who have granted admin consent to malicious OAuth apps

Answer

Identify service principals that have been compromised and are performing high-risk sign-ins

Question 15

You are configuring Microsoft Sentinel to use automation rules for incident response. You need to ensure that when an incident is created with a severity of High, a playbook is triggered to isolate the affected device. However, the playbook should not run if the incident is created by a specific analytics rule (RuleID: '12345'). What is the best way to implement this?

Accepted Answer

Create two automation rules: one for High severity from rule '12345' with no action, and one for High severity with condition 'Analytics rule name not equals 12345' that triggers the playbook. This approach uses two automation rules with different conditions and order of evaluation. The first rule handles incidents from rule ID '12345' with High severity but takes no action, effectively excluding them from further processing. The second rule applies to all other High severity incidents (where analytics rule name is not '12345') and triggers the playbook to isolate the device. Automation rules are evaluated in order, and the first matching rule's actions are executed, so incidents from rule '12345' will be caught by the first rule and will not trigger the playbook. Option A is incorrect because although a playbook could check the rule ID, the requirement is to prevent the playbook from running at all for those incidents; using a playbook to filter after triggering adds unnecessary complexity and latency. Option C is incorrect because automation rules cannot directly filter on analytics rule ID; they can filter on analytics rule name, but even then, a single condition group cannot combine 'High severity' and 'rule name not equals 12345' effectively because the condition logic is AND within a group, but you would need to exclude a specific rule which is not straightforward. Option D is incorrect because using OR would trigger the playbook for all High severity incidents as well as all incidents not from rule '12345', which is not the desired outcome.

Answer

Create an automation rule for all High severity incidents, then use a playbook to check the rule ID and skip if needed

Answer

Create one automation rule with condition: Severity equals High and Analytics rule ID not equals '12345'

Answer

Create one automation rule with conditions: Severity equals High OR Analytics rule name not equals '12345'

Question 16

Which THREE data sources can be used in Microsoft Sentinel for threat hunting to detect unusual authentication patterns? (Choose three.)

Accepted Answer

SecurityEvent (Windows Event Logs). Option A, SecurityEvent (Windows Event Logs), is correct because it ingests Windows security events such as 4624, 4625, and 4648, which reveal logon successes, failures, and explicit credential use that are essential for spotting unusual authentication patterns on hosts. Option B, AADNonInteractiveUserSignInLogs, is correct because it captures non-interactive Microsoft Entra ID sign-ins (token, service principal, and client-credential flows) that often indicate anomalous or automated authentication activity missed by interactive-only logs. Option E, SigninLogs (Microsoft Entra ID), is correct because it records interactive Entra ID sign-in events with details like IP address, location, device, conditional access result, and risk level, directly supporting detection of unusual authentication behavior. Option C, CommonSecurityLog, is not among the marked answers because it primarily carries CEF-formatted data from third-party security appliances (firewalls, proxies, IDS/IPS) rather than identity authentication telemetry. Option D, OfficeActivity (Office 365), is not among the marked answers because it focuses on Office 365 workload operations such as file, mailbox, and admin activities, not core authentication sign-in patterns.

Answer

CommonSecurityLog

Answer

OfficeActivity (Office 365)

Question 17

A threat hunter is analyzing a potential advanced persistent threat (APT) that uses living-off-the-land binaries (LOLBins) like certutil.exe to download payloads. The hunter wants to find instances where certutil.exe was used to download files from the internet in the last week. Which KQL query in Microsoft Sentinel would be most effective?

Accepted Answer

DeviceProcessEvents
| where TimeGenerated > ago(7d)
| where FileName == "certutil.exe"
| where ProcessCommandLine contains "-urlcache" or ProcessCommandLine contains "-split"
| project Timestamp, DeviceName, ProcessCommandLine. The query in option C correctly targets certutil.exe and filters for the specific command-line arguments '-urlcache' and '-split', which are commonly used by attackers to download files from the internet. This directly addresses the threat hunter's goal of finding certutil.exe download activity. The other options focus on different LOLBins (powershell.exe, mshta.exe, wscript.exe) that are not mentioned in the scenario.

Answer

DeviceProcessEvents
| where TimeGenerated > ago(7d)
| where FileName == "powershell.exe"
| where ProcessCommandLine contains "-enc"
| project Timestamp, DeviceName, ProcessCommandLine

Answer

DeviceProcessEvents
| where TimeGenerated > ago(7d)
| where FileName == "mshta.exe"
| where ProcessCommandLine contains "http"
| project Timestamp, DeviceName, ProcessCommandLine

Answer

DeviceProcessEvents
| where TimeGenerated > ago(7d)
| where FileName == "wscript.exe"
| where ProcessCommandLine contains "http"
| project Timestamp, DeviceName, ProcessCommandLine

Question 18

A threat hunter is investigating a potential data exfiltration incident. The hunter suspects that a user is using an unauthorized cloud storage service. Which Microsoft Defender for Cloud Apps signal would be most useful to detect this activity?

Accepted Answer

Cloud Discovery. Defender for Cloud Apps can discover shadow IT cloud apps. Option B is wrong because it does not detect cloud app usage. Option C is wrong because it is for web filtering, not cloud apps. Option D is wrong because it is for email protection.

Answer

Microsoft Defender for Endpoint Web Protection

Answer

Microsoft Defender for Identity

Answer

Microsoft Defender for Office 365 Safe Links

Question 19

Refer to the exhibit. You are hunting for PowerShell used to launch cmd.exe. The query is intended to find cmd.exe processes that occurred after the first PowerShell execution on the same device. However, it returns no results. What is the most likely issue?

Accepted Answer

The FirstSeen variable is a table, not a scalar value; 'between' cannot be used with a table.. The subquery uses 'min(Timestamp)' which returns a scalar value, but the 'between' operator expects a scalar value on both sides. However, the main issue is that 'FirstSeen' in the 'where' clause is a tabular expression (result of the subquery), not a scalar. The 'between' operator cannot be used with a table; it requires scalar datetime values. Option A is wrong because filtering on a specific time range would not solve the fundamental issue of using a table in 'between'. Option B is wrong because the join key should be DeviceId, not DeviceName, as that is the common identifier. Option D is wrong because 'innerunique' would not change the fact that 'between' cannot accept a table.

Answer

The query should filter on a specific time range instead of using FirstSeen.

Answer

The join key should be DeviceName instead of DeviceId.

Answer

The join type should be innerunique, not leftsemi.

Question 20

Your organization uses Microsoft Sentinel and has several analytics rules that generate incidents from various data sources. The SOC team is overwhelmed by the number of incidents. You need to implement a triage system that automatically assigns incidents to different analysts based on the incident's tactics and severity. You also want to send a notification to the assigned analyst via Teams. What should you do?

Accepted Answer

Create multiple automation rules that trigger on incident creation, each with conditions for specific tactics and severity, and then run a playbook that assigns the incident to an analyst and sends a Teams notification.. Automation rules in Microsoft Sentinel trigger on incident creation and support conditions based on incident properties such as tactics and severity, and they can invoke a playbook. Creating multiple automation rules with tactic/severity conditions that each run an assignment-and-notification playbook delivers the required automatic triage and Teams alerting. This is the native, supported pattern for conditional incident routing.

Answer

Use a workbook to create a triage dashboard and instruct analysts to manually claim incidents from the dashboard.

Answer

Modify each analytics rule to include a custom details field that specifies the analyst, and use a playbook to send Teams notification based on that field.

Answer

Create a single playbook that checks the incident's tactics and severity, assigns it to the appropriate analyst, and sends a Teams notification, then configure that playbook to run automatically on all new incidents.