SC-200 Timed Hard Questions — 25 Difficult Questions

Question 1

A security analyst is preparing to use a Jupyter notebook for threat hunting in Microsoft Sentinel. Which of the following sequences of actions is correct to start executing the notebook?

Accepted Answer

Provision compute → Clone Sentinel notebooks → Connect to workspace → Execute cells. Option A is correct because the correct sequence to start executing a Jupyter notebook for threat hunting in Microsoft Sentinel is to first provision compute (i.e., create a compute instance in Azure Machine Learning), then clone the Sentinel notebooks from the official GitHub repository, connect to the Sentinel workspace using the msticpy library, and finally execute the cells. This order ensures the compute environment is ready before loading the notebooks and establishing the workspace connection.

Answer

Clone Sentinel notebooks → Provision compute → Connect to workspace → Execute cells

Answer

Connect to workspace → Provision compute → Clone Sentinel notebooks → Execute cells

Answer

Provision compute → Connect to workspace → Clone Sentinel notebooks → Execute cells

Question 2

A security analyst is configuring Microsoft Sentinel scheduled analytics rules to detect brute-force attacks on Microsoft Entra ID. Arrange the steps in the correct order from first to last.

Accepted Answer

Create a query using KQL to count failed sign-ins. → Set the rule schedule (run every 5 minutes). → Set the alert threshold (e.g., >5 failed sign-ins from same IP in 5 minutes). → Define incident properties (title, severity, tactics). → Configure grouping settings to group alerts into incidents.. Option A is correct because the standard workflow for creating a scheduled analytics rule in Microsoft Sentinel begins with defining the detection logic via a KQL query, then configuring the schedule and threshold, followed by incident properties and grouping settings. This sequence ensures the rule has a valid query before setting operational parameters like run frequency and alert aggregation.

Answer

Verify results before configuring the source or rule settings.

Answer

Configure alert grouping before defining the detection query or source.

Answer

Skip validation and enable the rule or plan immediately.

Question 3

A Microsoft Sentinel scheduled analytics rule detects impossible travel but creates too many duplicate incidents for the same user within a short period. Which two rule settings should you tune? (Choose 2.)

Accepted Answer

Configure event grouping or incident grouping by user entity.. Option A is correct because configuring event grouping or incident grouping by user entity consolidates multiple alerts for the same user into a single incident, reducing duplicate incidents. In Microsoft Sentinel, this setting controls how alerts are aggregated into incidents based on entity fields like user account, ensuring that a burst of impossible travel alerts for the same user generates one incident instead of many.

Answer

Disable the data connector.

Answer

Delete the Log Analytics workspace.

Question 4

A SOC analyst is configuring a Microsoft Sentinel scheduled analytics rule to detect rare operations on Azure Key Vaults. The rule uses the AzureActivity table. The analyst wants to use a machine learning algorithm to identify anomalies based on historical activity patterns. Which analytics rule type should the analyst choose?

Accepted Answer

Anomaly detection. The Anomaly Detection rule type in Microsoft Sentinel is specifically designed to use machine learning algorithms to identify unusual patterns in historical data. For detecting rare operations on Azure Key Vaults based on historical activity patterns in the AzureActivity table, this rule type automatically applies time series analysis and ML models to baseline normal behavior and flag deviations, making it the correct choice.

Answer

Scheduled

Answer

Microsoft Security Incident (for using existing alert triggers)

Answer

NRT (Near-Real-Time)

Question 5

A large enterprise uses Microsoft Defender for Cloud with the integrated Microsoft Defender Vulnerability Management solution enabled for all servers. The security team wants to identify all virtual machines that have not been scanned for vulnerabilities in the last 7 days. They plan to use Azure Resource Graph (ARG) to generate a report. Which KQL query would correctly identify these machines?

Accepted Answer

securityresources | where type =~ 'microsoft.security/assessments' and name == '4da3e7e8-0e4b-4c5e-8e0a-7e8f4e8e4e8e' | where properties.status.code == 'Unhealthy' and properties.status.firstEvaluationDate < ago(7d). Option A is correct because it queries the `securityresources` table for the specific vulnerability assessment type (`microsoft.security/assessments`) and filters for the vulnerability assessment result named with the GUID `4da3e7e8-0e4b-4c5e-8e0a-7e8f4e8e4e8e`, which corresponds to the 'Vulnerabilities in your virtual machines should be remediated' assessment. It then checks that the status code is 'Unhealthy' (indicating vulnerabilities were found) and that the `firstEvaluationDate` is older than 7 days, which identifies machines that have not been scanned recently.

Answer

resources | where type =~ 'microsoft.compute/virtualmachines' | where properties.storageProfile.osDisk.managedDisk.id != ''

Answer

securityresources | where type =~ 'microsoft.security/regulatorycompliancestandards'

Answer

resources | where type =~ 'microsoft.security/securitystatuses'

Question 6

A security analyst in Microsoft Sentinel wants to correlate Microsoft Entra ID sign-in logs with IP addresses known to be associated with a threat actor. The threat actor's IPs are stored in a custom table named 'ThreatIntelligence_IP' that is ingested daily. The analyst needs to create an analytics rule that triggers only when a sign-in occurs from one of these IPs AND when the user is not in a list of approved users (stored in another custom table 'ApprovedUsers'). Which KQL query pattern should the analyst use to achieve this correlation and filtering?

Accepted Answer

SigninLogs | join kind=inner ThreatIntelligence_IP on IPAddress | join kind=leftanti (ApprovedUsers | project UserId) on $left.UserId == $right.UserId. Option C is correct because it uses a `join kind=inner` to match sign-in logs with threat IPs, ensuring only sign-ins from known malicious IPs are considered. It then applies a `join kind=leftanti` to exclude any user who appears in the ApprovedUsers table, effectively filtering out approved users. This pattern guarantees that the rule triggers only when both conditions are met: the IP is in the threat list and the user is not approved.

Answer

SigninLogs | join ThreatIntelligence_IP on IPAddress | where UserId notin (ApprovedUsers | project UserId)

Answer

SigninLogs | where IPAddress in (ThreatIntelligence_IP | project IPAddress) and UserId !in (ApprovedUsers | project UserId)

Answer

SigninLogs | join ThreatIntelligence_IP on IPAddress | where not(UserId in (ApprovedUsers | project UserId))

Question 7

A security analyst is writing a Kusto Query Language (KQL) advanced hunting query in Microsoft 365 Defender to detect lateral movement using Remote Desktop Protocol (RDP). Which table should the analyst join with the DeviceNetworkEvents table to identify processes initiating outgoing RDP connections?

Accepted Answer

DeviceProcessEvents. The DeviceNetworkEvents table logs network connections, including outgoing RDP traffic (port 3389). To identify which process initiated a specific outgoing RDP connection, you must join with the DeviceProcessEvents table on DeviceId and Timestamp (or ProcessId), because DeviceProcessEvents contains the process creation details (e.g., mstsc.exe) that launched the network connection. This join reveals the parent process responsible for the lateral movement attempt.

Answer

DeviceLogonEvents

Answer

DeviceFileEvents

Answer

DeviceRegistryEvents

Question 8

A security analyst is investigating a ransomware incident and needs to find all files that were written to a specific device within a 5-minute window before the ransomware process started. The analyst knows the device name and the ransomware process start time. Which advanced hunting table and KQL operator combination would be most efficient to find the file creation events?

Accepted Answer

DeviceFileEvents with where. DeviceFileEvents is the correct table because it specifically captures file creation, modification, and deletion events on devices. Using the `where` operator to filter by device name and a timestamp range (5 minutes before the ransomware process start time) is the most efficient way to retrieve the exact file creation events needed for the investigation.

Answer

DeviceProcessEvents with join

Answer

DeviceEvents with where

Answer

DeviceImageLoadEvents with where

Question 9

A SOC analyst is creating a scheduled analytics rule in Microsoft Sentinel to detect sign-ins from IP addresses that are not in the organization's known allow list. The allow list is maintained in a custom watchlist named 'AllowedIPs'. The analyst wants the KQL query to efficiently filter out allowed IPs. Which KQL approach should the analyst use?

Accepted Answer

Use the _GetWatchlist('AllowedIPs') function and filter with the '!in' operator.. Option C is correct because the _GetWatchlist('AllowedIPs') function retrieves the watchlist content at query runtime, and combining it with the '!in' operator efficiently filters out sign-ins from IPs present in the watchlist. This approach is dynamic, meaning updates to the watchlist are automatically reflected without modifying the query, and it avoids hardcoding IPs or using inefficient row-by-row lookups.

Answer

Use the 'lookup' operator to map IPs against the watchlist.

Answer

Use a 'let' statement to define a static list of allowed IPs.

Answer

Use the 'evaluate' operator with a python script.

Question 10

A security analyst is investigating a sophisticated attack that involved multiple devices. The analyst needs to create a custom detection rule in Microsoft 365 Defender that triggers when a process with a specific SHA256 hash is executed on any device AFTER an attacker-controlled file is created on another device. Which approach should the analyst use to build this detection?

Accepted Answer

Create a custom detection rule using an advanced hunting query that joins DeviceFileEvents and DeviceProcessEvents, and schedule it in Microsoft 365 Defender.. Option A is correct because the requirement is to correlate two distinct events (file creation on one device and process execution on another) across time and devices. An advanced hunting query in Microsoft 365 Defender can join DeviceFileEvents and DeviceProcessEvents tables using a common indicator (e.g., attacker-controlled file hash) and schedule the query as a custom detection rule. This is the only native Microsoft 365 Defender approach that supports multi-device, multi-event correlation with scheduled evaluation.

Answer

Use the Microsoft 365 Defender incident creation rule to generate an incident when the behavior is observed.

Answer

Use Microsoft Sentinel analytics rules with a data connector to Microsoft 365 Defender.

Answer

Use Microsoft Defender for Cloud's workload protection alerts.

Question 11

An analyst is investigating a data exfiltration incident. They suspect that a user downloaded sensitive files from a SharePoint site and then uploaded them to a non-corporate cloud storage service (e.g., Dropbox) using the same device. Which combination of Advanced Hunting tables should the analyst query to correlate the SharePoint download activity with network connections to external IPs?

Accepted Answer

CloudAppEvents and DeviceNetworkEvents. CloudAppEvents logs user activities in cloud apps like SharePoint, including file downloads. DeviceNetworkEvents logs network connections from devices, including connections to external IPs. Combining these tables allows the analyst to correlate the SharePoint download event (from CloudAppEvents) with subsequent network connections to non-corporate cloud storage IPs (from DeviceNetworkEvents) on the same device, directly mapping the exfiltration path.

Answer

EmailEvents and DeviceNetworkEvents

Answer

DeviceFileEvents and DeviceNetworkEvents

Answer

CloudAppEvents and IdentityLogonEvents

Question 12

A SOC analyst is creating an automation rule in Microsoft Sentinel to trigger a playbook when a new incident is created. The analyst wants the rule to apply only to incidents that have a severity of 'High' and where the 'User' entity is present. Which condition configuration should the analyst use?

Accepted Answer

Set 'Incident severity equals High' and 'Entity type contains User'. Option B is correct because Microsoft Sentinel automation rules evaluate conditions at the incident level, not the alert level. The 'Incident severity equals High' condition filters by incident severity, and 'Entity type contains User' checks that the incident's entities include a User entity, which is required for the playbook to receive entity context.

Answer

Set 'Incident severity equals High' and 'Incident tag contains User'

Answer

Set 'Alert severity equals High' and 'Alert entity type contains User'

Answer

Set 'Incident provider equals Microsoft Sentinel' and 'Entity type contains User'

Question 13

A security analyst is investigating an advanced persistent threat (APT) campaign that involves lateral movement using RDP. The analyst wants to create a custom detection rule in Microsoft 365 Defender that triggers when a device remotely connects to another device via RDP (process: mstsc.exe) and, within 10 minutes, the remote device executes a suspicious script (e.g., PowerShell.exe with encoded command). Which KQL query pattern in advanced hunting should be used to correlate these events across devices?

Accepted Answer

DeviceProcessEvents | where FileName == 'mstsc.exe' | project SourceDevice = DeviceName, TimeGenerated, RemoteDevice = extract(remote device from command line) | join kind=inner (DeviceProcessEvents | where FileName == 'powershell.exe') on $left.RemoteDevice == $right.DeviceName and $left.TimeGenerated between ($right.TimeGenerated-10m .. $right.TimeGenerated). Option B is correct because it uses the `extract()` function to parse the remote device name from the `mstsc.exe` command line (e.g., `mstsc.exe /v:REMOTE_PC`), then performs an inner join with `DeviceProcessEvents` for `powershell.exe` on the condition that the remote device name matches and the `mstsc.exe` timestamp falls within a 10-minute window before the PowerShell execution. This precisely correlates the lateral movement (RDP connection) with the subsequent suspicious script execution on the target device, which is the required detection pattern.

Answer

DeviceProcessEvents | where FileName == 'mstsc.exe' | join DeviceProcessEvents on DeviceName | where (Timestamp2 - Timestamp1) between (0m..10m) and FileName == 'powershell.exe'

Answer

DeviceProcessEvents | where FileName in~ ('mstsc.exe', 'powershell.exe') and TimeGenerated > ago(1h) | summarize makelist(DeviceName) by bin(TimeGenerated, 10m)

Answer

DeviceProcessEvents | where FileName == 'mstsc.exe' | extend RemoteDevice = extract(...,1, ProcessCommandLine) | join kind=inner (DeviceProcessEvents | where FileName == 'powershell.exe') on $left.RemoteDevice == $right.DeviceName and $left.TimeGenerated between ($right.TimeGenerated - 10m .. $right.TimeGenerated)

Question 14

A SOC analyst wants to detect when a user signs in from a device that has never been used by that user before. The analyst plans to use Microsoft Sentinel with the SigninLogs table. Which KQL approach correctly identifies sign-ins from devices not previously associated with the user within the last 30 days?

Accepted Answer

Join the SigninLogs table with itself to find the earliest sign-in per user and device, then filter for those that match the earliest timestamp. Option A is correct because it uses a self-join on the SigninLogs table to identify the earliest sign-in per user-device pair within the last 30 days. By filtering for rows where the sign-in timestamp matches the earliest timestamp, the query isolates sign-ins from devices that have never been used by that user before, effectively detecting first-time device usage.

Answer

Use the _GetWatchlist function with a custom watchlist of known user-device pairs

Answer

Use the BehaviorAnalytics table which already identifies new devices

Answer

Apply the 'where DeviceId != '' and DeviceId startswith "device-"' filter to ensure the device is new

Question 15

A threat hunter in Microsoft Sentinel writes a KQL query in the Logs blade to find possible data exfiltration. The query uses the CommonSecurityLog table to look for large outbound file transfers from a specific IP address. The analyst wants to include only events where the total bytes sent in a 5-minute window exceed 100 MB. Which KQL operator combination would best achieve this?

Accepted Answer

CommonSecurityLog | where SourceIp == '10.0.0.1' | summarize totalBytes = sum(BytesSent) by bin(TimeGenerated, 5m) | where totalBytes > 100000000. Option A is correct because it first filters the CommonSecurityLog table for the specific source IP, then uses `summarize` with `bin(TimeGenerated, 5m)` to aggregate total bytes sent in 5-minute windows, and finally filters for windows where the sum exceeds 100 MB (100,000,000 bytes). This correctly implements a time-windowed aggregation to detect large outbound transfers, which is the standard pattern for identifying data exfiltration over a period.

Answer

CommonSecurityLog | where SourceIp == '10.0.0.1' | extend bin = bin(TimeGenerated, 5m) | where BytesSent > 100000000

Answer

CommonSecurityLog | where SourceIp == '10.0.0.1' | summarize make_list(BytesSent) by TimeGenerated | where array_length(make_list) > 100000000

Answer

CommonSecurityLog | where SourceIp == '10.0.0.1' | project BytesSent, TimeGenerated | summarize sum(BytesSent) by bin(TimeGenerated, 5m) | where sum_BytesSent > 100000000

Question 16

A SOC analyst in Microsoft Sentinel is creating a scheduled analytics rule to detect a possible password spray attack. The rule must trigger when a single source IP address has more than 10 failed logon attempts on different user accounts within a 30-minute window. The analyst writes a KQL query starting with 'SigninLogs | where ResultType == 50057' (failed logon). Which operator should the analyst use to group events by source IP and count distinct user accounts, then filter for counts above 10?

Accepted Answer

summarize. The `summarize` operator is required to group events by source IP address and count distinct user accounts using `dcount()` or `count()`. After summarizing, you apply a `where` clause to filter for counts above 10, which meets the rule's threshold. This is the standard pattern for aggregation in KQL.

Answer

where

Answer

extend

Answer

project

Question 17

Match each Microsoft Sentinel data connector on the left with the table name it populates on the right.

Accepted Answer

Microsoft Entra ID → SigninLogs; Windows Security Events via AMA → SecurityEvent; Cisco ASA via Syslog → CommonSecurityLog; Azure Activity → AzureActivity. Option A is correct because it accurately maps each Microsoft Sentinel data connector to its corresponding log table. Microsoft Entra ID populates the SigninLogs table, Windows Security Events via AMA populates the SecurityEvent table, Cisco ASA via Syslog populates the CommonSecurityLog table (which is the standard schema for syslog-based security appliances), and Azure Activity populates the AzureActivity table. These mappings are defined by the data connectors themselves and are fundamental to querying the correct data in Sentinel.

Answer

The first and last mappings are swapped.

Answer

Every item maps to the same log table or feature category.

Answer

Only identity-related items are mapped; workload and network items are omitted.

Question 18

Arrange the steps in the correct order to create and save a custom hunting query in Microsoft Sentinel.

Accepted Answer

Open the Microsoft Sentinel workspace in the Azure portal → Navigate to the Hunting blade in the Sentinel menu → Click on the 'New Query' button → Write the KQL query in the query editor → Run the query to verify results → Save the query with a meaningful name and description. Option A is correct because creating a custom hunting query in Microsoft Sentinel requires first accessing the workspace, then navigating to the Hunting blade, clicking 'New Query', writing the KQL query, running it to validate results, and finally saving it with a meaningful name and description. This sequence ensures the query is tested before being stored, aligning with Sentinel's workflow for ad-hoc threat hunting.

Answer

Verify results before configuring the source or rule settings.

Answer

Configure alert grouping before defining the detection query or source.

Answer

Skip validation and enable the rule or plan immediately.

Question 19

In Microsoft 365 Defender advanced hunting, an analyst is investigating a case where a user's device was compromised via a malicious base64-encoded PowerShell script. The analyst wants to find all processes that were created by this script by decoding the command line. Which KQL function should be applied to the ProcessCommandLine column in the DeviceProcessEvents table?

Accepted Answer

base64_decode_tostring(ProcessCommandLine). The correct KQL function to decode a Base64-encoded string into a readable text format in Microsoft 365 Defender advanced hunting is `base64_decode_tostring()`. This function takes a string column (like ProcessCommandLine) and returns the decoded plaintext, allowing the analyst to see the actual PowerShell commands executed. The other options are either invalid KQL functions or do not exist in the Kusto Query Language used in advanced hunting.

Answer

parse_base64(ProcessCommandLine)

Answer

decode_base64(ProcessCommandLine)

Answer

convertstring(ProcessCommandLine, 'base64')

Question 20

Match each Microsoft Sentinel analytics rule type to its correct description.

Accepted Answer

Scheduled → Runs a KQL query on a schedule and generates alerts based on the query results.; Fusion → Correlates multiple high-fidelity alerts from various sources to create a single, comprehensive incident.; Anomaly → Uses machine learning to identify unusual patterns in activity by analyzing entity behavior over time.; Microsoft Security → Creates incidents from alerts generated by Microsoft security products such as Microsoft Defender for Endpoint.. Option A is correct because it accurately describes the four distinct Microsoft Sentinel analytics rule types. Scheduled rules execute KQL queries at defined intervals to generate alerts based on query results. Fusion rules use advanced machine learning to correlate multiple high-fidelity alerts from different sources into a single incident, reducing alert fatigue. Anomaly rules leverage machine learning to detect unusual patterns by analyzing entity behavior over time. Microsoft Security rules automatically create incidents from alerts generated by Microsoft security products like Microsoft Defender for Endpoint, integrating native security signals.

Answer

The first and last mappings are swapped.

Answer

Every item maps to the same log table or feature category.

Answer

Only identity-related items are mapped; workload and network items are omitted.