SC-200 Mitigate threats using Microsoft Defender XDR Practice Test 3 — 15 Questions

Question 1

A security analyst is reviewing a phishing incident in Microsoft 365 Defender. They need to find all users who received a specific email message by searching for the email's Internet Message ID. Which advanced hunting table should the analyst query?

Accepted Answer

EmailEvents. The EmailEvents table in Advanced Hunting stores metadata about email transactions, including the Internet Message ID (a unique identifier defined in RFC 5322). By querying this table with the specific Internet Message ID, the analyst can retrieve all recipients who received that exact email, making it the correct choice for this scenario.

Answer

EmailAttachmentInfo

Answer

EmailUrlInfo

Answer

AADSignInEventsBeta

Question 2

An organization uses Microsoft Defender for Office 365. A security analyst is investigating a phishing email that was delivered to a user. The user clicked the link, but it was blocked by Defender for Office 365 at the time of click. The analyst needs to view the full click verdict, including the specific block action (e.g., blocked by custom block list). Where can the analyst find this information?

Accepted Answer

The email entity page in Microsoft 365 Defender. The email entity page in Microsoft 365 Defender provides the full click verdict for a specific email, including the exact block action (e.g., blocked by custom block list, blocked by URL reputation). This page aggregates all detection and verdict details for a single email, making it the correct location for the analyst to view the specific block action at time of click.

Answer

Threat Explorer in Microsoft 365 Defender

Answer

The advanced hunting table EmailEvents

Answer

The Attack simulation training dashboard

Question 3

A security analyst uses Microsoft 365 Defender advanced hunting to investigate a phishing campaign. The analyst knows the Internet Message ID of a malicious email. Which table should the analyst query to find all users who received that specific email?

Accepted Answer

EmailEvents. The EmailEvents table in Microsoft 365 Defender advanced hunting stores records of email transactions, including the Internet Message ID and recipient information. By querying this table with the known Internet Message ID, the analyst can retrieve all users who received that specific email, as it contains the RecipientEmailAddress field for each delivery event.

Answer

EmailAttachmentInfo

Answer

EmailUrlInfo

Answer

EmailPostDeliveryEvents

Question 4

An organization uses Microsoft 365 Defender. An automated investigation on a device identifies a malicious file and blocks it. The analyst now wants to allow a specific trusted application that was incorrectly blocked, while keeping other malicious files blocked. Which action should the analyst take from the device's entity page?

Accepted Answer

Use the 'Add indicator' feature to create a custom IOC for the file hash with action 'Allow'.. The 'Add indicator' feature in Microsoft Defender XDR allows analysts to create custom indicators of compromise (IOCs) based on file hashes, IPs, or domains. By setting the action to 'Allow' for the specific file hash, the analyst can override the automated block for that trusted application while keeping other malicious files blocked. This is the correct approach because it provides granular control without affecting the overall automated investigation settings.

Answer

Initiate a live response session and delete the file manually.

Answer

Change the automated investigation settings to 'No action' and rerun investigation.

Answer

Collect the file for analysis; the allow decision must be made by Microsoft after analysis.

Question 5

A security analyst is using Microsoft 365 Defender advanced hunting to investigate potential lateral movement. The analyst has identified a compromised device (DeviceA) and wants to find all other devices that initiated a remote desktop connection from DeviceA to other devices in the last 24 hours. Which table and query approach should the analyst use?

Accepted Answer

Query DeviceNetworkEvents for events from DeviceA with RemotePort 3389, then join with DeviceInfo to get target device names.. Option A is correct because DeviceNetworkEvents logs network connections, including outbound RDP traffic (port 3389). By filtering for events from DeviceA with RemotePort 3389, the analyst captures all RDP connections initiated by DeviceA. Joining with DeviceInfo resolves the target IP addresses to device names, providing a complete list of devices that received an RDP connection from DeviceA in the last 24 hours.

Answer

Query DeviceLogonEvents for LogonType 10 (RemoteInteractive), filtering by initiating device.

Answer

Query IdentityLogonEvents to find logons associated with DeviceA.

Answer

Query EmailEvents to find emails sent from DeviceA that contain RDP configuration files.

Question 6

An analyst is investigating a malware incident in Microsoft 365 Defender and has isolated the compromised device using automated investigation and response. The analyst now needs to collect a copy of a suspicious file from that device for further analysis in a sandbox. Which action should the analyst take from the device's entity page?

Accepted Answer

Initiate 'Collect investigation package' action.. The 'Collect investigation package' action is the correct choice because it is specifically designed to gather a comprehensive set of forensic data from a device, including suspicious files, without requiring interactive access. This action automatically collects the file and other relevant artifacts, which can then be submitted to Microsoft 365 Defender's sandbox for analysis. It is a one-click, automated process that aligns with the analyst's need to obtain a copy of the file for further investigation.

Answer

Run a live response session and manually download the file.

Answer

Use the 'Add indicator' to allow the file and then collect.

Answer

Use the 'Device isolation' action to isolate again with different settings.

Question 7

A security analyst is investigating a potential data exfiltration incident in Microsoft 365 Defender. They have identified a suspicious email sent to an external recipient containing an attachment. They want to know if the attachment has been opened and if any sensitive data was accessed. Which advanced hunting table should the analyst query to find email attachment activities, such as file download or view?

Accepted Answer

EmailEvents. B is correct because EmailEvents is the advanced hunting table in Microsoft 365 Defender that captures email-level activities, including whether an attachment was opened or viewed by the recipient. This table contains actions such as 'Email open' and 'Attachment open', which directly answer the analyst's question about attachment access and potential data exfiltration.

Answer

DeviceFileEvents

Answer

EmailAttachmentInfo

Answer

UrlClickEvents

Question 8

A security analyst is investigating a compromised user account using Microsoft 365 Defender. The analyst wants to see all the sign-in attempts made by this user in the last 24 hours, including the IP addresses and locations. Which advanced hunting table should the analyst query?

Accepted Answer

IdentityLogonEvents. The IdentityLogonEvents table in Microsoft 365 Defender advanced hunting captures authentication events from Azure Active Directory, including sign-in attempts, IP addresses, and geographic locations. This makes it the correct table for an analyst investigating a compromised user account to review all sign-in activity over the last 24 hours.

Answer

AlertInfo

Answer

EmailAttachmentInfo

Answer

DeviceLogonEvents

Question 9

A security analyst is investigating a ransomware incident in Microsoft 365 Defender. The analyst wants to view all processes that initiated outbound network connections to known malicious IPs on a specific device. Which advanced hunting table should the analyst query?

Accepted Answer

DeviceNetworkEvents. The DeviceNetworkEvents table in Microsoft 365 Defender captures network connection events, including outbound connections to IP addresses, ports, and protocols. To investigate processes that initiated outbound connections to known malicious IPs on a specific device, this table provides the necessary data, such as the initiating process ID, remote IP, and port. The DeviceProcessEvents table only logs process creation events, not network activity, making it unsuitable for this query.

Answer

DeviceProcessEvents

Answer

DeviceFileEvents

Answer

DeviceRegistryEvents

Question 10

An analyst is investigating a sophisticated attack involving a compromised device. The analyst has identified a malicious process that spawned multiple child processes. The analyst wants to create a custom detection rule in Microsoft 365 Defender that alerts when a specific parent process creates a child process that makes an outbound network connection to any IP not in the organization's internal range. Which KQL query and rule type should the analyst use?

Accepted Answer

Create a custom detection rule (Advanced Hunting rule) with a query that joins DeviceProcessEvents and DeviceNetworkEvents, filtering for the parent process and external IP addresses. Option A is correct because the analyst needs to correlate process creation events with network connection events across two separate tables (DeviceProcessEvents and DeviceNetworkEvents) in Advanced Hunting. A custom detection rule (Advanced Hunting rule) in Microsoft 365 Defender allows joining these tables to identify when a specific parent process spawns a child that makes an outbound connection to an external IP address, which is exactly the required detection logic.

Answer

Create a scheduled rule in Sentinel and export the data from M365 Defender

Answer

Use a custom detection rule with DeviceEvents only

Answer

Use a Microsoft Defender for Endpoint custom detection rule (built-in) that already detects child process connections

Question 11

A security analyst is investigating a phishing incident and needs to find the specific email message that was delivered to a user. The analyst knows the subject line and the sender domain. Which advanced hunting table should the analyst query?

Accepted Answer

EmailEvents. The EmailEvents table in Microsoft Defender XDR's advanced hunting schema contains the core properties of email messages, including subject line, sender domain, recipient details, and delivery status. Since the analyst needs to find a specific email by subject and sender domain, this table is the correct starting point for querying delivered messages.

Answer

EmailAttachmentInfo

Answer

EmailUrlInfo

Answer

EmailPostDeliveryEvents

Question 12

A security analyst is investigating a malware incident on an endpoint using Microsoft 365 Defender. The analyst wants to see all processes that were created on the device in the last hour, including the command line arguments. Which advanced hunting table should they query?

Accepted Answer

DeviceProcessEvents. The DeviceProcessEvents table in Microsoft 365 Defender's advanced hunting schema captures process creation events, including the command line arguments used to start each process. This directly meets the analyst's need to see all processes created in the last hour with their command-line details, making it the correct table for investigating malware that spawns processes.

Answer

DeviceNetworkEvents

Answer

DeviceFileEvents

Answer

DeviceRegistryEvents

Question 13

An organization uses Microsoft 365 Defender and receives an alert for a suspicious email sent to multiple recipients. The analyst wants to view the email metadata, including the sender, subject, and any attachments. Which advanced hunting table should the analyst use?

Accepted Answer

EmailEvents. The EmailEvents table in Advanced Hunting stores the core metadata for every email processed by Microsoft Defender for Office 365, including sender, subject, recipient, and delivery status. Since the analyst needs to view the sender, subject, and attachments for a suspicious email sent to multiple recipients, EmailEvents is the correct starting point because it contains the primary email envelope information.

Answer

EmailAttachmentInfo

Answer

EmailUrlInfo

Answer

DeviceEmailEvents

Question 14

A security analyst is investigating a phishing campaign targeting multiple users. The analyst has identified a malicious attachment with a known SHA256 hash. The analyst needs to find all email messages that were delivered to any user and contained this specific attachment. Which advanced hunting table should the analyst query in Microsoft 365 Defender to obtain the message IDs of emails containing the attachment?

Accepted Answer

EmailAttachmentInfo. The EmailAttachmentInfo table in Microsoft 365 Defender advanced hunting contains metadata about attachments on email messages, including the SHA256 hash of each attachment. By querying this table with the known malicious SHA256 hash, the analyst can retrieve the NetworkMessageId values for all emails that contained that specific attachment, regardless of whether the email was delivered or blocked.

Answer

EmailEvents

Answer

EmailPostDeliveryEvents

Answer

DeviceFileEvents

Question 15

A security analyst is using Microsoft 365 Defender and discovers that a legitimate business application has been incorrectly blocked as malicious by an automated investigation. The analyst needs to unblock this application immediately so it can run on all endpoints in the organization. What action should the analyst take from the file's entity page in Microsoft 365 Defender?

Accepted Answer

Add an indicator to allow the file. Adding an indicator to allow the file creates a custom indicator of compromise (IoC) in Microsoft 365 Defender that explicitly overrides the automated investigation's verdict. This action immediately permits the file to run on all endpoints in the organization by adding an 'allow' entry to the threat intelligence feed, which takes precedence over the automated detection logic.

Answer

Submit the file to Microsoft for analysis

Answer

Remove the existing indicator for the file

Answer

Restore the file from quarantine