SC-200 Mitigate threats using Microsoft Defender XDR — Timed 15 Questions

Question 1

A user reports receiving a suspicious email that bypassed the spam filter. An analyst opens the Microsoft 365 Defender portal to investigate. Which component provides a detailed entity view of the email including delivery actions, phish simulation details, and campaign information?

Accepted Answer

Microsoft Defender for Office 365 (Threat Explorer). Microsoft Defender for Office 365's Threat Explorer (now part of the unified investigation experience) provides a detailed entity view of an email, including delivery actions (e.g., delivered to Junk, blocked, or allowed), whether the email was part of a phishing simulation, and the associated campaign information. This tool is specifically designed for deep email threat investigation within the Defender for Office 365 portal, leveraging telemetry from Exchange Online Protection (EOP) and Defender for Office 365.

Answer

Microsoft Defender for Endpoint

Answer

Microsoft Defender for Identity

Answer

Microsoft Defender for Cloud Apps

Question 2

During an incident investigation, an analyst notices a compromised user account that was used to access sensitive data from SharePoint Online. Which Microsoft 365 Defender workload would provide the most relevant alerts for suspicious file access patterns?

Accepted Answer

Microsoft Defender for Cloud Apps. Microsoft Defender for Cloud Apps (Option C) is the correct workload because it provides visibility into cloud application usage, including SharePoint Online, and can generate alerts for suspicious file access patterns such as mass download, unusual file sharing, or access from anomalous locations. It uses behavioral analytics and anomaly detection to identify compromised accounts accessing sensitive data in SaaS applications like SharePoint.

Answer

Microsoft Defender for Endpoint

Answer

Microsoft Defender for Office 365

Answer

Microsoft Defender for Identity

Question 3

A security analyst is writing a Kusto Query Language (KQL) advanced hunting query in Microsoft 365 Defender to detect lateral movement using Remote Desktop Protocol (RDP). Which table should the analyst join with the DeviceNetworkEvents table to identify processes initiating outgoing RDP connections?

Accepted Answer

DeviceProcessEvents. The DeviceNetworkEvents table logs network connections, including outgoing RDP traffic (port 3389). To identify which process initiated a specific outgoing RDP connection, you must join with the DeviceProcessEvents table on DeviceId and Timestamp (or ProcessId), because DeviceProcessEvents contains the process creation details (e.g., mstsc.exe) that launched the network connection. This join reveals the parent process responsible for the lateral movement attempt.

Answer

DeviceLogonEvents

Answer

DeviceFileEvents

Answer

DeviceRegistryEvents

Question 4

During an incident investigation in Microsoft 365 Defender, an analyst examines an email that was reported as phishing. The analyst opens the email entity page and looks at the 'Detection details' section. Which piece of information would the analyst find there?

Accepted Answer

The detection technology (e.g., Advanced ML, Reputation) and if the email was part of a phish simulation or a campaign.. Option D is correct because the 'Detection details' section on the email entity page in Microsoft 365 Defender specifically shows the detection technology used (e.g., Advanced ML, Reputation, Bulk) and whether the email was part of a phishing simulation or a campaign. This information helps analysts understand how the email was identified as malicious and its context within broader threat activity.

Answer

The delivery location and whether the email was delivered to Inbox, Junk, or Quarantine.

Answer

The authentication statuses (SPF, DKIM, DMARC) for the sender domain.

Answer

The sender IP address and the recipient email address.

Question 5

An organization uses Microsoft Defender for Office 365. A security analyst wants to configure automated investigation and response (AIR) for email threats. When a user reports a phishing email using the Report Message add-in, which automated action can be triggered by an AIR playbook?

Accepted Answer

Soft-delete the email from the user's mailbox and other mailboxes that received the same message.. When a user reports a phishing email via the Report Message add-in, the automated investigation and response (AIR) playbook in Microsoft Defender for Office 365 can automatically soft-delete the email from the user's mailbox and from all other mailboxes that received the same message. This action is part of the built-in remediation steps that AIR can take after confirming the threat, leveraging the email entity's hash or message ID to perform tenant-wide removal via the threat protection pipeline.

Answer

Trigger a training campaign for the user who reported the email.

Answer

Move the email to the tenant's shared mailbox for review.

Answer

Remove the Report Message add-in from Outlook to prevent false reports.

Question 6

A security analyst uses advanced hunting in Microsoft 365 Defender to investigate a potential lateral movement attack. The analyst suspects that an attacker used stolen credentials to authenticate to multiple workstations via RDP. Which KQL query would return a list of devices where a single user account (user@contoso.com) had successful interactive logons on more than 5 distinct devices within a 10-minute window?

Accepted Answer

DeviceLogonEvents | where AccountUpn == 'user@contoso.com' and LogonType == 'Interactive' | summarize dcount(DeviceName) by bin(Timestamp, 10m) | where dcount_DeviceName > 5. Option C is correct because DeviceLogonEvents is the Microsoft 365 Defender table that captures logon events on devices, including RDP interactive logons. The query filters for the specific user account and interactive logon type, then uses summarize with dcount(DeviceName) by bin(Timestamp, 10m) to count distinct devices within each 10-minute window, and finally filters for windows where the distinct device count exceeds 5, which matches the lateral movement scenario.

Answer

DeviceNetworkEvents | where RemoteIP == 'user@contoso.com' | summarize dcount(DeviceName) by bin(Timestamp, 10m) | where dcount_DeviceName > 5

Answer

IdentityLogonEvents | where AccountUpn == 'user@contoso.com' and LogonType == 'Interactive' | summarize dcount(DeviceName) by bin(Timestamp, 10m) | where dcount_DeviceName > 5

Answer

DeviceLogonEvents | where AccountUpn == 'user@contoso.com' | summarize count() by DeviceName, bin(Timestamp, 10m) | where count_ > 5

Question 7

An organization uses Microsoft 365 Defender. A security analyst is investigating an incident where a user's device was compromised. The analyst wants to determine if the attacker attempted to access sensitive files stored in SharePoint Online from that device. Which advanced hunting table should the analyst query to find file access events from cloud apps?

Accepted Answer

CloudAppEvents. The CloudAppEvents table in Microsoft 365 Defender captures audit logs for cloud applications, including SharePoint Online. It records file access events such as viewing, downloading, or modifying files, making it the correct table to query when investigating attacker attempts to access sensitive files from a compromised device.

Answer

IdentityLogonEvents

Answer

DeviceFileEvents

Answer

EmailEvents

Question 8

A security analyst is reviewing an incident in Microsoft 365 Defender where malware was detected on multiple endpoints. The analyst wants to see a visual representation of the attack progression, including the initial entry point and all affected devices. Which feature in the Microsoft 365 Defender portal should the analyst use?

Accepted Answer

Incident graph. The incident graph in Microsoft 365 Defender provides a visual, interactive map of the entire attack progression, showing the initial entry point, lateral movement, and all affected devices and users. It correlates alerts and evidence into a single timeline, enabling the analyst to understand the full scope of the incident at a glance. This directly meets the requirement for a visual representation of the attack progression.

Answer

Advanced hunting

Answer

Threat analytics

Answer

Action center

Question 9

A global enterprise uses Microsoft 365 Defender across multiple tenants. During an incident, a security analyst needs to search for a specific file hash indicator of compromise (IOC) across all mailboxes and endpoints in all tenants from a single interface. Which feature allows the analyst to run a query across multiple tenants without switching contexts?

Accepted Answer

Cross-tenant advanced hunting. Cross-tenant advanced hunting in Microsoft 365 Defender allows a security analyst to run Kusto Query Language (KQL) queries across multiple tenants from a single interface. This feature is specifically designed for hunting for indicators of compromise (IOCs), such as file hashes, across all mailboxes and endpoints in a multi-tenant environment without requiring the analyst to switch between tenant portals.

Answer

Multi-tenant management

Answer

Unified audit log

Answer

Microsoft Graph Security API

Question 10

A security analyst is investigating an incident in Microsoft 365 Defender where a device is detected as infected with a trojan. The analyst wants to use automated investigation to contain the threat. Which action can be automatically taken on the affected device as part of a standard AIR playbook for endpoint detection and response?

Accepted Answer

Initiate a device isolation.. In Microsoft Defender for Endpoint, the Automated Investigation and Response (AIR) playbook for endpoint detection and response includes the ability to isolate a device from the network. This action stops the device from communicating with other devices or the internet, containing the threat while allowing the investigation to continue. Option D is correct because device isolation is a standard containment action in the AIR playbook for trojan infections.

Answer

Remove the user account from the device.

Answer

Execute a full antivirus scan on the device.

Answer

Disable the network adapter.

Question 11

An organization uses Microsoft 365 Defender. A security analyst is reviewing an incident that involves a user who clicked a phishing link in an email. The analyst wants to see the email's full timeline, including delivery, click, and any follow-up actions. Which section of the email entity page provides this information?

Accepted Answer

Email timeline. The Email timeline section on the email entity page in Microsoft 365 Defender provides a chronological view of the email's lifecycle, including delivery, user clicks on the phishing link, and subsequent remediation actions such as soft delete or quarantine. This directly meets the analyst's need to see the full sequence of events for the incident.

Answer

Detection details

Answer

Threat types

Answer

Investigation graph

Question 12

A security analyst in Microsoft 365 Defender uses advanced hunting to detect possible credential theft. They want to find instances where a user signed in from an IP address that is not in their organization's known IP range. Which table should they query to get sign-in location and IP address?

Accepted Answer

IdentityLogonEvents. IdentityLogonEvents is the correct table because it contains cloud identity logon data from Microsoft Entra ID (formerly Azure AD), including sign-in location, IP address, and user details. This table is specifically designed for hunting authentication-related events like credential theft, where you need to correlate user sign-ins with IP addresses to detect anomalies against known IP ranges.

Answer

DeviceLogonEvents

Answer

EmailEvents

Answer

AlertInfo

Question 13

A security analyst in Microsoft 365 Defender is investigating an incident that involves multiple devices. The analyst wants to see a visual representation of the attack, showing how the attacker moved from one device to another. Which feature provides this view?

Accepted Answer

Incident graph. The Incident graph in Microsoft 365 Defender provides a visual, interactive representation of an attack, showing how the attacker moved from one device to another, including lateral movement paths and related alerts. This feature is specifically designed to help analysts understand the full scope of an incident by mapping out the relationships between entities such as devices, users, and alerts.

Answer

Alert queue

Answer

Advanced hunting

Answer

Action center

Question 14

A security analyst is investigating a phishing incident in Microsoft 365 Defender. They need to view the original email's sender, delivery action, and any automated remediation steps taken. Which entity page should the analyst open?

Accepted Answer

Email entity page. The Email entity page in Microsoft 365 Defender (part of Microsoft Defender XDR) is specifically designed to provide a comprehensive view of an email message, including the original sender, delivery action (e.g., delivered, quarantined, blocked), and any automated remediation steps (e.g., zero-hour auto purge, soft delete). This page aggregates data from Exchange Online Protection (EOP) and Microsoft Defender for Office 365, making it the correct choice for investigating phishing incidents.

Answer

User entity page

Answer

Device entity page

Answer

IP entity page

Question 15

A security analyst is using advanced hunting in Microsoft 365 Defender to detect lateral movement. The analyst wants to find all devices where a specific user account had an interactive logon, and then identify which of those devices subsequently initiated outbound Remote Desktop Protocol (RDP) connections to other internal IP addresses. Which KQL approach is most efficient for this investigation?

Accepted Answer

Use DeviceLogonEvents and DeviceNetworkEvents with a join on DeviceId and a time range. Option A is correct because it uses DeviceLogonEvents to identify interactive logons for the specific user account on devices, then joins those results with DeviceNetworkEvents on DeviceId within a time range to find subsequent outbound RDP connections (destination port 3389) to internal IPs. This approach directly correlates the user's logon activity with network connections from the same device, which is the most efficient and precise method for detecting lateral movement via RDP.

Answer

Use IdentityLogonEvents and DeviceNetworkEvents with a join on IP address

Answer

Use DeviceProcessEvents and DeviceNetworkEvents with a join on DeviceId

Answer

Use EmailEvents and DeviceLogonEvents with a join on RecipientEmail