Microsoft Security Operations Analyst SC-200 SC-200 Questions 1–75 | Page 1/4

Multi-Selecteasy

Which TWO built-in Microsoft Sentinel hunting queries are useful for detecting signs of compromised credentials?

Select 2 answers

A.Baseline of user behavior

B.Anomalous logon location

C.Brute force attempt against user accounts

D.Deleted user account

E.New user account creation

AnswersB, C

Identifies logins from unexpected geographies.

Why this answer

Correct options: B and C. Anomalous logon location (B) can indicate credential misuse. Brute force attempt (C) detects password guessing.

Option A (Baseline) is not a specific query. Option D (New user) may be legitimate. Option E (Deleted) is not specific to compromise.

Full explanation →

MCQhard

Your organization uses Microsoft Sentinel and Microsoft Defender XDR. You want to create a hunting query that finds users who have accessed a high number of distinct Azure resources within a short time frame, which may indicate credential theft. Which KQL query would be most effective?

A.AzureActivity | summarize dcount(Resource) by bin(TimeGenerated, 1m), Caller

B.AzureActivity | summarize count() by Caller | where count_ > 20

C.AzureActivity | summarize dcount(OperationName) by Caller, bin(TimeGenerated, 1h) | where dcount_OperationName > 20

D.AzureActivity | where TimeGenerated > ago(1d) | summarize dcount(Resource) by Caller, bin(TimeGenerated, 1h) | where dcount_Resource > 20

AnswerD

This counts distinct Azure resources accessed per user per hour, which can indicate rapid reconnaissance.

Why this answer

It uses the AzureActivity table to count distinct resources per user per hour, filtering for those with more than 20 resources. Option A is wrong because it uses a 1-minute bucket, too granular for meaningful hunting. Option B is wrong because it counts operations, not distinct resources.

Option C is wrong because it counts distinct operation names, not resources.

Full explanation →

Multi-Selecteasy

Which THREE actions are recommended when conducting a threat hunt for compromised identities using Microsoft Sentinel UEBA?

Select 3 answers

A.Search for access to applications the user does not normally use

B.Query DNS logs for unusual domain resolutions

C.Look for multiple failed logon attempts followed by a successful one

D.Investigate changes to firewall rules

E.Review UEBA anomalies for unusual logon times or locations

AnswersA, C, E

Unusual application access can indicate account takeover.

Why this answer

UEBA is used to detect anomalous behavior; focusing on unusual logon times, multiple failed attempts, and unusual application access are key indicators of compromised identities. Option B (querying DNS logs) is more for network anomalies. Option D (investigating firewall changes) is for network security.

Full explanation →

MCQhard

Your organization uses Microsoft Sentinel and Microsoft Defender for Identity. An incident is created for a user whose credentials were used from an unusual location to access sensitive HR data. The user's account is a domain admin. The security team needs to ensure the attacker cannot use the account again. What should you do first?

A.Remove the user from the Domain Admins group

B.Force the user to log out of all sessions

C.Reset the user's password and revoke the Kerberos TGT

D.Disable the user's account in Active Directory

AnswerC

Password reset and TGT revocation prevent reuse of credentials.

Why this answer

Resetting the password and revoking the Kerberos TGT ensures the attacker cannot reuse cached credentials. Option A is wrong because disabling the account may disrupt operations but password reset is more precise. Option B is wrong because logging out alone does not invalidate the TGT.

Option D is wrong because removing group membership is secondary.

Full explanation →

MCQhard

A SOC team uses Microsoft Sentinel with multiple workspaces distributed across different regions. They need to create a single analytics rule that can query data from multiple workspaces to detect cross-tenant attacks. What is the recommended approach?

A.Create separate analytics rules for each workspace

B.Use cross-workspace queries in a single analytics rule with the workspace() function

C.Create a union workspace that ingests data from all workspaces

D.Use Azure Lighthouse to manage multiple workspaces and create rules on each

AnswerB

The KQL workspace() function allows a single analytics rule to query tables from multiple Log Analytics workspaces, enabling cross-workspace detection.

Why this answer

The recommended approach is to use cross-workspace queries in a single analytics rule with the workspace() function. This allows the rule to query data from multiple Sentinel workspaces in different regions without duplicating rules or ingesting data centrally. The workspace() function enables a single KQL query to reference tables from up to 100 workspaces, making it ideal for detecting cross-tenant attacks across distributed environments.

Exam trap

The trap here is that candidates may think Azure Lighthouse alone solves the problem, but it only provides management plane access; the actual query logic still requires the workspace() function to combine data in a single rule.

How to eliminate wrong answers

Option A is wrong because creating separate analytics rules for each workspace would require managing multiple rules, increasing complexity and failing to correlate events across workspaces in a single detection. Option C is wrong because creating a union workspace that ingests data from all workspaces would require duplicating data ingestion, increasing costs and latency, and is not a native Sentinel feature for cross-workspace queries. Option D is wrong because Azure Lighthouse provides cross-tenant management capabilities but does not allow a single analytics rule to query multiple workspaces; rules must still be created per workspace or use cross-workspace queries.

Full explanation →

Multi-Selecthard

Which THREE actions are part of the threat hunting process in Microsoft Defender XDR?

Select 3 answers

A.Configure automated response actions

B.Investigate entities found in the results

C.Query advanced hunting using KQL

D.Formulate a hypothesis based on threat intelligence

E.Set data retention policies for hunting data

AnswersB, C, D

Investigating entities is a key hunting activity.

Why this answer

Formulating a hypothesis, querying advanced hunting, and investigating entities are core steps. Configuring automated responses is part of incident response, and setting retention policies is data management.

Full explanation →

MCQhard

Your threat hunt aims to detect possible Kerberoasting attacks. Which KQL query in Microsoft Sentinel would best identify service principal name (SPN) requests from unusual accounts?

A.SecurityEvent | where EventID == 4768 | summarize count() by Account | where count_ > 10

B.SecurityEvent | where EventID == 4769 | summarize count() by Account

C.let knownAccounts = dynamic(['svc_sql', 'svc_adfs']); SecurityEvent | where EventID == 4768 | where Account !in (knownAccounts) | summarize cnt=count() by Account, IpAddress | where cnt > 5

D.SecurityEvent | where EventID == 4773 | summarize count() by Account

AnswerC

This identifies unusual accounts with high TGT requests by excluding known service accounts.

Why this answer

The best query for detecting Kerberoasting is Option C. Kerberoasting involves requesting Kerberos service tickets (TGS) for service principal names (SPNs) to crack the service account password. Event ID 4769 corresponds to a Kerberos service ticket request.

Option C filters out known service accounts (like svc_sql, svc_adfs) and looks for accounts with more than 5 requests, which may indicate an attacker brute-forcing service tickets. Option A uses Event ID 4768 (TGT requests), which is not directly related to service ticket requests. Option B does not filter known accounts and includes all accounts.

Option D uses Event ID 4773 (Kerberos service ticket renewal), which is not the typical event for Kerberoasting.

Full explanation →

MCQmedium

Refer to the exhibit. An incident in Microsoft Sentinel contains the entities shown. Which additional data source would be most useful to investigate this incident?

A.Microsoft Defender for Endpoint device timeline

B.Microsoft Entra ID sign-in logs

C.Microsoft Purview audit logs

D.Microsoft Intune device compliance logs

AnswerB

Sign-in logs provide details about the authentication event.

Why this answer

The incident involves a suspicious sign-in from an unfamiliar IP. Checking Microsoft Entra ID sign-in logs can provide additional context like authentication details, user agent, and risk level. Option A is wrong because Microsoft Defender for Endpoint focuses on endpoints, not cloud sign-ins.

Option C is wrong because Microsoft Purview is for compliance and data governance. Option D is wrong because Microsoft Intune is for device management, not sign-in events.

Full explanation →

MCQmedium

Your organization uses Microsoft Sentinel with Microsoft Defender XDR integrated. A critical incident has been raised involving a user account that was used to access a confidential SharePoint site from an unusual location at 2:00 AM. The incident includes alerts from Microsoft Defender for Cloud Apps, Microsoft Defender for Identity, and Microsoft Defender for Office 365. The analyst needs to contain the incident, investigate the scope, and begin remediation. The environment has the following: Microsoft Entra ID with conditional access policies, Microsoft Intune for device management, and Microsoft Defender for Endpoint on all devices. The analyst has identified the user account and the device used. Which course of action should the analyst take first?

A.Create a conditional access policy to block the user.

B.Isolate the user's device using Microsoft Defender for Endpoint.

C.Run a KQL query to find all resources accessed by the user.

D.Disable the user account in Microsoft Entra ID and revoke all sessions.

AnswerD

Immediately stops the user from accessing any resources.

Why this answer

Disabling the user account in Microsoft Entra ID and revoking all sessions is the immediate containment step because it stops the compromised account from being used for any further access, including the suspicious SharePoint access and any lateral movement. This action directly addresses the core of the incident—the user account—and is the fastest way to cut off the attacker's current authentication tokens and sessions, preventing further damage while the investigation proceeds.

Exam trap

The trap here is that candidates often prioritize device isolation (Option B) because they think of endpoint compromise first, but the incident is about a user account used from an unusual location, meaning the account itself is the primary vector—disabling the account is the fastest and most effective containment step before any device or investigation actions.

How to eliminate wrong answers

Option A is wrong because creating a conditional access policy to block the user is a slower, more complex approach that requires policy propagation time and may not immediately revoke existing sessions or tokens, leaving the attacker with active access. Option B is wrong because isolating the user's device using Microsoft Defender for Endpoint contains the device but does not prevent the attacker from using the same compromised user account from another device or via web-based access (e.g., SharePoint Online). Option C is wrong because running a KQL query to find all resources accessed by the user is a forensic investigation step that should occur after containment; performing it first delays the critical containment action and allows the attacker more time to exfiltrate data or move laterally.

Full explanation →

Multi-Selecteasy

Which TWO actions are essential for configuring Microsoft Sentinel to support effective threat hunting?

Select 2 answers

A.Connect Microsoft 365 data sources (e.g., Office 365, Entra ID, Defender for Cloud Apps)

B.Create a Watchlist that maps user names to email addresses

C.Enable User and Entity Behavior Analytics (UEBA) in Microsoft Sentinel

D.Configure custom analytics rules for every MITRE ATT&CK technique

E.Install Sysmon on all domain controllers

AnswersA, C

These sources provide user and entity data critical for hunting.

Why this answer

Enabling User and Entity Behavior Analytics (UEBA) provides baselines for hunting anomalies, and connecting Microsoft 365 data sources provides rich data for hunting. Customizing analytics rules is for detection, not hunting; Sysmon is not required; Watchlists are helpful but not essential for basic hunting setup.

Full explanation →

MCQhard

You are conducting a threat hunt in Microsoft Defender XDR and want to identify devices that have recently communicated with a known C2 server IP address. Which advanced hunting table should you query?

A.DeviceNetworkEvents

B.DeviceFileEvents

C.DeviceLogonEvents

D.DeviceProcessEvents

AnswerA

Correct. DeviceNetworkEvents logs network connections, including destination IPs, which is required to identify communications with a C2 server.

Why this answer

EviceNetworkEvents (Option A) because this table contains network connection events including destination IP addresses, ports, and protocols. It is used to identify network communications with suspicious IPs such as C2 servers. DeviceProcessEvents (Option D) is for process creation events, DeviceLogonEvents (Option C) is for authentication events, and DeviceFileEvents (Option B) is for file system events.

Only DeviceNetworkEvents provides the necessary network traffic information for threat hunting in Microsoft Defender XDR.

Full explanation →

MCQhard

A threat hunter is using Microsoft Sentinel and wants to leverage machine learning to detect anomalous behavior in Azure subscription activity. Which analytics rule template should the hunter use?

A.Anomalous Sign-In Locations

B.Anomalous Azure Operations

C.Anomalous User Behavior

D.Lateral Movement Detection

AnswerB

This rule uses ML to detect anomalous operations in Azure subscription activity.

Why this answer

The Anomalous Azure Operations analytics rule uses ML to detect unusual Azure resource operations. Option A is wrong because it's for sign-ins. Option C is wrong because it's for user behavior.

Option D is wrong because it's for on-premises lateral movement.

Full explanation →

Multi-Selecthard

Your organization uses Microsoft Sentinel and Microsoft Defender for Cloud. During a security incident involving a compromised Azure VM, which THREE actions are appropriate to contain and investigate the incident?

Select 3 answers

A.Use Microsoft Defender for Cloud's Just-in-Time VM access to isolate the VM.

B.Create a Microsoft Sentinel automation rule to trigger a playbook that runs investigation actions.

C.Enable network security group flow logs to capture network traffic.

D.Delete the compromised VM to prevent further damage.

E.Update the VM's operating system to the latest patch.

AnswersA, B, C

Limits network access to the VM.

Why this answer

Microsoft Defender for Cloud's Just-in-Time VM access can be used to lock down inbound traffic to the VM, effectively isolating it from the network while preserving the VM for forensic analysis. This action reduces the attack surface and prevents lateral movement without destroying evidence, which is critical during incident response.

Exam trap

The trap here is that candidates may confuse containment with remediation, choosing to delete or patch the VM immediately, but Microsoft tests the principle of preserving forensic evidence during the containment phase of incident response.

Full explanation →

MCQhard

During a threat hunt, you find a PowerShell script that decodes a base64-encoded command and executes it. Which MITRE ATT&CK technique is this behavior most associated with?

A.T1059.001 (PowerShell)

B.T1055 (Process Injection)

C.T1003 (Credential Dumping)

D.T1027 (Obfuscated Files or Information)

AnswerD

Base64 encoding is a form of obfuscation.

Why this answer

Obfuscated Files or Information (T1027) includes encoding. PowerShell execution is also part of T1059.001, but the encoding aspect points to T1027.

Full explanation →

MCQmedium

You are investigating a detection in Microsoft Defender for Endpoint. The PowerShell output shows a threat with ID 2147723152. Which type of threat does this ID represent?

A.Ransomware

B.HackTool

C.Worm

D.Trojan

AnswerB

2147723152 is a known hacktool detection.

Why this answer

Threat ID 2147723152 corresponds to a hacktool (specifically, a tool used for penetration testing), often detected as 'HackTool:MSIL/Mimikatz!dha'.

Full explanation →

MCQmedium

A company uses Microsoft Defender XDR and has enabled automatic attack disruption for human-operated ransomware. During an incident, the system automatically contains a compromised account. However, the SOC team wants to ensure that the containment action is reversible and that the account can be restored after investigation. What should the team do before restoring the account?

A.Change the account's password and enable multi-factor authentication.

B.Verify that no other accounts were compromised.

C.Remove the account from all administrative roles.

D.Run a full antivirus scan on the account's devices.

AnswerA

Resetting the password and enabling MFA ensures the account is secured before restoration.

Why this answer

After automatic containment disables a compromised account, the SOC team must change its password and enable multi-factor authentication before restoring it. This ensures the attacker cannot regain access with stolen credentials. Option B is a good practice but not a prerequisite for restoring this specific account.

Option C is unnecessary if the account was not an administrator. Option D is irrelevant because containment applies to the account, not devices.

Full explanation →

MCQeasy

Your organization uses Microsoft Sentinel. A security incident is created, and the assigned analyst needs to perform initial triage. What is the first step the analyst should take according to Microsoft best practices for incident response?

A.Contain the affected resources immediately to prevent further damage.

B.Run a full investigation using Microsoft 365 Defender hunting queries.

C.Review the incident details and verify the alert is a true positive.

D.Escalate the incident to the senior security team.

AnswerC

First step is to validate the alert.

Why this answer

The first step in the Microsoft incident response process is to verify the alert and determine its validity. Option A is wrong because containment should follow after verification. Option B is wrong because escalating before verification bypasses triage.

Option D is wrong because detailed investigation comes after initial triage.

Full explanation →

Multi-Selecteasy

Your organization uses Microsoft Sentinel. You are investigating an incident and need to gather additional context about a suspicious IP address. Which TWO Microsoft Sentinel features can you use to enrich the investigation?

Select 2 answers

A.Threat intelligence

B.Watchlist

C.Hunting

D.Entity behavior analytics

E.User and Entity Behavior Analytics (UEBA)

AnswersA, D

Threat intelligence can indicate if the IP is known malicious.

Why this answer

Threat intelligence is correct because it allows you to cross-reference the suspicious IP address against known threat intelligence feeds (e.g., Tor exit nodes, known C2 servers) directly within Microsoft Sentinel. This enriches the investigation by providing context such as reputation scores, associated malware families, and geographic origin, helping you assess the IP's maliciousness.

Exam trap

The trap here is that candidates often confuse UEBA (Option E) with entity behavior analytics (Option D), but UEBA is a broader analytics framework that does not directly enrich a specific IP address with external threat context, whereas entity behavior analytics is the correct feature for enriching investigation by providing entity-specific behavioral insights.

Full explanation →

MCQmedium

A security analyst in Microsoft 365 Defender is investigating an email-based threat. The analyst needs to find all emails that were initially delivered to user inboxes but were later remediated (e.g., moved to junk, deleted, or quarantined) by Zero-Hour Auto Purge (ZAP). Which advanced hunting tables should the analyst query to get both the original email metadata and the post-delivery remediation events?

A.EmailEvents and EmailPostDeliveryEvents

B.EmailEvents and EmailAttachmentInfo

C.EmailPostDeliveryEvents and EmailUrlInfo

D.EmailEvents and CloudAppEvents

AnswerA

Correct. EmailEvents has delivery info; EmailPostDeliveryEvents has ZAP and other post-delivery actions.

Why this answer

To investigate emails that were initially delivered but later remediated by Zero-Hour Auto Purge (ZAP), you need both the original email metadata (from EmailEvents) and the post-delivery remediation actions (from EmailPostDeliveryEvents). EmailEvents provides details like sender, recipient, subject, and delivery status, while EmailPostDeliveryEvents records ZAP actions such as moving to junk, deleting, or quarantining. Querying these two tables together allows you to correlate the initial delivery with the subsequent remediation event.

Exam trap

The trap here is that candidates may think EmailPostDeliveryEvents alone suffices, but without EmailEvents you cannot confirm the original delivery status (e.g., 'Delivered') which is essential to distinguish ZAP from other post-delivery actions like manual user moves.

How to eliminate wrong answers

Option B is wrong because EmailAttachmentInfo only contains metadata about email attachments (e.g., file name, hash) and does not include post-delivery remediation events or original email delivery metadata needed for ZAP investigation. Option C is wrong because EmailUrlInfo only contains URL-related information from emails (e.g., clicked links) and lacks the original email metadata from EmailEvents, so you cannot see the initial delivery status. Option D is wrong because CloudAppEvents tracks activities in Microsoft cloud apps (e.g., SharePoint, OneDrive) and is not related to email delivery or ZAP remediation events in Exchange Online.

Full explanation →

Multi-Selectmedium

Which TWO data sources are most relevant for threat hunting for lateral movement using remote service creation (e.g., WMI, PsExec)?

Select 2 answers

A.DeviceRegistryEvents

B.DeviceEvents

C.DeviceNetworkEvents

D.DeviceFileEvents

E.DeviceProcessEvents

AnswersC, E

Captures network connections to remote admin shares (e.g., port 445) or high ports.

Why this answer

Correct options: C and E. DeviceProcessEvents captures process creation on remote machines (e.g., services.exe, cmd.exe) which is indicative of remote service creation via WMI or PsExec. DeviceNetworkEvents captures outbound network connections to high ports (e.g., 135, 445) on remote machines.

Option A (DeviceRegistryEvents) captures registry modifications, not directly relevant. Option B (DeviceEvents) is less specific for this scenario. Option D (DeviceFileEvents) captures file writes, not process execution.

Full explanation →

MCQeasy

A threat hunter wants to use Microsoft Sentinel to hunt for signs of brute-force attacks against Azure AD (now Microsoft Entra ID). Which data connector should be enabled to ingest sign-in logs?

A.Windows Security Events via AMA

B.DNS (Preview)

C.Microsoft Entra ID Audit Logs

D.Microsoft Entra ID

AnswerD

Microsoft Entra ID connector ingests sign-in logs and audit logs.

Why this answer

Microsoft Entra ID (formerly Azure AD) connector. This connector ingests sign-in logs, which contain authentication attempts and can be used to detect brute-force attacks. Option A (Windows Security Events via AMA) captures on-premises Windows security events, not cloud sign-ins.

Option B (DNS Preview) ingests DNS query logs, not sign-in logs. Option C (Microsoft Entra ID Audit Logs) captures audit logs (e.g., user management, configuration changes), not authentication sign-in logs. Therefore, only Option D provides the necessary sign-in log data for hunting brute-force attacks.

Full explanation →

MCQhard

You are threat hunting in Microsoft Sentinel and have enabled UEBA. You want to detect a possible privilege escalation where a user creates a new user account and adds it to a privileged role within minutes. Which UEBA anomaly type should you investigate?

A.Unusual file access

B.Impossible travel

C.Mass role assignment changes

D.Anomalous sign-in

AnswerC

Mass role assignment changes indicates privilege escalation.

Why this answer

UEBA detects 'Mass role assignment changes' as an anomaly that could indicate privilege escalation. Option A (Unusual file access) is for data exfiltration. Option B (Impossible travel) is for geographic anomalies.

Option D (Anomalous sign-in) focuses on authentication.

Full explanation →

Matchingmedium

Match each Microsoft Defender for Cloud security alert to its description.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts

Matches

Anomalous process run on a VM

Multiple failed login attempts from an IP

Antimalware scan found a threat

Download of a suspicious file from an external source

Unusual outbound data transfer detected

Why these pairings

Correct matches: SQL Injection detects SQL code injection, Brute Force detects multiple failed logins, Malware Alert detects known malware. Common confusions include swapping definitions between these alerts.

Full explanation →

MCQhard

Your organization uses Microsoft Sentinel with the Microsoft Defender XDR connector. You are hunting for signs of a possible Kerberos Golden Ticket attack. Which advanced hunting table should you query to detect anomalous Kerberos ticket-granting ticket (TGT) requests?

A.IdentityLogonEvents

B.DeviceEvents

C.IdentityDirectoryEvents

D.CloudAppEvents

AnswerC

IdentityDirectoryEvents include domain controller events such as Kerberos ticket requests and can help detect Golden Ticket attacks.

Why this answer

IdentityDirectoryEvents captures domain controller events, including Kerberos authentication details. Option A (IdentityLogonEvents) is for user logons. Option B (DeviceEvents) for endpoint processes.

Option D (CloudAppEvents) for cloud apps.

Full explanation →

MCQhard

You are threat hunting for signs of Kerberoasting in Microsoft Sentinel. Which combination of events indicates that a service account's Kerberos ticket was requested and then used?

A.Event ID 4769 (Kerberos Service Ticket Request) followed by Event ID 4624 (An account was logged on)

B.Event ID 4770 (Kerberos Ticket Renewal) followed by Event ID 4634 (Logoff)

C.Event ID 4740 (Account Lockout) followed by Event ID 4625 (Failed Logon)

D.Event ID 4768 (Kerberos Authentication Ticket) followed by Event ID 4776 (Credential Validation)

AnswerA

Service ticket request and subsequent logon are key indicators.

Why this answer

Kerberoasting involves TGS requests (4769) followed by service logon (4624). Option B is for AS requests. Option C is for account lockout.

Option D is for ticket renewal.

Full explanation →

MCQmedium

Your organization has Microsoft Defender for Cloud Apps (MDA) connected to Microsoft Sentinel. The SOC team wants to receive alerts when a user accesses a sanctioned cloud app from an anonymous IP address. What should you configure?

A.Create a file policy in Defender for Cloud Apps.

B.Create an activity policy in Defender for Cloud Apps and connect it to Sentinel.

C.Enable the Defender for Cloud Apps connector in Sentinel without additional configuration.

D.Create a session policy in Defender for Cloud Apps.

AnswerB

Activity policies can detect specific behaviors like anonymous IP access and send alerts to Sentinel.

Why this answer

An activity policy in Defender for Cloud Apps can be configured to trigger alerts on specific user activities, such as accessing a sanctioned app from an anonymous IP address. This policy can then be connected to Microsoft Sentinel via the Defender for Cloud Apps data connector, which ingests alerts as incidents for SOC review. File policies (A) focus on file-level actions like sharing or malware detection, not user access events, while session policies (D) control real-time access but do not generate alerts for historical or post-access monitoring.

Exam trap

The trap here is that candidates confuse file policies with activity policies, assuming any policy in Defender for Cloud Apps can detect access events, but only activity policies are designed to monitor user sign-in and access behaviors against IP-based conditions.

How to eliminate wrong answers

Option A is wrong because file policies monitor file-related activities (e.g., sharing, upload, download) and cannot detect user access events like logging into an app from an anonymous IP. Option C is wrong because simply enabling the Defender for Cloud Apps connector in Sentinel without additional configuration only ingests default alerts (e.g., from anomaly detection policies), not custom activity-based alerts for anonymous IP access. Option D is wrong because session policies are designed for real-time access control and monitoring during a user session (e.g., blocking downloads), not for generating alerts on access events that have already occurred.

Full explanation →

Multi-Selectmedium

Which TWO actions are appropriate when handling a confirmed ransomware incident in Microsoft 365?

Select 2 answers

A.Run a full antivirus scan on all devices.

B.Restore encrypted files from backup immediately without investigation.

C.Pay the ransom to regain access.

D.Isolate affected devices from the network.

E.Change passwords for all potentially compromised accounts.

AnswersD, E

Isolation contains the spread of ransomware.

Why this answer

Correct: Isolate affected devices to prevent spread, and change passwords for compromised accounts. Wrong: Paying ransom is not recommended; restoring from backup is good but not immediate; scanning with antivirus is reactive and may not remove all traces.

Full explanation →

MCQhard

Your organization is migrating to Microsoft Sentinel. You need to ensure that the workspace retains data for 2 years for compliance, but you want to reduce costs by using cheaper storage for data older than 90 days. What should you configure?

A.Set the workspace retention to 730 days and enable a data cap.

B.Set workspace retention to 90 days and configure long-term retention in Azure Data Explorer (ADX).

C.Export data older than 90 days to a storage account and delete from workspace.

D.Configure the workspace retention to 90 days and use Azure Storage archiving.

AnswerB

ADX integration allows cost-effective long-term retention with query capabilities.

Why this answer

Microsoft Sentinel allows you to set the workspace retention to 90 days for interactive, hot-tier access, and then configure long-term retention in Azure Data Explorer (ADX) for data older than 90 days. This approach meets the 2-year compliance requirement while reducing costs, as ADX provides cheaper storage for older data that is queried less frequently.

Exam trap

The trap here is that candidates often confuse Azure Storage archiving or data export with the ability to query the data in Sentinel, not realizing that only ADX provides native, queryable long-term retention integrated with Sentinel's KQL interface.

How to eliminate wrong answers

Option A is wrong because enabling a data cap does not provide cheaper storage for older data; it only limits data ingestion, and setting workspace retention to 730 days keeps all data in the expensive hot tier for the entire period, increasing costs. Option C is wrong because exporting data to a storage account and deleting it from the workspace breaks the ability to query that data within Sentinel, and Sentinel does not natively support querying data from external storage accounts without additional tooling. Option D is wrong because Azure Storage archiving is not natively integrated with Sentinel for querying archived data; Sentinel requires data to be in the workspace or in ADX for long-term retention with query capability.

Full explanation →

Multi-Selectmedium

Your Microsoft Sentinel workspace ingests logs from Microsoft Defender for Cloud and Microsoft 365 Defender. You need to create an incident response playbook that automatically responds to high-severity incidents. Which THREE components are required? (Choose three.)

Select 3 answers

A.A workbook to visualize the incident data

B.An analytics rule that generates the incident

C.An automation rule in Microsoft Sentinel

D.A hunting query to search for similar activity

E.A Logic Apps workflow with Microsoft Sentinel trigger

AnswersB, C, E

Correct. An analytics rule defines the conditions that generate an incident, which is necessary for any automated response.

Why this answer

The correct components are: an analytics rule to generate the incident (B), an automation rule to trigger the playbook (C), and a Logic Apps workflow with Microsoft Sentinel trigger to define the automated response actions (E). Option A (workbook) is for visualization, not automation. Option D (hunting query) is for proactive threat hunting, not automatic incident response.

Full explanation →

MCQhard

During a hunt, you find a device that made successive outbound connections to multiple IP addresses on port 445 (SMB) within a short time. Which type of activity does this pattern most likely indicate?

A.Data exfiltration

B.Lateral movement preparation

C.Command and control beaconing

D.Internal reconnaissance

AnswerB

Scanning for SMB shares is a common lateral movement technique.

Why this answer

Port 445 is used for SMB. Rapid successive connections to many IPs on SMB suggests scanning for open SMB shares, often a precursor to lateral movement. Option A (data exfiltration) typically uses HTTP/HTTPS.

Option C (C2 beaconing) uses common ports like 80/443. Option D (reconnaissance) is broad; the specific pattern points to lateral movement via SMB.

Full explanation →

MCQhard

Your organization uses Microsoft Sentinel and has multiple workspaces for different regions. The security team wants to use a single workbook to display data from all workspaces. What is the correct approach?

A.Create a workbook with cross-workspace queries using the workspace() expression

B.Export data from all workspaces to a single Azure Data Lake

C.Create a workbook in one workspace and configure it to use Azure Lighthouse

D.Create a workbook in each workspace and merge them manually

AnswerA

Cross-workspace queries allow a single workbook to query multiple workspaces.

Why this answer

Microsoft Sentinel workbooks support cross-workspace queries using the `workspace()` expression in Kusto Query Language (KQL). This allows a single workbook to aggregate and display data from multiple Sentinel workspaces without moving or duplicating the data, meeting the security team's requirement efficiently.

Exam trap

The trap here is that candidates may confuse Azure Lighthouse (which is for cross-tenant management) with cross-workspace querying, or assume that data must be centralized (e.g., via Data Lake) before it can be visualized in a single workbook.

How to eliminate wrong answers

Option B is wrong because exporting data to Azure Data Lake requires additional services (e.g., Azure Data Factory or Event Hubs) and does not provide a native way to query the data in a Sentinel workbook; it also incurs extra cost and latency. Option C is wrong because Azure Lighthouse enables cross-tenant management but does not allow a single workbook to query multiple workspaces within the same tenant; workbooks still need explicit cross-workspace queries. Option D is wrong because creating separate workbooks in each workspace and manually merging them is not a scalable or automated solution, and it defeats the purpose of a single unified view.

Full explanation →

MCQhard

Your organization uses Microsoft Sentinel. You have a custom analytics rule that generates incidents based on a KQL query. The rule is configured to run every 5 minutes. You notice that the rule is generating duplicate incidents for the same event. What should you do to prevent duplicates?

A.Create an automation rule that deletes duplicate incidents.

B.Set the rule to group alerts into a single incident if they occur within 5 minutes.

C.Create a playbook that checks for duplicates before incident creation.

D.Enable entity mapping in the analytics rule and set appropriate entities.

AnswerD

Correct: Entity mapping helps group related alerts.

Why this answer

To prevent duplicate incidents in Microsoft Sentinel, you should enable entity mapping in the analytics rule and set appropriate entities (option D). Entity mapping allows Sentinel to group alerts into a single incident based on common entities (e.g., user, host, IP address). Option A is wrong because automation rules can delete incidents post-creation but do not prevent duplicates at source.

Option B is wrong because grouping alerts by time only (within 5 minutes) may still miss duplicates if events are spaced beyond that window; entity mapping provides more precise deduplication. Option C is wrong because playbooks run after incident creation and cannot prevent duplicates from being generated in the first place.

Full explanation →

MCQhard

Your organization uses Microsoft Sentinel with the Microsoft Defender XDR connector. During a hunt, you notice that some alerts from Microsoft Defender for Identity are not appearing in Sentinel. You have verified the connector is enabled and data is flowing for other Defender products. What is the most likely cause?

A.The Microsoft Sentinel pricing tier is set to Free, which limits data ingestion.

B.The 'IdentityLogonEvents' data type is disabled in the Microsoft Sentinel connector configuration.

C.The Microsoft Sentinel workspace is in a different region than Microsoft Defender for Identity.

D.Your tenant does not have the required Microsoft Entra ID P2 license for Microsoft Defender for Identity alerts.

AnswerD

Microsoft Defender for Identity alerts require Microsoft Entra ID P2 license to be forwarded to Sentinel.

Why this answer

Microsoft Defender for Identity alerts require a premium Azure AD P2 license to be ingested via the connector. Option A is wrong because the connector is enabled. Option B is wrong because data ingestion is working for other products.

Option C is wrong because the data types are not disabled.

Full explanation →

Multi-Selectmedium

Which TWO Microsoft 365 Defender advanced hunting tables would you use together to investigate a potential data exfiltration via email?

Select 2 answers

A.EmailEvents

B.EmailAttachmentInfo

C.DeviceNetworkEvents

D.CloudAppEvents

E.DeviceProcessEvents

AnswersA, B

Contains sender, recipient, subject, and other email properties.

Why this answer

(EmailEvents) is correct because it contains email metadata such as sender, recipient, subject, and delivery details. Option B (EmailAttachmentInfo) is correct because it provides details about attachments in emails, including file names and sizes. Together, they allow investigation of data exfiltration via email by correlating email events with attachment data.

Option C (DeviceNetworkEvents) focuses on network connections from devices, not email. Option D (CloudAppEvents) covers activities in cloud applications, not specifically email. Option E (DeviceProcessEvents) deals with process executions on endpoints, irrelevant to email exfiltration.

Full explanation →

MCQmedium

Your organization uses Microsoft Sentinel. You receive an incident that involves a potential lateral movement detected by Microsoft Defender for Identity. You need to investigate the timeline of the attack. Which Microsoft Sentinel feature should you use?

A.Workbooks

B.Automation rules

C.Investigation graph

D.Analytics rules

AnswerC

Visual timeline for investigation.

Why this answer

The Investigation graph in Microsoft Sentinel is specifically designed to explore the scope and timeline of an attack by visually mapping entities (e.g., users, devices, IPs) and their connections. For a lateral movement incident detected by Defender for Identity, the graph automatically surfaces related alerts, entities, and activities in a chronological view, enabling you to trace the attacker's path across resources. This makes it the correct tool for investigating the attack timeline.

Exam trap

The trap here is that candidates confuse the Investigation graph with Workbooks, assuming any visual tool for analysis is a Workbook, but Workbooks are for aggregated reporting, not for per-incident entity timeline exploration.

How to eliminate wrong answers

Option A is wrong because Workbooks are used for creating custom dashboards and reports from pre-defined queries, not for interactive, entity-based timeline investigation of a specific incident. Option B is wrong because Automation rules are designed to trigger automated responses (e.g., closing incidents, assigning tasks) based on conditions, not to explore the historical sequence of an attack. Option D is wrong because Analytics rules define detection logic to generate alerts from data sources, but they do not provide a visual, entity-centric timeline for investigating an already-triggered incident.

Full explanation →

MCQeasy

You are reviewing a custom analytics rule in Microsoft Sentinel. The rule is enabled but you notice that no alerts have been generated even though there are many matching events. What is the most likely cause?

A.The rule is not associated with a data connector.

B.The triggerThreshold of 5 requires at least 5 matching events in each hour.

C.The queryPeriod is too short to capture events.

D.The rule is suppressed due to suppressionDuration of 5 hours.

AnswerB

If fewer than 5 events occur, no alert is created.

Why this answer

The rule suppresses alerts for 5 hours after an alert is generated. Since suppression is enabled (suppressionEnabled: true? Actually the value is false, but the duration is set. Wait, suppressionEnabled is false, so suppression is disabled.

However, the queryFrequency and queryPeriod are both 1 hour, and triggerThreshold is 5. If there are many matching events, the threshold might not be met if events are spread out. But the exhibit shows suppressionEnabled: false, so suppression is not the issue.

The most likely cause is that the rule has a triggerThreshold of 5, meaning it requires at least 5 events in the query period. If there are fewer than 5, no alert is generated.

Full explanation →

MCQeasy

Refer to the exhibit. You are reviewing an alert in Microsoft Defender for Endpoint. The alert details are shown. Which of the following actions should you take first?

A.Investigate the device and the alert details

B.Mark the alert as a false positive

C.Initiate device isolation to contain the threat

D.Run a full antivirus scan on the device

AnswerA

Investigation is the first step.

Why this answer

The first step in incident response is to investigate the alert details and the affected device to understand the scope and severity of the threat. Without investigation, you cannot determine whether the alert is a true positive, whether isolation is appropriate, or which remediation steps are needed. Microsoft Defender for Endpoint provides a rich investigation experience, including the alert story, device timeline, and related events, which must be reviewed before taking any containment or remediation actions.

Exam trap

The trap here is that candidates often jump to containment (isolation) or remediation (scan) because they think speed is critical, but the SC-200 exam emphasizes that investigation must always come first to avoid disrupting business operations or misclassifying alerts.

How to eliminate wrong answers

Option B is wrong because marking an alert as a false positive without investigation risks ignoring a real threat; you must first analyze the alert to confirm it is indeed benign. Option C is wrong because initiating device isolation should only be done after confirming the alert is a true positive and understanding the threat's behavior, as premature isolation can disrupt legitimate operations and lose forensic data. Option D is wrong because running a full antivirus scan is a remediation step that should follow investigation and containment, not precede them; scanning without context may miss advanced threats or alert on known good files.

Full explanation →

MCQmedium

Your organization uses Microsoft Sentinel and Microsoft Defender XDR. You are responsible for managing the security operations environment. Recently, the SOC team reported that incidents from Microsoft Defender for Endpoint are not appearing in Microsoft Sentinel. You have already configured the data connector for Microsoft Defender XDR and verified that logs are flowing into the 'SecurityAlert' table. However, incidents are not being created in Sentinel. What should you do?

A.Enable 'Create incidents from Microsoft 365 Defender' in the Microsoft Defender XDR data connector.

B.Create an analytics rule that queries the SecurityAlert table and generates incidents.

C.Verify the Azure Sentinel solution is installed and enable the streaming of incidents.

D.Configure the Microsoft Defender for Endpoint data connector.

AnswerA

Correct: This setting creates Sentinel incidents from Defender XDR incidents.

Why this answer

Incident creation from Defender XDR requires enabling the 'Microsoft 365 Defender' incident creation in the data connector. Option B is wrong because analytics rules are not needed; incidents come from the connector. Option C is wrong because that connector is for alerts, not incidents.

Option D is wrong because streaming is not the issue.

Full explanation →

MCQhard

A SOC analyst is using Microsoft Sentinel to investigate an incident involving a user who accessed a sensitive database from an unusual location. The analyst wants to find all activities performed by this user within the last 24 hours from multiple data sources. Which KQL operator should the analyst use to combine the results of two queries that return different schemas?

A.summarize

B.join

C.union

D.where

AnswerC

union combines multiple tables with different schemas by appending rows and adding nulls for missing columns.

Why this answer

The union operator combines tables or query results with different schemas by adding columns. Join requires a common column. The other operators are not appropriate.

Full explanation →

MCQeasy

Your organization uses Microsoft Sentinel. You have configured a data connector to ingest events from a third-party firewall. However, you notice that the logs are not appearing in Sentinel. What is the first thing you should check?

A.Check the firewall's syslog server configuration.

B.Verify that the workspace is in the correct region.

C.Reinstall the Log Analytics agent on the firewall.

D.Check the connector health page in Microsoft Sentinel.

AnswerD

The connector health page shows if the connector is connected and any errors.

Why this answer

The connector health page provides status and error messages for data connectors, making it the first place to troubleshoot. Options A, C, and D are less direct or irrelevant to connector issues.

Full explanation →

Multi-Selectmedium

Which THREE resources can be used as data sources for Microsoft Sentinel to detect security incidents? (Choose three.)

Select 3 answers

A.Microsoft 365 Defender

B.Microsoft Defender for Cloud

C.Azure Activity Log

D.Azure Cost Management

E.Azure Advisor

AnswersA, B, C

Provides integrated threat signals from endpoints, email, etc.

Why this answer

Options A, B, and C are correct. Microsoft 365 Defender provides integrated threat signals across endpoints, email, and identities. Microsoft Defender for Cloud delivers security alerts and posture assessments for cloud workloads.

Azure Activity Log captures subscription-level operational events, which can be streamed to Sentinel. Option D is incorrect because Azure Cost Management focuses on cost tracking and budgeting, not security events. Option E is incorrect because Azure Advisor provides optimization recommendations, not security incident data.

Full explanation →

Multi-Selecthard

Which THREE are valid methods to collect forensic evidence from a compromised Windows machine during incident response in Microsoft Defender XDR? (Choose three.)

Select 3 answers

A.Reset the device to a clean state

B.Collect a memory dump from the device using Live Response

C.Perform a full disk image using Microsoft Defender for Endpoint

D.Run Live Response commands to collect files and run scripts

E.Export Windows Event Logs using Live Response

AnswersB, D, E

Memory dump captures running processes and network connections.

Why this answer

Options B, D, and E are correct: Live Response allows script execution and file collection; collecting a memory dump captures volatile evidence necessary for forensic analysis; exporting Windows Event Logs provides a timeline of events. Option A is incorrect because resetting the device destroys evidence instead of preserving it. Option C is incorrect because full disk imaging is not natively supported in Microsoft Defender XDR; it requires external tools.

Full explanation →

MCQeasy

Your organization uses Microsoft Sentinel and Microsoft Defender XDR. The security team wants to automatically create an incident in Microsoft Sentinel when a Microsoft Defender for Endpoint alert is triggered. What should you configure?

A.Enable the Microsoft Defender XDR connector in Microsoft Sentinel and select the incident creation settings.

B.Set up a Logic App custom connector to poll Defender alerts.

C.Configure the Security Events connector to forward Defender alerts.

D.Create analytics rules in Microsoft Sentinel for each Defender alert type.

AnswerA

The Microsoft Defender XDR connector automatically creates incidents from Defender alerts.

Why this answer

The Microsoft Defender XDR connector in Microsoft Sentinel is specifically designed to ingest alerts and incidents from Microsoft Defender for Endpoint and other Defender products. By enabling this connector and configuring its incident creation settings, Sentinel automatically creates incidents when Defender for Endpoint alerts are triggered, without requiring custom logic or manual polling.

Exam trap

The trap here is that candidates often confuse the purpose of analytics rules (which generate alerts from raw data) with the connector's role (which ingests pre-existing alerts from external sources), leading them to incorrectly select Option D.

How to eliminate wrong answers

Option B is wrong because a Logic App custom connector would require building a custom polling mechanism, which is unnecessary and inefficient when the native Microsoft Defender XDR connector already provides automated, real-time incident ingestion. Option C is wrong because the Security Events connector is used to collect Windows security event logs (e.g., Event ID 4625) from on-premises or cloud-based systems, not Defender for Endpoint alerts. Option D is wrong because analytics rules in Sentinel are used to generate alerts from raw data sources (like Syslog or Windows Events), not to import existing alerts from Defender for Endpoint; the connector handles that ingestion automatically.

Full explanation →

Multi-Selecteasy

Which TWO tasks can you perform using Microsoft Sentinel automation rules?

Select 2 answers

A.Send an email notification without a playbook.

B.Assign an incident to an analyst.

C.Delete an incident.

D.Change the severity of an incident.

E.Create a new analytics rule.

AnswersB, D

Automation rules can assign incidents.

Why this answer

Automation rules in Microsoft Sentinel can directly assign incidents to specific analysts or groups without requiring a playbook. This is a native action within the automation rule configuration, enabling immediate ownership and accountability for incident response.

Exam trap

The trap here is that candidates often confuse automation rule capabilities with playbook actions, assuming email notifications or deletions are possible natively, but Microsoft Sentinel restricts automation rules to incident property changes and playbook triggers only.

Full explanation →

MCQeasy

A junior SOC analyst receives multiple low-severity alerts from Microsoft Sentinel. The alerts are related to failed logon attempts from a single IP address over a short period. The analyst wants to group these alerts into a single incident to reduce noise. What should the analyst do?

A.Use the Microsoft Defender XDR incident queue to group the alerts

B.Configure the analytics rule to group alerts into incidents by the IP address

C.Create an automation rule to close duplicate alerts

D.Manually merge the alerts into one incident in the Sentinel incidents blade

AnswerB

Incident grouping in the analytics rule automatically groups related alerts.

Why this answer

Incident grouping in analytics rules allows merging of alerts into a single incident based on criteria like IP address. Option A is wrong because manually grouping is not scalable. Option C is wrong because the incident queue does not have a built-in grouping feature.

Option D is wrong because automation rules do not group alerts; they act on incidents.

Full explanation →

Matchingmedium

Match each Microsoft Sentinel incident management action to its purpose.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts

Matches

Designate an owner for the incident

Resolve the incident as false positive or true positive

Document investigation notes

Adjust impact level based on findings

Trigger automated response actions

Why these pairings

The correct matches are: Change incident status updates the state, Assign incident assigns to an analyst, and Close incident resolves. Common confusions involve swapping Add comments (for notes) and Add tags (for custom labels).

Full explanation →

Multi-Selectmedium

Your organization uses Microsoft Sentinel and you are designing a data retention strategy. You have a Log Analytics workspace with the following tables: SecurityEvent, SigninLogs, and CommonSecurityLog. The compliance team requires that SigninLogs be retained for 7 years, while other tables can be retained for 1 year. Which THREE steps must you take to meet this requirement?

Select 3 answers

A.Set an archiving policy to move SigninLogs to cold storage after 1 year.

B.Set the workspace retention to 7 years.

C.Enable Azure Data Explorer (ADX) for long-term storage.

D.Configure table-level retention for SigninLogs to 7 years.

E.Ensure that the workspace is in a region that supports 7-year retention.

AnswersB, D, E

Setting the Log Analytics workspace retention to 7 years ensures that all tables, including SigninLogs, will initially meet the 7-year retention requirement for Microsoft Entra ID sign-in data. This is crucial because individual table retention settings can only reduce, not extend, the overall workspace retention period. Therefore, this step establishes the necessary ceiling, allowing SecurityEvent and CommonSecurityLog tables to be subsequently configured with a 1-year retention, overriding the workspace default downwards.

Why this answer

Setting the workspace retention to 7 years ensures that all tables in the workspace, including SigninLogs, are retained for the maximum required period. However, this alone would also retain other tables longer than needed, so you must combine it with table-level retention to override the workspace setting for specific tables. This approach allows you to meet the 7-year compliance requirement for SigninLogs while keeping other tables at 1 year.

Exam trap

The trap here is that candidates often think archiving (Option A) or external services like ADX (Option C) are required for long-term retention, when in fact Log Analytics supports up to 7 years of native retention with table-level granularity, making workspace and table-level settings the correct combination.

Full explanation →

MCQhard

A security analyst is configuring Microsoft Sentinel scheduled analytics rules to detect brute-force attacks on Microsoft Entra ID. Arrange the steps in the correct order from first to last.

A.Create a query using KQL to count failed sign-ins. → Set the rule schedule (run every 5 minutes). → Set the alert threshold (e.g., >5 failed sign-ins from same IP in 5 minutes). → Define incident properties (title, severity, tactics). → Configure grouping settings to group alerts into incidents.

B.Verify results before configuring the source or rule settings.

C.Configure alert grouping before defining the detection query or source.

D.Skip validation and enable the rule or plan immediately.

AnswerA

This order follows the required configuration sequence and verifies the result last.

Why this answer

The standard workflow for creating a scheduled analytics rule in Microsoft Sentinel begins with defining the detection logic via a KQL query, then configuring the schedule and threshold, followed by incident properties and grouping settings. This sequence ensures the rule has a valid query before setting operational parameters like run frequency and alert aggregation.

Exam trap

The trap here is that candidates often assume alert grouping or incident configuration can be done before the detection query is written, but Microsoft Sentinel requires the query to be defined first because grouping settings depend on the query's output schema.

How to eliminate wrong answers

Option B is wrong because verifying results (e.g., via the 'Run Query' button) should occur after the query is written, not before configuring the source or rule settings; the order implies skipping essential configuration steps. Option C is wrong because alert grouping (how alerts are combined into incidents) must be configured after the detection query and threshold are defined, as grouping depends on the alert output structure. Option D is wrong because skipping validation and enabling the rule immediately violates best practices; validation (testing the query and reviewing alerts) is critical to avoid false positives or missed detections.

Full explanation →

Multi-Selecteasy

Which TWO are valid incident classification categories in Microsoft Sentinel?

Select 2 answers

A.Benign positive

B.Unknown

C.True positive

D.Informational

E.False positive

AnswersC, E

Standard classification.

Why this answer

In Microsoft Sentinel, incident classification categories are used to determine the disposition of an alert. 'True positive' (Option C) is a valid classification indicating that the alert correctly identified a real security threat, and 'False positive' (Option E) is also valid, meaning the alert was triggered incorrectly. These two are part of the standard classification options in Sentinel's incident management.

Exam trap

The trap here is that candidates often confuse incident classification categories (True positive, False positive, Benign positive) with alert severity levels (Informational, Low, Medium, High) or investigation statuses (New, In progress, Resolved), leading them to select 'Informational' or 'Unknown' as valid classifications.

Full explanation →

MCQeasy

Your SOC uses Microsoft Sentinel and Microsoft Defender for Cloud Apps. You need to configure a policy that triggers when a user downloads a large number of files from SharePoint Online within a short period. Which policy type should you use?

A.Session policy

B.File policy

C.Anomaly detection policy

D.Activity policy

AnswerD

Activity policies allow custom detection of specific activities like mass downloads.

Why this answer

An activity policy in Microsoft Defender for Cloud Apps is designed to monitor and respond to specific user activities, such as downloading a large number of files from SharePoint Online within a short period. This policy type allows you to set thresholds and triggers based on user actions, making it the correct choice for detecting anomalous download behavior.

Exam trap

The trap here is that candidates often confuse anomaly detection policies (which are predefined and use machine learning) with activity policies (which are customizable and rule-based), leading them to select anomaly detection when a custom threshold-based trigger is required.

How to eliminate wrong answers

Option A is wrong because session policies are used for real-time monitoring and control of user sessions, such as blocking downloads during a session, but they do not trigger based on historical activity thresholds like a large number of downloads over time. Option B is wrong because file policies focus on detecting specific file types, content, or metadata (e.g., sensitive data in files), not on the volume or frequency of file downloads. Option C is wrong because anomaly detection policies in Defender for Cloud Apps use machine learning to detect unusual patterns across users, but they are predefined and cannot be customized to trigger specifically on a high volume of downloads from SharePoint Online within a short period.

Full explanation →

MCQeasy

A SOC analyst receives a phishing alert in Microsoft Defender for Office 365. The analyst needs to quickly determine if any users clicked the malicious link. Which action should the analyst take first?

A.Use Threat Explorer to search for the email subject

B.Open the user entity page for each recipient

C.Open the email entity page to view click details

D.Run a hunting query in Microsoft Sentinel

AnswerC

The email entity page shows whether recipients clicked the link.

Why this answer

The email entity page in Microsoft Defender for Office 365 provides detailed information about a specific email, including click verdicts for any URLs contained within. This allows the analyst to quickly see if any users clicked the malicious link. Option A (Threat Explorer) can also be used, but it requires more steps to filter for the specific email and then view click details.

Option B (user entity page) shows user-specific activities and alerts, but not email-specific click details. Option D (hunting query in Microsoft Sentinel) is effective but slower than directly viewing the email entity page in Defender for Office 365.

Full explanation →

Matchingmedium

Match each Microsoft 365 Defender role to its permission level.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts

Matches

Full access to all admin features

Manage security policies and view reports

Read-only access to security settings and logs

Respond to alerts and manage incidents

Manage compliance features and data loss prevention

Why these pairings

The correct matches: Global Administrator has full access; Security Administrator manages security; Security Reader has read-only access; Compliance Administrator manages compliance. Common confusions include swapping full access with read-only or misattributing the Global Administrator's scope.

Full explanation →

MCQhard

During a security incident, your team needs to preserve evidence from a Microsoft Defender for Endpoint onboarded device for forensic analysis. The device is still running and connected to the network. Which action should be taken to collect a forensic image while minimizing disruption?

A.Enable Microsoft Purview eDiscovery to preserve the device content.

B.Use the Microsoft Defender for Endpoint Live Response capability to acquire a disk image.

C.Isolate the device from the network using Microsoft Defender for Endpoint.

D.Initiate a Microsoft Sentinel data collection rule to export the device logs.

AnswerB

Live response supports disk acquisition for forensics while device remains on.

Why this answer

Live response allows collection of a forensic image (via disk acquisition) without shutting down the device, preserving volatile data. Option A is wrong because collecting from Microsoft Sentinel is not a forensic imaging method. Option C is wrong because isolating the device stops communication but does not collect an image.

Option D is wrong because it is not a built-in feature of Microsoft Purview.

Full explanation →

MCQmedium

Your security team uses Microsoft Sentinel to hunt for signs of credential theft. They want to correlate Azure AD sign-in logs with Microsoft Defender for Cloud Apps alerts. Which KQL operator should they use to join the two tables on the user principal name?

A.union

B.join

C.lookup

D.evaluate

AnswerB

Join correlates rows from two tables on a matching key.

Why this answer

The 'join' operator merges rows from two tables based on a matching key. Option A is incorrect because 'union' appends rows, not correlates. Option C is incorrect because 'lookup' is a type of join but is less common for this scenario.

Option D is incorrect because 'evaluate' is used for plugin execution, not joining tables.

Full explanation →

MCQeasy

Your organization uses Microsoft Sentinel and Microsoft Defender for Identity. An incident is generated for a potential lateral movement attack. The incident is linked to multiple alerts involving a domain controller and several workstations. You need to understand the attack path and identify the initial compromised account. Which feature should you use to visualize the attack chain? A) The incident graph in Microsoft Sentinel. B) The entity timeline in Microsoft Defender for Identity. C) The Microsoft 365 Defender attack story. D) The Microsoft Purview compliance portal. Which option provides the best visual representation of the attack path?

A.The incident graph in Microsoft Sentinel.

B.The Microsoft Purview compliance portal.

C.The entity timeline in Microsoft Defender for Identity.

D.The Microsoft 365 Defender attack story.

AnswerA

The incident graph visually maps entities and their connections, revealing the attack path.

Why this answer

The Microsoft Sentinel incident graph provides a visual representation of entities and their relationships, showing the attack path. Option B (Entity timeline) is linear and not a graph. Option C (Attack story) is in Defender XDR but focuses on alerts.

Option D (Purview) is for compliance, not security incidents.

Full explanation →

Multi-Selecteasy

Which TWO KQL operators are commonly used in threat hunting to join tables based on a key?

Select 2 answers

A.lookup

B.join

C.extend

D.summarize

E.union

AnswersA, B

Lookup extends a table with values from another based on keys.

Why this answer

Join and lookup are both used to combine tables based on keys. Union combines rows, summarize aggregates, extend adds columns.

Full explanation →

MCQmedium

You deploy this ARM template to a Microsoft Sentinel workspace. After deployment, you notice that the saved search does not appear as an analytics rule. What is the most likely reason?

A.The tags are incorrectly formatted.

B.The resource type is 'savedSearches', not 'scheduledQueryRules' or 'alertRules'.

C.The API version is incorrect.

D.The KQL query syntax is invalid.

AnswerB

Analytics rules are created using 'Microsoft.OperationalInsights/workspaces/scheduledQueryRules' or 'Microsoft.SecurityInsights/alertRules'.

Why this answer

Saved searches in Microsoft Sentinel are created under the 'Microsoft.OperationalInsights/workspaces/savedSearches' resource type, not as analytics rules. Analytics rules require a different resource type such as 'Microsoft.SecurityInsights/alertRules'. Therefore, deploying a saved search template will not create an analytics rule.

Option A is incorrect: tags are metadata and do not affect whether the resource appears as an analytics rule. Option C is incorrect: the API version used is valid for saved searches; an invalid API version would cause a deployment error, but the issue is the resource type, not the API version. Option D is incorrect: even if the KQL query syntax is invalid, the saved search would still be deployed as a saved search, but it would not become an analytics rule.

Full explanation →

Multi-Selecteasy

Which TWO are valid methods to ingest syslog data into Microsoft Sentinel?

Select 2 answers

A.Use the Syslog data connector from the Content hub

B.Configure a syslog forwarder with the Cisco ASIM parser

C.Use the Log Analytics agent to collect syslog from Linux machines

D.Deploy a Splunk Universal Forwarder to send syslog to Sentinel

E.Install a Windows-based syslog collector and forward to Sentinel using the Azure Monitor agent

AnswersA, C

The Syslog connector is a standard method.

Why this answer

The Syslog data connector available from the Content hub in Microsoft Sentinel provides a direct, built-in method to ingest syslog data from on-premises or cloud-based syslog sources. This connector uses the Log Analytics agent (or the newer Azure Monitor Agent with a Data Collection Rule) to collect syslog messages forwarded by a syslog daemon, typically over UDP port 514 or TCP, and maps them to the Syslog table in Log Analytics. It is the standard, supported approach for syslog ingestion without requiring third-party tools or custom parsers.

Exam trap

The trap here is that candidates confuse data ingestion methods with post-ingestion processing tools (like ASIM parsers) or assume that any universal forwarder (like Splunk's) can send data to Sentinel, when in fact only specific connectors and agents are supported for syslog ingestion.

Full explanation →

Matchingmedium

Match each Kusto Query Language (KQL) operator to its function.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts

Matches

Filters rows based on a condition

Groups rows and calculates aggregates

Selects specific columns

Creates computed columns

Combines rows from two tables

Why these pairings

These are fundamental KQL operators used in Microsoft Sentinel and Defender queries.

Full explanation →

MCQhard

A threat hunter is using Microsoft Sentinel to hunt for a potential advanced persistent threat (APT) that is using living-off-the-land binaries (LOLBins). The hunter creates a KQL query that lists all instances of certutil.exe making network connections. The query returns many legitimate results. What is the best way to reduce false positives while still detecting malicious use?

A.Replace the query with a Sysmon Event ID 3 (network connect) filter for certutil.exe

B.Remove certutil.exe from the hunting query and focus on other binaries

C.Expand the query to include all LOLBins that make network connections

D.Add additional filters to the query to detect only certutil.exe processes with suspicious command-line arguments (e.g., '-urlcache' or '-split')

AnswerD

Focusing on suspicious arguments reduces false positives because legitimate use typically does not involve these flags.

Why this answer

Malicious use of certutil.exe as a LOLBin often involves specific command-line arguments such as '-urlcache' or '-split' to download or encode data. By adding these filters to the KQL query, the hunter can reduce false positives from legitimate certutil.exe network connections while still capturing suspicious activity. Option A (Sysmon Event ID 3) still returns all network connections and does not filter on arguments, so it does not reduce false positives.

Option B would miss potential threats. Option C expands the query to include all LOLBins, which increases noise and does not target the specific binary in question.

Full explanation →

Multi-Selectmedium

Which TWO actions should a security analyst take when responding to a confirmed malware outbreak in Microsoft Defender for Endpoint?

Select 2 answers

A.Isolate the affected device

B.Run a full scan on the device

C.Create a custom detection rule for the malware

D.Delete the user account

E.Reset the user's password

AnswersA, B

Isolation stops the malware from spreading.

Why this answer

Options A and B are correct. Option A: Isolating the affected device immediately contains the outbreak and prevents lateral movement to other endpoints. Option B: Running a full scan ensures all malware components and artifacts are identified and removed.

Option C is wrong because creating a custom detection rule is a proactive measure for future detections, not an immediate response to a confirmed outbreak. Option D is wrong because deleting the user account is extreme and does not address the malware on the device. Option E is wrong because resetting the user's password helps with credential compromise but does not stop active malware.

Full explanation →

MCQmedium

Your organization uses Microsoft Sentinel with Microsoft Defender XDR integration. You have a scheduled analytics rule that detects failed logon attempts across multiple on-premises domain controllers. The rule is configured to run every 5 minutes and create an incident when more than 10 failed attempts occur from a single IP address within 5 minutes. Recently, the SOC team noticed that the rule is generating a high volume of low-fidelity incidents, mostly from legitimate users mistyping passwords. You need to reduce the number of false positive incidents while still detecting real brute-force attacks. What should you do?

A.Increase the query frequency to every 1 minute and reduce the threshold to 5.

B.Modify the query to require at least 20 failed attempts from a single IP and include a condition that the attempts are against multiple user accounts.

C.Disable the rule and create a new rule based on successful logons followed by failed attempts.

D.Decrease the threshold to 5 and add a condition to exclude known good IP addresses.

AnswerB

Higher threshold and multi-user condition reduce false positives from mistypes.

Why this answer

To reduce false positives, you can increase the threshold to require more failed attempts or add additional conditions like failed attempts across multiple user accounts. Option B is correct because it increases the threshold to 20 and adds a condition for multiple users, which better indicates a brute-force attack. Option A is wrong because increasing the frequency would generate more incidents, not fewer.

Option C is wrong because decreasing the threshold would increase incidents. Option D is wrong because disabling the rule would stop detection entirely.

Full explanation →

MCQmedium

Your organization has a Microsoft Sentinel workspace that ingests data from Microsoft 365 Defender (Defender for Endpoint, Office 365, Identity, Cloud Apps). You have configured a scheduled analytics rule to detect possible privilege escalation based on user activity. The rule runs every 5 minutes and looks at the last 5 minutes of data. Recently, the rule has been generating a high number of false positives. You analyze the alerts and find that they are triggered by legitimate administrative actions. You need to reduce false positives without completely disabling the rule. The rule uses a KQL query that joins the IdentityLogonEvents and CloudAppEvents tables. What should you do?

A.Increase the rule's run frequency to every 30 minutes.

B.Reduce the query's lookback period to 1 minute.

C.Modify the KQL query to exclude events from a list of known administrative user accounts or IP addresses.

D.Add an incident suppression rule that closes incidents from known admin accounts.

AnswerC

Excluding known admins reduces false positives while retaining detection for others.

Why this answer

Tuning the KQL query to exclude known administrative accounts or actions is the best way to reduce false positives. Option A is wrong because increasing the frequency would not reduce false positives. Option B is wrong because suppression can cause missed detections for other users.

Option D is wrong because reducing lookback may miss legitimate events.

Full explanation →

MCQmedium

Your organization uses Microsoft Sentinel and has deployed the Microsoft Defender XDR connector. You notice that some incidents from Defender XDR are not being synchronized to Sentinel. You verify that the connector is enabled and healthy. You also check that the relevant Defender XDR alerts are being generated. What could be the cause of the missing incidents?

A.The Microsoft Defender XDR connector has a filter that only syncs incidents with severity High or Medium, and the missing incidents are Low severity.

B.The Microsoft Defender XDR connector is configured to group alerts by entity, which prevents individual incidents from being created.

C.The diagnostic settings in Microsoft Defender XDR are not configured to send incidents to Sentinel.

D.The data connector is set to ingestion mode 'Raw data' instead of 'Incidents'.

AnswerA

Connector filters can exclude low-severity incidents.

Why this answer

Incidents from Defender XDR are synchronized to Sentinel based on the connector's filtering settings. Option A is correct because the connector might be configured to only sync incidents of certain severities. Option B is wrong because alert grouping is not a connector setting.

Option C is wrong because the data connector is for incidents, not raw data. Option D is wrong because diagnostic settings are for logs, not incidents.

Full explanation →

MCQeasy

Your security operations center (SOC) uses Microsoft Sentinel. Analysts need to collaborate on incidents by adding comments and changing severity. Which feature should they use?

A.Hunting

B.Playbooks

C.Workbooks

D.Incident management

AnswerD

Incident management provides commenting and severity changes.

Why this answer

Incident management in Microsoft Sentinel provides the built-in capability for SOC analysts to collaborate on incidents by adding comments and changing severity. This feature allows multiple analysts to work on the same incident, track changes, and update the severity level directly within the incident interface, which is essential for effective teamwork and triage.

Exam trap

The trap here is that candidates often confuse Hunting or Workbooks as tools for incident collaboration because they involve data exploration, but they lack the direct incident editing and commenting capabilities that incident management provides.

How to eliminate wrong answers

Option A is wrong because Hunting is a proactive search for threats using KQL queries, not a feature for collaborating on existing incidents or modifying their severity. Option B is wrong because Playbooks are automated workflows triggered by incidents or alerts, designed for response actions, not for manual collaboration or severity changes. Option C is wrong because Workbooks are interactive dashboards for visualizing data and metrics, not for direct incident collaboration or severity updates.

Full explanation →

MCQmedium

A SOC analyst is building a scheduled analytics rule in Microsoft Sentinel to detect PowerShell downloads from external IPs. The rule queries the DeviceProcessEvents table from Microsoft Defender for Endpoint forwarded to Sentinel. The analyst wants to reduce alert fatigue by excluding processes initiated by known system accounts (e.g., SYSTEM). Which KQL operator should the analyst use in the query?

A.where InitiatingProcessAccountName !contains "SYSTEM"

B.where InitiatingProcessAccountName !startswith "NT AUTHORITY"

C.where InitiatingProcessAccountName !has "NT AUTHORITY\SYSTEM"

D.where InitiatingProcessAccountName !matches regex "^NT AUTHORITY\\SYSTEM$"

AnswerC

This filters out records where the account name contains the exact substring 'NT AUTHORITY\SYSTEM', effectively excluding the SYSTEM account.

Why this answer

The `!has` operator performs a case-sensitive substring match, which is the most reliable way to exclude the exact string `NT AUTHORITY\SYSTEM` from the `InitiatingProcessAccountName` field. This ensures that only processes started by the SYSTEM account (as reported by Microsoft Defender for Endpoint) are filtered out, reducing alert fatigue without accidentally excluding other accounts that might contain similar substrings.

Exam trap

The trap here is that candidates often confuse `!contains` (case-insensitive) with `!has` (case-sensitive) or use `!startswith` without accounting for the full account name format, leading to either over-filtering or under-filtering of the SYSTEM account.

How to eliminate wrong answers

Option A is wrong because `!contains` performs a case-insensitive substring match, which could inadvertently exclude accounts with 'SYSTEM' in their name (e.g., 'SYSTEM32' or 'DOMAIN\SYSTEMUSER'), leading to missed detections. Option B is wrong because `!startswith` only checks if the field begins with 'NT AUTHORITY', but the actual account name in the DeviceProcessEvents table is typically formatted as 'NT AUTHORITY\SYSTEM' (with a backslash), so this would not exclude the SYSTEM account if the field starts with 'NT AUTHORITY\' but the operator does not match the full string. Option D is wrong because `!matches regex` is overly precise and can fail if the account name includes a domain or other variations (e.g., 'NT AUTHORITY\SYSTEM' might appear as 'NT AUTHORITY\SYSTEM' with a trailing space or different casing), and regex is unnecessary for this simple exclusion.

Full explanation →

MCQeasy

A security engineer needs to ensure that all Azure subscriptions under a management group are continuously assessed against the Azure Security Benchmark. They want to see the aggregated compliance score at the management group level. What should the engineer do in Microsoft Defender for Cloud?

A.Assign the Azure Security Benchmark initiative to each subscription individually and use the secure score dashboard.

B.Assign the Azure Security Benchmark initiative to the management group.

C.Enable the Regulatory Compliance dashboard and select the Azure Security Benchmark from the built-in standards list.

D.Configure Secure Score policies at the management group and enable Azure Security Benchmark.

AnswerB

When assigned to a management group, the initiative applies to all subscriptions under it, and the Regulatory Compliance dashboard shows aggregated compliance.

Why this answer

Assigning the Azure Security Benchmark initiative to the management group ensures that all subscriptions under that management group are continuously assessed against the benchmark. The aggregated compliance score is then visible at the management group level in the Regulatory Compliance dashboard, providing a single view of compliance across the entire hierarchy.

Exam trap

The trap here is that candidates often think they need to enable the Regulatory Compliance dashboard (Option C) or configure Secure Score policies (Option D) to see aggregated scores, but the critical step is assigning the initiative at the correct scope—the management group—to enable both continuous assessment and aggregation.

How to eliminate wrong answers

Option A is wrong because assigning the initiative to each subscription individually does not provide an aggregated compliance score at the management group level; it only shows per-subscription scores. Option C is wrong because enabling the Regulatory Compliance dashboard and selecting the Azure Security Benchmark from the built-in standards list only enables the dashboard view, it does not assign the initiative to the management group or subscriptions, so no continuous assessment occurs. Option D is wrong because there is no 'Secure Score policies' configuration at the management group; secure score is derived from the assigned initiatives, and the Azure Security Benchmark must be assigned as an initiative, not just 'enabled' as a policy.

Full explanation →

MCQeasy

To hunt for malicious PowerShell encoded commands, which columns in the DeviceProcessEvents table in Microsoft 365 Defender advanced hunting should you focus on?

A.DeviceName

B.FileName

C.ProcessCommandLine

D.InitiatingProcessFileName

AnswerC

Contains the full command line, including encoded parts.

Why this answer

The ProcessCommandLine column contains the full command line, including encoded commands. Option A (FileName) only shows the executable name. Option B (InitiatingProcessFileName) shows parent process.

Option D (DeviceName) is the machine name. The correct column is ProcessCommandLine.

Full explanation →

MCQmedium

You are a threat hunter investigating a potential data exfiltration via Microsoft Teams. You need to identify if any users have shared sensitive files externally. Which hunting approach should you use?

A.Analyze Microsoft Defender for Endpoint device timeline for file activity related to Teams.

B.Run a custom detection rule in Microsoft Defender for Cloud Apps to alert on large file uploads to Teams.

C.Query the Office 365 audit log for file download events from Teams.

D.Use Microsoft Purview DLP reports to review incidents where sensitive files were shared externally via Teams.

AnswerD

DLP policies can detect and report on sensitive data shared externally, providing relevant hunting data.

Why this answer

Microsoft Purview Data Loss Prevention (DLP) reports provide detailed information on policy matches, including external sharing of sensitive files via Teams. Option A is wrong because Microsoft Defender for Endpoint device timeline focuses on endpoint device activity, not specifically on Teams file sharing. Option B is wrong because while Microsoft Defender for Cloud Apps can detect anomalous file uploads, it is not the primary hunting approach for identifying externally shared sensitive files via Teams; DLP reports are more direct.

Option C is wrong because the Office 365 audit log for file download events does not specifically indicate external sharing of sensitive files; it logs general file access.

Full explanation →

MCQmedium

A security analyst receives an alert in Microsoft Defender XDR indicating that a user account was compromised. The analyst needs to isolate the affected device to prevent lateral movement. Which action should the analyst take first?

A.Run a full antimalware scan on the device

B.Initiate device isolation from Microsoft Defender for Endpoint

C.Reset the user's password in Microsoft Entra ID

D.Create a custom detection rule in Microsoft Sentinel

AnswerB

Device isolation immediately blocks network communication to contain the threat.

Why this answer

Initiating device isolation in Microsoft Defender for Endpoint immediately contains the compromised device, preventing lateral movement. Option A is wrong because a full antimalware scan does not isolate the device and may not stop ongoing malicious activity. Option C is wrong because resetting the user's password does not isolate the device; it only revokes access to cloud resources.

Option D is wrong because creating a custom detection rule in Microsoft Sentinel does not take immediate action to contain the threat.

Full explanation →

MCQhard

Your company uses Microsoft Defender for Cloud Apps. You discover that a user's account is compromised and used to access a sensitive SharePoint site from an unfamiliar IP. You need to immediately revoke the user's session and force them to re-authenticate. Which action should you take?

A.Add the IP to the blocked IP addresses list.

B.Create a governance action to suspend the user.

C.Send a notification to the user to change their password.

D.Apply a policy with the 'Revoke session' action.

AnswerD

Revoking the session forces re-authentication and ends the current access.

Why this answer

The 'Revoke session' policy action in Defender for Cloud Apps terminates the user's current session and forces re-authentication. Option A (Suspend user) is too drastic and may disrupt legitimate access. Option C (Block IP) would block all users from that IP, which may not be desired.

Option D (Notify user) is not immediate and does not stop the session.

Full explanation →

Multi-Selectmedium

A security operations center (SOC) is configuring automated investigation and response (AIR) for Microsoft Defender for Office 365. Which of the following actions can be automatically taken when a malicious email is detected by AIR policies? (Choose all that apply.)

Select 2 answers

A.Soft delete the email from user mailbox

B.Add the sender to the user's blocked sender list

C.Quarantine the email

D.Permanently delete the email from all mailboxes

AnswersA, C

AIR can be configured to soft delete emails, moving them to the Deleted Items folder.

Why this answer

AIR policies in Microsoft Defender for Office 365 can automatically soft-delete a malicious email from a user's mailbox. Soft deletion moves the email to the Recoverable Items folder, allowing administrators to restore it if needed, which is a standard remediation action for confirmed threats.

Exam trap

The trap here is that candidates often confuse manual user-side actions (like adding a sender to a blocked list) with automated AIR remediation actions, or assume that 'permanently delete' is a valid automated response when Microsoft deliberately avoids irreversible actions in AIR to prevent data loss.

Full explanation →

Multi-Selecteasy

Which TWO features are available in Microsoft Sentinel to automate incident response?

Select 2 answers

A.Playbooks based on Azure Logic Apps.

B.Workbooks.

C.Kusto Query Language (KQL) queries.

D.UEBA.

E.Automation rules.

AnswersA, E

Playbooks automate response actions.

Why this answer

Playbooks based on Azure Logic Apps are correct because they provide a native, low-code automation framework within Microsoft Sentinel. They allow security analysts to define and execute complex, multi-step response actions—such as isolating a compromised VM, blocking an IP address, or opening a ticket—triggered by alerts or incidents. This directly automates incident response workflows without manual intervention.

Exam trap

The trap here is that candidates often confuse detection or analysis tools (Workbooks, KQL, UEBA) with automation tools, failing to recognize that only Playbooks and Automation Rules provide the actual execution of response actions in Sentinel.

Full explanation →

Multi-Selecteasy

Your organization plans to implement Microsoft Sentinel. Which THREE components are required for a basic deployment? (Choose three.)

Select 3 answers

A.User and Entity Behavior Analytics (UEBA) enabled.

B.Analytics rules to generate incidents.

C.At least one data connector enabled.

D.Bookmarks for incident investigations.

E.A Log Analytics workspace.

AnswersB, C, E

Analytics rules detect threats.

Why this answer

Analytics rules are required to generate incidents from the data ingested into Microsoft Sentinel. Without analytics rules, the raw log data remains unprocessed and no security incidents are created, making the deployment non-functional for detection and response.

Exam trap

The trap here is that candidates often mistake optional advanced features like UEBA or bookmarks as required components, when in fact only the workspace, a data connector, and analytics rules are necessary to establish a basic, functional Sentinel deployment.

Full explanation →

MCQhard

An organization uses Microsoft Defender XDR. During an incident investigation, the security team needs to determine if a specific file was executed on any devices in the organization over the past 30 days. They have the file hash. What is the most efficient way to get this information?

A.Use the action center to search for the file

B.Use advanced hunting to query for file execution events

C.Review the incident timeline for the file

D.Check the device inventory for the file

AnswerB

Advanced hunting allows querying for file execution events across all devices using the file hash.

Why this answer

Advanced hunting in Microsoft Defender XDR allows querying for file execution events across all devices using the file hash. Option A is wrong because the action center is for response actions, not queries. Option C is wrong because the incident timeline is for a specific incident, not a file search across devices.

Option D is wrong because the device inventory does not show execution history.

Full explanation →

Microsoft Security Operations Analyst SC-200 (SC-200) — Questions 1–75