SC-200 Multiple Select — 40 Questions

Question 1

Which TWO actions are effective when threat hunting for lateral movement using remote desktop protocol (RDP) in Microsoft Defender XDR?

Accepted Answer

Query DeviceNetworkEvents for inbound connections on port 3389. Querying DeviceNetworkEvents for inbound RDP connections (port 3389) helps identify potential lateral movement. Correlating with LogonEvents for successful RDP logins confirms the movement. Option B (reviewing CloudAppEvents) is not directly RDP-related but could indicate lateral movement via cloud apps. Option D (checking for unusual email forwarding rules) is typically for exfiltration, not lateral movement. Option E (searching for SMB file share connections) is more related to file sharing and not specifically RDP lateral movement.

Answer

Review CloudAppEvents for access to cloud apps from multiple IPs

Answer

Check for unusual email forwarding rules

Answer

Search for SMB file share connections

Question 2

Which TWO features are available in Microsoft Sentinel to automate incident response?

Accepted Answer

Playbooks based on Azure Logic Apps.. Playbooks based on Azure Logic Apps are correct because they provide a native, low-code automation framework within Microsoft Sentinel. They allow security analysts to define and execute complex, multi-step response actions—such as isolating a compromised VM, blocking an IP address, or opening a ticket—triggered by alerts or incidents. This directly automates incident response workflows without manual intervention.

Answer

Workbooks.

Answer

Kusto Query Language (KQL) queries.

Answer

UEBA.

Question 3

Which THREE steps are part of the containment phase of incident response in Microsoft Sentinel? (Select THREE.)

Accepted Answer

Disable compromised user accounts in Microsoft Entra ID.. Disabling compromised user accounts in Microsoft Entra ID is a containment step because it immediately revokes the account's access tokens and prevents further authentication, stopping an attacker from using that identity to move laterally or access resources. This aligns with the containment phase's goal of limiting the blast radius of an incident.

Answer

Collect forensic data from affected endpoints.

Answer

Restore encrypted files from backup.

Question 4

Which THREE actions can be performed by automation rules in Microsoft Sentinel?

Accepted Answer

Assign an incident to a specific owner. Automation rules in Microsoft Sentinel can automatically assign incidents to specific owners based on conditions such as severity, entity type, or custom criteria. This action helps streamline incident response by ensuring the right personnel are notified and responsible for handling the incident without manual intervention.

Answer

Modify a data connector to ingest more logs

Answer

Create a new analytics rule

Question 5

Which TWO actions should a security analyst take when responding to a confirmed malware outbreak in Microsoft Defender for Endpoint?

Accepted Answer

Isolate the affected device. Options A and B are correct. Option A: Isolating the affected device immediately contains the outbreak and prevents lateral movement to other endpoints. Option B: Running a full scan ensures all malware components and artifacts are identified and removed. Option C is wrong because creating a custom detection rule is a proactive measure for future detections, not an immediate response to a confirmed outbreak. Option D is wrong because deleting the user account is extreme and does not address the malware on the device. Option E is wrong because resetting the user's password helps with credential compromise but does not stop active malware.

Answer

Create a custom detection rule for the malware

Answer

Delete the user account

Answer

Reset the user's password

Question 6

Your organization uses Microsoft Sentinel. You need to design a solution that automatically responds to incidents with severity High and enriches them with threat intelligence from Microsoft Defender Threat Intelligence. Which TWO actions should you include?

Accepted Answer

Create an automation rule that triggers when an incident is created with severity High and runs a playbook to enrich the incident with threat intelligence.. To automatically respond to incidents, you use automation rules. Option A is correct because automation rules can be set to trigger on incident creation with severity High and run a playbook that enriches the incident with threat intelligence. Option E is correct because you can add an action in the automation rule to change the incident severity after enrichment if needed. Option B is incorrect because automation rules do not modify analytics rule queries; they trigger on incidents. Option C is incorrect because you cannot run a playbook directly from the analytics rule; it must be triggered by an automation rule. Option D is incorrect because the analytics rule's incident configuration does not automatically run playbooks without an automation rule.

Answer

Set the automation rule to modify the analytics rule's query to include threat intelligence.

Answer

Configure the playbook to run directly from the analytics rule that generates the incident.

Answer

Use the analytics rule's incident configuration to automatically run the playbook.

Question 7

Which TWO actions can be performed using automation rules in Microsoft Sentinel? (Select TWO.)

Accepted Answer

Assign an incident to a specific owner.. Automation rules in Microsoft Sentinel can perform actions such as assigning an incident to a specific owner. This is a built-in action within the automation rule configuration, allowing you to automatically set the owner field of an incident based on conditions like severity or rule ID, without requiring a playbook.

Answer

Create a new incident from an alert.

Answer

Modify the query of an existing analytics rule.

Answer

Delete an incident automatically.

Question 8

Which TWO actions are appropriate when handling a confirmed ransomware incident in Microsoft 365?

Accepted Answer

Isolate affected devices from the network.. Correct: Isolate affected devices to prevent spread, and change passwords for compromised accounts. Wrong: Paying ransom is not recommended; restoring from backup is good but not immediate; scanning with antivirus is reactive and may not remove all traces.

Answer

Run a full antivirus scan on all devices.

Answer

Restore encrypted files from backup immediately without investigation.

Answer

Pay the ransom to regain access.

Question 9

Which THREE actions should you take when investigating a potential data exfiltration incident detected by Microsoft Defender for Cloud Apps?

Accepted Answer

Create a file policy to detect similar activities in the future. Creating a file policy in Defender for Cloud Apps allows you to detect similar exfiltration activities in the future by monitoring file sharing and access patterns. Option C is correct because integrating with Microsoft Sentinel enables you to correlate events across multiple sources and perform advanced hunting for related incidents. Option E is correct because reviewing the user's activity log in the Defender for Cloud Apps portal provides detailed audit of file access, downloads, and sharing that reveals the exfiltration. Option B is incorrect because Microsoft Defender for Identity focuses on on-premises Active Directory threats, not cloud app activities. Option D is incorrect because the cloud discovery report identifies unsanctioned apps in use, but is not a tool for investigating a specific exfiltration incident.

Answer

Check Microsoft Defender for Identity for related alerts

Answer

Run a cloud discovery report to identify unsanctioned apps

Question 10

Which THREE elements are required to create a custom detection rule in Microsoft Sentinel?

Accepted Answer

A KQL query. A custom detection rule requires a KQL query to define logic, a schedule to run the query, and entity mapping to link results to incidents. Alert threshold is optional; playbook is separate.

Answer

An alert threshold

Answer

An automation playbook

Question 11

Which THREE resources can be used as data sources for Microsoft Sentinel to detect security incidents? (Choose three.)

Accepted Answer

Microsoft 365 Defender. Options A, B, and C are correct. Microsoft 365 Defender provides integrated threat signals across endpoints, email, and identities. Microsoft Defender for Cloud delivers security alerts and posture assessments for cloud workloads. Azure Activity Log captures subscription-level operational events, which can be streamed to Sentinel. Option D is incorrect because Azure Cost Management focuses on cost tracking and budgeting, not security events. Option E is incorrect because Azure Advisor provides optimization recommendations, not security incident data.

Answer

Azure Cost Management

Answer

Azure Advisor

Question 12

Which THREE are valid methods to collect forensic evidence from a compromised Windows machine during incident response in Microsoft Defender XDR? (Choose three.)

Accepted Answer

Collect a memory dump from the device using Live Response. Options B, D, and E are correct: Live Response allows script execution and file collection; collecting a memory dump captures volatile evidence necessary for forensic analysis; exporting Windows Event Logs provides a timeline of events. Option A is incorrect because resetting the device destroys evidence instead of preserving it. Option C is incorrect because full disk imaging is not natively supported in Microsoft Defender XDR; it requires external tools.

Answer

Reset the device to a clean state

Answer

Perform a full disk image using Microsoft Defender for Endpoint

Question 13

Which TWO tools in Microsoft Defender XDR provide automated investigation and response capabilities?

Accepted Answer

Microsoft Defender for Endpoint. Automated investigation and response (AIR) is available in Defender for Office 365 and Defender for Endpoint. Defender for Identity and Defender for Cloud Apps have some automation but not full AIR. Defender for Cloud is separate.

Answer

Microsoft Defender for Identity

Answer

Microsoft Defender for Cloud Apps

Answer

Microsoft Defender for Cloud

Question 14

Which TWO data sources are most relevant for threat hunting for lateral movement using remote service creation (e.g., WMI, PsExec)?

Accepted Answer

DeviceNetworkEvents. Correct options: C and E. DeviceProcessEvents captures process creation on remote machines (e.g., services.exe, cmd.exe) which is indicative of remote service creation via WMI or PsExec. DeviceNetworkEvents captures outbound network connections to high ports (e.g., 135, 445) on remote machines. Option A (DeviceRegistryEvents) captures registry modifications, not directly relevant. Option B (DeviceEvents) is less specific for this scenario. Option D (DeviceFileEvents) captures file writes, not process execution.

Answer

DeviceRegistryEvents

Answer

DeviceEvents

Answer

DeviceFileEvents

Question 15

Which THREE approaches are effective for hunting threats in Microsoft Defender XDR using advanced hunting? (Choose three.)

Accepted Answer

Using known indicators of compromise (IOCs) from threat intelligence feeds.. Effective hunting in Microsoft Defender XDR using advanced hunting involves proactive approaches: using known IOCs from threat intelligence (A) helps identify known threats; establishing a baseline of normal behavior and hunting for deviations (B) detects anomalies; applying machine learning models (E) leverages automated anomaly detection. Option C is incorrect because reviewing all alerts is reactive and not a hunting technique. Option D is incorrect because hunting looks for patterns, not isolated unusual events.

Answer

Reviewing all alerts generated by automated detection rules.

Answer

Searching for any single event that appears unusual.

Question 16

Which TWO built-in Microsoft Sentinel hunting queries are useful for detecting signs of compromised credentials?

Accepted Answer

Anomalous logon location. Correct options: B and C. Anomalous logon location (B) can indicate credential misuse. Brute force attempt (C) detects password guessing. Option A (Baseline) is not a specific query. Option D (New user) may be legitimate. Option E (Deleted) is not specific to compromise.

Answer

Baseline of user behavior

Answer

Deleted user account

Answer

New user account creation

Question 17

Which TWO data sources are essential for threat hunting in Microsoft Sentinel to detect lateral movement?

Accepted Answer

DeviceNetworkEvents (Microsoft Defender for Endpoint). DeviceNetworkEvents (Microsoft Defender for Endpoint) provides network connections between devices, which can reveal lateral movement attempts. SecurityEvent (Windows Event Logs) provides security-related events such as remote logons (Event ID 4624) and service creation (Event ID 7045), which are key indicators of lateral movement. Option A (Microsoft Entra ID sign-in logs) focuses on cloud identity and is not directly relevant for on-premises lateral movement. Option D (CommonSecurityLog) typically comes from network perimeter devices and is not essential for internal lateral movement. Option E (DnsEvents) can provide insight into DNS queries but is less essential than the other two data sources for detecting lateral movement.

Answer

Microsoft Entra ID sign-in logs

Answer

CommonSecurityLog (Syslog)

Answer

DnsEvents

Question 18

Which THREE actions are recommended when conducting a threat hunt for compromised identities using Microsoft Sentinel UEBA?

Accepted Answer

Search for access to applications the user does not normally use. UEBA is used to detect anomalous behavior; focusing on unusual logon times, multiple failed attempts, and unusual application access are key indicators of compromised identities. Option B (querying DNS logs) is more for network anomalies. Option D (investigating firewall changes) is for network security.

Answer

Query DNS logs for unusual domain resolutions

Answer

Investigate changes to firewall rules

Question 19

Which THREE actions are part of the threat hunting process in Microsoft Defender XDR?

Accepted Answer

Investigate entities found in the results. Formulating a hypothesis, querying advanced hunting, and investigating entities are core steps. Configuring automated responses is part of incident response, and setting retention policies is data management.

Answer

Configure automated response actions

Answer

Set data retention policies for hunting data

Question 20

Your organization uses Microsoft Sentinel with multiple workspaces. You need to create a unified incident queue across all workspaces. Which TWO solutions should you consider?

Accepted Answer

Consolidate all data into a single Log Analytics workspace.. Consolidating all data into a single Log Analytics workspace is the most straightforward and supported method to create a unified incident queue in Microsoft Sentinel. With a single workspace, all alerts and incidents are naturally aggregated, eliminating the need for cross-workspace synchronization. This approach simplifies management, ensures consistent analytics rules, and avoids the complexity of stitching incidents across multiple workspaces.

Answer

Use cross-workspace queries in workbooks.

Answer

Use Azure Policy to enforce workspace configuration.

Answer

Deploy multiple playbooks to synchronize incidents.