Respond to security incidents →mediumMultiple Choice

SC-200 Respond to security incidents Practice Question

Exhibit

Refer to the exhibit.
```json
{
  "type": "Microsoft.SecurityInsights/alertRules",
  "apiVersion": "2023-02-01-preview",
  "properties": {
    "displayName": "Anomalous PowerShell Execution",
    "description": "Detects PowerShell executed from unusual locations.",
    "severity": "High",
    "query": "DeviceProcessEvents | where FileName == 'powershell.exe' | where InitiatingProcessCommandLine contains '-EncodedCommand' | where not(ProcessCommandLine contains 'C:\\Windows\\System32')"
  }
}
```

You are testing this analytics rule. It should detect encoded PowerShell commands not from System32, but it is generating false positives. What is the most likely cause?

⚠ Common exam trap

The trap is assuming the rule is broken or misconfigured when the real issue is incomplete tuning — candidates may overlook that SysWOW64 is a legitimate path that must be excluded alongside System32.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

The rule does not exclude other legitimate paths like SysWOW64

The rule is designed to detect encoded PowerShell commands not originating from System32, but it is generating false positives. The most likely cause is that the rule does not exclude other legitimate paths such as SysWOW64, which also contains legitimate PowerShell executables on 64-bit Windows. Adding an exclusion for SysWOW64 (and possibly other trusted paths) would reduce false positives while maintaining detection of suspicious executions.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
The severity should be Informational
Why it's wrong here
Severity only controls alert triage priority, not rule matching logic, so it cannot generate false positives. It is tempting because Informational severity suits noisy, low-fidelity detections, and would be the right choice when tuning alert fatigue after the query itself is accurate.
✗
The rule should also include System32
Why it's wrong here
Adding System32 to the rule widens the match set rather than excluding it, so genuine System32-launched encoded commands would still trigger alerts. The exclusion belongs in the query logic itself. Including System32 would suit a rule intended to audit all PowerShell usage, not one scoped to non-System32 origins.
✗
The query syntax is incorrect
Why it's wrong here
A syntax error would cause the query to fail or return nothing, not produce false positives. The rule is evidently parsing and matching events; the flaw lies in its filter logic, which fails to exclude System32 paths. Syntax checks matter when authoring a new query that returns no results at all.
✓
The rule does not exclude other legitimate paths like SysWOW64
Why this is correct
The rule flags encoded PowerShell outside System32, but legitimate 32-bit processes launch from SysWOW64, which the path exclusion omits. Adding SysWOW64 to the exclusion list removes those benign executions, addressing the false positives described in the stem.

Go deeper

1 more way this is tested on SC-200

These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.

Variation 1. Refer to the exhibit. You are deploying this analytics rule in Microsoft Sentinel. Which activity will trigger an alert?

easy

A.cmd.exe launching winword.exe
B.Any process creation event
C.Winword.exe execution
D.Any cmd.exe execution
✓ E.Word launching cmd.exe

Why E: The analytics rule is configured to trigger an alert when a process creation event (Event ID 4688) has a parent process of 'winword.exe' and a child process of 'cmd.exe'. This specific parent-child relationship indicates that Microsoft Word is launching a command prompt, which is a common technique used in malicious documents to execute commands. The rule's query filters for 'ParentImage' containing 'winword.exe' and 'Image' containing 'cmd.exe', so only when Word launches cmd.exe will the alert fire.

Written and reviewed by Johnson Ajibi, MSc IT Security

Senior Network & Security Engineer · founder of Courseiva

Last reviewed September 2026 · checked against the official Microsoft exam blueprint

This SC-200 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-200 exam.

SC-200 Respond to security incidents Practice Question

Exhibit

Why each option matters

Option-by-option breakdown

Related to this question

1 more way this is tested on SC-200