Microsoft Security Operations Analyst SC-200 SC-200 Questions 151–209 | Page 3/3

151

MCQeasy

An organization uses Microsoft Defender for Office 365. A security analyst wants to configure automated investigation and response (AIR) for email threats. When a user reports a phishing email using the Report Message add-in, which automated action can be triggered by an AIR playbook?

A.Trigger a training campaign for the user who reported the email.

B.Move the email to the tenant's shared mailbox for review.

C.Remove the Report Message add-in from Outlook to prevent false reports.

D.Soft-delete the email from the user's mailbox and other mailboxes that received the same message.

AnswerD

Soft-deleting the email is a correct and supported AIR action in Microsoft Defender for Office 365 that automatically removes the reported message from the user's mailbox and any other mailboxes that received the same message. This action leverages the message's network message ID or Internet Message ID to identify all instances of the email across the tenant and moves them to the Recoverable Items folder, effectively containing the threat. Once a soft delete is performed, the email is no longer visible to the user but can still be recovered by an administrator within a retention period, balancing security with forensic needs. This is a direct remediation step that aligns with the goal of automatically neutralizing email-borne threats reported by a user.

Why this answer

When a user reports a phishing email via the Report Message add-in, the automated investigation and response (AIR) playbook in Microsoft Defender for Office 365 can automatically soft-delete the email from the user's mailbox and from all other mailboxes that received the same message. This action is part of the built-in remediation steps that AIR can take after confirming the threat, leveraging the email entity's hash or message ID to perform tenant-wide removal via the threat protection pipeline.

Exam trap

The trap here is that candidates may confuse automated remediation actions (like soft-delete) with administrative or training-related tasks, leading them to select options that describe manual or non-automated processes.

How to eliminate wrong answers

Option A is wrong because triggering a training campaign is not an automated action within an AIR playbook; training campaigns are separate features in Defender for Office 365 that require manual configuration and are not triggered automatically by AIR. Option B is wrong because moving the email to a shared mailbox for review is not a standard AIR remediation action; AIR focuses on containment and removal, not manual review workflows. Option C is wrong because removing the Report Message add-in would prevent future reports and is not an automated remediation action; AIR playbooks are designed to respond to threats, not to disable reporting tools.

Full explanation →

152

MCQeasy

A security analyst is investigating a ransomware incident in Microsoft 365 Defender. The analyst wants to see a timeline of all actions performed on a specific device, including file creation, registry modifications, and network connections, in chronological order. Which feature should the analyst use?

A.Device timeline

B.Advanced hunting

C.Incident graph

D.Action center

AnswerA

The device timeline displays a chronological sequence of events that occurred on a specific device, allowing analysts to trace attack activities.

Why this answer

The Device timeline in Microsoft Defender for Endpoint provides a chronological view of all events and actions on a specific device, including file creation, registry modifications, and network connections. This feature is specifically designed for forensic investigation of incidents like ransomware, offering a time-ordered list of activities without requiring custom queries.

Exam trap

The trap here is that candidates may confuse the chronological event view of the Device timeline with the query-based flexibility of Advanced hunting, but the question specifically asks for a pre-built timeline without requiring custom queries.

How to eliminate wrong answers

Option B is wrong because Advanced hunting is a query-based tool using Kusto Query Language (KQL) to search across raw data tables, not a pre-built chronological timeline for a single device. Option C is wrong because the Incident graph visualizes the relationships between alerts, assets, and entities within an incident, but it does not provide a sequential timeline of actions on a specific device. Option D is wrong because Action center is used to review and approve remediation actions (e.g., isolating a device or running antivirus scans), not to view historical event timelines.

Full explanation →

153

MCQmedium

A company uses Microsoft Defender for Cloud with enhanced security features enabled. They recently deployed a new Azure Kubernetes Service (AKS) cluster and want to ensure it is protected by Defender for Containers. What must they do to enable protection?

A.Enable the Defender for Containers plan for the subscription in Defender for Cloud.

B.Install the Microsoft Defender for Cloud agent on the AKS nodes.

C.Create a Log Analytics workspace and connect AKS to it.

D.Enable Azure Policy for AKS.

AnswerA

Enabling the Defender for Containers plan at the subscription level is the required first action; it activates Microsoft's workload protection for AKS and all other supported Kubernetes platforms in that subscription. Once toggled on, Defender for Cloud automatically provisions the necessary components for existing and future AKS clusters, including Kubernetes audit log analysis, runtime threat detection, and image vulnerability assessment. No separate node-agent installation or workspace configuration is needed for the plan to take effect, making this the precise enablement step.

Why this answer

Defender for Containers is a plan-level feature in Microsoft Defender for Cloud that must be enabled at the subscription level. Once enabled, it automatically discovers and protects AKS clusters without requiring any manual agent installation on nodes, as it uses the Defender sensor deployed by AKS itself. This is the only action needed to enable protection for the new AKS cluster.

Exam trap

The trap here is that candidates often assume agent installation or Log Analytics workspace configuration is necessary for container protection, but Defender for Containers is a subscription-level plan that automatically provisions the required sensor without manual node-level setup.

How to eliminate wrong answers

Option B is wrong because Defender for Containers does not require installing the Microsoft Defender for Cloud agent on AKS nodes; it uses a dedicated Defender sensor that is automatically deployed by the AKS integration. Option C is wrong because a Log Analytics workspace is not a prerequisite for Defender for Containers; while logs can be collected, the plan works independently of Log Analytics. Option D is wrong because enabling Azure Policy for AKS is not required to enable Defender for Containers; Azure Policy can be used for compliance and governance but is separate from the Defender plan activation.

Full explanation →

154

MCQmedium

An organization uses Microsoft 365 Defender. During an incident, the analyst wants to automatically isolate a compromised device from the network while allowing communication with a specific list of trusted IP addresses (e.g., for patching). Which action in an automated investigation and response (AIR) playbook for endpoints can achieve this?

A.Run antivirus scan

B.Isolate device

C.Contain device

D.Restrict app execution

AnswerB

Isolate device is the correct response because it disconnects the compromised endpoint from the network while still permitting communication with specifically allowed IPs, such as Microsoft Defender for Endpoint services, Windows Update, or other approved update servers. This selectively quarantines the device at the network layer, blocking both inbound and outbound traffic to all other hosts, which stops lateral movement and data exfiltration. The ability to configure an allow list makes this action uniquely suited for maintaining critical services during an incident.

Why this answer

The 'Isolate device' action in Microsoft Defender for Endpoint's automated investigation and response (AIR) playbook can be configured to isolate a device from the network while allowing communication with a specified list of trusted IP addresses (e.g., for patching or compliance). This is achieved through the 'selective isolation' capability, which uses Windows Filtering Platform (WFP) to block all inbound/outbound traffic except to the defined IPs. Option B is correct because it directly matches the requirement to maintain connectivity to trusted endpoints during isolation.

Exam trap

The trap here is that candidates often confuse 'Contain device' (which only blocks inbound connections from other devices) with 'Isolate device' (which blocks both inbound and outbound traffic, with optional selective allow lists), leading them to choose the wrong option when the question specifies allowing outbound communication to trusted IPs.

How to eliminate wrong answers

Option A is wrong because 'Run antivirus scan' only performs a malware scan and does not involve any network isolation or allow-listing of IP addresses. Option C is wrong because 'Contain device' is a legacy term from Microsoft Defender for Endpoint that typically refers to blocking communication with the device from other devices (network containment), but it does not provide the granular control to allow specific trusted IPs for outbound communication; it is a broader block. Option D is wrong because 'Restrict app execution' limits which applications can run on the device (e.g., via AppLocker or WDAC), but it does not affect network connectivity or allow specific IP addresses.

Full explanation →

155

MCQhard

Your organization uses Microsoft Sentinel and has enabled UEBA. A security analyst observes that a user account with no prior administrative activity performed a high volume of Azure Resource Manager operations. The analyst wants to investigate further. Which Microsoft Sentinel feature should the analyst use to quickly identify if this behavior is anomalous based on the user's historical profile?

A.Hunting queries

B.Workbooks

C.User and Entity Behavior Analytics (UEBA)

D.Analytics rules

AnswerC

User and Entity Behavior Analytics (UEBA) is the correct capability because it uses machine learning models to build a personalized historical baseline for each user and entity—such as typical logon times, locations, and performed actions—then continuously scores new activities against that profile to identify anomalous behavior automatically in Sentinel. UEBA's anomaly detections are surfaced as suspicious activities or incidents and feed into the entity timeline, requiring no custom rule authoring to compare current events to the user's own established patterns.

Why this answer

UEBA is the correct feature because it builds a behavioral baseline for each user over time, including typical Azure Resource Manager activity patterns. When a user with no prior administrative history suddenly performs a high volume of ARM operations, UEBA can flag this as anomalous by comparing the current activity against the user's historical profile, surfacing the deviation in the UEBA investigation pane without requiring custom query creation.

Exam trap

The trap here is that candidates often confuse UEBA with Analytics rules, assuming that any detection must come from a rule, but UEBA is specifically designed for behavior-based anomaly detection against a user's own historical baseline, not signature-based or rule-based detection.

How to eliminate wrong answers

Option A is wrong because Hunting queries are proactive, iterative searches for potential threats using KQL, but they do not automatically compare current behavior against a user's historical baseline; they require the analyst to manually define and run queries. Option B is wrong because Workbooks are visualization dashboards that aggregate data from various sources, but they do not perform user-specific anomaly detection or compare against historical profiles. Option D is wrong because Analytics rules are used to create automated detections and alerts based on predefined logic, but they do not inherently leverage UEBA's historical user profiles to identify anomalies unless specifically configured with UEBA data, and the question asks for quickly identifying anomalous behavior based on the user's historical profile, which is UEBA's core function.

Full explanation →

156

Multi-Selectmedium

Your organization uses Microsoft Sentinel. You need to automatically classify incidents based on MITRE ATT&CK techniques. Which THREE methods can be used to accomplish this?

Select 3 answers

A.Enable the MITRE ATT&CK data connector.

B.Create a watchlist with MITRE techniques.

C.Use analytics rules that include MITRE ATT&CK mapping.

D.Use UEBA to detect techniques.

E.Create an automation rule that tags incidents with MITRE techniques.

AnswersA, C, E

This connector provides threat intelligence and enriches incidents.

Why this answer

The MITRE ATT&CK data connector in Microsoft Sentinel ingests threat intelligence feeds that include MITRE ATT&CK technique mappings, enabling automatic classification of incidents by technique. This connector pulls in indicators of compromise (IOCs) with associated technique IDs, which Sentinel then uses to tag and classify incidents during analysis.

Exam trap

The trap here is that candidates often confuse watchlists (static enrichment) with automated classification mechanisms, or think UEBA's anomaly detection inherently maps to MITRE techniques, when in fact it does not assign technique IDs without additional configuration.

Full explanation →

157

MCQmedium

A security analyst in Microsoft 365 Defender has just completed an automated investigation on a device. The analyst wants to review the specific remediation actions that were taken automatically, such as file quarantine or process termination, as well as any actions that are still pending approval. Where should the analyst look?

A.Action center

B.Incident details page -> Alerts tab

C.Device timeline in advanced hunting

D.Email & collaboration incidents tab

AnswerA

The Action center in Microsoft 365 Defender is the centralized console for tracking and approving remediation actions generated by automated investigations and manual response actions. Analysts can review pending actions, such as quarantining files or isolating devices, and approve or reject them with a full audit trail. This is the correct place to see the outcomes of automated investigation steps and manage their execution.

Why this answer

The Action center in Microsoft 365 Defender is the centralized location to review all automated remediation actions (e.g., file quarantine, process termination) and pending approval actions across devices, email, and identities. It provides a unified view of completed, in-progress, and awaiting-approval actions from automated investigations, ensuring the analyst can track and manage remediation status efficiently.

Exam trap

The trap here is that candidates confuse the Incident details page (which shows alert evidence and investigation graph) with the Action center (which specifically tracks remediation actions and their approval status), leading them to select the Alerts tab instead of the correct centralized action management location.

How to eliminate wrong answers

Option B is wrong because the Incident details page's Alerts tab shows the alerts associated with an incident, not the specific remediation actions taken or pending; it focuses on alert metadata and evidence, not action status. Option C is wrong because the Device timeline in advanced hunting shows raw events and activities on a device (e.g., process creations, file modifications) but does not display remediation actions or their approval status; it is for hunting, not action management. Option D is wrong because the Email & collaboration incidents tab is specific to threats in Exchange Online and Microsoft Teams, not device-level automated remediation actions like file quarantine or process termination.

Full explanation →

158

MCQhard

A security engineer is configuring Microsoft Defender for Cloud in a hybrid environment that includes on-premises servers connected via Azure Arc. The engineer wants to enable the Defender for Cloud plans for servers (including vulnerability assessment) on all Azure Arc-enabled machines. What is the correct method to deploy the Log Analytics agent (or Azure Monitor Agent) and the Microsoft Defender for Endpoint (MDE) integration?

A.Manually install the agents on each server via Group Policy.

B.Enable Azure Policy 'Configure Azure Arc machines to run Azure Monitor Agent' with a DeployIfNotExists policy that also installs the MDE extension.

C.Use the Azure Automation Update Management to deploy agents.

D.Enable the 'Log Analytics agent for Windows' extension on each Arc machine via Azure Arc management.

AnswerB

The built-in Azure Policy DeployIfNotExists initiative 'Configure Azure Arc machines to run Azure Monitor Agent' automatically provisions the Azure Monitor Agent and the Microsoft Defender for Endpoint extension on every Azure Arc-enabled machine at assignment scope. It gives Defender for Cloud a continuous compliance signal, remediates noncompliant machines without human intervention, and ensures MDE is present for unified endpoint detection and response alongside Defender for Cloud's server plans.

Why this answer

It leverages Azure Policy with a DeployIfNotExists effect to automatically deploy the Azure Monitor Agent (AMA) and the Microsoft Defender for Endpoint (MDE) extension on Azure Arc-enabled servers. This ensures compliance at scale without manual intervention, and it is the recommended method in Defender for Cloud for hybrid machines. The policy also handles the vulnerability assessment integration by enabling the Defender for Cloud plans for servers.

Exam trap

The trap here is that candidates often assume manual agent installation (Option A) or Update Management (Option C) are valid for Defender for Cloud integration, but the exam tests the understanding that Azure Policy is the only scalable, compliant method to deploy both AMA and MDE extensions on Arc machines while enabling Defender for Cloud plans automatically.

How to eliminate wrong answers

Option A is wrong because manually installing agents via Group Policy does not integrate with Defender for Cloud's centralized management, nor does it automatically enable the MDE extension or vulnerability assessment; it also lacks the scalability and compliance enforcement of Azure Policy. Option C is wrong because Azure Automation Update Management is designed for patching and update orchestration, not for deploying agents or extensions; it cannot install the MDE extension or enable Defender for Cloud plans. Option D is wrong because enabling the 'Log Analytics agent for Windows' extension manually via Azure Arc management only deploys the legacy Log Analytics agent (MMA), not the Azure Monitor Agent (AMA) or the MDE extension, and it does not automatically enable vulnerability assessment or Defender for Cloud plans.

Full explanation →

159

MCQmedium

A SOC analyst needs to create an analytics rule in Microsoft Sentinel that triggers when a user logs in from an IP address outside of the organization's typical geographic locations, based on a learned baseline. Which type of analytics rule is best suited for this scenario?

A.Scheduled rule

B.NRT (Near-Real-Time) rule

C.Anomaly rule

D.Fusion rule

AnswerC

Anomaly rules in Microsoft Sentinel leverage built-in machine learning models to learn the baseline of normal sign-in behavior for users and entities over a specified time window. They then flag sign-in events that deviate significantly from that learned baseline, such as sign-ins from geographically unusual locations, impossible travel, or previously unseen IP addresses. This adaptive, self-learning approach eliminates the need for manually configured thresholds, making anomaly rules the appropriate choice for detecting unusual sign-in locations.

Why this answer

An Anomaly rule in Microsoft Sentinel uses machine learning to establish a baseline of normal user behavior, such as typical geographic login locations. When a login event deviates from that learned baseline (e.g., from an unusual IP address outside the expected regions), the rule triggers an alert. This is the only rule type specifically designed for behavior-based anomaly detection without requiring static thresholds or predefined patterns.

Exam trap

The trap here is that candidates confuse Anomaly rules with Scheduled rules, thinking a scheduled query with a geographic filter (e.g., 'where ip_geo not in allowed list') can achieve the same result, but they miss that Anomaly rules dynamically learn and adapt the baseline without manual maintenance of allowed location lists.

How to eliminate wrong answers

Option A is wrong because a Scheduled rule runs on a fixed schedule (e.g., every 5 minutes) and relies on static KQL queries with explicit thresholds, not on a dynamically learned baseline of geographic locations. Option B is wrong because an NRT (Near-Real-Time) rule processes streaming data with low latency but still requires a predefined query and threshold, not machine learning-based anomaly detection. Option D is wrong because a Fusion rule correlates multiple low-fidelity alerts across different products to identify advanced attacks, but it does not learn a baseline of normal user behavior or detect single-event geographic anomalies.

Full explanation →

160

MCQhard

A security administrator is configuring Microsoft Defender for Cloud's regulatory compliance dashboard for Azure resources. They need to track compliance against the SOC 2 standard using a built-in initiative. Which steps are required to add SOC 2 to the dashboard?

A.Enable Defender for Cloud on the subscription, then add the SOC 2 regulatory compliance initiative

B.Enable Defender for Cloud's enhanced security features, then assign the built-in SOC 2 policy initiative

C.Create a custom policy initiative based on SOC 2 controls and assign it to the management group

D.Configure Azure Policy manually with SOC 2 policies

AnswerB

Enhanced security features (Defender for Cloud plans) enable the full set of capabilities, and then the SOC 2 initiative can be assigned from the regulatory compliance dashboard.

Why this answer

Microsoft Defender for Cloud's regulatory compliance dashboard requires enhanced security features (formerly Azure Defender) to be enabled on the subscription. Once enabled, you can assign the built-in SOC 2 policy initiative, which automatically maps Azure Policy definitions to SOC 2 controls and displays compliance status in the dashboard. Without enhanced security features, the regulatory compliance dashboard is not available.

Exam trap

The trap here is that candidates often assume the free tier of Defender for Cloud is sufficient for regulatory compliance tracking, but Microsoft specifically requires enhanced security features (paid tier) to enable the regulatory compliance dashboard and assign built-in initiatives like SOC 2.

How to eliminate wrong answers

Option A is wrong because simply enabling Defender for Cloud (the free tier) does not provide access to the regulatory compliance dashboard; enhanced security features must be enabled. Option C is wrong because creating a custom policy initiative based on SOC 2 controls is unnecessary and not the built-in method; the SOC 2 initiative is provided out-of-the-box and should be assigned directly. Option D is wrong because manually configuring Azure Policy with SOC 2 policies would not integrate with the regulatory compliance dashboard's automated mapping and scoring; the built-in initiative is required for proper dashboard integration.

Full explanation →

161

Multi-Selectmedium

Which TWO actions can be performed using automation rules in Microsoft Sentinel? (Select TWO.)

Select 2 answers

A.Create a new incident from an alert.

B.Modify the query of an existing analytics rule.

C.Assign an incident to a specific owner.

D.Delete an incident automatically.

E.Trigger a playbook when an incident is created.

AnswersC, E

Assignment is a supported action in automation rules.

Why this answer

Automation rules in Microsoft Sentinel can perform actions such as assigning an incident to a specific owner. This is a built-in action within the automation rule configuration, allowing you to automatically set the owner field of an incident based on conditions like severity or rule ID, without requiring a playbook.

Exam trap

The trap here is that candidates often confuse automation rules with analytics rules, mistakenly thinking automation rules can create incidents or modify analytics rule logic, when in fact automation rules only act on existing incidents and cannot alter detection logic or delete incidents.

Full explanation →

162

Multi-Selecthard

Your organization uses Microsoft Sentinel and Microsoft Defender for Cloud. You need to implement a solution that automatically suppresses low-severity incidents from specific IP addresses that are known internal scanners. Which THREE configurations should you make?

Select 3 answers

A.Add the IP addresses to a watchlist and reference it in analytics rules.

B.Configure an analytics rule with a suppression condition that includes the IP addresses.

C.Create an automation rule that closes incidents matching the IP addresses.

D.Create a suppression rule in Microsoft Defender for Cloud.

E.Create a playbook that deletes incidents from those IP addresses.

AnswersA, B, C

Correct: Watchlists can be used for filtering.

Why this answer

A watchlist in Microsoft Sentinel can store known internal scanner IP addresses, and analytics rules can reference this watchlist to automatically suppress low-severity incidents from those IPs. This allows you to exclude benign scanner activity from generating alerts without modifying the rule logic for other threats.

Exam trap

The trap here is that candidates confuse suppression rules in Defender for Cloud (which suppress alerts at the CSPM level) with incident suppression in Sentinel, leading them to select Option D incorrectly.

Full explanation →

163

MCQeasy

A security analyst is using Microsoft Defender for Cloud's adaptive application controls (AAC) to allowlist trusted applications on Azure VMs. After enabling AAC and running in 'Audit' mode for a week, the analyst wants to switch to 'Enforce' mode. Which pre-requisite must be met before enforcement can be applied?

A.The VM must have the Guest Configuration extension installed.

B.A valid Microsoft Defender for Servers Plan 2 license must be assigned to the VM.

C.The VM must have a baseline of allowed applications generated from at least two weeks of audit data.

D.The VM must be running on a supported operating system like Windows Server 2016 or later.

AnswerC

Adaptive Application Controls must first run in audit-only mode for at least two weeks so Defender for Cloud can observe normal application usage and build a baseline of known-good executables, including file paths, publishers, and hashes. This audit-derived baseline is the specific prerequisite for switching a policy to enforce mode; without it, the allowlist would be incomplete and would cause legitimate applications to be blocked. Therefore, having a baseline generated from at least two weeks of audit data is the required condition before enforcement can be safely enabled.

Why this answer

Adaptive application controls require a minimum of two weeks of audit data to establish a reliable baseline of allowed applications before enforcement can be applied. This baseline ensures that legitimate applications are not blocked when switching from Audit to Enforce mode, reducing false positives and operational disruptions.

Exam trap

The trap here is that candidates may assume any supported OS or license is sufficient, but Microsoft specifically requires the two-week audit baseline to prevent enforcement from blocking legitimate applications.

How to eliminate wrong answers

Option A is wrong because the Guest Configuration extension is used for Azure Policy guest configuration assignments, not for adaptive application controls. Option B is wrong because while Defender for Servers Plan 2 is required to use adaptive application controls, it is a prerequisite for enabling the feature itself, not specifically for switching from Audit to Enforce mode. Option D is wrong because although supported operating systems are necessary, the specific prerequisite for enforcement is the two-week audit baseline, not just OS version support.

Full explanation →

164

MCQhard

A security analyst is investigating a ransomware incident and needs to find all files that were written to a specific device within a 5-minute window before the ransomware process started. The analyst knows the device name and the ransomware process start time. Which advanced hunting table and KQL operator combination would be most efficient to find the file creation events?

A.DeviceFileEvents with where

B.DeviceProcessEvents with join

C.DeviceEvents with where

D.DeviceImageLoadEvents with where

AnswerA

DeviceFileEvents contains file creation events; filtering with 'where' on device and time is the simplest approach.

Why this answer

DeviceFileEvents is the correct table because it specifically captures file creation, modification, and deletion events on devices. Using the `where` operator to filter by device name and a timestamp range (5 minutes before the ransomware process start time) is the most efficient way to retrieve the exact file creation events needed for the investigation.

Exam trap

The trap here is that candidates often confuse DeviceProcessEvents (process creation) with file creation events, or they think a `join` is needed to correlate process start time with file events, when a simple `where` on DeviceFileEvents is sufficient and more efficient.

How to eliminate wrong answers

Option B is wrong because DeviceProcessEvents tracks process creation events, not file creation events, and using `join` would be unnecessarily complex and less efficient than a simple `where` filter. Option C is wrong because DeviceEvents is a generic table that captures various security events (e.g., Windows Defender alerts, exploit guard events) but does not specifically log file creation events. Option D is wrong because DeviceImageLoadEvents records when a process loads a DLL or executable image, not file creation events.

Full explanation →

165

MCQmedium

A SOC team wants to automatically categorize incidents in Microsoft Sentinel with MITRE ATT&CK tactics (e.g., 'Initial Access', 'Execution') when an analytics rule triggers. How can they achieve this?

A.Use the incident details custom fields

B.Map MITRE ATT&CK tactics in the analytics rule

C.Use automation rule to set tactics

D.Use playbook to update incident

AnswerB

The analytics rule in Microsoft Sentinel includes a configuration pane where you can select one or more MITRE ATT&CK tactics and techniques (such as Initial Access, Execution, or Command and Control) that the rule is designed to detect. When the rule fires and creates an incident, the selected tactics are automatically applied to the incident's MITRE ATT&CK fields, enabling immediate categorization and correlation with other threat intelligence. This is the intended, first-party mechanism for tagging incidents with tactics, and it requires no additional overhead or post-processing, making it the correct and most reliable approach for automatic categorization.

Why this answer

Microsoft Sentinel analytics rules include a dedicated 'MITRE ATT&CK' configuration section where you can map specific tactics (e.g., Initial Access, Execution) to the rule. When the rule triggers and generates an incident, Sentinel automatically populates the incident's MITRE ATT&CK tactics field based on this mapping, enabling automated categorization without additional configuration.

Exam trap

Microsoft often tests the distinction between native analytics rule configuration (which directly sets MITRE ATT&CK tactics) versus post-processing methods like automation rules or playbooks, leading candidates to overcomplicate the solution when the simplest, built-in option is correct.

How to eliminate wrong answers

Option A is wrong because incident details custom fields are user-defined fields for storing arbitrary data, not a mechanism to automatically set MITRE ATT&CK tactics from an analytics rule trigger. Option C is wrong because automation rules can modify incident properties (e.g., severity, status) but cannot directly set MITRE ATT&CK tactics; they lack a dedicated action for MITRE ATT&CK fields. Option D is wrong because while a playbook (Azure Logic App) could theoretically update incident tactics via the Microsoft Sentinel API, this is an indirect, complex approach that requires custom code and is not the intended or simplest method—the native analytics rule mapping is the correct design.

Full explanation →

166

MCQeasy

You are configuring Microsoft Sentinel to ingest logs from Azure Active Directory (now Microsoft Entra ID). Which of the following connectors should you use to collect sign-in logs and audit logs?

A.Microsoft Defender for Cloud connector.

B.Office 365 connector.

C.Azure Activity connector.

D.Microsoft Entra ID connector.

AnswerD

This connector collects sign-in logs, audit logs, and provisioning logs.

Why this answer

The Microsoft Entra ID connector (formerly Azure AD connector) is the correct choice because it is specifically designed to ingest sign-in logs, audit logs, and provisioning logs from Microsoft Entra ID into Microsoft Sentinel. This connector uses the Microsoft Graph API to pull these logs, enabling security monitoring of user authentication and administrative activities.

Exam trap

The trap here is that candidates often confuse the Azure Activity connector (which logs Azure resource operations) with the Entra ID connector (which logs identity and authentication events), leading them to incorrectly select option C.

How to eliminate wrong answers

Option A is wrong because the Microsoft Defender for Cloud connector is used to ingest security alerts and recommendations from Defender for Cloud, not Azure AD sign-in or audit logs. Option B is wrong because the Office 365 connector ingests logs from Exchange Online, SharePoint Online, Teams, and other Office 365 workloads, but it does not include Azure AD sign-in or audit logs. Option C is wrong because the Azure Activity connector ingests subscription-level operational logs from Azure Resource Manager (e.g., create/delete resources), not Azure AD sign-in or audit logs.

Full explanation →

167

MCQeasy

You are threat hunting for credential dumping activity. Which Windows event ID is commonly associated with the use of tools like Mimikatz?

A.4624 (Successful Logon)

B.4768 (Kerberos Authentication Ticket Request)

C.4688 (Process Creation)

D.4672 (Special Logon)

AnswerC

Process creation events can show when Mimikatz or similar tools are launched.

Why this answer

Windows Event ID 4688 (Process Creation) logs every new process spawned on the system, including the execution of tools like Mimikatz. When Mimikatz runs, it creates a process (e.g., mimikatz.exe), and the 4688 event captures the command line, parent process, and user context, which are critical for detecting credential dumping activity.

Exam trap

Microsoft often tests the misconception that credential dumping is tied to authentication events (like 4624 or 4768), but the key indicator is the process creation event (4688) that captures the execution of the dumping tool itself.

How to eliminate wrong answers

Option A is wrong because Event ID 4624 (Successful Logon) records authentication events, not the execution of a process like Mimikatz; credential dumping occurs after logon, not during it. Option B is wrong because Event ID 4768 (Kerberos Authentication Ticket Request) tracks TGT requests to a domain controller, which is unrelated to local credential dumping via Mimikatz. Option D is wrong because Event ID 4672 (Special Logon) logs when a user is granted special privileges (e.g., SeTcbPrivilege), but it does not directly indicate process creation or execution of a credential dumping tool.

Full explanation →

168

MCQmedium

Refer to the exhibit. You have created a scheduled analytics rule in Microsoft Sentinel as shown. The rule is not generating any incidents, even though you know Copilot for Microsoft 365 is accessing sensitive files. What is the most likely cause?

A.The triggerThreshold is too high

B.The table being queried does not contain Copilot events

C.The severity is set to Medium, which suppresses incidents

D.The queryFrequency is too short

AnswerB

Copilot events are in CloudAppEvents.

Why this answer

The rule queries the 'SensitivityLabelEvents' table, which tracks sensitivity label changes but does not contain Copilot for Microsoft 365 events. Copilot events are stored in the 'MicrosoftCopilotAudit' table (or 'CloudAppEvents' with specific filters). Since the query targets the wrong table, no matching records are returned, and no incidents are generated.

Exam trap

The trap here is that candidates assume any table related to sensitivity labels will contain all Copilot events, but Microsoft separates Copilot-specific audit logs into a dedicated table, and the exam tests awareness of this schema distinction.

How to eliminate wrong answers

Option A is wrong because the triggerThreshold of 1 is the minimum value; a higher threshold would reduce incidents, but here the issue is zero incidents, not too few. Option C is wrong because severity settings (Medium, High, etc.) do not suppress incident creation; they only affect the incident's priority in the queue. Option D is wrong because a queryFrequency of 5 hours is reasonable for detecting patterns; making it shorter would increase run frequency but would not fix the root cause of querying the wrong table.

Full explanation →

169

Multi-Selectmedium

Your organization uses Microsoft Sentinel and Microsoft Defender XDR. You need to ensure that all incidents are reviewed within 24 hours. Which TWO actions should you take?

Select 2 answers

A.Create an automation rule that runs 24 hours after incident creation and escalates if status is not 'In progress'.

B.Create a playbook that runs every hour and checks incident age.

C.Configure Microsoft Defender XDR to automatically reassign incidents after 24 hours.

D.Create a workbook that displays incidents older than 24 hours and alerts the SOC manager.

E.Modify the analytics rule to automatically close incidents after 24 hours.

AnswersA, D

Correct: Automation rules can use conditions based on time.

Why this answer

Automation rules in Microsoft Sentinel can be configured to run a specific time after incident creation (e.g., 24 hours) and trigger an action, such as changing the status or reassigning the incident, ensuring it is reviewed within the required timeframe. This directly enforces the SLA without manual intervention.

Exam trap

The trap here is that candidates may confuse the purpose of automation rules (for enforcement) with workbooks (for visibility) and incorrectly think that a periodic playbook or a Defender XDR feature is the correct approach, when in fact only automation rules and workbooks provide the required review and alerting capabilities.

Full explanation →

170

MCQeasy

A SOC analyst wants to create a scheduled analytics rule in Microsoft Sentinel that detects when a user is added to a privileged Microsoft Entra ID role (e.g., Global Administrator). Which data table is essential for the query?

A.AuditLogs

B.SigninLogs

C.SecurityEvent

D.CommonSecurityLog

AnswerA

Correct. The AuditLogs table in Microsoft Sentinel (via Microsoft Entra ID connector) contains directory audit events, including changes to privileged role memberships.

Why this answer

The AuditLogs table in Microsoft Sentinel captures all directory-level audit activities, including modifications to Microsoft Entra ID (formerly Azure AD) role assignments. When a user is added to a privileged role like Global Administrator, the event is logged as an 'Add member to role' activity in the AuditLogs table. This makes AuditLogs the essential data source for detecting such privileged role changes.

Exam trap

Microsoft often tests the distinction between sign-in logs (SigninLogs) and audit logs (AuditLogs), trapping candidates who confuse authentication events with directory configuration changes.

How to eliminate wrong answers

Option B (SigninLogs) is wrong because it records user authentication events (sign-ins), not directory configuration changes like role assignments. Option C (SecurityEvent) is wrong because it contains Windows security events from on-premises or Azure VMs, not Microsoft Entra ID role activities. Option D (CommonSecurityLog) is wrong because it aggregates syslog-style logs from third-party security appliances (e.g., firewalls, IDS/IPS), not Microsoft Entra ID audit data.

Full explanation →

171

MCQeasy

A security team uses Microsoft Sentinel to hunt for signs of credential theft. They want to detect when a user account has been used to log in from an unusual location and then immediately performs a password reset for another user. Which hunting approach is most effective for this scenario?

A.Use a Microsoft Sentinel playbook to automatically flag any password reset

B.Write a KQL query that joins SigninLogs with AuditLogs on user principal name and times within a short window

C.Search the SigninLogs table for logins from unusual locations

D.Create a watchlist of known unusual locations and use it in a query against AuditLogs

AnswerB

This correlates the two events to detect the sequence of unusual login followed by password reset.

Why this answer

(KQL query using join between two tables) is correct because it allows correlating login events from SigninLogs with password reset events from AuditLogs, combining the two conditions. Option A (playbook) is for automated response, not hunting. Option C (searching only SigninLogs) cannot correlate with password reset events.

Option D (watchlist) provides static data, not real-time correlation.

Full explanation →

172

MCQmedium

A SOC analyst has created a custom scheduled analytics rule in Microsoft Sentinel that runs every hour and generates an incident when a certain pattern is detected. The analyst notices that the same set of events is causing a new incident every hour, leading to duplicates. What should the analyst configure to prevent duplicate incident generation from the same events?

A.Set the alert suppression setting in the analytics rule

B.Use an automation rule to close duplicates

C.Modify the query to use the 'summarize' operator

D.Change the query to use the 'take' operator

AnswerA

Alert suppression is a native analytic rule setting in Microsoft Sentinel that prevents duplicate alerts by silencing the rule for a defined period after the first alert fires. When the same events or query results are processed in subsequent scheduled runs within that period, no new alert or incident is created. This is the most efficient method because it eliminates duplication at the source, reducing noise without consuming automation resources or requiring custom KQL logic.

Why this answer

The alert suppression setting in a Microsoft Sentinel scheduled analytics rule allows you to configure a time window during which duplicate alerts from the same events are suppressed. When enabled, Sentinel will not generate a new incident from the same set of events until the suppression window expires, preventing the hourly duplication the analyst observed.

Exam trap

The trap here is that candidates often confuse alert suppression (preventing duplicate alerts) with incident closing mechanisms (automation rules), leading them to choose Option B instead of the correct suppression setting.

How to eliminate wrong answers

Option B is wrong because automation rules can close incidents after they are created, but they do not prevent the generation of duplicate incidents from the same events; duplicates would still be created and then closed, which is inefficient and does not address the root cause. Option C is wrong because using the 'summarize' operator in the query would aggregate events but would not prevent the same events from being evaluated again in the next hourly run; it could also alter the detection logic and miss patterns. Option D is wrong because the 'take' operator limits the number of rows returned by the query, which would arbitrarily drop events and could cause missed detections, not prevent duplicates from the same events.

Full explanation →

173

MCQeasy

Which Microsoft Sentinel feature allows you to automatically respond to incidents by running a playbook when an incident is created?

A.Analytics rules

B.Playbooks

C.Watchlists

D.Workbooks

E.Automation rules

AnswerE

Automation rules can trigger playbooks on incident creation.

Why this answer

Automation rules in Microsoft Sentinel allow you to define automated responses to incidents, including running a playbook when an incident is created. They provide a centralized way to trigger actions based on incident properties such as severity, status, or specific tactics, without needing to embed automation logic directly in analytics rules.

Exam trap

The trap here is that candidates often confuse playbooks with automation rules, thinking playbooks themselves automatically respond to incidents, when in fact playbooks are the action components that must be triggered by an automation rule or manual invocation.

How to eliminate wrong answers

Option A is wrong because analytics rules generate alerts or incidents based on data queries, but they do not directly run playbooks; automation rules are the mechanism that triggers playbooks upon incident creation. Option B is wrong because playbooks are collections of actions (based on Azure Logic Apps) that can be run manually or via automation rules, but they are not the feature that automatically responds to incidents when created. Option C is wrong because watchlists are collections of data (e.g., IP addresses, hostnames) used for correlation and enrichment in analytics rules, not for automated incident response.

Option D is wrong because workbooks are interactive dashboards for visualizing and analyzing data, not for triggering automated responses.

Full explanation →

174

MCQmedium

A cloud security team uses Microsoft Defender for Cloud with Defender for Servers enabled. They want to integrate a third-party vulnerability assessment solution for their Azure VMs and ensure findings appear in the Defender for Cloud recommendations. What must be done?

A.Configure a data connector in Microsoft Sentinel to forward the partner's findings.

B.Enable the 'Integrated' partner solution in Defender for Cloud and install the scanner on VMs.

C.Deploy the Microsoft Defender Vulnerability Management solution instead of a third-party tool.

D.Use Azure Policy to assign a built-in initiative that mandates vulnerability scanning.

AnswerB

In Defender for Cloud, the Vulnerability assessment settings let you enable an integrated partner solution such as Qualys or Rapid7; after selecting the partner, you install the designated scanner agent on each virtual machine. The scanner transmits identified vulnerabilities to Defender for Cloud, which ingests them into the recommendation 'Vulnerabilities in your virtual machines should be remediated' and includes them in the secure score and regulatory compliance assessments. This is the only mechanism that directly integrates the existing third-party tool's findings into Defender for Cloud.

Why this answer

Defender for Cloud supports integrating third-party vulnerability assessment solutions through the 'Integrated' partner solution setting. Once enabled, you must install the partner's scanner agent on each Azure VM. The findings are then ingested into Defender for Cloud and appear in the 'Vulnerabilities in your virtual machines should be remediated' recommendation, allowing the security team to view and manage them alongside built-in assessments.

Exam trap

The trap here is that candidates often confuse the role of Microsoft Sentinel (a SIEM) with Defender for Cloud's native vulnerability assessment integration, thinking that any security data can be funneled through Sentinel to populate Defender for Cloud recommendations, which is incorrect because Sentinel does not write to Defender for Cloud's recommendation engine.

How to eliminate wrong answers

Option A is wrong because Microsoft Sentinel is a SIEM for collecting and analyzing security logs, not a mechanism to ingest vulnerability assessment findings into Defender for Cloud recommendations; it would not populate the specific Defender for Cloud vulnerability recommendation. Option C is wrong because the question explicitly requires integrating a third-party solution, not replacing it with Microsoft Defender Vulnerability Management. Option D is wrong because Azure Policy can enforce that a vulnerability assessment solution is deployed, but it does not directly cause findings from a third-party tool to appear in Defender for Cloud recommendations; the 'Integrated' partner solution must be enabled and the scanner installed.

Full explanation →

175

MCQeasy

A security analyst in Microsoft 365 Defender is investigating an incident that involves multiple devices. The analyst wants to see a visual representation of the attack, showing how the attacker moved from one device to another. Which feature provides this view?

A.Alert queue

B.Incident graph

C.Advanced hunting

D.Action center

AnswerB

The Incident graph is a dedicated visualization that maps the full attack story by showing nodes for entities such as devices, users, and alerts, and edges representing causal relationships and movement. It automatically aggregates related alerts from the merged incident and provides a timeline-based view of how the attacker entered and expanded across the environment. This allows the analyst to identify the attack path and affected scope at a glance.

Why this answer

The Incident graph in Microsoft 365 Defender provides a visual, interactive representation of an attack, showing how the attacker moved from one device to another, including lateral movement paths and related alerts. This feature is specifically designed to help analysts understand the full scope of an incident by mapping out the relationships between entities such as devices, users, and alerts.

Exam trap

The trap here is that candidates often confuse the Incident graph with Advanced hunting, thinking that a query-based tool is needed to visualize attack paths, but the Incident graph provides this visualization automatically without requiring any query writing.

How to eliminate wrong answers

Option A is wrong because the Alert queue is a list of individual alerts, not a visual graph showing lateral movement between devices. Option C is wrong because Advanced hunting is a query-based tool for searching raw data using KQL, not a pre-built visual attack path. Option D is wrong because the Action center is used to view and approve remediation actions (e.g., isolating devices, running antivirus scans), not to visualize attack progression.

Full explanation →

176

MCQeasy

A security analyst wants to identify all devices in the organization that have a specific software vulnerability (CVE-2023-1234) installed using Microsoft 365 Defender Advanced Hunting. Which table should be queried?

A.DeviceInfo

B.DeviceTvmSoftwareVulnerabilities

C.DeviceTvmSoftwareInventory

D.DeviceNetworkInfo

AnswerB

DeviceTvmSoftwareVulnerabilities is the Threat & Vulnerability Management (TVM) table containing one row for each software vulnerability detected on a device, with fields such as CveId, DeviceId, SoftwareVendor, SoftwareName, SoftwareVersion, and exploitability/severity information. Filtering on a specific CveId returns every affected device, which is exactly the required result. This makes it the canonical and correct data source for the analyst's query.

Why this answer

The DeviceTvmSoftwareVulnerabilities table in Microsoft 365 Defender Advanced Hunting contains records of software vulnerabilities discovered on devices, including specific CVE identifiers like CVE-2023-1234. This table is designed to answer questions about which devices have a particular vulnerability installed, as it links device IDs to vulnerability details such as CVE ID, severity, and exploitability.

Exam trap

The trap here is that candidates often confuse DeviceTvmSoftwareInventory (which lists installed software) with DeviceTvmSoftwareVulnerabilities (which lists actual vulnerabilities), leading them to pick Option C because they think software inventory implies vulnerability presence.

How to eliminate wrong answers

Option A is wrong because DeviceInfo provides general device metadata (e.g., OS version, device name, last seen time) but does not include vulnerability or software inventory details. Option C is wrong because DeviceTvmSoftwareInventory lists installed software products and versions on devices, but it does not map those to specific CVEs or vulnerabilities. Option D is wrong because DeviceNetworkInfo contains network-related data such as IP addresses, network adapters, and connection details, and has no relation to software vulnerabilities.

Full explanation →

177

MCQmedium

A company uses Microsoft Defender for Cloud with Defender for Servers enabled. The security team wants to integrate a third-party vulnerability assessment solution (e.g., Qualys) and have findings appear in the Defender for Cloud recommendations. What must be done?

A.Install the Qualys agent on the VMs and configure the vulnerability assessment solution in Defender for Cloud.

B.Enable the built-in Microsoft Defender Vulnerability Management (MDVM) solution; it automatically integrates with any third-party scanner.

C.Set up automatic provisioning of the Log Analytics agent and enable vulnerability assessment in the regulatory compliance dashboard.

D.Nothing; Defender for Cloud automatically scans all Azure VMs for vulnerabilities using the integrated Qualys scanner.

AnswerA

Deploying the Qualys agent on every Virtual Machine is mandatory because Defender for Cloud uses that agent to collect and transmit vulnerability data to the Qualys cloud service. After installation, the solution must be registered under Defender for Cloud's Vulnerability assessment settings, which patches the security policy with the associated plan. Once configured, the Qualys findings appear in the 'Vulnerabilities in your virtual machines should be remediated' recommendation, and auto-provisioning can later be enabled for new VMs.

Why this answer

To integrate a third-party vulnerability assessment solution like Qualys with Microsoft Defender for Cloud, you must install the Qualys agent on the VMs and then configure the vulnerability assessment solution in Defender for Cloud. This allows Defender for Cloud to receive and display the vulnerability findings from Qualys as part of its security recommendations. Without this explicit configuration, Defender for Cloud cannot ingest third-party scanner data.

Exam trap

The trap here is that candidates assume Defender for Cloud automatically integrates with any third-party scanner or that enabling MDVM will bridge to third-party tools, when in fact a specific agent installation and connector configuration is required for third-party solutions.

How to eliminate wrong answers

Option B is wrong because Microsoft Defender Vulnerability Management (MDVM) is a built-in solution that does not automatically integrate with third-party scanners; it is a separate offering that replaces the need for third-party tools, not a bridge to them. Option C is wrong because automatic provisioning of the Log Analytics agent and enabling vulnerability assessment in the regulatory compliance dashboard does not integrate a third-party scanner; it only enables built-in vulnerability assessment or MDVM, not Qualys. Option D is wrong because Defender for Cloud does not automatically scan all Azure VMs using an integrated Qualys scanner; it uses its own built-in vulnerability assessment or requires explicit integration of a third-party solution.

Full explanation →

178

MCQmedium

A company runs its critical workloads on Azure Kubernetes Service (AKS). The security team wants to use Microsoft Defender for Cloud to protect the AKS clusters. After enabling Defender for Cloud on the subscription, they also need to enable the Defender for Containers plan. Which of the following capabilities becomes available specifically after enabling the Defender for Containers plan (with the plan turned on)?

A.Azure Policy for Kubernetes add-on installation to enforce pod security policies.

B.Kubernetes audit logs are automatically streamed to the Log Analytics workspace.

C.Security alerts for container runtime threats, such as privilege escalation in a container.

D.Integration with Microsoft Sentinel for monitoring AKS logs.

AnswerC

Defender for Containers provides advanced runtime threat detection that analyzes Kubernetes audit logs and container activity using behavioral analytics. It specifically identifies container runtime threats such as privilege escalation inside a container, container breakouts, and suspicious process execution. This capability to generate actionable, security alerts is the core value of the plan and distinguishes it from static policy enforcement or raw log ingestion.

Why this answer

Enabling the Defender for Containers plan in Microsoft Defender for Cloud activates host-level and cluster-level threat detection for AKS, including runtime threat protection. This allows Defender for Cloud to generate security alerts for container-specific threats such as privilege escalation, container breakout, and suspicious process execution within containers, which are not available with just the basic Defender for Cloud enabled on the subscription.

Exam trap

The trap here is that candidates often confuse the general security monitoring capabilities of Defender for Cloud (like audit log streaming or policy enforcement) with the specific runtime threat detection that only the Defender for Containers plan enables, leading them to select options that are available without the plan or require separate configuration.

How to eliminate wrong answers

Option A is wrong because Azure Policy for Kubernetes add-on installation is a feature of Azure Policy itself, not of the Defender for Containers plan; it can be used to enforce pod security policies (e.g., via built-in initiatives) regardless of whether the Defender for Containers plan is enabled. Option B is wrong because Kubernetes audit logs are automatically streamed to the Log Analytics workspace only if you configure diagnostic settings on the AKS cluster to send them to a Log Analytics workspace; this is not an automatic behavior triggered by enabling the Defender for Containers plan. Option D is wrong because integration with Microsoft Sentinel for monitoring AKS logs is a feature of Sentinel's data connectors, not a capability that becomes available specifically after enabling the Defender for Containers plan; Sentinel can ingest AKS logs via diagnostic settings regardless of the Defender for Containers plan status.

Full explanation →

179

MCQhard

Your organization uses Microsoft Defender for Cloud Apps and Microsoft Sentinel. You discover that a user is performing unusual bulk downloads from SharePoint. You need to automatically create an incident in Sentinel and suspend the user in Microsoft Entra ID. What should you use?

A.Create a scheduled analytics rule in Sentinel and use automation rules to trigger a playbook that suspends the user.

B.Configure a Microsoft Entra ID Protection policy to require password reset for risky users.

C.Use a playbook triggered by an incident creation rule to suspend the user.

D.Configure a policy in Defender for Cloud Apps with a governance action to suspend the user.

AnswerA

Automation rules run playbooks, which can use Microsoft Graph to suspend the user.

Why this answer

A scheduled analytics rule in Sentinel can detect the unusual bulk download behavior from SharePoint (via ingested logs from Defender for Cloud Apps or Office 365 connector). An automation rule on that analytics rule triggers a playbook (Azure Logic App) that uses the Microsoft Graph API to suspend the user in Microsoft Entra ID, creating an incident automatically as part of the rule's configuration.

Exam trap

The trap here is that candidates assume Defender for Cloud Apps governance actions alone can satisfy both requirements, but they forget that creating a Sentinel incident requires an analytics rule and automation rule orchestration, not just a cloud app policy.

How to eliminate wrong answers

Option B is wrong because Microsoft Entra ID Protection policies focus on sign-in risk and user risk (e.g., leaked credentials, anonymous IP) but do not directly detect bulk download anomalies from SharePoint; they also cannot trigger a Sentinel incident. Option C is wrong because 'incident creation rule' is not a valid Sentinel construct—incidents are created by analytics rules, and playbooks are triggered by automation rules, not by a rule named 'incident creation rule'. Option D is wrong because while Defender for Cloud Apps can apply governance actions (like suspend user) directly, it does not automatically create an incident in Sentinel; the question requires both an incident in Sentinel AND user suspension, which requires the orchestration of a playbook.

Full explanation →

180

MCQeasy

A security analyst needs to identify incidents in Microsoft Sentinel that are related to IP addresses known to be associated with a specific threat actor. The analyst has a CSV file containing a list of these IP addresses. Which feature should the analyst use to make this list available for queries in Sentinel?

A.Custom Log

B.Watchlist

C.Threat Intelligence indicator

D.Bookmark

AnswerB

In Microsoft Sentinel, a watchlist is a metadata-stored, queryable table that lets you upload a CSV of IP addresses and reference it in KQL via _GetWatchlist(), allowing you to match incident entities or enrich analytics rules without redeploying detections. Watchlists support aliases, search keys, validity dates, and are natively integrated into Alert Rules and hunting, making them the simplest and most appropriate mechanism for a custom IP list that must be joined against incoming events. Unlike raw data ingestion, watchlist data is retained in a structured reference table optimized for lookups.

Why this answer

A Watchlist in Microsoft Sentinel allows you to import a CSV file containing IP addresses and use it directly in KQL queries via the _GetWatchlist() function. This is the correct feature because it is specifically designed for storing and querying static reference data, such as known threat actor IPs, without requiring custom ingestion or transformation.

Exam trap

The trap here is that candidates often confuse Threat Intelligence indicators with a simple CSV import, but TI indicators require a structured format and integration with a TI platform, whereas a Watchlist is the direct, low-friction solution for static reference data.

How to eliminate wrong answers

Option A is wrong because a Custom Log is used to ingest raw data from a custom source into a Log Analytics workspace, requiring a defined schema and ingestion pipeline; it is not designed for quick, queryable reference lists from a CSV file. Option C is wrong because Threat Intelligence indicators are structured objects (e.g., STIX format) that integrate with threat intelligence platforms and are used for correlation with Sentinel's TI analytics rules, not for importing a simple CSV list of IPs. Option D is wrong because a Bookmark is used to save specific search results or hunting queries for later investigation, not to store or make a static list of IP addresses available for queries.

Full explanation →

181

MCQhard

An analyst is investigating a sophisticated attack involving a compromised device. The analyst has identified a malicious process that spawned multiple child processes. The analyst wants to create a custom detection rule in Microsoft 365 Defender that alerts when a specific parent process creates a child process that makes an outbound network connection to any IP not in the organization's internal range. Which KQL query and rule type should the analyst use?

A.Create a custom detection rule (Advanced Hunting rule) with a query that joins DeviceProcessEvents and DeviceNetworkEvents, filtering for the parent process and external IP addresses

B.Create a scheduled rule in Sentinel and export the data from M365 Defender

C.Use a custom detection rule with DeviceEvents only

D.Use a Microsoft Defender for Endpoint custom detection rule (built-in) that already detects child process connections

AnswerA

A custom detection rule in Microsoft 365 Defender is the correct choice because it is built on the Advanced Hunting schema, where you can join DeviceProcessEvents and DeviceNetworkEvents on DeviceId and Timestamp. By filtering for the specific parent process and external IP addresses, the query captures child processes making outbound connections, and the scheduled rule can generate alerts and trigger automated response actions.

Why this answer

The analyst needs to correlate process creation events with network connection events across two separate tables (DeviceProcessEvents and DeviceNetworkEvents) in Advanced Hunting. A custom detection rule (Advanced Hunting rule) in Microsoft 365 Defender allows joining these tables to identify when a specific parent process spawns a child that makes an outbound connection to an external IP address, which is exactly the required detection logic.

Exam trap

The trap here is that candidates may think DeviceEvents contains all necessary telemetry or that a built-in rule already covers this specific scenario, but they must recognize that joining two distinct tables (DeviceProcessEvents and DeviceNetworkEvents) in an Advanced Hunting custom detection rule is required to correlate process creation with outbound network connections.

How to eliminate wrong answers

Option B is wrong because creating a scheduled rule in Sentinel and exporting data from M365 Defender is unnecessary and inefficient; the detection can be built natively within Microsoft 365 Defender using Advanced Hunting rules without exporting data. Option C is wrong because DeviceEvents alone do not contain network connection details (like destination IP addresses) needed to filter for external IPs; DeviceNetworkEvents is required for that data. Option D is wrong because there is no built-in custom detection rule in Microsoft Defender for Endpoint that specifically detects child process connections to external IPs; the analyst must create a custom rule.

Full explanation →

182

MCQeasy

In Microsoft Defender for Cloud, what does the Secure Score represent?

A.The number of currently active security alerts.

B.The percentage of compliance with the Azure Security Benchmark.

C.The overall security posture of your resources, based on implemented security controls and recommendations.

D.The number of VMs that have been assessed for vulnerabilities.

AnswerC

The Secure Score is a percentage (0-100%) that quantifies how well your subscriptions and resources have implemented Microsoft's security best practices as recommendations. Each recommendation contributes points based on its associated security control and risk weight, so the score reflects your aggregate posture and helps prioritize remediation actions across all resource types.

Why this answer

The Secure Score in Microsoft Defender for Cloud is a numeric representation of your overall security posture, calculated based on the implementation of security controls and the remediation of recommendations. It aggregates the status of all assessed resources against security best practices, providing a single score that reflects how well you are protecting your workloads. This score helps prioritize actions to improve security, as each recommendation contributes a specific number of points toward the total possible score.

Exam trap

The trap here is that candidates often confuse the Secure Score with a simple compliance percentage or a count of alerts, but Microsoft specifically designed it as a posture metric that reflects the implementation of security controls, not just compliance with a single benchmark or the number of threats detected.

How to eliminate wrong answers

Option A is wrong because the Secure Score does not represent the number of active security alerts; active alerts are tracked separately in the Security Alerts dashboard and do not directly influence the score calculation. Option B is wrong because while the Secure Score is aligned with the Azure Security Benchmark, it is not a percentage of compliance with that benchmark; instead, it is a weighted score based on the implementation of security controls and recommendations across multiple benchmarks and standards. Option D is wrong because the Secure Score is not limited to VM vulnerability assessments; it encompasses all supported resource types (e.g., storage accounts, SQL servers, containers) and their associated security controls.

Full explanation →

183

MCQmedium

A company uses Microsoft Defender for Cloud to protect their Azure resources. They have enabled the enhanced security features on a subscription that contains several Azure SQL databases. They want to be alerted if a user attempts to perform SQL injection attacks against these databases. Which Defender for Cloud plan specifically enables SQL injection detection alerts?

A.Defender for Servers

B.Defender for SQL

C.Defender for App Service

D.Defender for Storage

AnswerB

Defender for SQL is the dedicated plan that protects Azure SQL Database, SQL Managed Instance, and SQL on Azure VMs by surfacing database-level threats. It analyzes SQL audit logs and query activity to detect SQL injection attempts, anomalous access patterns, brute-force attacks, and other database-specific vulnerabilities. This plan also provides vulnerability assessment and data discovery/classification, making it the only option here that directly addresses the requirement for SQL security alerts.

Why this answer

Defender for SQL is the specific Microsoft Defender for Cloud plan that provides SQL-specific threat detection, including alerts for SQL injection attacks. This plan monitors SQL databases for anomalous activities such as SQL injection attempts, brute-force attacks, and unusual access patterns by analyzing query logs and audit records. Enabling Defender for SQL on the subscription activates these detection capabilities for Azure SQL databases, making it the correct choice for the scenario.

Exam trap

The trap here is that candidates may confuse Defender for App Service with SQL injection detection because App Service can host web applications that are vulnerable to SQL injection, but the question specifically asks for the plan that enables detection alerts against the SQL databases themselves, not the web layer.

How to eliminate wrong answers

Option A is wrong because Defender for Servers focuses on protecting virtual machines and servers, not Azure SQL databases, and does not include SQL injection detection. Option C is wrong because Defender for App Service is designed to protect web applications and APIs running on Azure App Service, not SQL databases, and its threat detection centers on web application attacks like DDoS or cross-site scripting. Option D is wrong because Defender for Storage protects Azure Blob Storage, Azure Files, and Azure Data Lake Storage from threats like malware uploads or anonymous access, but it does not monitor SQL databases or detect SQL injection attacks.

Full explanation →

184

MCQeasy

In Microsoft 365 Defender, after an automated investigation completes, where can an analyst review the specific remediation actions that were taken (e.g., file quarantine, device isolation)?

A.Incident timeline

B.Action center

C.Threat analytics

D.Device inventory

AnswerB

The Action center is the centralized, cross-tenant hub in Microsoft 365 Defender that records every remediation action generated by automated investigations (AIR) as well as manual response activities. It shows the action's status (pending, approved, or rejected), the entity it targets (file, device, email, URL, etc.), and the investigation it belongs to, making it the definitive location to review, approve, or reject actions after an automated investigation finishes.

Why this answer

The Action center in Microsoft 365 Defender is the centralized location where all manual and automated remediation actions (such as file quarantine, device isolation, and process termination) are tracked and can be reviewed or approved. After an automated investigation completes, the specific actions taken are recorded in the Action center's history tab, allowing analysts to see exactly what was executed and the outcome. This is distinct from the Incident timeline, which shows alerts and events but not the detailed remediation action records.

Exam trap

The trap here is that candidates confuse the Incident timeline (which shows investigation steps and alerts) with the Action center (which is the sole location for reviewing and managing remediation actions), leading them to select the Incident timeline instead of the correct Action center.

How to eliminate wrong answers

Option A is wrong because the Incident timeline displays alerts, events, and investigation steps in chronological order, but it does not provide a dedicated view of remediation actions taken; those actions are logged in the Action center. Option C is wrong because Threat analytics provides threat intelligence, vulnerability reports, and mitigation guidance, not a record of specific remediation actions performed on endpoints. Option D is wrong because Device inventory lists managed devices and their properties (e.g., OS, health status) but does not show remediation actions like file quarantine or device isolation.

Full explanation →

185

MCQeasy

A company uses Microsoft Defender for Cloud to secure its Azure environment. The security team wants to receive notifications via email whenever a high-severity security alert is generated. What should they configure in Defender for Cloud?

A.Enable the 'Continuous Export' feature to send alerts to a Log Analytics workspace.

B.Configure an alert rule in Azure Monitor.

C.Set up email notifications for high-severity alerts in the Defender for Cloud environment settings.

D.Create an automation rule in Microsoft Sentinel.

AnswerC

In Microsoft Defender for Cloud, the correct way to receive email notifications for high-severity alerts is to navigate to the environment settings, select the subscription's settings, and then configure the email notifications pane. There you can specify security contact email addresses and choose the severity levels (e.g., high severity) for which notifications should be sent. This native feature is purpose-built for directly alerting security teams via email when critical vulnerabilities are detected, ensuring timely awareness without relying on external workflows.

Why this answer

Defender for Cloud provides a built-in email notification configuration specifically for security alerts. By navigating to the 'Environment settings' for the subscription or management group, then selecting 'Email notifications', you can enable and configure alerts to be sent to specified recipients when high-severity alerts are generated. This is the direct, purpose-built method for email notification of Defender for Cloud alerts without requiring additional services.

Exam trap

The trap here is that candidates often confuse the purpose of 'Continuous Export' (which is for data export, not direct notification) or assume that Azure Monitor alert rules are the universal mechanism for all Azure alerts, overlooking Defender for Cloud's dedicated email notification settings.

How to eliminate wrong answers

Option A is wrong because 'Continuous Export' streams security alerts and recommendations to a Log Analytics workspace or Event Hubs for integration with other tools (e.g., SIEM), but it does not directly send email notifications; it requires additional logic (e.g., Azure Monitor alerts or Logic Apps) to trigger emails. Option B is wrong because Azure Monitor alert rules are designed for metrics, logs, and activity logs, not for Defender for Cloud security alerts; while you can create a custom alert rule using Log Analytics data if Continuous Export is enabled, this is an indirect, extra-step approach, not the native configuration for Defender for Cloud email notifications. Option D is wrong because automation rules in Microsoft Sentinel are used to automate incident management and response within Sentinel, not to configure email notifications for Defender for Cloud alerts; Sentinel can ingest Defender for Cloud alerts, but the email notification setting is a Defender for Cloud feature, not a Sentinel one.

Full explanation →

186

MCQhard

A SOC analyst creates a scheduled analytics rule in Microsoft Sentinel that uses the following KQL query to detect impossible travel: SigninLogs | where TimeGenerated > ago(1d) | summarize Countries = make_set(Location) by UserPrincipalName | where array_length(Countries) > 1 However, the analyst notices that the rule generates too many false positives for users who travel legitimately. What is the best way to refine the rule to reduce false positives without missing actual impossible travel?

A.Add a condition to filter out VPN IP addresses from the Log Analytics workspace.

B.Instead of using make_set, use the dcount() function to estimate distinct countries.

C.Use the time series anomaly detection function series_decompose() on the signin data.

D.Modify the query to include a time difference condition using the partition operator or a join to find sign-ins from different countries within a short time window.

AnswerD

This is correct because it introduces the missing temporal constraint: by partitioning sign-ins by user (or self-joining the sign-in table), the query can sort events by timestamp and compute the time difference between consecutive sign-ins where the country changes. A threshold, for example less than 60 minutes for countries that are thousands of miles apart, makes the rule detect actual impossible travel rather than merely multiple countries in a day. The partition operator or join with a time-diff filter enables the scheduled analytics rule to alert only on geographically inconsistent rapid transitions.

Why this answer

Impossible travel detection requires correlating sign-ins from different geographic locations within a time window that is too short for physical travel. By using the partition operator or a join to compare timestamps between sign-ins from different countries, the query can distinguish between legitimate sequential travel (e.g., a user flying from New York to London over 8 hours) and truly impossible simultaneous sign-ins (e.g., sign-ins from New York and London within 30 minutes). This reduces false positives while still catching actual impossible travel.

Exam trap

The trap here is that candidates may think filtering by VPN or using aggregation functions like make_set or dcount() is sufficient, but they fail to recognize that impossible travel detection fundamentally requires a time-based correlation between geographically distinct sign-in events.

How to eliminate wrong answers

Option A is wrong because filtering out VPN IP addresses does not address the core issue of legitimate travel; VPNs may be used for remote access and do not inherently indicate impossible travel, and this approach could miss actual threats where an attacker uses a VPN to mask their location. Option B is wrong because using dcount() instead of make_set only changes how distinct countries are counted (approximate vs. exact) and does not add any time-based logic to differentiate between sequential and simultaneous sign-ins. Option C is wrong because series_decompose() is designed for time series anomaly detection on numeric metrics (e.g., count of sign-ins over time), not for correlating geographic locations across user sign-in events to detect impossible travel.

Full explanation →

187

Multi-Selectmedium

Which of the following resource types are supported by Microsoft Defender for Cloud's workload protection plans? (Select all that apply.) (Choose 3.)

Select 3 answers

A.Azure virtual machines

B.Azure SQL databases

C.On-premises servers connected via Azure Arc

D.Azure Logic Apps

AnswersA, B, C

Microsoft Defender for Cloud's Defender for Servers plan natively integrates with Azure virtual machines, offering a comprehensive suite of protections that include file integrity monitoring, just-in-time VM access, adaptive application controls, and integrated threat detection powered by Microsoft Defender for Endpoint. The plan also facilitates vulnerability assessment by continuously scanning VM operating systems for missing patches and misconfigurations, making Azure VMs a primary and fully supported workload type.

Why this answer

Microsoft Defender for Cloud's workload protection plans support Azure virtual machines by providing integrated threat detection and advanced security features like just-in-time VM access, file integrity monitoring, and vulnerability assessments. These capabilities leverage the Microsoft Monitoring Agent or Azure Monitor Agent to analyze security events and detect suspicious activities within the VM's operating system and network traffic.

Exam trap

The trap here is that candidates often assume all Azure resource types are covered by the same workload protection plan, but Microsoft specifically scopes these plans to compute, data, and hybrid workloads, excluding serverless or integration services like Logic Apps which require separate Defender plans.

Full explanation →

188

Multi-Selectmedium

Which TWO actions should an analyst take when a confirmed ransomware incident is detected on multiple endpoints? (Choose TWO.)

Select 2 answers

A.Run a full antivirus scan on all endpoints.

B.Isolate affected endpoints using Microsoft Defender for Endpoint.

C.Block known malicious IP addresses and domains in the firewall.

D.Disconnect network cables but leave endpoints powered on.

E.Shut down all affected endpoints to prevent data loss.

AnswersB, C

Immediately contains the threat by isolating devices.

Why this answer

Microsoft Defender for Endpoint's device isolation feature immediately severs all network communication (both inbound and outbound) from the affected endpoint while keeping the device powered on for forensic analysis. This containment action prevents lateral movement and further encryption of data across the network, which is critical during a ransomware incident.

Exam trap

The trap here is that candidates often confuse 'isolation' with 'shutdown' or 'disconnect', not realizing that isolation preserves forensic data and allows remote management, while shutdown destroys volatile evidence and may accelerate data loss.

Full explanation →

189

MCQeasy

A security analyst is investigating a malware incident on an endpoint using Microsoft 365 Defender. The analyst wants to see all processes that were created on the device in the last hour, including the command line arguments. Which advanced hunting table should they query?

A.DeviceProcessEvents

B.DeviceNetworkEvents

C.DeviceFileEvents

D.DeviceRegistryEvents

AnswerA

This table records process creation events, including the full command line arguments.

Why this answer

The DeviceProcessEvents table in Microsoft 365 Defender's advanced hunting schema captures process creation events, including the command line arguments used to start each process. This directly meets the analyst's need to see all processes created in the last hour with their command-line details, making it the correct table for investigating malware that spawns processes.

Exam trap

The trap here is that candidates often confuse process creation events with network or file events, mistakenly choosing DeviceNetworkEvents or DeviceFileEvents because they associate malware with network traffic or file drops, rather than recognizing that command-line arguments are exclusively stored in DeviceProcessEvents.

How to eliminate wrong answers

Option B (DeviceNetworkEvents) is wrong because it records network connections (e.g., IP addresses, ports, protocols) and not process creation or command-line arguments. Option C (DeviceFileEvents) is wrong because it logs file creation, modification, and deletion events, not process creation or command-line data. Option D (DeviceRegistryEvents) is wrong because it tracks registry key modifications, not process creation or command-line arguments.

Full explanation →

190

MCQhard

An organization needs to meet PCI DSS compliance requirements and also enforce a custom policy requiring that encryption keys be stored in a specific Azure Key Vault. The security administrator wants to view a unified compliance score that includes both the built-in PCI DSS standard and the custom policy. What should the administrator do in Microsoft Defender for Cloud?

A.Assign the built-in PCI DSS regulatory compliance standard and add a custom policy through Azure Policy

B.Create a custom initiative that includes the PCI DSS built-in policy set and the custom key vault policy, then assign it to the scope

C.Use Azure Blueprints to deploy the PCI DSS standard and custom policies

D.Enable the Secure Score dashboard to measure compliance

AnswerB

Creating a custom initiative lets you combine the built-in PCI DSS policy set with a custom Key Vault policy definition into one assignable Azure Policy object, which overcomes the read-only nature of built-in regulatory standards. After assignment to the management group, subscription, or resource group, this initiative appears under Defender for Cloud's Regulatory Compliance dashboard because custom initiatives are supported there and are evaluated against the corresponding compliance controls. This is the only option that both enforces the custom Key Vault requirement and surfaces the result as part of the PCI DSS compliance view.

Why this answer

Microsoft Defender for Cloud's regulatory compliance dashboard can only display a unified compliance score when all relevant standards and custom policies are grouped into a single initiative. By creating a custom initiative that includes both the built-in PCI DSS policy set and the custom Key Vault policy, then assigning that initiative to the scope, the administrator ensures the compliance score reflects both requirements in one view.

Exam trap

The trap here is that candidates assume simply assigning the built-in standard and adding a custom policy separately will merge their scores, but Defender for Cloud requires all policies to be part of the same initiative for a unified compliance score.

How to eliminate wrong answers

Option A is wrong because simply assigning the built-in PCI DSS standard and adding a custom policy through Azure Policy does not merge them into a single compliance score; the custom policy would appear separately and not contribute to the unified score. Option C is wrong because Azure Blueprints is a deployment and orchestration tool, not a compliance scoring mechanism; it cannot aggregate compliance data into Defender for Cloud's regulatory compliance dashboard. Option D is wrong because the Secure Score dashboard measures security posture based on security controls, not regulatory or custom policy compliance; it does not include PCI DSS or custom key vault policies.

Full explanation →

191

MCQeasy

A company wants to be alerted when a virtual machine is exposed to the internet through a permissive network security group rule. Which Microsoft Defender for Cloud feature provides recommendations and alerts for such misconfigurations?

A.Adaptive network hardening

B.Just-in-time VM access

C.File integrity monitoring

D.Application controls

AnswerA

Adaptive network hardening is a Microsoft Defender for Cloud feature that uses machine learning to analyze historical traffic patterns against current network security group (NSG) rules. When it identifies rules that are overly permissive—such as allowing inbound traffic from the internet on management ports—it generates a security alert and provides a recommendation to restrict the rule. This directly surfaces VMs that are inadvertently exposed to the internet due to flawed NSG configurations.

Why this answer

Adaptive network hardening (ANH) in Microsoft Defender for Cloud analyzes actual traffic patterns, NSG rules, and internet-facing endpoints to identify overly permissive rules that expose VMs to the internet. It then provides actionable recommendations to tighten those rules and can generate security alerts when such misconfigurations are detected. This directly matches the requirement for alerts on internet exposure via permissive NSG rules.

Exam trap

The trap here is confusing a feature that actively controls access (like JIT VM access) with one that detects and alerts on existing misconfigurations (adaptive network hardening), leading candidates to choose JIT because it also deals with internet exposure, but it does not generate alerts for permissive NSG rules.

How to eliminate wrong answers

Option B (Just-in-time VM access) is wrong because it controls inbound access by temporarily opening ports only when needed, but it does not analyze existing NSG rules for permissive internet exposure or generate alerts for misconfigurations. Option C (File integrity monitoring) is wrong because it monitors changes to critical files, registry keys, and system files for compliance and forensic purposes, not network security group rules or internet exposure. Option D (Application controls) is wrong because it uses allow/deny lists to control which applications can run on VMs, focusing on executable and script control, not network security group rule analysis or internet exposure alerts.

Full explanation →

192

MCQmedium

Your Microsoft Sentinel environment is not generating incidents from a custom KQL detection rule. The rule runs successfully in the Log Analytics query editor but no incidents appear. What is the most likely cause?

A.The rule's alert grouping settings are misconfigured

B.The rule is set to create alerts but not incidents

C.The rule's query schedule is too long

D.The rule does not have entity mapping configured

AnswerB

Correct. The rule is set to create alerts but not incidents, meaning the 'Create incident' toggle is off. This is the most common reason for missing incidents despite successful query execution.

Why this answer

The most likely cause is that the rule is set to create alerts but not incidents. In Microsoft Sentinel, analytics rules have a toggle to 'Create incidents' from alerts. If this toggle is disabled, alerts are generated but not grouped into incidents.

The query running successfully in Log Analytics confirms the rule logic works, but incidents will not appear unless the incident creation toggle is enabled. Entity mapping is not required for incident creation; it enhances correlation but is not a prerequisite.

Exam trap

The trap is that candidates often assume entity mapping is necessary for incident creation, but in reality the key setting is the 'Create incident' toggle. They may overlook this simple configuration.

How to eliminate wrong answers

Option A is wrong because alert grouping settings control how alerts are grouped into a single incident (e.g., by entity or time window), but they do not prevent incidents from being created entirely; if incidents are enabled, misconfigured grouping might cause unexpected grouping, not a total absence of incidents. Option B is wrong because this is the correct description of the issue—the rule is set to create alerts but not incidents, which directly explains why no incidents appear despite successful query execution. Option C is wrong because a long query schedule (e.g., running every 24 hours) would delay incident creation but not prevent it; incidents would still appear after the scheduled run if the rule is configured to create them.

Full explanation →

193

MCQhard

A SOC team uses Microsoft Sentinel. They receive a large volume of low-severity incidents from a specific analytics rule that causes alert fatigue. They want to automatically close incidents that match certain criteria (e.g., originating from a known test IP). Which feature should they configure?

A.Automation rules with a condition to close incidents

B.Playbook with a timer trigger

C.Watchlist integration

D.Fusion rule

AnswerA

Automation rules are native Sentinel orchestration objects that trigger synchronously on incident creation or update. Under a condition such as an entity matching a watchlist or a low severity classification, the rule can execute the 'Close incident' action with a chosen classification and comment, requiring no external logic app and no analyst intervention. This is the correct low-code way to suppress noisy alerts.

Why this answer

Automation rules in Microsoft Sentinel allow you to automatically close incidents based on specific conditions, such as a known test IP address. This directly addresses alert fatigue by suppressing low-severity incidents without manual intervention. Unlike playbooks, automation rules are lightweight and run natively within Sentinel without requiring a Logic Apps instance.

Exam trap

Microsoft often tests the distinction between automation rules (native, condition-based actions) and playbooks (external Logic Apps workflows), leading candidates to incorrectly choose a playbook when a simpler automation rule suffices.

How to eliminate wrong answers

Option B is wrong because a playbook with a timer trigger runs on a schedule, not in response to an incident being created; it cannot automatically close incidents based on real-time criteria like source IP. Option C is wrong because a watchlist is a data reference object used for enrichment or correlation in queries and rules, not a mechanism to automatically close incidents. Option D is wrong because a Fusion rule is a correlation-based analytics rule that reduces alert fatigue by combining alerts into high-fidelity incidents, but it does not close existing incidents based on custom criteria like a test IP.

Full explanation →

194

MCQmedium

A company uses Microsoft Defender for Cloud with Defender for Containers enabled. The security team wants to view security alerts generated for their Azure Kubernetes Service (AKS) clusters. Where should they navigate to see these alerts?

A.In the Microsoft Defender for Cloud 'Security alerts' page.

B.In Microsoft Sentinel incidents.

C.In the Microsoft 365 Defender portal.

D.In Azure Monitor alerts.

AnswerA

All Defender for Cloud security alerts—whether they originate from Azure, hybrid, multicloud, or container workloads—are aggregated in the unified Security alerts page. This page is the default and authoritative console for viewing, filtering, and triaging alerts generated by Defender for Cloud's plans, including Defender for Containers. Container-specific findings appear here with the relevant resource, severity, and associated MITRE ATT&CK tactics, making it the correct location for this scenario.

Why this answer

Microsoft Defender for Cloud is the central console for security alerts generated by Defender for Containers, including those for AKS clusters. The 'Security alerts' page within Defender for Cloud aggregates all cloud workload protection alerts, making it the correct location to view AKS-specific alerts. Alerts from Defender for Containers are automatically surfaced here without additional configuration.

Exam trap

The trap here is that candidates often confuse the Microsoft 365 Defender portal (unified for Microsoft 365 security) with Defender for Cloud (for cloud workloads), leading them to choose Option C instead of the correct Azure-native security alerts page.

How to eliminate wrong answers

Option B is wrong because Microsoft Sentinel incidents require a separate SIEM integration and are not the native location for Defender for Cloud alerts; alerts must be forwarded via connector to appear there. Option C is wrong because the Microsoft 365 Defender portal focuses on endpoint, email, and identity threats, not cloud workload alerts from AKS. Option D is wrong because Azure Monitor alerts are designed for infrastructure metrics and logs, not the security-specific, contextual alerts generated by Defender for Cloud's threat detection engines.

Full explanation →

195

MCQmedium

A security analyst is building a custom detection rule in Microsoft 365 Defender to identify ransomware activity. The rule should trigger when files with specific extensions (e.g., .encrypted, .locked) are created on multiple devices within a short time frame, suggesting a widespread attack. Which combination of advanced hunting tables should be used to obtain both file creation events and device information?

A.DeviceFileEvents and DeviceInfo

B.DeviceProcessEvents and DeviceInfo

C.DeviceFileEvents and DeviceNetworkEvents

D.DeviceFileEvents and DeviceLogonEvents

AnswerA

Correct. DeviceFileEvents contains file creation (ActionType 'FileCreated') details including SHA256, file name, and folder path. Joining with DeviceInfo provides device metadata like device name and OS. This combination directly supports the requirement.

Why this answer

DeviceFileEvents captures file creation events, including the specific extensions like .encrypted and .locked, while DeviceInfo provides device metadata such as device name, OS platform, and device group. Joining these tables on DeviceId allows the analyst to correlate file creation events across multiple devices, enabling detection of widespread ransomware activity within a short time frame.

Exam trap

The trap here is that candidates may confuse file creation events with process creation events (DeviceProcessEvents) or network events (DeviceNetworkEvents), overlooking that only DeviceFileEvents directly captures the file extension data needed for ransomware detection.

How to eliminate wrong answers

Option B is wrong because DeviceProcessEvents logs process creation events (e.g., command-line executions), not file creation events; it cannot directly identify files with specific extensions being created. Option C is wrong because DeviceNetworkEvents captures network connections and DNS queries, not file creation events; it provides no visibility into local file system changes. Option D is wrong because DeviceLogonEvents records authentication events (logon/logoff), not file creation events; it cannot detect the creation of encrypted or locked files.

Full explanation →

196

MCQeasy

You are configuring a Microsoft Sentinel automation rule to automatically assign incidents to a specific owner based on a custom property. Which action type should you use?

A.Run playbook

B.Assign owner

C.Change status

D.Create ticket (preview)

AnswerB

This action sets the incident owner to a specified user or group.

Why this answer

The 'Assign owner' action type is specifically designed to change the owner of an incident in Microsoft Sentinel. When you need to automatically assign incidents to a specific owner based on a custom property (e.g., a tag or custom field), this action directly modifies the incident's 'Owner' property. Other action types serve different purposes: 'Run playbook' executes a logic app, 'Change status' updates the incident's status (e.g., New, Active, Closed), and 'Create ticket (preview)' creates an external ticket in a connected ticketing system.

Exam trap

The trap here is that candidates often confuse 'Assign owner' with 'Run playbook', thinking a playbook is required to change the owner, but Sentinel provides a native action for this simple property change without needing a Logic App.

How to eliminate wrong answers

Option A is wrong because 'Run playbook' triggers a Logic App workflow, which can include complex logic but is not a direct action to set the incident owner; it is used for automation beyond simple property changes. Option C is wrong because 'Change status' modifies the incident's status (e.g., from New to Active), not the owner assignment. Option D is wrong because 'Create ticket (preview)' generates a ticket in an external system (e.g., ServiceNow) and does not modify the Sentinel incident's owner field.

Full explanation →

197

MCQmedium

An analyst is investigating an incident where a user's mailbox was compromised. The analyst wants to find all mailbox access events (e.g., logins, message access) performed from a specific IP address. Which Advanced Hunting table in Microsoft 365 Defender should be queried?

A.CloudAppEvents

B.EmailEvents

C.EmailAttachmentInfo

D.AADSignInEventsBeta

AnswerA

Correct. This table logs actions in cloud apps including mailbox access events.

Why this answer

The CloudAppEvents table in Microsoft 365 Defender captures audit logs for cloud applications, including Exchange Online mailbox operations such as logins, message access, and folder bindings. This table contains the 'IPAddress' field, allowing the analyst to filter events from a specific IP address. Other tables lack the necessary scope of mailbox access events or the IP address field for this query.

Exam trap

The trap here is that candidates confuse Azure AD sign-in logs (AADSignInEventsBeta) with mailbox access logs, but Azure AD logs only capture authentication events, not the subsequent application-level operations within Exchange Online.

How to eliminate wrong answers

Option B (EmailEvents) is wrong because it tracks email delivery and transport events (e.g., send, receive, spam verdicts), not mailbox access events like logins or message reads. Option C (EmailAttachmentInfo) is wrong because it focuses on attachment metadata (e.g., file name, hash) and does not include user access logs or IP addresses. Option D (AADSignInEventsBeta) is wrong because it records Azure AD authentication events for user sign-ins to cloud apps, but it does not capture granular mailbox-level operations such as message access or folder browsing within Exchange Online.

Full explanation →

198

MCQmedium

A security analyst is configuring a Microsoft Sentinel playbook to automate the response to phishing incidents. When an incident is created based on a phishing analytics rule, the playbook needs to execute an action in Microsoft 365 Defender, such as blocking the sender email address. Which connector should the analyst add to the playbook to interact with Microsoft 365 Defender?

A.Microsoft 365 Defender connector

B.Microsoft Entra ID connector

C.Azure DevOps connector

D.Teams connector

AnswerA

The Microsoft 365 Defender connector is the correct choice because it is purpose-built for security response actions in Microsoft 365 Defender, including blocking email senders, isolating compromised devices, and running advanced hunting queries. It is implemented as a Logic Apps managed connector that uses the Microsoft 365 Defender APIs, allowing playbooks to initiate remediation directly from Sentinel incidents.

Why this answer

The Microsoft 365 Defender connector is the correct choice because it provides the necessary actions to interact directly with Microsoft 365 Defender components, such as blocking a sender email address via the Advanced Hunting or action APIs. This connector enables the playbook to trigger remediation actions like email quarantine or sender block within the Microsoft 365 Defender portal, which is essential for automating responses to phishing incidents in Microsoft Sentinel.

Exam trap

The trap here is that candidates often confuse the Microsoft 365 Defender connector with the Microsoft Entra ID connector, assuming identity actions can block email senders, but Entra ID lacks the email security APIs required for such remediation.

How to eliminate wrong answers

Option B is wrong because the Microsoft Entra ID connector is designed for identity and access management actions (e.g., revoking user sessions, disabling accounts), not for email security actions like blocking a sender in Microsoft 365 Defender. Option C is wrong because the Azure DevOps connector is used for managing work items, pipelines, and repositories in Azure DevOps, not for security response actions in Microsoft 365 Defender. Option D is wrong because the Teams connector is used for sending messages or notifications to Microsoft Teams channels, not for executing remediation actions like blocking a sender email address.

Full explanation →

199

MCQhard

A security analyst is investigating an advanced persistent threat (APT) campaign that involves lateral movement using RDP. The analyst wants to create a custom detection rule in Microsoft 365 Defender that triggers when a device remotely connects to another device via RDP (process: mstsc.exe) and, within 10 minutes, the remote device executes a suspicious script (e.g., PowerShell.exe with encoded command). Which KQL query pattern in advanced hunting should be used to correlate these events across devices?

A.DeviceProcessEvents | where FileName == 'mstsc.exe' | join DeviceProcessEvents on DeviceName | where (Timestamp2 - Timestamp1) between (0m..10m) and FileName == 'powershell.exe'

B.DeviceProcessEvents | where FileName == 'mstsc.exe' | project SourceDevice = DeviceName, TimeGenerated, RemoteDevice = extract(remote device from command line) | join kind=inner (DeviceProcessEvents | where FileName == 'powershell.exe') on $left.RemoteDevice == $right.DeviceName and $left.TimeGenerated between ($right.TimeGenerated-10m .. $right.TimeGenerated)

C.DeviceProcessEvents | where FileName in~ ('mstsc.exe', 'powershell.exe') and TimeGenerated > ago(1h) | summarize makelist(DeviceName) by bin(TimeGenerated, 10m)

D.DeviceProcessEvents | where FileName == 'mstsc.exe' | extend RemoteDevice = extract(...,1, ProcessCommandLine) | join kind=inner (DeviceProcessEvents | where FileName == 'powershell.exe') on $left.RemoteDevice == $right.DeviceName and $left.TimeGenerated between ($right.TimeGenerated - 10m .. $right.TimeGenerated)

AnswerB

This pattern extracts the remote device from the mstsc command line and joins with PowerShell events on the remote device within a 10-minute window after the RDP connection.

Why this answer

It uses the `extract()` function to parse the remote device name from the `mstsc.exe` command line (e.g., `mstsc.exe /v:REMOTE_PC`), then performs an inner join with `DeviceProcessEvents` for `powershell.exe` on the condition that the remote device name matches and the `mstsc.exe` timestamp falls within a 10-minute window before the PowerShell execution. This precisely correlates the lateral movement (RDP connection) with the subsequent suspicious script execution on the target device, which is the required detection pattern.

Exam trap

The trap here is that candidates often overlook the need to extract the remote device from the `mstsc.exe` command line and instead join on `DeviceName`, which would incorrectly correlate events on the same device rather than across devices, or they misorder the time window (checking after instead of before).

How to eliminate wrong answers

Option A is wrong because it joins on `DeviceName` instead of extracting the remote device from the command line, so it would only match events on the same device, not across devices; also, `Timestamp2` and `Timestamp1` are not valid fields in `DeviceProcessEvents`. Option C is wrong because it simply groups both process events into 10-minute bins without correlating the RDP connection to a specific remote device, producing a list of devices rather than a cross-device sequence. Option D is wrong because it uses an incomplete `extract()` syntax (missing the capture group index and the regex pattern), and the join condition uses `$left.TimeGenerated between ($right.TimeGenerated - 10m .. $right.TimeGenerated)` which incorrectly checks if the RDP event occurred after the PowerShell event, whereas the correct logic requires the RDP event to occur before the PowerShell event.

Full explanation →

200

MCQhard

A global organization has Azure subscriptions organized under a single management group. The security team wants to ensure that the Azure Security Benchmark initiative is assigned once to cover all current and future subscriptions within that management group, without needing to assign it individually. They also want to see compliance results aggregated at the management group level. In Microsoft Defender for Cloud, what is the correct approach to achieve this?

A.Assign the Azure Security Benchmark initiative directly to the management group via Azure Policy, and use the Defender for Cloud's Regulatory Compliance dashboard.

B.Enable Defender for Cloud's enhanced security features on each subscription, and the benchmark will be automatically applied.

C.Create a custom assessment in Defender for Cloud that queries the management group scope.

D.Assign the initiative to the root management group using Azure Policy, then configure Defender for Cloud to ignore individual subscription assignments.

AnswerA

Assigning the Azure Security Benchmark initiative at the management group scope via Azure Policy applies the policy definitions to every subscription within that group through inheritance. Defender for Cloud's Regulatory Compliance dashboard then evaluates those assigned initiatives and aggregates the compliance results for the whole management group, providing a single-pane view of security controls. This is the intended method for centralized, organization-wide compliance monitoring because it avoids the need to assign the initiative separately to each subscription.

Why this answer

Assigning the Azure Security Benchmark initiative directly to the management group via Azure Policy ensures that the policy initiative is inherited by all current and future subscriptions under that management group. Defender for Cloud's Regulatory Compliance dashboard then aggregates compliance results at the management group level, providing a single view of compliance across the entire hierarchy without requiring individual assignments.

Exam trap

The trap here is that candidates may think enabling enhanced security features in Defender for Cloud automatically applies the Azure Security Benchmark, but in reality, the benchmark must be explicitly assigned as a policy initiative, and the management group scope is the correct way to cover all subscriptions.

How to eliminate wrong answers

Option B is wrong because enabling Defender for Cloud's enhanced security features on each subscription does not automatically assign the Azure Security Benchmark initiative; the benchmark must be explicitly assigned via Azure Policy. Option C is wrong because creating a custom assessment in Defender for Cloud that queries the management group scope does not enforce the Azure Security Benchmark initiative across subscriptions; it only provides a custom query without policy-driven compliance evaluation. Option D is wrong because assigning the initiative to the root management group would cover all subscriptions, but configuring Defender for Cloud to ignore individual subscription assignments is unnecessary and not a supported configuration; the correct approach is to assign directly to the target management group.

Full explanation →

201

MCQhard

A security analyst is hunting for a targeted phishing attack in Microsoft 365 Defender. They have identified a phishing email delivered to a user and want to find all devices where the user clicked the link in the email, and any processes that were spawned from the browser on those devices. Which advanced hunting strategy is most effective to correlate the email, network, and process data?

A.Query EmailEvents for the email, then DeviceLogonEvents for user logons, then DeviceProcessEvents for process creations after logon.

B.Query EmailUrlInfo for the URL, then DeviceNetworkEvents for devices that connected to that URL, then DeviceProcessEvents for processes on those devices that started shortly after the connection.

C.Query EmailAttachmentInfo, then DeviceFileEvents for files dropped.

D.Query IdentityLogonEvents, then DeviceEvents from the device where the logon occurred.

AnswerB

This is the correct hunting path because EmailUrlInfo directly reveals the malicious URL from the email, DeviceNetworkEvents captures the outbound connection made by the endpoint when the user clicks that URL, and DeviceProcessEvents can then be filtered by a short time window around that network event to identify the payload process. Joining these tables on device ID and timestamp gives a precise, evidence-backed chain from email to network connection to execution. This approach works for link-based phishing even when the user is already logged on and no new authentication event occurs.

Why this answer

It directly correlates the malicious URL from the email (via EmailUrlInfo) with devices that connected to that URL (via DeviceNetworkEvents), then identifies any processes spawned on those devices shortly after the connection (via DeviceProcessEvents). This sequence maps the attack chain from email delivery to network connection to post-click process execution, which is exactly what the analyst needs to find devices where the link was clicked and any resulting processes.

Exam trap

The trap here is that candidates often choose Option A, mistakenly thinking that user logon events are a reliable proxy for link clicks, but logons do not indicate that the user actually clicked the URL or that any malicious process was spawned from the browser.

How to eliminate wrong answers

Option A is wrong because DeviceLogonEvents captures user authentication events, not the specific act of clicking a link in a browser; correlating logons with process creations is too broad and misses the direct network connection to the phishing URL. Option C is wrong because it focuses on email attachments and file drops, but the question specifies a phishing email with a link, not an attachment; DeviceFileEvents would not capture browser network connections or spawned processes from clicking a URL. Option D is wrong because IdentityLogonEvents tracks identity-based logon events, not email or network activity; it cannot correlate the specific phishing email or URL with device processes.

Full explanation →

202

MCQmedium

A company has several Azure virtual machines running SQL Server (IaaS). The security team wants to enable Advanced Threat Protection for these SQL Server instances to detect threats like SQL injection. What should they do?

A.Deploy the SQL Server IaaS Agent extension on each VM and enable Azure Defender for SQL in Microsoft Defender for Cloud.

B.Enable Azure Defender for Servers on the subscription; it automatically protects SQL Server workloads.

C.Enable Azure Defender for SQL on the Log Analytics workspace used by the VMs.

D.Configure the Microsoft Sentinel SQL connector to ingest SQL audit logs.

AnswerA

Correct. The SQL IaaS Agent extension registers the VM with the SQL resource provider. After that, enabling Azure Defender for SQL (under Defender for Cloud plans) provides Advanced Threat Protection and vulnerability assessment for the SQL Server instances.

Why this answer

To enable Advanced Threat Protection for SQL Server IaaS, you must deploy the SQL Server IaaS Agent extension on each VM, which allows the VM to register with the SQL IaaS platform. Then, you enable Azure Defender for SQL in Microsoft Defender for Cloud, which provides threat detection for SQL injection and other anomalous activities. This combination ensures the SQL Server instances are monitored by Defender for Cloud's SQL-specific protections.

Exam trap

The trap here is that candidates often confuse Azure Defender for Servers with Azure Defender for SQL, assuming server-level protection automatically covers SQL workloads, but SQL-specific threat detection requires the dedicated SQL Defender plan and the IaaS Agent extension.

How to eliminate wrong answers

Option B is wrong because Azure Defender for Servers protects the VM's operating system and network, but it does not automatically enable SQL-specific threat detection like SQL injection; you need Azure Defender for SQL for that. Option C is wrong because Azure Defender for SQL is enabled at the subscription or workspace level for PaaS SQL databases, not for SQL Server IaaS VMs, which require the IaaS Agent extension. Option D is wrong because the Microsoft Sentinel SQL connector ingests audit logs for analysis in Sentinel, but it does not enable Advanced Threat Protection or real-time threat detection for SQL Server IaaS; that requires Defender for SQL.

Full explanation →

203

MCQeasy

A company enables Microsoft Defender for Cloud on its Azure subscription. The security team wants to ensure that all existing and future Azure VMs have Just-In-Time (JIT) VM access configured. Which of the following actions must the team take first to enable JIT for VMs?

A.Enable the 'Just-In-Time VM access' plan in Microsoft Defender for Cloud's environment settings

B.Configure a network security group (NSG) to allow RDP traffic from a specific IP range

C.Create a security policy assignment to block all inbound RDP traffic

D.Install the Log Analytics agent on all VMs

AnswerA

Enabling the Just-In-Time VM access plan in Microsoft Defender for Cloud's environment settings is the prerequisite step that activates the JIT feature for the subscription. Before any VM can be protected or any request processed, the plan must be turned on; after that, you configure individual VMs by selecting ports, allowed source IPs, and the maximum time window for access. Once configured, a user's access request causes Defender for Cloud to dynamically create temporary NSG allow rules, and those rules are automatically removed when the window expires.

Why this answer

Enabling the 'Just-In-Time VM access' plan in Microsoft Defender for Cloud's environment settings is the prerequisite step that activates the JIT feature for the subscription. Without this plan enabled, Defender for Cloud cannot enforce JIT policies on any VMs, regardless of NSG or agent configurations.

Exam trap

The trap here is that candidates often think JIT requires an agent or manual NSG configuration, but the first step is always enabling the plan in Defender for Cloud's environment settings, as JIT is a cloud-level policy feature, not a VM-level agent-based one.

How to eliminate wrong answers

Option B is wrong because configuring an NSG to allow RDP from a specific IP range is a manual access control method, not the first step to enable JIT; JIT itself dynamically manages NSG rules. Option C is wrong because creating a security policy to block all inbound RDP traffic would prevent JIT from opening ports on demand, as JIT requires the ability to temporarily allow traffic. Option D is wrong because the Log Analytics agent is not required for JIT VM access; JIT works through Azure Resource Manager and NSG rules, not agent-based monitoring.

Full explanation →

204

MCQmedium

A security administrator wants to enable vulnerability assessment for all existing and future Azure virtual machines using the integrated Microsoft Defender Vulnerability Management solution. Which action should they take in Microsoft Defender for Cloud?

A.Enable 'Microsoft Defender for Servers' plan and check the 'Vulnerability assessment' option in the environment settings

B.Install the Log Analytics agent and configure the Qualys connector on each VM

C.Create a policy assignment from the built-in initiative 'Enable Azure Monitor for VMs'

D.Enable 'Servers' workload protection in Defender for Cloud and then manually deploy the VA agent to each existing VM using Azure Policy

AnswerA

Enabling the Microsoft Defender for Servers plan at the subscription level activates the integrated Microsoft Defender Vulnerability Management (MDVM) solution, which is the default vulnerability assessment engine in Defender for Cloud. Checking the 'Vulnerability assessment' option in the environment settings auto-provisions this integrated scanner across every current and future VM without requiring manual agent installation. This ensures continuous coverage and management of vulnerabilities through Defender for Cloud's dashboards and recommendations.

Why this answer

To enable vulnerability assessment for all existing and future Azure VMs using the integrated Microsoft Defender Vulnerability Management solution, you must enable the 'Microsoft Defender for Servers' plan in Defender for Cloud and then check the 'Vulnerability assessment' option within the environment settings. This action activates the built-in, agentless vulnerability assessment engine that is part of Defender for Cloud, automatically scanning VMs without requiring additional agents or manual deployment.

Exam trap

The trap here is that candidates often confuse enabling 'Microsoft Defender for Servers' (which provides general threat protection) with the separate 'Vulnerability assessment' toggle that must be explicitly checked to activate the integrated vulnerability scanning, leading them to select option D which only mentions enabling workload protection.

How to eliminate wrong answers

Option B is wrong because installing the Log Analytics agent and configuring the Qualys connector is a legacy approach for vulnerability assessment that requires a third-party solution and manual per-VM configuration, not the integrated Microsoft Defender Vulnerability Management solution. Option C is wrong because creating a policy assignment from 'Enable Azure Monitor for VMs' enables VM insights and Log Analytics agent deployment, not vulnerability assessment via Defender for Cloud. Option D is wrong because enabling 'Servers' workload protection alone does not automatically enable vulnerability assessment; you must also check the 'Vulnerability assessment' option, and manually deploying the VA agent is unnecessary when the integrated solution is agentless.

Full explanation →

205

MCQhard

Match each Microsoft Sentinel data connector on the left with the table name it populates on the right.

A.Microsoft Entra ID → SigninLogs; Windows Security Events via AMA → SecurityEvent; Cisco ASA via Syslog → CommonSecurityLog; Azure Activity → AzureActivity

B.The first and last mappings are swapped.

C.Every item maps to the same log table or feature category.

D.Only identity-related items are mapped; workload and network items are omitted.

AnswerA

This is the correct mapping based on the documented function of each item.

Why this answer

It accurately maps each Microsoft Sentinel data connector to its corresponding log table. Microsoft Entra ID populates the SigninLogs table, Windows Security Events via AMA populates the SecurityEvent table, Cisco ASA via Syslog populates the CommonSecurityLog table (which is the standard schema for syslog-based security appliances), and Azure Activity populates the AzureActivity table. These mappings are defined by the data connectors themselves and are fundamental to querying the correct data in Sentinel.

Exam trap

The trap here is that candidates often confuse the CommonSecurityLog table with the Syslog table, but Cisco ASA via Syslog specifically populates CommonSecurityLog (not Syslog) because Sentinel normalizes syslog data from security appliances into a common schema for easier correlation.

How to eliminate wrong answers

Option B is wrong because it suggests the first and last mappings are swapped, but Microsoft Entra ID correctly maps to SigninLogs (not AzureActivity) and Azure Activity correctly maps to AzureActivity (not SigninLogs); swapping them would be incorrect. Option C is wrong because it claims every item maps to the same log table or feature category, which is false as each connector populates a distinct table (SigninLogs, SecurityEvent, CommonSecurityLog, AzureActivity) with different schemas and purposes. Option D is wrong because it states only identity-related items are mapped, but the set includes Windows Security Events (workload security) and Cisco ASA (network security), which are not identity-related; all four items are correctly mapped.

Full explanation →

206

MCQhard

A SOC team wants to use Microsoft Sentinel to detect when a user logs in from a new country not previously seen for that user. They have the SigninLogs table. Which KQL function is most appropriate to build this anomaly detection?

A.timechart()

B.make_set() with lookup

C.dcount()

D.startofday()

AnswerB

make_set() creates a dynamic array of distinct values for each user, effectively building a baseline of historically seen countries by grouping on the user column and applying make_set(Country). When a new login occurs, you can use a lookup or join operation to retrieve that user's set and then check whether the current Country exists in the array using array_contains() or the set_has_element operator. This allows you to flag any login from a country not present in the user's set, making make_set() with lookup the correct and direct method for this anomaly detection logic.

Why this answer

The `make_set()` function creates a dynamic array of distinct values (e.g., countries) per user over a specified time window. By using `lookup` to compare the current sign-in's country against the historical set, you can flag logins from countries not previously seen. This directly implements the 'new country' anomaly detection pattern in KQL.

Exam trap

Microsoft often tests the distinction between aggregate functions that return counts (`dcount`) versus those that return the actual set of values (`make_set`), leading candidates to choose `dcount` when they need to compare individual values against a historical list.

How to eliminate wrong answers

Option A is wrong because `timechart()` is a rendering function used to plot time-series data visually; it does not perform set-based anomaly detection or comparison logic. Option C is wrong because `dcount()` returns an approximate distinct count of values, not the actual set of values needed to check if a specific country has been seen before. Option D is wrong because `startofday()` is a datetime function that truncates timestamps to the start of the day; it has no capability to build or compare historical sets of countries.

Full explanation →

207

MCQhard

Your security team uses Microsoft Defender XDR (formerly Microsoft 365 Defender) to investigate incidents. You notice that some alerts from Microsoft Defender for Endpoint are not being automatically correlated into incidents as expected. You have confirmed that the relevant alert sources are enabled in the Microsoft Defender XDR portal. What is the most likely cause?

A.Alert tuning rules are causing the alerts to be excluded.

B.Incident correlation rules are not enabled for the relevant alert sources.

C.Automation rules in Microsoft Sentinel are deleting the alerts.

D.Alert suppression rules are blocking the alerts.

AnswerB

Correlation rules must be enabled to automatically create incidents from alerts.

Why this answer

Microsoft Defender XDR uses built-in correlation logic to automatically group related alerts from different sources (e.g., Defender for Endpoint, Defender for Office 365) into incidents. If alerts from a specific source, such as Defender for Endpoint, are not being correlated, the most likely cause is that the incident correlation rules for that source are not enabled in the Microsoft Defender XDR portal. Enabling the alert source alone is insufficient; the correlation engine must be explicitly activated for each source to aggregate alerts into incidents.

Exam trap

The trap here is that candidates assume enabling an alert source in the Microsoft Defender XDR portal automatically enables incident correlation for that source, but in reality, correlation rules must be explicitly enabled separately for each source.

How to eliminate wrong answers

Option A is wrong because alert tuning rules in Microsoft Defender XDR are used to reduce noise by suppressing or grouping alerts, but they do not prevent alerts from being correlated into incidents; they only affect alert generation. Option C is wrong because automation rules in Microsoft Sentinel are separate from Microsoft Defender XDR and operate on Sentinel incidents, not on Defender XDR alert correlation; Sentinel automation rules cannot delete alerts from Defender XDR. Option D is wrong because alert suppression rules in Defender for Endpoint are designed to suppress alerts based on criteria like device groups or severity, but they do not block alerts from being correlated into incidents; suppression only prevents alert creation, not correlation.

Full explanation →

208

MCQhard

You are investigating an incident where a user reported receiving a suspicious email with a malicious attachment. Microsoft Defender for Office 365 did not block it. The email originated from a known malicious sender domain. What configuration should you check first?

A.User-reported message settings

B.SPF record for the sender domain

C.Safe Attachments policy

D.Anti-phishing policy in Microsoft Defender for Office 365

AnswerD

Anti-phishing policy in Microsoft Defender for Office 365 is the correct control because it provides domain impersonation protection and spoof intelligence that can identify and block messages from known malicious domains or those mimicking protected senders. It leverages threat intelligence and real-time reputation to enforce blocking, quarantine, or redirect to Junk before delivery to the user's inbox. This policy is specifically designed to combat phishing and impersonation, which aligns with the reported incident involving a suspicious email.

Why this answer

The anti-phishing policy in Microsoft Defender for Office 365 is the primary configuration that evaluates sender reputation, impersonation attempts, and spoof intelligence. Since the email originated from a known malicious sender domain and was not blocked, the anti-phishing policy's spoof settings or impersonation protection may be misconfigured or not applied to the affected user. This policy directly controls how Defender handles emails from malicious domains, making it the first place to check.

Exam trap

The trap here is that candidates confuse the anti-phishing policy with Safe Attachments or SPF records, but the anti-phishing policy is the correct first check because it directly handles domain-based threats and spoofing, while Safe Attachments focuses on file analysis and SPF is a DNS record not configurable within Defender.

How to eliminate wrong answers

Option A is wrong because user-reported message settings control how users submit emails for analysis (e.g., via the Report Message add-in), not how Defender blocks malicious emails at the transport layer. Option B is wrong because the SPF record for the sender domain is a DNS record that the recipient's mail server checks, but it is not a configuration within Microsoft Defender for Office 365 that you can adjust; you can only configure SPF handling in the anti-phishing policy. Option C is wrong because Safe Attachments policy specifically handles attachments by detonating them in a sandbox, but the question states the email had a malicious attachment that was not blocked, and the primary issue is the sender domain being known malicious, which is addressed by anti-phishing policies, not attachment scanning.

Full explanation →

209

MCQeasy

A security analyst is investigating a phishing campaign using Microsoft 365 Defender advanced hunting. The analyst needs to find all emails sent from a specific sender address in the last 7 days. Which table should be queried?

A.EmailEvents

B.EmailAttachmentInfo

C.EmailUrlInfo

D.DeviceEvents

AnswerA

EmailEvents is the correct table because it is the primary Microsoft 365 Defender email metadata store, containing the sender address (SenderFromAddress/SenderDisplayName), recipient (RecipientEmailAddress), subject, and delivery status/actions such as Phish or Junk. In a phishing campaign investigation, you start here to identify which mailboxes received the malicious message and to correlate the sender and delivery outcome. It also fields like ThreatTypes and DetectionMethods, making it the authoritative source for the core message flow. Without querying EmailEvents, you cannot establish the baseline scope of the campaign.

Why this answer

The EmailEvents table in Microsoft 365 Defender advanced hunting stores metadata about email messages, including sender addresses, recipients, timestamps, and delivery actions. To find all emails from a specific sender in the last 7 days, you query EmailEvents because it contains the 'SenderFromAddress' or 'SenderMailFromAddress' fields needed to filter by sender. The other tables focus on attachments, URLs, or device-level events, which are not relevant for identifying emails by sender address.

Exam trap

The trap here is that candidates may confuse the purpose of EmailAttachmentInfo or EmailUrlInfo, thinking they contain sender data, when in fact they only store attachment or URL details and require a join with EmailEvents to correlate back to the sender.

How to eliminate wrong answers

Option B (EmailAttachmentInfo) is wrong because it stores information about email attachments (e.g., file names, hashes) but does not contain the sender address field needed to filter by sender. Option C (EmailUrlInfo) is wrong because it tracks URLs found in email bodies or attachments, not sender metadata. Option D (DeviceEvents) is wrong because it logs endpoint-level activities (e.g., process creation, network connections) and has no email-related data, making it irrelevant for querying email sender addresses.

Full explanation →

Microsoft Security Operations Analyst SC-200 (SC-200) — Questions 151–209