SC-200 Multiple Select — 60 Questions

Question 1

A Microsoft Sentinel scheduled analytics rule detects impossible travel but creates too many duplicate incidents for the same user within a short period. Which two rule settings should you tune? (Choose 2.)

Accepted Answer

Configure event grouping or incident grouping by user entity.. Option A is correct because configuring event grouping or incident grouping by user entity consolidates multiple alerts for the same user into a single incident, reducing duplicate incidents. In Microsoft Sentinel, this setting controls how alerts are aggregated into incidents based on entity fields like user account, ensuring that a burst of impossible travel alerts for the same user generates one incident instead of many.

Answer

Disable the data connector.

Answer

Delete the Log Analytics workspace.

Question 2

A hybrid environment contains Azure VMs and on-premises servers connected through Azure Arc. Which two outcomes can Defender for Cloud provide for these servers? (Choose 2.)

Accepted Answer

Security recommendations for misconfigurations and missing updates.. Defender for Cloud continuously assesses the security posture of Azure VMs and Azure Arc-enabled on-premises servers. It generates security recommendations for misconfigurations (e.g., open management ports, weak encryption) and missing updates (e.g., OS patches, critical CVE fixes) by comparing the server's configuration against built-in security baselines and the Microsoft Security Response Center (MSRC) threat intelligence. This is a core capability of the cloud security posture management (CSPM) module within Defender for Cloud.

Answer

Automatic replacement of all unsupported operating systems.

Answer

Guaranteed compliance certification for every regulatory standard.

Question 3

A Microsoft Sentinel incident contains alerts from multiple analytics rules. The analyst suspects the same compromised account performed impossible travel followed by suspicious mailbox access. Which two actions best help correlate identity and mailbox activity?

Accepted Answer

Query SigninLogs for the account around the alert timestamps. Option A is correct because querying SigninLogs for the account around the alert timestamps directly retrieves Azure AD authentication events, which are essential for identifying the source IP addresses, locations, and timestamps that define the impossible travel pattern. This data is the primary evidence for the first part of the suspected compromise.

Answer

Delete the incident to force it to regenerate

Answer

Disable all analytics rules that contributed alerts

Question 4

A security analyst is triaging security alerts in Microsoft Defender for Cloud. Which of the following are valid ways to suppress a specific alert type to reduce noise? (Choose all that apply.)

Accepted Answer

Create an alert suppression rule based on alert entity. Option A is correct because Microsoft Defender for Cloud allows you to create suppression rules that automatically dismiss alerts based on specific alert entities (such as alert ID, title, or severity) to reduce noise. These rules are configured in the security alerts settings and can be scoped to a subscription or management group, ensuring that alerts matching the defined criteria are silently dismissed without generating incidents.

Answer

Modify the alert's severity

Answer

Set an automatic response action

Question 5

A security operations center (SOC) is configuring automated investigation and response (AIR) for Microsoft Defender for Office 365. Which of the following actions can be automatically taken when a malicious email is detected by AIR policies? (Choose all that apply.)

Accepted Answer

Soft delete the email from user mailbox. Option A is correct because AIR policies in Microsoft Defender for Office 365 can automatically soft-delete a malicious email from a user's mailbox. Soft deletion moves the email to the Recoverable Items folder, allowing administrators to restore it if needed, which is a standard remediation action for confirmed threats.

Answer

Add the sender to the user's blocked sender list

Answer

Permanently delete the email from all mailboxes

Question 6

An analyst is investigating a ransomware outbreak using Microsoft 365 Defender Advanced Hunting. They need to find all devices where a file with the extension '.locked' was created within one hour after a known malicious process (e.g., 'ransomware.exe') was executed on the same device. Which two tables should be joined in the query? (Choose 2.)

Accepted Answer

DeviceProcessEvents. DeviceProcessEvents is correct because it logs process creation events, including the execution of 'ransomware.exe'. This table is essential to identify the timestamp and device where the malicious process ran, which serves as the starting point for the time-bound investigation.

Answer

DeviceNetworkEvents

Answer

DeviceRegistryEvents

Question 7

A SOC analyst needs to create a custom watchlist in Microsoft Sentinel to use in an analytics rule. Order the following steps from first to last to correctly create and use the watchlist (Choose 4.)

Accepted Answer

1. Create a new watchlist in Microsoft Sentinel (e.g., from Sentinel > Watchlists > Add new).. Option A is correct because creating a new watchlist in Microsoft Sentinel is the initial step to define a custom data source for threat intelligence or reference data. This is done via Sentinel > Watchlists > Add new, where you specify the alias, description, and other metadata before uploading data. Without this step, there is no container to import the CSV file into, making it the logical first action.

Question 8

An analyst writes an advanced hunting query to investigate a suspicious executable that initiated outbound connections. Which two Microsoft 365 Defender tables are most relevant? (Choose 2.)

Accepted Answer

DeviceProcessEvents.. DeviceProcessEvents is correct because it records process creation events, including the executable that initiated the outbound connection. By querying this table, you can identify the suspicious executable's name, command line, and parent process, which is essential for tracing the origin of the malicious activity.

Answer

EmailAttachmentInfo.

Answer

IdentityInfo.

Question 9

Which of the following detection scenarios can be implemented using a scheduled analytics rule in Microsoft Sentinel? (Select all that apply.) (Choose 2.)

Accepted Answer

Identifying sign-ins from IP addresses listed in a custom threat intelligence watchlist.. Option A is correct because scheduled analytics rules in Microsoft Sentinel can be configured to run queries at regular intervals, and these queries can reference watchlists, including custom threat intelligence watchlists. By querying sign-in logs and joining them with a watchlist of known malicious IPs, the rule can identify sign-ins from those IPs and generate alerts. This is a common pattern for leveraging external threat intelligence within Sentinel's detection capabilities.

Answer

Detecting anomalous sign-in behavior based on user entity behavior.

Answer

Automatically blocking malicious IPs on a firewall.

Question 10

Which of the following resource types are supported by Microsoft Defender for Cloud's workload protection plans? (Select all that apply.) (Choose 3.)

Accepted Answer

Azure virtual machines. Microsoft Defender for Cloud's workload protection plans support Azure virtual machines by providing integrated threat detection and advanced security features like just-in-time VM access, file integrity monitoring, and vulnerability assessments. These capabilities leverage the Microsoft Monitoring Agent or Azure Monitor Agent to analyze security events and detect suspicious activities within the VM's operating system and network traffic.

Answer

Azure Logic Apps

Question 11

A SOC analyst is building a scheduled analytics rule in Microsoft Sentinel to detect when a user is added to a privileged Microsoft Entra ID role (e.g., Global Administrator). Which two tables must be included in the KQL query to capture the role assignment event and to retrieve user details? (Choose 2.)

Accepted Answer

AADAuditLogs. AADAuditLogs captures all directory audit events, including role assignment activities such as adding a user to a privileged Microsoft Entra ID role. This table is essential because it records the 'Add member to role' operation with details like the target user, role name, and initiating actor, which are required to detect the security event.

Answer

SigninLogs

Answer

AzureActivity

Question 12

A SOC analyst in Microsoft Sentinel needs to create an automation rule that triggers a playbook when a new incident is created and the incident severity is 'High'. Additionally, the playbook should only run if the incident is not already assigned to an analyst. Which two conditions must the analyst include in the automation rule? (Select all that apply.) (Choose 2.)

Accepted Answer

Condition: 'Severity' equals 'High'. Option A is correct because the automation rule must trigger only when the incident severity is 'High'. In Microsoft Sentinel, automation rules evaluate conditions against incident properties, and the 'Severity' condition filters incidents by their assigned severity level. This ensures the playbook runs exclusively for high-severity incidents, aligning with the SOC's requirement to prioritize critical alerts.

Answer

Condition: 'Status' equals 'New'

Answer

Condition: 'Provider' contains 'Microsoft Sentinel'

Question 13

A SOC analyst is configuring a Microsoft Sentinel automation rule to trigger a playbook when an incident is created. The playbook should only run if the incident severity is 'High' and the incident title contains 'Phishing'. Which two conditions should the analyst add to the automation rule? (Select all that apply.) (Choose 2.)

Accepted Answer

Incident severity equals High. Option A is correct because the automation rule condition 'Incident severity equals High' directly matches the requirement that the playbook should only trigger for incidents with a severity of 'High'. In Microsoft Sentinel, automation rules evaluate conditions against incident properties, and severity is a standard field that can be filtered using the 'equals' operator. This ensures the playbook is not invoked for lower-severity incidents.

Answer

Incident status is New

Answer

Incident owner is Unassigned

Question 14

A SOC team uses Microsoft Sentinel and wants to automate the response to high-severity incidents. When a new incident of severity 'High' is created, they need to send an email notification to the on-call analyst and assign the incident to that analyst. Which two components must be configured together to achieve this? (Choose the best answer.)

Accepted Answer

Automation rule and a playbook. Automation rules in Microsoft Sentinel allow you to define triggers based on incident creation or update, including severity conditions. By configuring an automation rule to trigger when a 'High' severity incident is created, you can run a playbook that sends an email to the on-call analyst and assigns the incident to them. This combination provides a no-code or low-code automated response without requiring a scheduled or Fusion rule.

Answer

Scheduled analytics rule and a playbook

Answer

Watchlist and an automation rule

Question 15

An analyst is building a custom detection rule in Microsoft 365 Defender to identify potential data exfiltration. The rule should alert when a process (e.g., powershell.exe) initiates multiple outbound network connections to an external IP address that is not in the company's corporate IP range within a short time. Which two Advanced Hunting tables must be joined to correlate process execution with network connection details?

Accepted Answer

DeviceProcessEvents and DeviceNetworkEvents. The rule requires correlating process execution (e.g., powershell.exe) with outbound network connections to external IPs. DeviceProcessEvents logs process creation events, while DeviceNetworkEvents logs network connection details including destination IP and port. Joining these two tables on DeviceId and Timestamp (within a short time window) allows the analyst to identify which process initiated the suspicious outbound connections, making A correct.

Answer

DeviceProcessEvents and DeviceFileEvents

Answer

DeviceProcessEvents and EmailEvents

Question 16

A SOC team in Microsoft Sentinel wants to automatically assign high-severity incidents to the 'SOC Tier 2' group and automatically close low-severity incidents that have not been updated in 7 days. Which two configuration elements are required in a single automation rule?

Accepted Answer

One condition for 'Severity equals High' with action 'Assign to SOC Tier 2' and add another condition for 'Severity equals Low' AND 'Last update time older than 7 days' with action 'Close incident'.. Option A is correct because a single Microsoft Sentinel automation rule can include multiple conditions using AND/OR logic, and each condition can trigger a different action (e.g., assign or close). This allows the SOC team to handle both high-severity assignment and low-severity auto-closure within one rule, meeting the requirement efficiently.

Answer

Create one rule for high severity assignments and another rule for low severity closure; you cannot combine different actions in one rule.

Answer

Set the automation rule to trigger on incident creation and then use a custom action to assign owner, but closure cannot be automated in an automation rule.

Question 17

A security analyst is investigating a sophisticated attack where an attacker used a compromised account to send a phishing email. The analyst wants to correlate the email event with the subsequent sign-in activity from the same sender's mailbox using Advanced Hunting. Which two tables should the analyst join to link the email sender to the sign-in IP address?

Accepted Answer

EmailEvents and AADSignInEventsBeta. To correlate a phishing email event with the subsequent sign-in activity from the same sender's mailbox, the analyst needs to join the EmailEvents table (which contains email metadata like sender and recipient) with the AADSignInEventsBeta table (which captures Azure AD sign-in logs, including IP addresses). This join allows linking the sender's email address to the sign-in IP address used during the session that sent the email.

Answer

EmailEvents and CloudAppEvents

Answer

EmailAttachmentInfo and AADSignInEventsBeta

Question 18

Which THREE components are required to automate incident response in Microsoft Sentinel using playbooks? (Choose three.)

Accepted Answer

An automation rule in Sentinel.. Option A is correct because playbooks are based on Azure Logic Apps. Option B is correct because automation rules trigger playbooks. Option C is correct because a trigger is required for the logic app. Option D is wrong because analytics rules create incidents, not playbooks. Option E is wrong because workbooks are visualization, not automation.

Answer

A workbook.

Answer

An analytics rule.

Question 19

Which THREE capabilities are provided by Microsoft Defender for Cloud's Cloud Security Posture Management (CSPM) plan? (Select THREE.)

Accepted Answer

Compliance dashboard that shows your posture against regulatory standards.. Option A is correct because Microsoft Defender for Cloud's CSPM plan includes a compliance dashboard that continuously assesses your cloud resources against regulatory standards such as SOC 2, ISO 27001, and PCI DSS. This dashboard provides a real-time view of your compliance posture, mapping security controls to specific regulatory requirements and highlighting non-compliant resources.

Answer

Endpoint detection and response for on-premises machines.

Answer

Integrated vulnerability assessment for virtual machines.

Question 20

Which TWO capabilities are provided by Microsoft Copilot for Security within the Microsoft Sentinel experience?

Accepted Answer

Suggest KQL queries based on a description of what you want to detect.. Option A is correct because Microsoft Copilot for Security in Microsoft Sentinel can generate KQL queries from natural language descriptions, allowing analysts to quickly create detection rules without manually writing KQL syntax. This capability leverages AI to interpret the analyst's intent and produce a query that matches the described detection logic.

Answer

Deploy a new workbook template from a description.

Answer

Modify an existing playbook by adding steps through natural language.

Answer

Automatically create an automation rule based on a chat prompt.