SC-200 Timed Hard Questions — 25 Difficult Questions

Question 1

Match each Microsoft Sentinel data connector on the left with the table name it populates on the right.

Accepted Answer

Microsoft Entra ID → SigninLogs; Windows Security Events via AMA → SecurityEvent; Cisco ASA via Syslog → CommonSecurityLog; Azure Activity → AzureActivity. It accurately maps each Microsoft Sentinel data connector to its corresponding log table. Microsoft Entra ID populates the SigninLogs table, Windows Security Events via AMA populates the SecurityEvent table, Cisco ASA via Syslog populates the CommonSecurityLog table (which is the standard schema for syslog-based security appliances), and Azure Activity populates the AzureActivity table. These mappings are defined by the data connectors themselves and are fundamental to querying the correct data in Sentinel.

Answer

The first and last mappings are swapped.

Answer

Every item maps to the same log table or feature category.

Answer

Only identity-related items are mapped; workload and network items are omitted.

Question 2

Which THREE components are required to automate incident response in Microsoft Sentinel using playbooks? (Choose three.)

Accepted Answer

An automation rule in Sentinel.. Playbooks in Microsoft Sentinel are automated workflows that can be triggered by automation rules. The required components are: an automation rule (A) to define the trigger condition and invoke the playbook, a Logic Apps workflow (B) which is the playbook itself, and a trigger (E) such as 'when an incident is created' that starts the Logic App. Option C (workbook) is incorrect because workbooks are for visualization, not automation. Option D (analytics rule) is incorrect because analytics rules generate incidents, not playbooks.

Answer

A workbook.

Answer

An analytics rule.

Question 3

A SOC analyst in Microsoft Sentinel is creating a scheduled analytics rule to detect a possible password spray attack. The rule must trigger when a single source IP address has more than 10 failed logon attempts on different user accounts within a 30-minute window. The analyst writes a KQL query starting with 'SigninLogs | where ResultType == 50057' (failed logon). Which operator should the analyst use to group events by source IP and count distinct user accounts, then filter for counts above 10?

Accepted Answer

summarize. The `summarize` operator is required to group events by source IP address and count distinct user accounts using `dcount()` or `count()`. After summarizing, you apply a `where` clause to filter for counts above 10, which meets the rule's threshold. This is the standard pattern for aggregation in KQL.

Answer

where

Answer

extend

Answer

project

Question 4

A SOC team wants to use Microsoft Sentinel to detect when a user logs in from a new country not previously seen for that user. They have the SigninLogs table. Which KQL function is most appropriate to build this anomaly detection?

Accepted Answer

make_set() with lookup. The `make_set()` function creates a dynamic array of distinct values (e.g., countries) per user over a specified time window. By using `lookup` to compare the current sign-in's country against the historical set, you can flag logins from countries not previously seen. This directly implements the 'new country' anomaly detection pattern in KQL.

Answer

timechart()

Answer

dcount()

Answer

startofday()

Question 5

Wide World Importers uses Microsoft Sentinel, Microsoft Defender XDR, and Microsoft Purview for data loss prevention (DLP). An incident is generated: 'DLP policy violation - sensitive data shared externally.' The incident shows that a user shared a document containing credit card numbers via SharePoint Online with an external guest. The user is a finance department employee. You need to respond to the incident. The organization wants to minimize business disruption while protecting data. Which of the following is the BEST immediate action?

Accepted Answer

Remove the external guest's access to the document in SharePoint Online.. Removing the external guest's access to the document stops data exposure without affecting the user's work. Option A is wrong: disabling the user prevents all work and may be too drastic. Option B is wrong: deleting the document destroys evidence. Option D is wrong: DLP policy change takes time and does not stop current exposure.

Answer

Delete the document from SharePoint Online.

Answer

Modify the DLP policy to block sharing of credit card numbers.

Answer

Disable the user's account in Microsoft Entra ID and investigate.

Question 6

Your organization uses Microsoft Defender XDR and has a custom detection rule that queries DeviceProcessEvents for suspicious PowerShell commands. You notice that the rule is generating a high number of false positives. You need to reduce false positives while still detecting real threats. What should you do?

Accepted Answer

Add a condition to exclude processes signed by trusted certificates or from known IT admin accounts.. Adding a condition to exclude processes signed by trusted certificates or from known IT admin accounts directly reduces false positives by filtering out legitimate administrative activity. Custom detection rules in Microsoft Defender XDR allow you to refine queries with additional conditions, such as excluding specific signers or accounts, which preserves detection of malicious PowerShell commands while ignoring benign ones.

Answer

Disable the rule and create a new rule with a different MITRE technique.

Answer

Increase the lookback period from 7 to 30 days.

Answer

Modify the rule to set the severity to 'Informational'.

Question 7

Your security team uses Microsoft Defender XDR (formerly Microsoft 365 Defender) to investigate incidents. You notice that some alerts from Microsoft Defender for Endpoint are not being automatically correlated into incidents as expected. You have confirmed that the relevant alert sources are enabled in the Microsoft Defender XDR portal. What is the most likely cause?

Accepted Answer

Incident correlation rules are not enabled for the relevant alert sources.. Microsoft Defender XDR uses built-in correlation logic to automatically group related alerts from different sources (e.g., Defender for Endpoint, Defender for Office 365) into incidents. If alerts from a specific source, such as Defender for Endpoint, are not being correlated, the most likely cause is that the incident correlation rules for that source are not enabled in the Microsoft Defender XDR portal. Enabling the alert source alone is insufficient; the correlation engine must be explicitly activated for each source to aggregate alerts into incidents.

Answer

Alert tuning rules are causing the alerts to be excluded.

Answer

Automation rules in Microsoft Sentinel are deleting the alerts.

Answer

Alert suppression rules are blocking the alerts.

Question 8

During a ransomware incident, Microsoft Defender for Cloud Apps alerts indicate that a user is uploading large volumes of data to an external cloud storage provider not approved by your organization. Which two actions should you take first? (Choose two.)

Accepted Answer

Block the unapproved cloud storage app. Blocking the unapproved cloud storage app in Microsoft Defender for Cloud Apps immediately stops the ongoing data exfiltration by preventing further uploads to that external provider. This is a direct, real-time containment action that leverages Defender for Cloud Apps's app governance and conditional access controls to enforce organizational policies without disrupting the user's access to other resources.

Answer

Notify the user about the policy violation

Answer

Initiate a legal hold on the user's data

Question 9

You are investigating an incident where a user reported receiving a suspicious email with a malicious attachment. Microsoft Defender for Office 365 did not block it. The email originated from a known malicious sender domain. What configuration should you check first?

Accepted Answer

Anti-phishing policy in Microsoft Defender for Office 365. The anti-phishing policy in Microsoft Defender for Office 365 is the primary configuration that evaluates sender reputation, impersonation attempts, and spoof intelligence. Since the email originated from a known malicious sender domain and was not blocked, the anti-phishing policy's spoof settings or impersonation protection may be misconfigured or not applied to the affected user. This policy directly controls how Defender handles emails from malicious domains, making it the first place to check.

Answer

User-reported message settings

Answer

SPF record for the sender domain

Answer

Safe Attachments policy

Question 10

Your organization uses Microsoft Sentinel with UEBA (User and Entity Behavior Analytics) enabled. The SOC team notices that UEBA is not generating any anomalies for a specific user group. What is the most likely cause?

Accepted Answer

The data history for that user group is less than the required baseline period.. UEBA (User and Entity Behavior Analytics) requires a minimum baseline period of at least 14 days of data to learn normal behavior. Without sufficient historical data for the user group, anomalies cannot be generated. Option A is incorrect because excluding a user group from Identity Protection does not affect UEBA, which operates independently. Option C is incorrect because data connectors may be present, but the issue is the lack of historical data, not monitoring. Option D is incorrect because UEBA uses its own machine learning models and does not require analytics rules to be enabled.

Answer

The user group is excluded from Identity Protection.

Answer

The user group is not being monitored by any data connector.

Answer

The analytics rules for UEBA are not enabled.

Question 11

A user reports that they cannot access their Microsoft 365 apps after clicking a link in an email. You suspect token theft. In Microsoft Defender XDR, which incident investigation action should you take first to verify the scope?

Accepted Answer

Review the user's sign-in logs in Microsoft Entra ID for anomalous locations. The correct first action is to review the user's sign-in logs in Microsoft Entra ID for anomalous locations (Option A). This allows you to verify if the token is being used from unusual IP addresses or locations, which is a strong indicator of token theft. Isolating the device (B) is a containment step, not initial verification. Checking for malware (C) may be relevant later but does not directly confirm token theft. Investigating the email (D) is about the phishing vector, not the token usage.

Answer

Isolate the user's device from the network

Answer

Check the user's device for malware using Microsoft Defender for Endpoint

Answer

Investigate the email in Microsoft Defender for Office 365

Question 12

Your organization uses Microsoft Sentinel with UEBA (User and Entity Behavior Analytics). An alert indicates a user's sign-in from an unusual location, followed by a mass download of sensitive files from SharePoint. The user is a low-privilege employee. What is the most likely conclusion?

Accepted Answer

The user's account is compromised. The combination of unusual location and mass download of sensitive files by a low-privilege user suggests account compromise. It is not necessarily ransomware or a false positive, and insider threat is less likely without evidence of intent.

Answer

The alert is a false positive due to user travel

Answer

The user is an insider threat

Answer

The user is conducting a ransomware attack

Question 13

You are reviewing a hunting query. What is the primary purpose of this query?

Accepted Answer

Find users with medium-risk sign-ins that share IP addresses with service principal sign-ins, indicating possible token theft or lateral movement. The query filters for users with medium risk sign-ins and joins with service principal sign-ins on IP address, then counts occurrences per user exceeding 5, indicating potential compromise involving both user and service principal activity from the same IP. Option A is wrong because it does not focus on service principal compromise alone. Option B is wrong because it does not look for admin consent grants. Option D is wrong because it uses only medium risk, not high.

Answer

List all users with any risk level during sign-in in the last 7 days

Answer

Detect users who have granted admin consent to malicious OAuth apps

Answer

Identify service principals that have been compromised and are performing high-risk sign-ins

Question 14

You are configuring Microsoft Sentinel to use automation rules for incident response. You need to ensure that when an incident is created with a severity of High, a playbook is triggered to isolate the affected device. However, the playbook should not run if the incident is created by a specific analytics rule (RuleID: '12345'). What is the best way to implement this?

Accepted Answer

Create two automation rules: one for High severity from rule '12345' with no action, and one for High severity with condition 'Analytics rule name not equals 12345' that triggers the playbook. This approach uses two automation rules with different conditions and order of evaluation. The first rule handles incidents from rule ID '12345' with High severity but takes no action, effectively excluding them from further processing. The second rule applies to all other High severity incidents (where analytics rule name is not '12345') and triggers the playbook to isolate the device. Automation rules are evaluated in order, and the first matching rule's actions are executed, so incidents from rule '12345' will be caught by the first rule and will not trigger the playbook. Option A is incorrect because although a playbook could check the rule ID, the requirement is to prevent the playbook from running at all for those incidents; using a playbook to filter after triggering adds unnecessary complexity and latency. Option C is incorrect because automation rules cannot directly filter on analytics rule ID; they can filter on analytics rule name, but even then, a single condition group cannot combine 'High severity' and 'rule name not equals 12345' effectively because the condition logic is AND within a group, but you would need to exclude a specific rule which is not straightforward. Option D is incorrect because using OR would trigger the playbook for all High severity incidents as well as all incidents not from rule '12345', which is not the desired outcome.

Answer

Create an automation rule for all High severity incidents, then use a playbook to check the rule ID and skip if needed

Answer

Create one automation rule with condition: Severity equals High and Analytics rule ID not equals '12345'

Answer

Create one automation rule with conditions: Severity equals High OR Analytics rule name not equals '12345'

Question 15

Which THREE of the following are valid ways to ingest logs into Microsoft Sentinel?

Accepted Answer

Syslog. Syslog is a valid data connector in Microsoft Sentinel that ingests logs from Linux-based and network devices using the standard syslog protocol (RFC 5424 or RFC 3164). Sentinel collects these logs via the Log Analytics agent (or Azure Monitor Agent) listening on UDP port 514 or TCP port 6514, and parses them into the Syslog table for analysis. This makes option A correct because it is a native, supported ingestion method.

Answer

Windows Event Logs

Answer

Custom logs via direct API

Question 16

Which TWO actions are valid for automation rules in Microsoft Sentinel? (Choose two.)

Accepted Answer

Change the severity of an incident.. Automation rules in Microsoft Sentinel allow you to automate incident management tasks without requiring a playbook. Changing the severity of an incident is a supported action, enabling you to adjust the priority based on custom criteria such as incident properties or enrichment data.

Answer

Delete an incident.

Answer

Add tags to an incident.

Answer

Modify an existing analytics rule.

Question 17

Which THREE data sources should be included in a Microsoft Sentinel workspace to comprehensively monitor for lateral movement within an Azure environment?

Accepted Answer

Azure AD sign-in logs. Options A, C, and E are correct because they cover identity (Azure AD sign-in logs), network (Azure Network Security Group flow logs), and compute/control plane (Azure Activity logs) aspects of lateral movement. Option B (Power BI audit logs) is irrelevant for infrastructure lateral movement, as Power BI is a business analytics service. Option D (Azure DevOps audit logs) pertains to development pipeline activities, not runtime lateral movement within an Azure environment.

Answer

Power BI audit logs

Answer

Azure DevOps audit logs

Question 18

Your organization uses Microsoft Sentinel and Microsoft Defender for Cloud Apps. You receive a high-severity incident indicating that a user's credentials were used to access a sensitive SharePoint site from an unmanaged device. The user, 'jdoe@contoso.com', is a senior executive. The IP address is from a public Wi-Fi hotspot. The incident includes a recommendation to apply session policy to block download of sensitive files. You need to create a policy in Microsoft Defender for Cloud Apps that blocks downloads from unmanaged devices for this specific user when accessing the sensitive site. The policy should trigger only when the user accesses the specific SharePoint site named 'ExecConfidential'. What should you do?

Accepted Answer

Create an app connector for SharePoint and a session policy that targets the user, site, and device tag 'Unmanaged' with the action 'Block download'.. It involves creating an app connector for SharePoint to enable session control, followed by a session policy in Microsoft Defender for Cloud Apps that targets the specific user (jdoe@contoso.com), the specific site (ExecConfidential), and the device tag 'Unmanaged' with the action 'Block download'. This precisely meets the requirement to block downloads from unmanaged devices for that user on that site. Option B is incorrect because device compliance policies in Microsoft Intune are for device management, not session-level control within Defender for Cloud Apps. Option C is incorrect because Conditional Access policies in Microsoft Entra ID can require compliant devices but cannot granularly block downloads. Option D is incorrect because a file policy monitors and quarantines files, it does not provide session-level control to block downloads in real-time.

Answer

Create a device compliance policy in Microsoft Intune to block unmanaged devices from accessing SharePoint.

Answer

Create a Conditional Access policy in Microsoft Entra ID to require compliant device for the SharePoint site.

Answer

Create a file policy in Defender for Cloud Apps to quarantine files downloaded from the site.

Question 19

Your SOC is implementing a Microsoft Sentinel workspace with multiple content hub solutions. You need to ensure that only approved analytics rules are enabled and that any custom rules are reviewed before activation. Which THREE actions should you take?

Accepted Answer

Use Microsoft Sentinel Repositories (CI/CD) to manage analytics rules via Azure DevOps or GitHub.. Microsoft Sentinel Repositories (CI/CD) enables you to manage analytics rules as code via Azure DevOps or GitHub, allowing you to enforce a review and approval process before rules are deployed to production. This ensures that only approved custom rules are activated, aligning with the requirement to review custom rules before activation.

Answer

Configure Threat Intelligence - Taxii connector to import rules from an external feed.

Answer

Use the Hunting blade to create custom hunting queries instead of analytics rules.

Question 20

You are a security analyst at Contoso. You manage a Microsoft Sentinel workspace with Microsoft Defender for Cloud Apps, Microsoft Defender for Endpoint, and Microsoft Entra ID (formerly Azure AD) data connectors. You are performing a proactive threat hunt for potential data exfiltration via external file sharing services like Dropbox and Google Drive. Your organization blocks these services on managed devices but users can access them from personal devices. You want to detect when users log in to these services from a corporate network using Microsoft Entra ID credentials. You have access to CloudAppEvents, AADSignInEventsBeta, and DeviceNetworkEvents tables in Microsoft Defender XDR advanced hunting. You need to create a hunting query that identifies sign-ins to external file sharing apps from corporate IP ranges. The query should also exclude sign-ins from known good service accounts. Which approach should you take?

Accepted Answer

Join AADSignInEventsBeta with CloudAppEvents on AccountUpn, filter for app categories containing 'file sharing', and where IPAddress is in the corporate range.. This query joins AADSignInEventsBeta with CloudAppEvents on the AccountUpn field, then filters for app categories containing 'file sharing' and where the IPAddress is within the corporate IP range. This directly identifies sign-ins to external file sharing apps from corporate IPs using Microsoft Entra ID credentials, and can exclude known good service accounts by adding a filter on the user or account name. Option A only uses network events without sign-in context, so it cannot determine if the user actually signed in with Entra ID credentials. Option B uses CloudAppEvents and filters by IP, but then joins with DeviceInfo for device ownership; this does not include the sign-in events, and it may miss personal devices not managed. Option D relies on high-volume traffic analysis, which is less precise and lacks the app-level context.

Answer

Use DeviceNetworkEvents to find connections to file sharing service IPs, then correlate with AADSignInEventsBeta by user.

Answer

Filter CloudAppEvents for app categories 'file sharing' and where IP is in corporate range, then join with DeviceInfo for device ownership.

Answer

Use DeviceNetworkEvents to find high-volume outbound traffic to cloud storage provider IP ranges, then manually investigate users.