SC-200 Mitigate threats using Microsoft Sentinel Practice Test 5 — 15 Questions

Question 1

A SOC analyst needs to write a KQL query for a Microsoft Sentinel scheduled analytics rule that detects impossible travel activity. The rule should alert when a user signs in from two different countries within 60 minutes. The analyst has the SigninLogs table with columns: UserPrincipalName, IPAddress, Location (country), TimeGenerated. Which KQL query pattern correctly triggers an alert for each pair of sign-ins meeting the condition?

Accepted Answer

Self-join SigninLogs on UserPrincipalName, where TimeGenerated difference < 60m and Location != Location, then summarize by bin(TimeGenerated, 1h).. Option A is correct because it uses a self-join on the SigninLogs table to compare each sign-in event with every other sign-in event for the same user (UserPrincipalName). The join condition filters for pairs where the absolute time difference is less than 60 minutes (TimeGenerated difference < 60m) and the locations are different (Location != Location). This directly identifies any two sign-ins from different countries within the 60-minute window, which is the exact definition of impossible travel. The subsequent summarize by bin(TimeGenerated, 1h) groups the results into hourly buckets to trigger a single alert per detection window, as required by a scheduled analytics rule.

Answer

Use the `make_list()` function to aggregate all locations per user within a 60-minute window and check if the list has more than one distinct value.

Answer

Use the `series_decompose()` function to detect outliers in location sequences.

Answer

Use the `rolling_join()` function to compare each sign-in with the previous one per user.

Question 2

A SOC analyst needs to create a custom watchlist in Microsoft Sentinel to use in an analytics rule. Order the following steps from first to last to correctly create and use the watchlist (Choose 4.)

Accepted Answer

1. Create a new watchlist in Microsoft Sentinel (e.g., from Sentinel > Watchlists > Add new).. Option A is correct because creating a new watchlist in Microsoft Sentinel is the initial step to define a custom data source for threat intelligence or reference data. This is done via Sentinel > Watchlists > Add new, where you specify the alias, description, and other metadata before uploading data. Without this step, there is no container to import the CSV file into, making it the logical first action.

Question 3

A security analyst needs to identify incidents in Microsoft Sentinel that are related to IP addresses known to be associated with a specific threat actor. The analyst has a CSV file containing a list of these IP addresses. Which feature should the analyst use to make this list available for queries in Sentinel?

Accepted Answer

Watchlist. A Watchlist in Microsoft Sentinel allows you to import a CSV file containing IP addresses and use it directly in KQL queries via the _GetWatchlist() function. This is the correct feature because it is specifically designed for storing and querying static reference data, such as known threat actor IPs, without requiring custom ingestion or transformation.

Answer

Custom Log

Answer

Threat Intelligence indicator

Answer

Bookmark

Question 4

A SOC analyst needs to create a Microsoft Sentinel scheduled analytics rule that detects a potential brute-force attack. The rule should alert when a single IP address attempts to sign in to more than 10 different user accounts within 5 minutes. The data is in the 'SigninLogs' table. Which KQL operator should the analyst use to count distinct users per IP address per 5-minute time window?

Accepted Answer

summarize dcount(UserPrincipalName) by IPAddress, bin(TimeGenerated, 5m). Option A is correct because the requirement is to count distinct user accounts per IP address within a 5-minute window. The `dcount()` function estimates the number of distinct values of `UserPrincipalName`, `bin(TimeGenerated, 5m)` groups the logs into 5-minute buckets, and `summarize ... by IPAddress` ensures the count is per source IP. This directly matches the brute-force detection logic of more than 10 distinct users from a single IP in 5 minutes.

Answer

summarize count(UserPrincipalName) by IPAddress

Answer

summarize dcount(IPAddress) by UserPrincipalName, bin(TimeGenerated, 5m)

Answer

make-set(UserPrincipalName) by IPAddress

Question 5

An organization ingests its Palo Alto firewall logs into a custom table named 'PaloAlto_CL' in Microsoft Sentinel. A security analyst wants to create a scheduled analytics rule that triggers an incident when a single source IP is involved in more than 100 outbound connections to different destinations in 1 minute. Which KQL query and configuration would trigger the alert correctly?

Accepted Answer

summarize dcount(DestinationIP) by SourceIP, bin(TimeGenerated,1m) and set threshold >100. Option B is correct because the requirement is to count distinct destination IPs per source IP per minute, not total connections. Using `dcount(DestinationIP)` with `bin(TimeGenerated,1m)` ensures we count unique destinations, and setting the threshold to >100 triggers when a single source IP connects to more than 100 different destinations in one minute, exactly matching the alert condition.

Answer

summarize count() by SourceIP, bin(TimeGenerated,1m) and set threshold >100

Answer

summarize count() by DestinationIP and threshold >100

Answer

summarize dcount(SourceIP) by DestinationIP, bin(TimeGenerated,1m) and threshold >100

Question 6

A SOC analyst is creating an automation rule in Microsoft Sentinel to trigger a playbook when a new incident is created. The analyst wants the rule to apply only to incidents that have a severity of 'High' and where the 'User' entity is present. Which condition configuration should the analyst use?

Accepted Answer

Set 'Incident severity equals High' and 'Entity type contains User'. Option B is correct because Microsoft Sentinel automation rules evaluate conditions at the incident level, not the alert level. The 'Incident severity equals High' condition filters by incident severity, and 'Entity type contains User' checks that the incident's entities include a User entity, which is required for the playbook to receive entity context.

Answer

Set 'Incident severity equals High' and 'Incident tag contains User'

Answer

Set 'Alert severity equals High' and 'Alert entity type contains User'

Answer

Set 'Incident provider equals Microsoft Sentinel' and 'Entity type contains User'

Question 7

A SOC team ingests Microsoft 365 Defender advanced hunting data into Microsoft Sentinel. They want to create a scheduled analytics rule that detects when a user receives more than 5 emails from an external sender containing a specific attachment name within 1 hour. Which KQL tables and approach should the analyst use?

Accepted Answer

EmailEvents and EmailAttachmentInfo; summarize count() by AccountUpn, AttachmentFileName, bin(Timestamp,1h). Option A is correct because the detection requires joining EmailEvents (which contains sender/recipient metadata) with EmailAttachmentInfo (which contains attachment file names) to filter by external senders and a specific attachment name, then using summarize count() with bin(Timestamp,1h) to group events into 1-hour windows and identify users receiving more than 5 such emails. This approach directly maps to the requirement: external sender, attachment name, user identity (AccountUpn), and time-based aggregation.

Answer

EmailEvents and EmailUrlInfo; summarize count() by SenderObjectId

Answer

EmailEvents only; filter by AttachmentFileName

Answer

EmailPostDeliveryEvents; summarize count() by RecipientEmailAddress

Question 8

A SOC analyst is investigating a potential brute-force attack on an Azure VM. The analyst has ingested Windows Security Events into Microsoft Sentinel. Which KQL query would count the number of failed logon attempts (EventID 4625) per user account in the last hour?

Accepted Answer

SecurityEvent | where EventID == 4625 and TimeGenerated > ago(1h) | summarize Count = count() by Account. Option B is correct because it filters for EventID 4625 (failed logon) and restricts the time range to the last hour before summarizing the count per Account. This ensures only relevant events are counted, and the aggregation is performed on the correct field (Account) from the SecurityEvent table, which contains Windows Security Events ingested into Sentinel.

Answer

SecurityEvent | where EventID == 4625 | summarize Count = count() by Account | where TimeGenerated > ago(1h)

Answer

SigninLogs | where ResultType != 0 | summarize Count = count() by UserPrincipalName | where TimeGenerated > ago(1h)

Answer

SecurityEvent | where EventID == 4625 | make-series Count = count() default=0 on TimeGenerated from ago(1h) to now() step 1h by Account

Question 9

A security team wants to automatically block an IP address in Azure Firewall when Microsoft Sentinel detects a high number of failed logins from that IP. Which automation approach should they use?

Accepted Answer

Create an automation rule that triggers on incident creation and runs a playbook that uses the Azure Firewall connector to add a rule.. Option C is correct because it uses an automation rule triggered on incident creation to run a playbook, which can leverage the Azure Firewall connector to add a blocking rule. This approach directly integrates Sentinel's detection of a high number of failed logins with automated remediation in Azure Firewall, ensuring a real-time response without manual intervention.

Answer

Create an automation rule that triggers a playbook directly.

Answer

Create a scheduled analytics rule that runs a playbook.

Answer

Configure a Logic App to poll Sentinel alerts and block IPs.

Question 10

A SOC team wants to use Microsoft Sentinel to detect when a user logs in from a new country not previously seen for that user. They have the SigninLogs table. Which KQL function is most appropriate to build this anomaly detection?

Accepted Answer

make_set() with lookup. The `make_set()` function creates a dynamic array of distinct values (e.g., countries) per user over a specified time window. By using `lookup` to compare the current sign-in's country against the historical set, you can flag logins from countries not previously seen. This directly implements the 'new country' anomaly detection pattern in KQL.

Answer

timechart()

Answer

dcount()

Answer

startofday()

Question 11

A security analyst is configuring a Microsoft Sentinel workspace. The analyst needs to connect a third-party firewall that sends logs via Syslog and supports a common event format (CEF). Which data connector should the analyst use to ingest these logs?

Accepted Answer

Common Event Format (CEF) via AMA. The Common Event Format (CEF) via AMA data connector is specifically designed to ingest logs from security appliances that send Syslog messages in CEF format. CEF is an industry-standard format that allows firewalls and other devices to send structured event data, and the Azure Monitor Agent (AMA) replaces the older Log Analytics Agent for this purpose. This connector parses the CEF headers and maps the fields to the appropriate Microsoft Sentinel tables, enabling efficient threat detection and analysis.

Answer

Windows Security Events via AMA

Answer

Azure Activity Log

Answer

Office 365 connector

Question 12

A SOC analyst creates a scheduled analytics rule in Microsoft Sentinel that uses the following KQL query to detect impossible travel: SigninLogs | where TimeGenerated > ago(1d) | summarize Countries = make_set(Location) by UserPrincipalName | where array_length(Countries) > 1 However, the analyst notices that the rule generates too many false positives for users who travel legitimately. What is the best way to refine the rule to reduce false positives without missing actual impossible travel?

Accepted Answer

Modify the query to include a time difference condition using the partition operator or a join to find sign-ins from different countries within a short time window.. Option D is correct because impossible travel detection requires correlating sign-ins from different geographic locations within a time window that is too short for physical travel. By using the partition operator or a join to compare timestamps between sign-ins from different countries, the query can distinguish between legitimate sequential travel (e.g., a user flying from New York to London over 8 hours) and truly impossible simultaneous sign-ins (e.g., sign-ins from New York and London within 30 minutes). This reduces false positives while still catching actual impossible travel.

Answer

Add a condition to filter out VPN IP addresses from the Log Analytics workspace.

Answer

Instead of using make_set, use the dcount() function to estimate distinct countries.

Answer

Use the time series anomaly detection function series_decompose() on the signin data.

Question 13

A security analyst needs to create a custom watchlist in Microsoft Sentinel to correlate IP addresses known to be used by a threat actor. The watchlist will be uploaded from a CSV file. Which data type should the analyst specify for the watchlist alias?

Accepted Answer

String. The watchlist alias in Microsoft Sentinel is a string identifier used to reference the watchlist in KQL queries. Since IP addresses are stored as text values in CSV files and are not numeric integers, dates, or boolean flags, the correct data type for the alias is String. This ensures the alias can be used in join or lookup operations without type mismatch errors.

Answer

Integer

Answer

DateTime

Answer

Boolean

Question 14

A SOC team wants to automate response to incidents detected by Microsoft Sentinel. When a new incident is created with severity "High" and contains a specific tag "malware", they want to run a playbook that isolates the affected device. What is the correct way to configure this automation?

Accepted Answer

Create an automation rule that triggers on "When incident is created" and set conditions for severity equals High and tag contains "malware", then set a playbook action.. Option A is correct because automation rules in Microsoft Sentinel are specifically designed to trigger playbooks based on incident creation events and conditions like severity and tag. By setting the trigger to 'When incident is created' and conditions for severity equals 'High' and tag contains 'malware', the rule will invoke the playbook to isolate the affected device automatically, without manual intervention.

Answer

Create a custom analytics rule that runs the playbook directly when triggered.

Answer

Configure a logic app with a trigger on "When a Microsoft Sentinel incident is created" and use conditions inside the logic app.

Answer

Use the Microsoft Sentinel API to create a webhook that triggers the playbook.

Question 15

A SOC analyst needs to create a Microsoft Sentinel scheduled analytics rule that triggers when an Microsoft Entra ID user performs more than 10 failed sign-in attempts from different IP addresses within 15 minutes, using the SigninLogs table. Which KQL query aggregate pattern should be used?

Accepted Answer

SigninLogs | summarize DistinctIPs = dcount(IPAddress) by UserPrincipalName, bin(TimeGenerated, 15m) | where DistinctIPs > 10. Option B is correct because the query uses `dcount(IPAddress)` to count distinct IP addresses per user within a 15-minute time window, then filters for users with more than 10 distinct IPs. This directly matches the requirement to detect failed sign-ins from different IP addresses, not just total failed attempts.

Answer

SigninLogs | summarize FailedCount = count() by UserPrincipalName, IPAddress, bin(TimeGenerated, 15m) | where FailedCount > 10

Answer

SigninLogs | summarize DistinctIPs = count() by UserPrincipalName, IPAddress | where DistinctIPs > 10

Answer

SigninLogs | where Status contains 'Failed' | summarize by UserPrincipalName, IPAddress | count > 10