SC-200 Quick Quiz — 10 Questions

Question 1

Your organization uses Microsoft 365 Defender. An incident is created for a user who received a phishing email that contained a link to a malicious website. The user clicked the link but did not enter any credentials. The incident includes the alert 'Phishing delivered' from Microsoft Defender for Office 365. You need to remediate the incident and prevent future occurrences. The user is in the Finance department and frequently receives emails from external vendors. What is the best course of action?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Use Threat Explorer to delete the email from the user's mailbox and create a Safe Links policy to block the malicious URL.. The best remediation combines immediate containment with prevention: Threat Explorer (or the unified action center) lets you soft-delete or hard-delete the phishing email from the user's mailbox, and a Safe Links policy blocks the malicious URL so future clicks are neutralized. This addresses both the current incident and the recurring risk from external vendors, which is the correct incident-response sequence of contain, eradicate, and prevent.

Answer

Report the email to Microsoft for analysis and block the sender domain.

Answer

Provide security awareness training to the user and mark the incident as resolved.

Answer

Add the sender's domain to the Tenant Allow/Block List as allowed to avoid future false positives.

Question 2

A SOC analyst in Microsoft Sentinel is creating a scheduled analytics rule to detect a possible password spray attack. The rule must trigger when a single source IP address has more than 10 failed logon attempts on different user accounts within a 30-minute window. The analyst writes a KQL query starting with 'SigninLogs | where ResultType == 50057' (failed logon). Which operator should the analyst use to group events by source IP and count distinct user accounts, then filter for counts above 10?

Accepted Answer

summarize. The `summarize` operator is required to group events by source IP address and count distinct user accounts using `dcount()` or `count()`. After summarizing, you apply a `where` clause to filter for counts above 10, which meets the rule's threshold. This is the standard pattern for aggregation in KQL.

Answer

where

Answer

extend

Answer

project

Question 3

Which THREE are valid incident classification options in Microsoft Sentinel?

Accepted Answer

Benign Positive. (Benign Positive) is correct because Microsoft Sentinel uses incident classification to categorize the outcome of an investigation. A Benign Positive indicates that an alert is triggered by legitimate activity that is expected or acceptable, such as a security tool scanning the network or a user performing an authorized administrative task. This classification helps analysts distinguish between true threats and harmless events without marking them as false positives.

Answer

Informational

Answer

Malicious

Question 4

Your organization uses Microsoft Sentinel to manage security incidents. The security team wants to automatically close low-severity incidents after 24 hours if no activity has occurred. Which feature should you use?

Accepted Answer

Playbooks. A playbook (Azure Logic App) built on a Recurrence trigger — not an incident trigger — is the correct mechanism. Automation rules only fire in response to a Sentinel incident event (created/updated) and have no built-in condition to detect elapsed inactivity time; they cannot poll on a schedule. A recurrence-triggered playbook, by contrast, can run periodically (e.g., hourly), query the Sentinel incidents REST API for Low-severity incidents that have had no updates in the last 24 hours, and close them automatically — this is Microsoft's documented pattern for automated stale-incident closure.

Answer

Automation rules

Answer

Watchlists

Answer

Analytics rules

Question 5

You are a security operations analyst at a company that uses Microsoft Sentinel. You need to create an automation rule that automatically closes incidents with a severity of Informational and a status of New after 24 hours, but only if they do not contain any entities. Which three conditions must you configure in the automation rule?

Accepted Answer

Severity equals Informational, Status equals New, and Entities count equals 0.. The automation rule must target incidents that are Informational severity, have a status of New, and contain no entities. These conditions ensure that only low-risk, unassigned incidents without any associated entities are automatically closed after 24 hours, reducing analyst workload. The other combinations either target incorrect severity, status, or entity presence, failing to meet the scenario's requirements.

Answer

Severity equals Low, Status equals New, and Entities count equals 0.

Answer

Severity equals Informational, Status equals New, and Entities count greater than 0.

Answer

Severity equals Informational, Status equals Active, and Entities count equals 0.

Question 6

Your organization uses Microsoft Sentinel and has enabled UEBA. You notice that many low-severity incidents are being created from high-volume informational alerts. You want to reduce noise without disabling data connectors. What should you do?

Accepted Answer

Modify the analytics rule query to exclude the high-volume informational events using KQL.. Modifying the analytics rule query to exclude high-volume informational events using KQL directly addresses the root cause: the rule is generating low-severity incidents from noisy informational data. This approach preserves the data connectors and UEBA functionality while filtering out the specific events that cause alert fatigue. Unlike automation rules that close incidents after creation, query modification prevents the incidents from being generated in the first place.

Answer

Create an automation rule that closes low-severity incidents immediately.

Answer

Increase the incident creation threshold in the analytics rule.

Answer

Disable the Microsoft 365 Defender connector for those data sources.

Question 7

A SOC team wants to use Microsoft Sentinel to detect when a user logs in from a new country not previously seen for that user. They have the SigninLogs table. Which KQL function is most appropriate to build this anomaly detection?

Accepted Answer

make_set() with lookup. The `make_set()` function creates a dynamic array of distinct values (e.g., countries) per user over a specified time window. By using `lookup` to compare the current sign-in's country against the historical set, you can flag logins from countries not previously seen. This directly implements the 'new country' anomaly detection pattern in KQL.

Answer

timechart()

Answer

dcount()

Answer

startofday()

Question 8

Wide World Importers uses Microsoft Sentinel, Microsoft Defender XDR, and Microsoft Purview for data loss prevention (DLP). An incident is generated: 'DLP policy violation - sensitive data shared externally.' The incident shows that a user shared a document containing credit card numbers via SharePoint Online with an external guest. The user is a finance department employee. You need to respond to the incident. The organization wants to minimize business disruption while protecting data. Which of the following is the BEST immediate action?

Accepted Answer

Remove the external guest's access to the document in SharePoint Online.. Removing the external guest's access to the document stops data exposure without affecting the user's work. Option A is wrong: disabling the user prevents all work and may be too drastic. Option B is wrong: deleting the document destroys evidence. Option D is wrong: DLP policy change takes time and does not stop current exposure.

Answer

Delete the document from SharePoint Online.

Answer

Modify the DLP policy to block sharing of credit card numbers.

Answer

Disable the user's account in Microsoft Entra ID and investigate.

Question 9

Your organization uses Microsoft Defender XDR for threat detection and response. The security team wants to automatically isolate a compromised device when a specific malware alert is triggered, but only if the device is not a critical server. What is the most efficient way to achieve this?

Accepted Answer

Configure an automation rule in Microsoft Defender XDR. Automation rules in Microsoft Defender XDR allow you to define conditions (e.g., malware alert triggered) and actions (e.g., isolate device) with scoping filters (e.g., exclude devices tagged as 'critical server'). This provides a no-code, built-in mechanism that runs automatically without manual intervention or external scripting, making it the most efficient approach for conditional automated response.

Answer

Use advanced hunting to find devices and then manually isolate

Answer

Use PowerShell scripts in a playbook

Answer

Create a custom detection rule

Question 10

A security analyst receives a high-severity incident in Microsoft Sentinel for a user who is suspected of lateral movement. The analyst wants to automatically run a playbook that isolates the user's machine and disables their account when such an incident is created. What is the most efficient way to achieve this?

Accepted Answer

Create an automation rule that triggers the playbook when the incident is created. Automation rules in Microsoft Sentinel are designed to trigger playbooks automatically when an incident is created, based on conditions like severity or rule name. This provides the most efficient, event-driven response without polling or manual intervention, directly addressing the requirement to isolate the machine and disable the account upon incident creation.

Answer

Configure a Logic Apps trigger to poll for new incidents every minute

Answer

Train analysts to manually run the playbook when they see the incident

Answer

Create an analytics rule that runs a playbook as part of its alert generation