SC-200 Quick Quiz — 10 Questions

Question 1

Match each Microsoft Sentinel data connector on the left with the table name it populates on the right.

Accepted Answer

Microsoft Entra ID → SigninLogs; Windows Security Events via AMA → SecurityEvent; Cisco ASA via Syslog → CommonSecurityLog; Azure Activity → AzureActivity. It accurately maps each Microsoft Sentinel data connector to its corresponding log table. Microsoft Entra ID populates the SigninLogs table, Windows Security Events via AMA populates the SecurityEvent table, Cisco ASA via Syslog populates the CommonSecurityLog table (which is the standard schema for syslog-based security appliances), and Azure Activity populates the AzureActivity table. These mappings are defined by the data connectors themselves and are fundamental to querying the correct data in Sentinel.

Answer

The first and last mappings are swapped.

Answer

Every item maps to the same log table or feature category.

Answer

Only identity-related items are mapped; workload and network items are omitted.

Question 2

Which THREE steps are part of the incident response process when using Microsoft Sentinel?

Accepted Answer

Investigate the incident using hunting queries and entity timelines.. Investigating an incident using hunting queries and entity timelines is a core step in the Microsoft Sentinel incident response process. After an incident is created, analysts use KQL-based hunting queries to proactively search for related threats and leverage entity timelines to visualize the sequence of events and entity interactions, which is essential for understanding the scope and impact of the incident.

Answer

Identify the incident by creating an analytics rule.

Answer

Report the incident to the security team via email.

Question 3

A security analyst is investigating a suspicious process on an endpoint and needs to see all network connections initiated by that process. The analyst knows the ProcessId and DeviceName. Which advanced hunting table in Microsoft 365 Defender should the analyst query to retrieve network connection details associated with this process?

Accepted Answer

DeviceNetworkEvents. The DeviceNetworkEvents table in Microsoft 365 Defender is specifically designed to capture network connection events, including source and destination IP addresses, ports, protocols, and the initiating process ID (ProcessId). By querying this table with the known ProcessId and DeviceName, the analyst can retrieve all network connections initiated by that process, making it the correct choice for this investigation.

Answer

DeviceProcessEvents

Answer

DeviceEvents

Answer

IdentityLogonEvents

Question 4

A SOC analyst needs to investigate a potential data exfiltration incident involving a user uploading files to an external cloud storage service. Which Microsoft Sentinel data source would provide the MOST relevant information?

Accepted Answer

OfficeActivity. OfficeActivity (D) is the correct data source because it captures audit logs from Microsoft 365 services, including SharePoint Online, OneDrive for Business, and Exchange Online. These logs record file uploads, downloads, and sharing events, making them the most relevant for investigating data exfiltration to external cloud storage services like OneDrive or SharePoint.

Answer

SigninLogs

Answer

CommonSecurityLog

Answer

AzureActivity

Question 5

Refer to the exhibit. A Microsoft Sentinel scheduled rule is configured as shown. The rule generates an alert, but the incident created contains only the first alert, and subsequent alerts do not update the incident. What is the most likely cause?

Accepted Answer

The rule does not have incident grouping enabled.. The exhibit shows the rule is configured to create a single incident from alerts grouped by entities, but the 'Grouping' settings are not enabled. Without incident grouping enabled, each alert generates a separate incident, and subsequent alerts do not update the existing incident. Enabling incident grouping allows alerts matching the same grouping criteria to be merged into the same incident, ensuring updates occur.

Answer

The triggerOperator and triggerThreshold are misconfigured.

Answer

The KQL query is missing a join to include more data.

Answer

The severity is set to High, which prevents incident updates.

Question 6

During an incident investigation, you discover that an attacker used a legitimate account to access sensitive data in Microsoft Purview Information Protection. You need to identify what data was accessed and by whom. Which log source should you query?

Accepted Answer

Microsoft Purview data access logs. Microsoft Purview data access logs (option B) are the correct source because they specifically record when users access sensitive data labeled with Microsoft Purview Information Protection, including details about what data was accessed and by whom. Unlike other logs, these capture data-level access events such as viewing, downloading, or modifying protected documents, which is essential for investigating an attacker using a legitimate account to exfiltrate sensitive information.

Answer

Microsoft 365 Defender alerts

Answer

Microsoft Entra ID sign-in logs

Answer

Office 365 audit logs (unified audit log)

Question 7

Which TWO of the following are required to enable Microsoft Sentinel to receive alerts from Microsoft Defender for Cloud? (Choose two.)

Accepted Answer

Install the 'Microsoft Defender for Cloud' data connector in Microsoft Sentinel.. The 'Microsoft Defender for Cloud' data connector in Microsoft Sentinel is the specific integration point that ingests security alerts from Defender for Cloud into Sentinel. Without installing and configuring this connector, Sentinel cannot receive the alerts, even if Defender for Cloud is enabled on the subscription.

Answer

Deploy the Log Analytics agent on all VMs.

Answer

Connect a non-Azure machine using Azure Arc.

Answer

Assign an Azure Policy to enable Defender for Cloud.

Question 8

You are a security administrator for a multinational company using Microsoft Sentinel. You need to ensure that critical incidents are automatically escalated to the on-call team via email and SMS. The on-call schedule uses Microsoft Teams channel. What is the most efficient way to achieve this?

Accepted Answer

Build a playbook using Microsoft Teams connector to post a message in the on-call channel with an adaptive card that allows acknowledge and escalate.. It uses a Microsoft Teams connector playbook triggered by an automation rule to post an adaptive card in the on-call channel. This allows the on-call team to acknowledge or escalate the incident directly from Teams, fulfilling the requirement for email and SMS escalation through the Teams channel schedule. Automation rules in Sentinel can trigger playbooks based on incident creation or update, making this the most efficient integrated approach.

Answer

Create an automation rule that sends email directly to the on-call team.

Answer

Configure the analytics rule to send an email when the incident is created.

Answer

Use a workbook to display critical incidents and expect the team to monitor it.

Question 9

Which TWO actions are effective when threat hunting for lateral movement using remote desktop protocol (RDP) in Microsoft Defender XDR?

Accepted Answer

Query DeviceNetworkEvents for inbound connections on port 3389. Querying DeviceNetworkEvents for inbound RDP connections (port 3389) helps identify potential lateral movement. Correlating with LogonEvents for successful RDP logins confirms the movement. Option B (reviewing CloudAppEvents) is not directly RDP-related but could indicate lateral movement via cloud apps. Option D (checking for unusual email forwarding rules) is typically for exfiltration, not lateral movement. Option E (searching for SMB file share connections) is more related to file sharing and not specifically RDP lateral movement.

Answer

Review CloudAppEvents for access to cloud apps from multiple IPs

Answer

Check for unusual email forwarding rules

Answer

Search for SMB file share connections

Question 10

A SOC analyst in Microsoft Sentinel is creating a scheduled analytics rule to detect a possible password spray attack. The rule must trigger when a single source IP address has more than 10 failed logon attempts on different user accounts within a 30-minute window. The analyst writes a KQL query starting with 'SigninLogs | where ResultType == 50057' (failed logon). Which operator should the analyst use to group events by source IP and count distinct user accounts, then filter for counts above 10?

Accepted Answer

summarize. The `summarize` operator is required to group events by source IP address and count distinct user accounts using `dcount()` or `count()`. After summarizing, you apply a `where` clause to filter for counts above 10, which meets the rule's threshold. This is the standard pattern for aggregation in KQL.

Answer

where

Answer

extend

Answer

project