SC-200 Mitigate threats using Microsoft Defender XDR Practice Test 4 — 15 Questions

Question 1

A security analyst is reviewing phishing emails in Microsoft 365 Defender and wants to identify all messages that were blocked by an anti-phish policy before delivery. The analyst plans to use advanced hunting. Which table column indicates whether an email was blocked as phishing?

Accepted Answer

EmailEvents table, the 'DeliveryAction' column. The EmailEvents table records actions taken on emails before delivery, including whether a message was blocked by anti-phish policies. The 'DeliveryAction' column specifically indicates the final disposition, such as 'Blocked' for phishing. This makes it the correct source for identifying pre-delivery phishing blocks in advanced hunting.

Answer

EmailPostDeliveryEvents table, the 'Action' column

Answer

EmailAttachmentInfo table, the 'FileType' column

Answer

EmailUrlInfo table, the 'Url' column

Question 2

A security analyst is investigating a suspicious process on an endpoint and needs to see all network connections initiated by that process. The analyst knows the ProcessId and DeviceName. Which advanced hunting table in Microsoft 365 Defender should the analyst query to retrieve network connection details associated with this process?

Accepted Answer

DeviceNetworkEvents. The DeviceNetworkEvents table in Microsoft 365 Defender is specifically designed to capture network connection events, including source and destination IP addresses, ports, protocols, and the initiating process ID (ProcessId). By querying this table with the known ProcessId and DeviceName, the analyst can retrieve all network connections initiated by that process, making it the correct choice for this investigation.

Answer

DeviceProcessEvents

Answer

DeviceEvents

Answer

IdentityLogonEvents

Question 3

A security analyst is investigating a malware incident and has identified a specific parent process ID (PID) on an endpoint. The analyst wants to retrieve all outbound network connections made by any child processes spawned by this parent process. Which advanced hunting table should the analyst query to get the network connection details, including the destination IP and the child process ID?

Accepted Answer

DeviceNetworkEvents. DeviceNetworkEvents is the correct table because it specifically captures outbound network connections, including destination IP addresses and process IDs (PID). By filtering on the parent process ID and then joining or filtering on child process IDs, the analyst can trace all network connections initiated by child processes spawned from the identified parent PID.

Answer

DeviceProcessEvents

Answer

DeviceEvents

Answer

IdentityNetworkEvents

Question 4

A security analyst is investigating a potential phishing campaign and has identified a malicious attachment with a known SHA256 hash. The analyst needs to find all email messages that were delivered to users and contained this exact attachment. Which advanced hunting table should the analyst query to obtain the network message IDs of the relevant emails?

Accepted Answer

EmailAttachmentInfo. The EmailAttachmentInfo table in Microsoft 365 Advanced Hunting contains records of every attachment in email messages, including the SHA256 hash. By querying this table with the known hash, the analyst can retrieve the NetworkMessageId values for all emails that contained that specific malicious attachment, enabling further investigation into delivery and impact.

Answer

EmailEvents

Answer

EmailUrlInfo

Answer

EmailPostDeliveryEvents

Question 5

A security analyst is investigating a suspicious process on an endpoint and wants to see all changes made to the Windows Registry by that process. Which advanced hunting table should the analyst query to find registry modification events associated with the process?

Accepted Answer

DeviceRegistryEvents. DeviceRegistryEvents is the correct table because it specifically captures Windows Registry modification events, including create, modify, and delete operations. For a process-based investigation, this table includes the InitiatingProcessId and InitiatingProcessFileName columns, allowing the analyst to filter by the suspicious process's PID or name to see all registry changes it made.

Answer

DeviceProcessEvents

Answer

DeviceEvents

Answer

DeviceFileEvents

Question 6

A security analyst in Microsoft 365 Defender needs to review all actions that were automatically taken by an investigation (e.g., isolating a device, deleting a file) that occurred during an incident. Where should the analyst find this list of executed actions?

Accepted Answer

Action center. The Action center in Microsoft 365 Defender is the centralized location that records all manual and automated response actions taken during investigations, such as device isolation, file deletion, or process termination. This includes actions automatically executed by automated investigation and response (AIR) playbooks during an incident. The analyst can filter the Action center by 'Automated' to see only those actions taken without manual intervention.

Answer

Hunting queries

Answer

Incidents page

Answer

Alerts page

Question 7

A security analyst is investigating a sophisticated attack where an attacker used a compromised account to send a phishing email. The analyst wants to correlate the email event with the subsequent sign-in activity from the same sender's mailbox using Advanced Hunting. Which two tables should the analyst join to link the email sender to the sign-in IP address?

Accepted Answer

EmailEvents and AADSignInEventsBeta. To correlate a phishing email event with the subsequent sign-in activity from the same sender's mailbox, the analyst needs to join the EmailEvents table (which contains email metadata like sender and recipient) with the AADSignInEventsBeta table (which captures Azure AD sign-in logs, including IP addresses). This join allows linking the sender's email address to the sign-in IP address used during the session that sent the email.

Answer

EmailEvents and CloudAppEvents

Answer

EmailAttachmentInfo and AADSignInEventsBeta

Question 8

A security analyst is investigating a ransomware incident and needs to find all files that were written to a specific device within a 5-minute window before the ransomware process started. The analyst knows the device name and the ransomware process start time. Which advanced hunting table and KQL operator combination would be most efficient to find the file creation events?

Accepted Answer

DeviceFileEvents with where. DeviceFileEvents is the correct table because it specifically captures file creation, modification, and deletion events on devices. Using the `where` operator to filter by device name and a timestamp range (5 minutes before the ransomware process start time) is the most efficient way to retrieve the exact file creation events needed for the investigation.

Answer

DeviceProcessEvents with join

Answer

DeviceEvents with where

Answer

DeviceImageLoadEvents with where

Question 9

A security analyst wants to see the delivery status and phishing verdict of an email. Which advanced hunting table should the analyst query in Microsoft 365 Defender?

Accepted Answer

EmailEvents. The EmailEvents table in Microsoft 365 Defender's advanced hunting schema contains the delivery status (e.g., Delivered, Failed, Filtered as spam) and the phishing verdict (e.g., Phish, Normal) for each email. This table records the initial processing and classification of the email, making it the correct source for both pieces of information.

Answer

EmailPostDeliveryEvents

Answer

EmailAttachmentInfo

Answer

EmailUrlInfo

Question 10

In Microsoft 365 Defender, what is the primary function of the Action center?

Accepted Answer

View and manage pending and completed remediation actions from automated investigations.. The Action center in Microsoft 365 Defender is the centralized console for tracking and managing remediation actions generated by automated investigations. It consolidates both pending actions (requiring approval) and completed actions (e.g., quarantining a file, blocking an IP) across Defender for Endpoint, Office 365, Identity, and Cloud Apps, ensuring security teams can review and approve or reject responses without switching contexts.

Answer

Manage user roles and permissions for the security portal.

Answer

Create custom detection rules using advanced hunting queries.

Answer

Manage threat intelligence feeds and indicators.

Question 11

An analyst is investigating a file that was detected as malicious on several devices. In Microsoft 365 Defender, where can the analyst find information about the file's prevalence, global reputation, and related incidents?

Accepted Answer

File entity page. The File entity page in Microsoft 365 Defender aggregates file-level telemetry, including prevalence (number of devices/users), global reputation (Microsoft's cloud-based threat intelligence), and a timeline of related incidents. This page is the single pane of glass for file-centric investigations, pulling data from Microsoft Defender for Endpoint, Office 365, and other XDR sources.

Answer

Device entity page

Answer

User entity page

Answer

Email entity page

Question 12

In Microsoft 365 Defender, after an automated investigation completes, where can an analyst review the specific remediation actions that were taken (e.g., file quarantine, device isolation)?

Accepted Answer

Action center. The Action center in Microsoft 365 Defender is the centralized location where all manual and automated remediation actions (such as file quarantine, device isolation, and process termination) are tracked and can be reviewed or approved. After an automated investigation completes, the specific actions taken are recorded in the Action center's history tab, allowing analysts to see exactly what was executed and the outcome. This is distinct from the Incident timeline, which shows alerts and events but not the detailed remediation action records.

Answer

Incident timeline

Answer

Threat analytics

Answer

Device inventory

Question 13

In Microsoft 365 Defender, a security analyst wants to get a detailed report on a newly discovered malware campaign, including indicators of compromise, recommended actions, and impacted devices. Where should the analyst go to find this information?

Accepted Answer

Threat analytics. Threat analytics in Microsoft 365 Defender provides detailed reports on active malware campaigns, including indicators of compromise (IoCs), recommended actions, and impacted devices. This is the dedicated workspace for tracking and responding to emerging threats, offering curated intelligence from Microsoft security researchers.

Answer

Alerts queue

Answer

Incident page

Answer

Action center

Question 14

A security analyst is investigating a potential business email compromise (BEC) campaign. The analyst wants to find all emails that were sent to external recipients from an internal user's mailbox that also had a login from an unusual location shortly after the email was sent. Which advanced hunting tables should the analyst query to get the email metadata and the sign-in details?

Accepted Answer

EmailEvents and AADSignInEventsBeta. Option A is correct because EmailEvents stores email metadata (sender, recipient, subject, etc.) and AADSignInEventsBeta captures Azure AD sign-in logs, including location data. Joining these tables on the user's account object ID allows the analyst to correlate emails sent to external recipients with unusual sign-in locations shortly after the email was sent, directly addressing the BEC investigation scenario.

Answer

EmailPostDeliveryEvents and DeviceLogonEvents

Answer

EmailAttachmentInfo and IdentityLogonEvents

Answer

EmailUrlInfo and CloudAppEvents

Question 15

A security analyst in Microsoft 365 Defender is investigating an email-based threat. The analyst needs to find all emails that were initially delivered to user inboxes but were later remediated (e.g., moved to junk, deleted, or quarantined) by Zero-Hour Auto Purge (ZAP). Which advanced hunting tables should the analyst query to get both the original email metadata and the post-delivery remediation events?

Accepted Answer

EmailEvents and EmailPostDeliveryEvents. To investigate emails that were initially delivered but later remediated by Zero-Hour Auto Purge (ZAP), you need both the original email metadata (from EmailEvents) and the post-delivery remediation actions (from EmailPostDeliveryEvents). EmailEvents provides details like sender, recipient, subject, and delivery status, while EmailPostDeliveryEvents records ZAP actions such as moving to junk, deleting, or quarantining. Querying these two tables together allows you to correlate the initial delivery with the subsequent remediation event.

Answer

EmailEvents and EmailAttachmentInfo

Answer

EmailPostDeliveryEvents and EmailUrlInfo

Answer

EmailEvents and CloudAppEvents