SC-200 Mitigate threats using Microsoft Defender XDR Practice Test 5 — 15 Questions

Question 1

A security analyst in Microsoft 365 Defender has just completed an automated investigation on a device. The analyst wants to review the specific remediation actions that were taken automatically, such as file quarantine or process termination, as well as any actions that are still pending approval. Where should the analyst look?

Accepted Answer

Action center. The Action center in Microsoft 365 Defender is the centralized location to review all automated remediation actions (e.g., file quarantine, process termination) and pending approval actions across devices, email, and identities. It provides a unified view of completed, in-progress, and awaiting-approval actions from automated investigations, ensuring the analyst can track and manage remediation status efficiently.

Answer

Incident details page -> Alerts tab

Answer

Device timeline in advanced hunting

Answer

Email & collaboration incidents tab

Question 2

A security analyst in Microsoft 365 Defender is investigating an incident that contains multiple alerts from different sources (e.g., Microsoft Defender for Endpoint, Microsoft 365 Defender for Office). The analyst wants to see a consolidated list of all alerts associated with the incident, including their severity, status, and detection source. Which tab within the incident details page should the analyst use?

Accepted Answer

Alerts tab. The Alerts tab on the incident details page in Microsoft 365 Defender provides a consolidated, filterable list of all alerts linked to the incident, regardless of their source (e.g., Microsoft Defender for Endpoint, Microsoft Defender for Office 365). This tab displays each alert's severity, status, and detection source, allowing the analyst to triage and correlate alerts from different workloads in a single view. The other tabs focus on specific entities (devices, users, mailboxes) rather than the unified alert list.

Answer

Devices tab

Answer

Users tab

Answer

Mailboxes tab

Question 3

A security analyst is investigating a ransomware incident in Microsoft 365 Defender. The analyst wants to see a timeline of all actions performed on a specific device, including file creation, registry modifications, and network connections, in chronological order. Which feature should the analyst use?

Accepted Answer

Device timeline. The Device timeline in Microsoft Defender for Endpoint provides a chronological view of all events and actions on a specific device, including file creation, registry modifications, and network connections. This feature is specifically designed for forensic investigation of incidents like ransomware, offering a time-ordered list of activities without requiring custom queries.

Answer

Advanced hunting

Answer

Incident graph

Answer

Action center

Question 4

A security analyst wants to identify all users who received a phishing email that contained a known malicious URL. The analyst has the URL. Which advanced hunting table should the analyst query first to find the emails that contained this URL?

Accepted Answer

EmailUrlInfo. The EmailUrlInfo table in Microsoft Defender XDR contains records of URLs extracted from email messages, including the specific URL and the email's unique identifier (NetworkMessageId). By querying this table for the known malicious URL, the analyst can retrieve the NetworkMessageIds of all emails containing that URL, which can then be joined with the EmailEvents table to identify the recipients. This is the most direct and efficient first step because EmailUrlInfo is purpose-built to map URLs to email messages.

Answer

EmailEvents

Answer

EmailAttachmentInfo

Answer

EmailPostDeliveryEvents

Question 5

In Microsoft 365 Defender, an analyst is investigating an incident involving a malicious script. The analyst wants to see the command-line arguments executed by the script on a specific device. Which Advanced Hunting table should the analyst query?

Accepted Answer

DeviceProcessEvents. The DeviceProcessEvents table in Advanced Hunting captures process creation events, including the command-line arguments used to execute a process. Since the analyst needs to see the command-line arguments executed by a malicious script on a specific device, querying DeviceProcessEvents is the correct approach because it records the ProcessCommandLine column for each process creation event.

Answer

DeviceNetworkEvents

Answer

DeviceFileEvents

Answer

DeviceEvents

Question 6

A security analyst suspects a user's device is exfiltrating data via DNS queries to a known malicious domain. Which Advanced Hunting table should the analyst query to find DNS requests made from the device?

Accepted Answer

DeviceNetworkEvents. DeviceNetworkEvents is the correct table because it contains network-level events, including DNS queries, from devices monitored by Microsoft Defender for Endpoint. The analyst needs to inspect DNS requests to identify exfiltration to a known malicious domain, and this table specifically logs the destination URL (including FQDNs) and the initiating process, making it the appropriate source for such queries.

Answer

DeviceProcessEvents

Answer

IdentityLogonEvents

Answer

EmailUrlInfo

Question 7

In Microsoft 365 Defender, a security analyst reviews an automated investigation that found a potentially unwanted application on multiple devices. The analyst wants to manually approve the suggested remediation action of uninstalling the application. Where should the analyst go?

Accepted Answer

The Action center. The Action center in Microsoft 365 Defender is the centralized location where security analysts can view and manually approve or reject remediation actions that were suggested by automated investigations, such as uninstalling a potentially unwanted application. This is the correct place because the Action center consolidates all pending and completed actions across devices, allowing the analyst to take direct manual intervention on the recommended remediation.

Answer

The Incidents page

Answer

The Alerts queue

Answer

The Device inventory

Question 8

A security analyst in Microsoft 365 Defender is using advanced hunting to investigate a suspected data exfiltration. The analyst wants to find all outbound network connections from a specific device that occurred in the last hour, ordered by timestamp. Which table and KQL query should the analyst use?

Accepted Answer

DeviceNetworkEvents | where DeviceName == "deviceA" and Timestamp > ago(1h) | project Timestamp, RemoteIP, RemotePort | order by Timestamp asc. Option A is correct because the DeviceNetworkEvents table in Microsoft 365 Defender captures outbound network connections, including remote IP addresses and ports. The query filters for a specific device (DeviceName == 'deviceA'), limits results to the last hour using Timestamp > ago(1h), projects the relevant columns, and orders by Timestamp ascending to show the earliest connections first.

Answer

DeviceProcessEvents | where DeviceName == "deviceA" and Timestamp > ago(1h) | project Timestamp, RemoteIP, RemotePort | order by Timestamp asc

Answer

DeviceFileEvents | where DeviceName == "deviceA" and Timestamp > ago(1h) | project Timestamp, RemoteIP, RemotePort | order by Timestamp asc

Answer

EmailEvents | where SenderUpn == "deviceA" and Timestamp > ago(1h) | project Timestamp, RemoteIP, RemotePort | order by Timestamp asc

Question 9

In Microsoft 365 Defender, an incident is created automatically. An analyst wants to see all related alerts for that incident. Which tab on the incident details page should the analyst select?

Accepted Answer

Alerts tab. The Alerts tab on the incident details page in Microsoft 365 Defender displays all alerts that have been automatically correlated into the incident. Since an incident is a collection of related alerts, selecting the Alerts tab is the correct way for an analyst to view every individual alert that contributed to the incident.

Answer

Devices tab

Answer

Users tab

Answer

Evidence tab

Question 10

A security analyst is investigating a complex incident in Microsoft 365 Defender that involves multiple stages: a phishing email, credential theft, and lateral movement. The analyst wants to view a visual representation of the attack chain, showing how alerts and entities are related. Which feature should the analyst use?

Accepted Answer

Incident graph. The incident graph in Microsoft 365 Defender provides a visual, interactive map of the entire attack chain, linking alerts, entities (such as users, devices, and IPs), and suspicious activities. This allows the analyst to see the progression from the phishing email to credential theft and lateral movement in a single view, making it the correct tool for understanding complex, multi-stage incidents.

Answer

Advanced hunting

Answer

Automated investigation

Answer

Alert timeline

Question 11

A security analyst in Microsoft 365 Defender is investigating an incident that involves a malicious email attachment. Which advanced hunting table should the analyst use to find information about the email including sender, recipient, and subject?

Accepted Answer

EmailEvents. The EmailEvents table in Microsoft 365 Defender advanced hunting contains the core email metadata, including sender (SenderFromAddress), recipient (RecipientEmailAddress), and subject (Subject). This table records events such as email delivery, blocking, and filtering actions, making it the primary source for investigating email-related incidents. The other tables focus on specific components like attachments or URLs, not the full email envelope details.

Answer

EmailAttachmentInfo

Answer

EmailUrlInfo

Answer

IdentityLogonEvents

Question 12

A security analyst is investigating a ransomware attack in Microsoft 365 Defender and needs to understand how the attacker moved laterally from an initial compromised workstation to a domain controller. Which feature should the analyst use to see a visual timeline of device-to-device connections and process executions?

Accepted Answer

Incident graph (attack story). The Incident graph (attack story) in Microsoft 365 Defender provides a visual, interactive timeline that correlates alerts, device-to-device connections, and process executions across the entire attack chain. This allows the analyst to trace lateral movement from the initial compromised workstation to the domain controller in a single, consolidated view, which is exactly what the question requires.

Answer

Device timeline view for each affected device

Answer

Advanced hunting with DeviceNetworkEvents and DeviceProcessEvents

Answer

Automated investigation report

Question 13

A security analyst wants to create a custom detection rule in Microsoft 365 Defender that alerts when a user receives more than 5 emails with the same attachment name within 1 hour, indicating a possible malware campaign. Which advanced hunting tables should be joined to achieve this detection?

Accepted Answer

Join EmailEvents and EmailAttachmentInfo on NetworkMessageId. To detect when a user receives more than 5 emails with the same attachment name within 1 hour, you need to correlate email metadata with attachment details. The EmailEvents table contains email-level information (e.g., recipient, timestamp), while the EmailAttachmentInfo table stores attachment-level data (e.g., file name). Joining these on NetworkMessageId allows you to count occurrences of the same attachment name per recipient within a time window, enabling the custom detection rule.

Answer

Join EmailEvents and EmailUrlInfo on NetworkMessageId

Answer

Use only EmailAttachmentInfo table with a filter on file name

Answer

Join EmailEvents and DeviceFileEvents on SHA1 hash

Question 14

A security analyst is investigating a user who may have been compromised. The analyst sees a sign-in from an unusual location and then a series of suspicious actions performed by that user, including deleting files and sending emails. The analyst wants to find all emails sent by the user after the anomalous sign-in. Which advanced hunting tables should be used?

Accepted Answer

EmailEvents and IdentityLogonEvents. Option A is correct because the investigation requires correlating a specific sign-in event (from IdentityLogonEvents) with subsequent email activity (from EmailEvents). IdentityLogonEvents captures authentication details including location, while EmailEvents records email send/receive metadata. Joining these tables on the user principal name (UPN) and timestamp allows the analyst to filter all emails sent after the anomalous sign-in.

Answer

EmailEvents and DeviceFileEvents

Answer

IdentityLogonEvents and DeviceEvents

Answer

EmailAttachmentInfo and EmailUrlInfo alone

Question 15

In Microsoft 365 Defender advanced hunting, an analyst is investigating a case where a user's device was compromised via a malicious base64-encoded PowerShell script. The analyst wants to find all processes that were created by this script by decoding the command line. Which KQL function should be applied to the ProcessCommandLine column in the DeviceProcessEvents table?

Accepted Answer

base64_decode_tostring(ProcessCommandLine). The correct KQL function to decode a Base64-encoded string into a readable text format in Microsoft 365 Defender advanced hunting is `base64_decode_tostring()`. This function takes a string column (like ProcessCommandLine) and returns the decoded plaintext, allowing the analyst to see the actual PowerShell commands executed. The other options are either invalid KQL functions or do not exist in the Kusto Query Language used in advanced hunting.

Answer

parse_base64(ProcessCommandLine)

Answer

decode_base64(ProcessCommandLine)

Answer

convertstring(ProcessCommandLine, 'base64')