SC-200 Mitigate threats using Microsoft Defender XDR Practice Test 7 — 15 Questions

Question 1

An analyst is investigating an incident where a user's mailbox was compromised. The analyst wants to find all mailbox access events (e.g., logins, message access) performed from a specific IP address. Which Advanced Hunting table in Microsoft 365 Defender should be queried?

Accepted Answer

CloudAppEvents. The CloudAppEvents table in Microsoft 365 Defender captures audit logs for cloud applications, including Exchange Online mailbox operations such as logins, message access, and folder bindings. This table contains the 'IPAddress' field, allowing the analyst to filter events from a specific IP address. Other tables lack the necessary scope of mailbox access events or the IP address field for this query.

Answer

EmailEvents

Answer

EmailAttachmentInfo

Answer

AADSignInEventsBeta

Question 2

An analyst is investigating a data exfiltration incident. They suspect that a user downloaded sensitive files from a SharePoint site and then uploaded them to a non-corporate cloud storage service (e.g., Dropbox) using the same device. Which combination of Advanced Hunting tables should the analyst query to correlate the SharePoint download activity with network connections to external IPs?

Accepted Answer

CloudAppEvents and DeviceNetworkEvents. CloudAppEvents logs user activities in cloud apps like SharePoint, including file downloads. DeviceNetworkEvents logs network connections from devices, including connections to external IPs. Combining these tables allows the analyst to correlate the SharePoint download event (from CloudAppEvents) with subsequent network connections to non-corporate cloud storage IPs (from DeviceNetworkEvents) on the same device, directly mapping the exfiltration path.

Answer

EmailEvents and DeviceNetworkEvents

Answer

DeviceFileEvents and DeviceNetworkEvents

Answer

CloudAppEvents and IdentityLogonEvents

Question 3

An analyst wants to find all devices that have run a specific process named 'malware.exe' in the last 24 hours using Microsoft 365 Defender Advanced Hunting. Which table should be the primary source for this query?

Accepted Answer

DeviceProcessEvents. The DeviceProcessEvents table in Microsoft 365 Defender Advanced Hunting is the primary source for querying process creation events, including the execution of a specific process name like 'malware.exe'. This table captures process creation and termination events, making it the correct choice for finding devices that have run a specific process within a given time frame.

Answer

DeviceEvents

Answer

DeviceFileEvents

Answer

DeviceNetworkEvents

Question 4

A security analyst wants to identify all devices in the organization that have a specific software vulnerability (CVE-2023-1234) installed using Microsoft 365 Defender Advanced Hunting. Which table should be queried?

Accepted Answer

DeviceTvmSoftwareVulnerabilities. The DeviceTvmSoftwareVulnerabilities table in Microsoft 365 Defender Advanced Hunting contains records of software vulnerabilities discovered on devices, including specific CVE identifiers like CVE-2023-1234. This table is designed to answer questions about which devices have a particular vulnerability installed, as it links device IDs to vulnerability details such as CVE ID, severity, and exploitability.

Answer

DeviceInfo

Answer

DeviceTvmSoftwareInventory

Answer

DeviceNetworkInfo

Question 5

A security analyst is investigating a malware outbreak and needs to find all devices where a specific malicious file with a known SHA1 hash has been observed in the last 24 hours. Which Advanced Hunting table in Microsoft 365 Defender should be the primary source for this query?

Accepted Answer

DeviceFileEvents. DeviceFileEvents is the correct table because it specifically records file creation, modification, and deletion events on endpoints, including the SHA1 hash of files. To find all devices where a specific malicious file with a known SHA1 hash has been observed, this table provides the direct file-level telemetry needed for the query.

Answer

EmailAttachmentInfo

Answer

DeviceProcessEvents

Answer

DeviceNetworkEvents

Question 6

An analyst is building a custom detection rule in Microsoft 365 Defender to identify potential data exfiltration. The rule should alert when a process (e.g., powershell.exe) initiates multiple outbound network connections to an external IP address that is not in the company's corporate IP range within a short time. Which two Advanced Hunting tables must be joined to correlate process execution with network connection details?

Accepted Answer

DeviceProcessEvents and DeviceNetworkEvents. The rule requires correlating process execution (e.g., powershell.exe) with outbound network connections to external IPs. DeviceProcessEvents logs process creation events, while DeviceNetworkEvents logs network connection details including destination IP and port. Joining these two tables on DeviceId and Timestamp (within a short time window) allows the analyst to identify which process initiated the suspicious outbound connections, making A correct.

Answer

DeviceProcessEvents and DeviceFileEvents

Answer

DeviceProcessEvents and EmailEvents

Question 7

An analyst writes an advanced hunting query to investigate a suspicious executable that initiated outbound connections. Which two Microsoft 365 Defender tables are most relevant? (Choose 2.)

Accepted Answer

DeviceProcessEvents.. DeviceProcessEvents is correct because it records process creation events, including the executable that initiated the outbound connection. By querying this table, you can identify the suspicious executable's name, command line, and parent process, which is essential for tracing the origin of the malicious activity.

Answer

EmailAttachmentInfo.

Answer

IdentityInfo.

Question 8

A phishing email was delivered to several users. The analyst wants to find all messages in the campaign, see delivery actions, and perform remediation from the Microsoft 365 Defender portal. Which tool should they use?

Accepted Answer

Threat Explorer.. Threat Explorer (also known as Explorer) in Microsoft 365 Defender is the correct tool because it provides a comprehensive view of email threats, including phishing campaigns. It allows analysts to search for all messages in a campaign, review delivery actions (e.g., blocked, delivered to junk, or delivered), and perform remediation actions such as soft delete, hard delete, or move to quarantine directly from the portal.

Answer

Microsoft Secure Score.

Answer

Azure Activity log.

Answer

Microsoft Defender Vulnerability Management software inventory.

Question 9

A security operations center (SOC) is configuring automated investigation and response (AIR) for Microsoft Defender for Office 365. Which of the following actions can be automatically taken when a malicious email is detected by AIR policies? (Choose all that apply.)

Accepted Answer

Soft delete the email from user mailbox. Option A is correct because AIR policies in Microsoft Defender for Office 365 can automatically soft-delete a malicious email from a user's mailbox. Soft deletion moves the email to the Recoverable Items folder, allowing administrators to restore it if needed, which is a standard remediation action for confirmed threats.

Answer

Add the sender to the user's blocked sender list

Answer

Permanently delete the email from all mailboxes

Question 10

An analyst is using advanced hunting in Microsoft 365 Defender. A device made outbound RDP connections shortly after a suspicious PowerShell process started. Which join is most useful to identify the initiating process for those network connections?

Accepted Answer

Join DeviceNetworkEvents with DeviceProcessEvents by device and process identifiers/time window. Option D is correct because it joins DeviceNetworkEvents (which contain outbound RDP connection details) with DeviceProcessEvents (which contain process creation data like the suspicious PowerShell process) using device ID, process ID, and a time window. This join allows the analyst to directly correlate the network connection to the initiating process, identifying whether the PowerShell process spawned the RDP connection.

Answer

Join EmailEvents with UrlClickEvents

Answer

Join IdentityInfo with SecureScoreControls

Answer

Join CloudAppEvents with AlertEvidence only

Question 11

Arrange the steps to configure an Azure Sentinel data connector for Windows Security Events via Azure Monitor Agent in the correct order.

Question 12

Order the steps to investigate a user account compromise using Microsoft Sentinel incidents.

Question 13

Arrange the steps to enable and configure Microsoft Defender for Identity (MDI) sensor on a domain controller.

Question 14

Order the steps to set up a Microsoft Sentinel workspace and connect Microsoft 365 Defender data.

Question 15

Match each Microsoft 365 Defender workload to its description.