SC200 - Practice test

You have a Microsoft 365 E5 subscription. You plan to deploy Microsoft Defender for Endpoint to meet the following requirements: · Block executable content from email messages. · Block unsigned processes that run from USB drives. Which Defender for Endpoint capability should you use?. Attack surface reduction. Block at first site. Controlled folder access. Exploit protection.

You have a Microsoft 365 E5 subscription that uses Microsoft Defender for Endpoint. You need to be notified when new or updated threat analytics information is added to Microsoft Defender XDR. Which method can you use?. Configure a Microsoft Sentinel automation rule. Configure a threat analytics email notification rule. Configure a vulnerabilities email notification rule. Configure en Advanced Hunting detection rule. Configure an alert email notification rule.

You have a Microsoft Defender XDR subscription that uses automated remediation. You have a line-of-business (LOB) application named LOB1. LOB1 uses a file that was incorrectly blocked by Microsoft Defender XDR. You need to ensure that the file is unblocked immediately and prevent Microsoft Defender XDR from blocking the file again in the future. The solution must prevent other malicious files from being unblocked automatically. What should you do in the Microsoft Defender portal?. Configure a file threat indicator. Create a critical asset classification. Create a custom quarantine policy. Edit the Tenant Allow/Block List.

You have a hybrid environment that includes an on-premises Active Directory Domain Services (AD DS) domain, a Microsoft Entra tenant, and a Microsoft 365 E5 subscription. All Windows 11 devices are onboarded to Microsoft Defender for Endpoint. You deploy Microsoft Defender for Identity sensors to domain controllers. You need to enable automatic attack disruption in Microsoft Defender XDR. The solution must meet the following requirements: · During an active attack, affected devices must be contained automatically, and compromised user accounts must be disabled. · User disruptions must be minimized. What should you configure?. Advanced features in Microsoft Defender for Identity. Attack Surface Reduction (ASR) rules in Microsoft Defender for Endpoint. Device isolation in Microsoft Defender for Endpoint. Indicators in Microsoft Defender for Endpoint.

You have a Microsoft 365 E5 subscription that contains the following users: User1: · Microsoft Entra role: Global Administrator · Microsoft 365 role group: Security Administrator User2: · Microsoft Entra role: Security Administrator · Microsoft 365 role group: Security Reader User3: · Microsoft Entra role: Security Reader · Microsoft 365 role group: Security Reader Which users can modify the security settings in Microsoft Defender XDR?. User1 only. User1 and User2 only. User1 and User3 only. User1, User2 and User3.

You have a Microsoft 365 E5 subscription that uses Microsoft Defender for Endpoint. You deploy an app named App1. App1 clears logs from an application server. When App1 runs, it triggers a Microsoft Defender alert. You need to prevent App1 from triggering alerts. The solution must ensure that other apps will still trigger alerts. What should you configure?. a detection rule. a suppression rule. an alert policy. an automated investigation.

Your company uses Microsoft Defender XDR. You need to use Microsoft Defender XDR deception rules to detect attacks as early as possible. What Microsoft Defender XDR service should you use to create the deception rules?. Microsoft Defender for Cloud Apps. Microsoft Defender for Endpoint. Microsoft Defender for Identity. Microsoft Defender for Office 365.

You have a Microsoft Sentinel workspace and a playbook named Playbook1. You need to ensure that you can manually run Playbook1 from an incident investigation. The solution must ensure that Playbook1 is available from Actions on the incident information window. What should you do?. Add the Microsoft Sentinel Automation Contributor role to Playbook1. Update Playbook1 to use a managed identity. Update Playbook1 to use the alert trigger. Update Playbook1 to use the incident trigger.

You have a Microsoft Sentinel workspace. You need to create a playbook that will run automatically in response to a Microsoft Sentinel incident. What should you create first?. a hunting query. a logic app. a trigger. an automation rule.

You have an Azure subscription that uses Microsoft Sentinel. You create a user named Admin1. You need to ensure that Admin1 can add playbooks in Microsoft Sentinel. The solution must follow the principle of least privilege. Which role should you assign to Admin1?. Logic App Contributor. Microsoft Sentinel Contributor. Microsoft Sentinel Responder. Owner.

You have an Azure subscription that contains a Microsoft Sentinel workspace. You have the following query. AzureActivity | summarize count() by OperationName, bin(TimeGenerated, 4h) You need to update the KQL query to show graphical output. Which operator should you use?. print. project. project-away. render.

You have a Microsoft Sentinel workspace that has a Microsoft Entra ID data connector. You need to create a report that visualizes sign-in information over time. What should you use?. a hunting query. a notebook. a playbook. a workbook.

You have a Microsoft Sentinel workspace named Workspace1. You need to create and customize a workbook based on an Identity & Access template in Workspace1. What should you do first?. Clone the workbook template. Edit the workbook template. Publish the workbook template. Save the workbook template.

You have a Microsoft Sentinel workspace. You need to view a visual representation of the data in the workspace. What should you use?. a notebook. a playbook. a workbook. Azure Data Factory.

Your on-premises network contains multiple devices that provide logs in Common Event Format (CEF). You have an Azure subscription and a Microsoft Sentinel workspace named Workspace1. You need to ingest the logs from the devices into Workspace1. What should you do first?. Add the Security Events via the AMA data connector in Microsoft Sentinel. Add the Syslog data connector in Microsoft Sentinel. Deploy a computer that runs Linux. Deploy a server that runs Windows Server.

You are implementing Microsoft Sentinel. You add a Microsoft Entra ID Protection data connector to Microsoft Sentinel. You need to verify whether data is ingested from the connector. Which table should you query?. AzureDiagnostics. CommonSecurityLog. SecurityAlert. SecurityEvents.

You have an Azure subscription that contains a Microsoft Sentinel workspace deployed to West US Azure region. You have the following Azure virtual machines: · A virtual machine named VM1 that runs Windows Server and is deployed to the East US Azure region · A virtual machine named VM2 that runs Windows Server and is deployed to the West US region · A virtual machine named VM3 that runs Windows 11 and is deployed to the East US region · A virtual machine named VM4 that runs Windows 11 and is deployed to the West US region You deploy Windows Security Events via the Azure Monitoring Agent (AMA) data connector to the Microsoft Sentinel workspace. From which virtual machines can you collect events?. VM1 and VM2 only. VM1, VM2, VM3 and VM4. VM2 and VM4. VM2 only.

Your company uses Microsoft Defender XDR. You have a hunting query that retrieves suspicious behaviors and returns values for DeviceId, IPAddress, and AccountName. You need to create a custom detection rule from the query that automatically applies full network isolation to any affected devices. The solution must minimize administrative effort. What should you do first in the Microsoft Defender portal?. From Advanced hunting, select Export. From Rules, configure the Advanced settings. From Rules, select Actions. From Settings, select the device group.

You have a Microsoft Sentinel workspace that has a Microsoft Defender for Cloud data connector. You create a Microsoft incident creation rule named Rule1. You need to ensure that Rule1 creates incidents based on Defender for Cloud alerts. What should you configure in Rule1?. a rule query. alert details. analytics rule logic. entity mapping.

You have a Microsoft Sentinel workspace. You create the following analytics rules in Microsoft Sentinel: · A near-real-time (NRT) rule named Rule1 · A fusion rule named Rule2 · A scheduled rule named Rule3 · A Microsoft security rule named Rule4 You need to identify which rules will generate incidents that can be investigated by using Microsoft Sentinel. Which rules should you identify?. Rule1 and Rule2 only. Rule1 and Rule3 only. Rule1, Rule2 and Rule3 only. Rule1, Rule2, Rule3 and Rule4. Rule4 only.

You have a Microsoft Sentinel workspace that contains active scheduled analytics rules and active near-real-time (NRT) analytics rules. You review MITRE ATT&CK coverage from Threat management in Microsoft Sentinel. For a specific MITRE technique, you need to identify: · The number of active detections in the workspace · The number of additional detections available but NOT configured What should you do in the MITRE ATT&CK coverage matrix?. Open SOC optimizations and review the spider charts. Enable View MITRE by threat scenarios and select a scenario. Select the technique in the matrix and review the technique details pane. Create a hunting query mapped to the technique and convert the query to a scheduled rule.

You have a Microsoft 365 E5 subscription. You plan to create a Microsoft Defender XDR hunting query to identify users that have been affected by clicking a suspicious URL. You need to create a detection rule that will mark the user as compromised. Which two properties should you include in the rule? Each answer presents part of the solution. AccountUpn. AlertId. ReportId. TimeGenerated.

You have a Microsoft 365 E5 subscription. You are using Microsoft Defender portal. You need to create a custom detection rule by using a hunting query. Which two columns should the query return? Each correct answer presents part of the solution. AlertId. ReportId. TimeGenerated. Timestamp.

You have a Microsoft Sentinel workspace that includes the following tables: · SigninLogs · AuditLogs · SecurityAlerts You need to create a query that will look for an IP address across the three tables and return the matching rows. Which operator should you use?. extend. join. lookup. union.

You have Microsoft Sentinel workspace that have The User and Entity Behavior Analytics (UEBA) behaviors layer enabled. You need to create an advanced hunting query that returns behavior titles and descriptions and the associated user UPNs by joining the behavior information dataset with the behavior entities dataset. Which table should you use as the behavior information source?. BehaviorEntities. BehaviorInfo. IdentityAccountInfo. IdentityInfo.

You have Microsoft Defender XDR deployed, and macOS devices are onboarded to Microsoft Defender for Endpoint. Tamper protection is enabled. You suspect that an attacker might be enabling troubleshooting mode to modify policy-locked settings. You need to identify devices that started troubleshooting mode during the last three hours by using advanced hunting. You are writing the following query. DeviceEvents | where Timestamp > ago(3h) | where [ Target1 ] | extend _tsmodeproperties = parse_json(AdditionalFields) | where _tsmodeproperties.TroubleshootingStateChangeReason contains "started" | summarize (Timestamp, ReportId)=arg_max(Timestamp, ReportId), count() by DeviceId | order by Timestamp desc Which expression should you insert at [Target1]?. ActionType == "AntivirusTroubleshootModeEvent". ActionType == "DeviceTamperProtectionDisabled". EventType == "TroubleshootingModeStarted". OperationName == "TroubleshootModeStart".

You use Microsoft Sentinel graph-based hunting in the Microsoft Defender portal. A scheduled analytics rule creates incidents from a third-party alert source. Some alerts identify the user only as user1, while other records identify the same account as user1@contoso.com. When analysts investigate activity in the hunting graph, two separate user nodes appear for the same person. You need to ensure that the alerts referencing user1 and user1@contoso.com are mapped to the same user entity in the hunting graph. What should you do?. Sync user account entities with Microsoft Entra ID. Enable incident creation rules for the scheduled analytics rule. Create an automation rule that renames the incident title to match the user UPN. Disable the Microsoft Defender XDR connector and enable the legacy Defender connectors.

You have an Azure subscription that contains a Microsoft Sentinel workspace. You develop three hunting queries. You need to ensure that the hunting queries run each time you open the Hunting blade. What should you do?. Add the queries as Bookmarks. Add the queries as Favorites. Add the queries to a livestream. Create an analytics rule.

You have a Microsoft Sentinel workspace that stores Azure Activity logs in a table named AzureActivity. You need to identify which users edited analytics rules in Microsoft Sentinel during the last 24 hours. You are writing the following KQL query. AzureActivity | where TimeGenerated > ago(1d) | where [Target1] | where ActivityStatusValue contains "Succeeded" | project Caller, TimeGenerated, Properties Which expression should you insert at [Target1]?. OperationName contains "Delete". OperationNameValue startswith "MICROSOFT.SECURITYINSIGHTS/ALERTRULES/WRITE". QueryText contains "MICROSOFT.SECURITYINSIGHTS/ALERTRULES/WRITE". ResourceProvider contains "SecurityInsights".

You have a Microsoft Sentinel workspace that ingests high-volume network session logs into a custom table named NetworkSessions_CL. A summary rule aggregates the raw sessions into a destination table named NetworkSessionSummary_CL. Analysts report that hunting queries time out when they query NetworkSessions_CL for trends across multiple days. You need to ensure that analysts can query seven days of network session logs without experiencing time outs. Which table should you instruct the analysts to query?. AzureActivity. NetworkSessions_CL. NetworkSessionSummary_CL. SecurityEvent.

You use Microsoft Visual Studio Code as an MCP client to run threat hunting queries from a Jupyter notebook connected to the Microsoft Sentinel MCP server. You have access to two Microsoft Sentinel data lake workspaces. MCP tool calls sometimes return results from different workspace identifiers. You need to ensure that the MCP tool calls always query a specific workspace in the data lake. What should you do?. Append Use 'default' as the workspaceId to the prompt. Add the x-mcp-client-tenant-id header to the MCP server definition. Remove and recreate the MCP server configuration in Visual Studio Code. Use the list_sentinel_workspaces tool to identify the workspace and specify that workspace ID in the prompt.

You have a Microsoft Sentinel workspace that ingests high-volume network and firewall logs into a custom Log Analytics table. Analysts frequently run hunting queries that aggregate the same data across several days. During peak ingestion, the queries time out. You need a solution that runs a scheduled KQL aggregation in the background and stores the results in a smaller analytics-tier table that analysts can query during investigations. Which Microsoft Sentinel feature should you use?. KQL jobs. scheduled analytics rules. search jobs. summary rules.

You have a Microsoft 365 E5 subscription that contains five Microsoft SharePoint Online sites. You apply data loss prevention (DLP) policies to the SharePoint Online sites. You need to review the DLP alerts. Which two portals can you use? Each correct answer presents a complete solution. the Microsoft Purview portal. the SharePoint admin center. the Microsoft 365 admin center. the Microsoft Defender portal.

You have a Microsoft 365 E5 subscription that contains a user named User1 and a Microsoft SharePoint Online site named Site1. User1 leaves the company, and the user’s account is deleted. You need to identify whether User1 downloaded files from Site1 during the 30 days before the account was deleted. Which type of policy should you create?. a Microsoft Defender for Cloud Apps file policy. a Microsoft Defender for Office 365 alert policy. a Microsoft Purview insider risk management policy. a Microsoft Entra Governance access review.

You have a hybrid Microsoft Entra tenant and a Microsoft 365 E5 subscription. You need to review all changes made to the Active Directory Enterprise Admins group during the last 14 days. What should you use?. the Microsoft Entra ID Provisioning Analysis workbook. the Microsoft Entra ID Sensitive Operations Report workbook. the Microsoft Defender for Cloud Apps Cloud Discovery users page. the Microsoft Defender for Identity Modifications to sensitive groups report.

You have a hybrid Microsoft Entra tenant and a Microsoft 365 E5 subscription. You need to identify any high-risk users that have performed a password reset during the last 14 days. What should you use?. the Identity Protection risk analysis workbook in Microsoft Entra ID. the Sensitive Operations Report workbook in Microsoft Entra ID. the Risky sign-ins report in Microsoft Entra ID Protection. the Risky users report in Microsoft Entra ID Protection.

You have a Microsoft Defender XDR deployment that includes Microsoft Defender for Endpoint, Microsoft Defender for Identity, and Microsoft Defender for Cloud Apps. You need to view alerts from all three security services aggregated as a single incident. Which page should you use in the Microsoft Defender portal?. Device inventory. Hunting. Incidents & alerts. Secure Score.

You have Microsoft Defender for Cloud workload protections enabled for an Azure Kubernetes Service (AKS) cluster. Alerts are investigated in the Microsoft Defender portal. For a container, you have a Defender for Cloud alert that includes manual remediation steps. The same type of alert occurs frequently for new containers in the cluster. You need to ensure that the remediation steps run automatically when the alert occurs. What should you create?. a custom detection rule. a filter. an incident tag. a logic app.

You have a hybrid identity environment that contains: · On-premises Active Directory domain controllers monitored by using Microsoft Defender for Identity · Microsoft Entra ID Protection enabled for cloud identity risk detection · Incidents managed in Microsoft Defender XDR An incident in the Microsoft Defender portal includes identity-related alerts for a user named user1@contoso.com. You confirm that the account is compromised, and the user appears as a Risky user in Microsoft Entra ID Protection. You need to remediate the identity risk and ensure that the user completes strong authentication again before regaining access to Microsoft 365 resources. What should you do?. Create a Conditional Access policy. Dismiss the user risk in Microsoft Entra ID Protection. Reset the user multifactor authentication (MFA) registration. Install Defender for Identity sensors on all the domain controllers.

You investigate incidents in the Microsoft Defender portal by using the embedded Microsoft Security Copilot experience. During a phishing investigation, analysts do NOT see Copilot-generated incident summaries or guided responses. Copilot features are unavailable for incident investigation in Microsoft Defender XDR, although analysts can use the standalone Security Copilot experience. You need to enable Security Copilot to ensure that it can invoke Microsoft Defender XDR product capabilities from the embedded experience. What should you do?. Enable the Microsoft Defender XDR plugin in Security Copilot. Create a Microsoft Sentinel automation rule to tag and close incidents. Connect a Microsoft Sentinel workspace to the Microsoft Defender portal. Enable automatic investigation and response (AIR) for Microsoft 365 and Microsoft Entra ID alerts.

Your company uses Microsoft Defender for Endpoint. A device is flagged when one of its processes communicates with a known command-and-control server. You need to remotely analyze the suspicious process to identify whether it is malicious. What should you use in the Microsoft Defender portal?. Advanced hunting. Live response. Threat analytics. Action center.

Your company uses Microsoft Defender for Endpoint. You discover that a device was used to download and run malware. You need to identify the user who signed in interactively to the device during the time of the attack. What should you use in the Microsoft Defender portal?. the IdentityInfo table. the Incidents queue. the timeline. Threat analytics.

Your company uses Microsoft Defender for Endpoint. All security alerts are automatically remediated. Microsoft Defender notifies you that it blocked a malware infection attempt on a device. You need to perform an analysis on the device. The solution must meet the following requirements: Analyze the device memory, active processes, and inbound and outbound network connections. Minimize the impact of the analysis on device users. Avoid identifying false positives as malicious. What should you do first?. Collect an investigation package. Isolate the device. Request an antivirus scan. Review the alert evidence.

Your company uses Microsoft Defender for Endpoint. You discover an incident related to a device named Device1. You need to review the most recent actions taken on Device1. The solution must minimize administrative effort. What should you use in the Microsoft Defender portal?. Advanced hunting. the Alerts queue. the Incidents queue. the Timeline.

Your company uses Microsoft Defender for Endpoint. A security incident is currently affecting devices that run Windows 11 or macOS. You need to identify the scope of the incident. What should you use in the Microsoft Defender portal?. Advanced hunting. Action center. Deep analysis. Device inventory.

You have Windows 11 devices onboarded to Microsoft Defender for Endpoint. An incident contains an alert for a suspicious PowerShell command line on a device. You need to use the device Timeline to create a clean breach timeline that meets the following requirements: · Highlights key device events · Displays only the highlighted events · Limits the view to events that occurred before the highlighted event What should you do?. Select the suspicious event and select Hunt for related events. Export the timeline of a custom date range and review the exported file. Review the Active alerts card on the device Overview tab and analyze the alert drilldown. Flag the key event or events, enable the Only Flagged events filter, and use the time bar to show events before the flagged event.

You have a Microsoft Sentinel workspace. You need to prevent a built-in Advanced Security Information Model (ASIM) parser from being updated automatically. Which two actions can you perform? Each answer presents a complete solution. Build a custom unifying parser and include the built-in parser version. Create a hunting query and reference the built-in parser. Create an analytics rule and include the built-in parser. Redeploy the built-in parser and specify a CallerContext value of Any and a SourceSpecificParser value of Any. Redeploy the built-in parser and specify a CallerContext value of Built-in.

You send Microsoft Graph activity logs to a Log Analytics workspace. During the last three days, some requests to the /groups resource returned HTTP 401 and HTTP 403 errors. You need to identify the top 20 calling entities that generate the highest number of distinct failed requests to /groups. Which KQL query should you run?. MicrosoftGraphActivityLogs | where TimeGenerated >= ago(30d) | where RequestUri contains "/groups" | summarize UniqueRequests=dcount(RequestId) by UserPrincipalName | sort by UniqueRequests desc | limit 20. MicrosoftGraphActivityLogs | where TimeGenerated >= ago(3d) | where ResponseStatusCode == 401 and ResponseStatusCode == 403 | where RequestUri contains "/groups" | summarize UniqueRequests=count() by AppId | sort by UniqueRequests desc | limit 20. MicrosoftGraphActivityLogs | where TimeGenerated >= ago(3d) | where ResponseStatusCode == 401 or ResponseStatusCode == 403 | where RequestUri contains "/groups" | summarize UniqueRequests=count_distinct(RequestId) by AppId, ServicePrincipalId, UserId | sort by UniqueRequests desc | limit 20. SigninLogs | where TimeGenerated >= ago(3d) | where ResultType in ("401","403") | where ResourceDisplayName contains "groups" | summarize UniqueRequests=dcount(CorrelationId) by AppId, UserId | sort by UniqueRequests desc | limit 20.

You have a Microsoft 365 tenant that uses Microsoft Purview Audit (Standard). An audit search in the Microsoft Purview portal returns more than 80,000 matching events. Your SIEM team requires a CSV export that includes all matching audit records. You cannot upgrade to Audit (Premium). You need to ensure that no audit records are omitted due to export limits. What should you do?. Export the audit search results directly from the Microsoft Purview portal. Create a new Audit (Premium) audit log retention policy and rerun the search. Duplicate the search job by using Copy this search and export the results from each copy. Refine the search into multiple smaller time ranges and export each result set to a CSV file.

You have a Microsoft 365 tenant that uses Microsoft Purview Audit (Standard). Your security team investigates activity by using the audit search tool in the Microsoft Purview portal. An investigation requests Microsoft Entra ID and Exchange Online audit events from nine months ago, but no results are returned. You need to ensure that, going forward, audit records for Microsoft Entra ID and Exchange Online remain searchable for at least one year. Which Microsoft Purview auditing solution should you use?. Audit (Premium). Audit (Standard). Office 365 Management Activity API. Search-UnifiedAuditLog in Exchange Online PowerShell.