SC-200 Matching — 10 Questions

Question 1

Match each Microsoft 365 Defender workload to its description.

Accepted Answer

Microsoft Defender for Endpoint: Provides enterprise-grade endpoint security, including antivirus, anti-malware, and advanced threat protection for devices.. Microsoft 365 Defender includes four main workloads: Defender for Endpoint (endpoint security), Defender for Office 365 (email & collaboration), Defender for Identity (on-premises AD security), and Defender for Cloud Apps (cloud app security). Common confusions involve mixing up definitions between these workloads.

Answer

Microsoft Defender for Endpoint: Safeguards email and collaboration tools (Exchange, SharePoint, Teams) against phishing, spam, malware, and other threats.

Answer

Microsoft Defender for Office 365: Uses on-premises Active Directory signals to identify, detect, and investigate advanced threats and identity compromises.

Question 2

Match each threat intelligence indicator type to its description.

Accepted Answer

IP Address: A numerical label assigned to each device connected to a computer network.. These are common STIX indicator types used in threat intelligence. Correct matches: IP Address is a numerical label, Domain Name is an identification string, File Hash is a hash of file content. Common confusions involve swapping definitions between IP and Domain, or IP and File Hash.

Answer

IP Address: An identification string that defines a realm of administrative autonomy on the Internet.

Answer

File Hash: A numerical label assigned to each device connected to a computer network.

Question 3

Match each Microsoft Sentinel data connector to its data source.

Accepted Answer

Azure Activity connector: Azure subscription activity logs. Correct matches: Azure Activity → subscription logs, Office 365 → Exchange/SharePoint/Teams, Azure AD → sign-in/audit logs, AWS CloudTrail → API calls. Common confusions include swapping Azure Activity with Azure AD logs, and Office 365 with Azure subscription logs.

Answer

Azure Activity connector: Azure AD sign-in and audit logs

Answer

Office 365 connector: Azure subscription activity logs

Question 4

Match each Microsoft Sentinel feature to its purpose.

Accepted Answer

Analytics rules: Automatically create security incidents based on data queries and alerts.. Analytics rules generate incidents, Workbooks visualize data, Hunting queries search for threats, and Playbooks automate response. Common confusions include mixing visualization with rule generation and automation with proactive search.

Answer

Analytics rules: Visualize security data on custom dashboards.

Answer

Playbooks: Proactively search for unknown threats in logs.

Question 5

Match each incident severity level to its description in Microsoft 365 Defender.

Accepted Answer

Informational: Not considered malicious but may provide visibility into the environment.. Severity levels in Microsoft 365 Defender help prioritize incident response. Informational provides visibility, Low indicates minor issues, Medium requires investigation, High denotes significant threats, and Critical demands immediate action. The distractors swap or misrepresent these definitions.

Answer

High: Minimal impact; no investigation needed.

Answer

Critical: Significant threat that requires investigation; may cause damage.

Question 6

Match each Microsoft 365 Defender role to its permission level.

Accepted Answer

Global Administrator: Full administrative access to all Microsoft 365 services. The correct matches: Global Administrator has full access; Security Administrator manages security; Security Reader has read-only access; Compliance Administrator manages compliance. Common confusions include swapping full access with read-only or misattributing the Global Administrator's scope.

Answer

Global Administrator: Read-only access to security reports

Answer

Security Administrator: Full administrative access to all Microsoft 365 services

Question 7

Match each Microsoft Defender for Cloud security alert to its description.

Accepted Answer

SQL Injection: Detects attempts to inject malicious SQL code into application queries.. Correct matches: SQL Injection detects SQL code injection, Brute Force detects multiple failed logins, Malware Alert detects known malware. Common confusions include swapping definitions between these alerts.

Answer

SQL Injection: Detects multiple failed login attempts from a single source.

Answer

Malware Alert: Detects attempts to inject malicious SQL code.

Question 8

Match each Microsoft Sentinel incident management action to its purpose.

Accepted Answer

Change incident status: Updates the incident state to Active, New, or Closed.. The correct matches are: Change incident status updates the state, Assign incident assigns to an analyst, and Close incident resolves. Common confusions involve swapping Add comments (for notes) and Add tags (for custom labels).

Answer

Add comments: Adds custom classification labels.

Answer

Add tags: Adds notes for collaboration.

Question 9

Match each Microsoft Purview compliance feature to its description.

Accepted Answer

Data Lifecycle Management: Governs data retention and deletion to meet compliance and legal obligations.. The correct matches are: Data Lifecycle Management with retention/deletion, MIP with classification/protection, Insider Risk Management with internal risk detection, and Communication Compliance with monitoring communications. Common confusions arise from overlapping scopes, such as communication monitoring being mistaken for data lifecycle or classification being misattributed to insider risk.

Answer

Data Lifecycle Management: Monitors communications to detect policy violations and ensure regulatory compliance.

Answer

Insider Risk Management: Classifies sensitive data and applies protection policies.

Question 10

Match each Kusto Query Language (KQL) operator to its function.

Accepted Answer

where: Filters rows based on a condition. These are fundamental KQL operators used in Microsoft Sentinel and Defender queries.

Answer

where: Aggregates rows into groups

Answer

summarize: Filters rows based on a condition