100 Free SC-200 Practice Questions and Answers

Why A is right

Notebooks in Azure Sentinel provide an interactive environment where you can visualize data, integrate third-party data sources, and enrich data to identify indicators of compromise. Notebooks support Python and KQL, allowing complex analysis and enrichment workflows with external sources.

Why C is right

The count function aggregates data by counting occurrences within groups, which is the fundamental operation needed to create a bar graph showing the number of security alerts by category or dimension. When combined with summarize, count produces the aggregated values necessary for bar chart visualization.

Why D is right

To make 200 custom ASIM parsers based on the DNS schema available in Workspace1 with minimal administrative effort, you create a YAML file based on the DNS template. YAML files define the parser configuration and can be bulk-deployed, significantly reducing manual effort compared to other approaches. JSON and XML are not the standard formats for ASIM parser templates.

Why B is right

After enabling the 'Allow or block file' option in Microsoft Defender portal, you must add indicators to specify which files should be blocked. Indicators define the specific files (by hash, IP, URL, or domain) that will be blocked on the devices. This is the next step after enabling the feature to make it functional.

Why D is right

Content search is the appropriate tool in Microsoft Purview to search for specific email messages by subject line across selected mailboxes. This feature allows you to specify search criteria (Project1 in subject line) and select specific user mailboxes to search, making it ideal for finding emails matching specific criteria within a defined set of mailboxes. Content search is designed for exactly this scenario of targeted email discovery.

Why C is right

Unsecure Kerberos delegation is remediated by modifying the properties of the exposed computer objects to disable unconstrained or constrained delegation settings. This involves changing the delegation configuration at the Active Directory object level for the affected computers.

Why B is right

The risky users report shows users whose identities may have been compromised based on risk detections over the specified time period. This report aggregates all risk signals for a user and indicates if their account was involved in risky activities. While risk detections report shows individual events, risky users report provides the user-centric view needed to determine if a specific user's identity was compromised.

Why A is right

The Azure Sentinel Contributor role is the built-in role specifically designed to allow editing of Azure Sentinel resources including custom workbooks and queries. Security Administrator and Azure Sentinel Responder have broader or different permissions that don't align with least privilege for this specific task. Logic App Contributor is unrelated to Sentinel workbooks.

Why A is right

To configure Microsoft Defender XDR automatic attack disruption with Defender for Cloud Apps signals, you must: (A) Enable the Microsoft 365 connector to allow data flow between Cloud Apps and Defender XDR, and (C) Turn on app governance to enable the necessary monitoring and control capabilities. Log collectors (B) are for on-premises traffic, Cloud Discovery enrichment (D) is for user identification, and file monitoring (E) is for data protection-none are required for attack disruption signal integration.

Why C is right

To configure Microsoft Defender XDR automatic attack disruption with Defender for Cloud Apps signals, you must: (A) Enable the Microsoft 365 connector to allow data flow between Cloud Apps and Defender XDR, and (C) Turn on app governance to enable the necessary monitoring and control capabilities. Log collectors (B) are for on-premises traffic, Cloud Discovery enrichment (D) is for user identification, and file monitoring (E) is for data protection-none are required for attack disruption signal integration.

Why D is right

Insider risk management policies are specifically designed to detect and alert on suspicious user activities including data exfiltration patterns such as unusual document downloads before account deletion. This feature can retroactively analyze user activities from the past month and flag concerning download patterns by deleted users, making it the appropriate solution for this scenario.

Why B is right

The union operator with kind=inner is correct for combining multiple tables while retaining all rows from each table. The question asks to 'link' tables and 'return all rows in the tables,' which describes a union operation rather than a join. A union operation appends rows from multiple tables with the same schema, whereas a join combines tables based on common columns, which would reduce rows based on matching criteria.

Why F is right

Automatic attack disruption's "contain user" action pushes a containment policy to every Windows device onboarded to Microsoft Defender for Endpoint, not just the compromised one. Once User1 is contained, any onboarded device - including Device2 - blocks that user's incoming traffic on the protocols typically abused for lateral movement, namely remote logons using RDP, RPC, and SMB, and terminates any existing remote sessions for that account. Local sign-ins and traffic from other, non-contained users are unaffected, so Device2 stays productive while the compromised identity is cut off across all three protocols.

Why C is right

The Analytics section in Microsoft Sentinel is where you manage, enable, and disable all analytic rules including anomaly rules. This is the central location for reviewing which anomaly detection rules are enabled and their configurations.

Why A is right

The SeenBy() function in advanced hunting specifically identifies which onboarded device discovered a particular network device. This built-in function is designed to correlate discovered network devices with the Defender for Endpoint devices that observed them, making it perfect for queries that need to return both the discovered network device and the identity of the discovering endpoint.

Why B is right

The Intent field in Defender for Cloud alert JSON contains the MITRE ATT&CK tactic classification. This field maps detected behaviors to the MITRE ATT&CK framework tactics such as Privilege Escalation, Persistence, Defense Evasion, etc. SIEM solutions search this field to filter alerts by attack tactic.

Why D is right

A Syslog connector minimizes administrative effort by natively collecting standard Linux system logs with built-in parsing, reducing the need for manual data transformation. Syslog is the standard protocol for Linux logging and integrates seamlessly with Microsoft Sentinel.

Why B is right

Attack surface reduction (ASR) rules in Microsoft Defender for Endpoint are specifically designed to block the types of threats described: Excel macros downloading scripts, executable attachments in Outlook, and Outlook rules/forms exploits. ASR rules provide granular control over dangerous behaviors and application behaviors without requiring full application blocking. Microsoft Defender Antivirus provides basic malware detection but not behavioral blocking; Windows Defender Firewall controls network traffic; and Azure Defender adaptive application control is for server environments, not Office 365 client threats.

Why D is right

For a logic app to work as a playbook in Azure Sentinel, it must be triggered automatically by Azure Sentinel events. Since the existing logic app uses a manual trigger, you must modify it to use an Azure Sentinel trigger (such as 'When a response to an Azure Sentinel alert is triggered'). This is the prerequisite before the playbook can function within Azure Sentinel's automation framework.

Why C is right

Mapping entities in the Set rule logic section is critical for Azure Sentinel to properly identify and correlate security entities (users, hosts, IPs, etc.) in query results, enabling effective incident creation and investigation capabilities.

Why A is right

To test Azure Defender alerts on Linux, you must first create a copy of the echo binary with the specific alert test filename (asc_alerttest_662jfi039n), then execute it with the alert test parameters. The first command (A) creates the test file by copying the echo binary with the required name. The second command (D) executes this test file with the 'testing eicar pipe' parameters, which triggers the alert simulation that Azure Defender detects and reports.

Why D is right

To test Azure Defender alerts on Linux, you must first create a copy of the echo binary with the specific alert test filename (asc_alerttest_662jfi039n), then execute it with the alert test parameters. The first command (A) creates the test file by copying the echo binary with the required name. The second command (D) executes this test file with the 'testing eicar pipe' parameters, which triggers the alert simulation that Azure Defender detects and reports.

Why C is right

To create a custom alert suppression rule for suspicious PowerShell activity on VM1, you must first trigger a PowerShell alert on the machine. Security Center requires an actual alert to exist before you can create a suppression rule for it, as the rule needs to match against real alert properties and signatures.

Why C is right

To restrict cloud apps on a specific device through Microsoft Defender for Endpoint, you must configure Advanced features in Microsoft Defender Security Center to enable cloud app security integration, and then configure Cloud Discovery settings in Cloud App Security to define which apps are restricted. Cloud Discovery allows policy creation for cloud app restrictions that integrate with Defender for Endpoint.

Why D is right

To restrict cloud apps on a specific device through Microsoft Defender for Endpoint, you must configure Advanced features in Microsoft Defender Security Center to enable cloud app security integration, and then configure Cloud Discovery settings in Cloud App Security to define which apps are restricted. Cloud Discovery allows policy creation for cloud app restrictions that integrate with Defender for Endpoint.

Why A is right

Security Administrator is the appropriate role that allows management of both custom detection rules and endpoint security policies while following least privilege principles. It has sufficient permissions for these specific tasks without granting excessive permissions that other roles like Security Operator would not have access to.

Why D is right

An automation rule can suppress or dismiss alerts for specific entities based on conditions, preventing false positive alerts for that account while allowing legitimate alerts to continue for other accounts. This provides granular, low-effort control without modifying the underlying detection rule.

Why D is right

The Reader role provides the minimum permissions needed to view and export alert data from Microsoft Defender for Cloud without the ability to make changes or manage access. User Access Administrator, Owner, and Contributor all grant excessive permissions beyond what is needed for exporting alerts, violating the principle of least privilege.

Why C is right

The 'Collect investigation package' response action is the specific action used to gather investigation packages from devices in Microsoft 365 Defender portal. This action collects forensic data and diagnostic information from the device for investigation purposes. While Live Response can be used to interact with devices, the direct action to collect investigation packages is the dedicated 'Collect investigation package' option.

Why A is right

Incidents in Microsoft 365 Defender portal provide a unified view of malware alerts, automatically group related alerts, collect evidence across devices, and allow you to initiate response actions like device isolation from a central location. This is the primary interface for managing security incidents.

Why C is right

Msticpy is the Microsoft Security Toolkit for Python specifically designed for Jupyter notebooks in Sentinel. It provides pre-built functions for querying Sentinel data, creating security-focused visualizations, and pinning results to dashboards with minimal development effort. Plotly and matplotlib are general visualization libraries requiring more work, and TensorFlow is for machine learning.

Why B is right

Advanced Hunting in Microsoft 365 Defender is the dedicated page where you create custom hunting queries using KQL (Kusto Query Language). This feature allows you to build and save tracked queries for ongoing threat assessment and hunting activities across your environment.

Why B is right

To query watchlists in a Sentinel workbook, you must use the Logs (Analytics) data source, which connects to the Log Analytics workspace where the watchlist metadata is stored. The _GetWatchlist() KQL function is executed against the Logs analytics data source to retrieve watchlist data. Azure Resource Graph does not provide access to Sentinel watchlist objects; only the Log Analytics workspace through Logs does.

Why D is right

IP addresses can be labeled as indicators of compromise (IoC) directly from the incident page in Microsoft Sentinel. IP addresses are recognized threat indicators that represent network-based compromise evidence. Host names, user accounts, and malware names are entities but cannot be directly labeled as IoCs from the incident interface-only specific indicator types like IP addresses, domains, and file hashes support direct IoC tagging.

Why A is right

The Azure Activity workbook is the appropriate choice for analyzing actions performed by users with administrative privileges to the subscription. It tracks Azure control plane operations and administrative activities. While Microsoft Entra workbooks track authentication and sign-in events, the Azure Activity workbook specifically focuses on administrative actions and resource changes at the subscription level.

Why C is right

Microsoft Entra audit logs in Sentinel can be retained for up to 7 years when configured for long-term retention in a Sentinel data lake. This aligns with compliance requirements for many regulated industries and provides the maximum retention period supported by the platform while maximizing the audit log preservation requirement stated in the question.

Why C is right

The @odata.nextLink property contains the URL for the next page of results when server-side paging is implemented. This is the standard OData mechanism for handling paginated responses. By querying this property and following the link, you can retrieve all subsequent pages of results from the unified audit log. @odata.deltaLink is for tracking changes, @odata.count shows the total count, and @odata.context provides metadata about the response.

Why D is right

When creating a scheduled KQL job that writes output to a table, the output schema must match the schema of the target table. This is a critical requirement for successful data ingestion. The job will validate that all output columns match the table's defined columns and data types before writing data.

Why A is right

The Microsoft Sentinel - Incidents page in the Azure portal provides a unified view of incidents from multiple workspaces when accessed at the subscription or tenant level. This allows viewing all 50 workspaces' incidents on a single page with minimal administrative effort. The Log Analytics workspaces page does not provide incident views, workbooks are for visualization only, and the generic Sentinel page does not offer consolidated incident views.

Why C is right

To integrate GitHub repositories with Microsoft Defender for Cloud, you must first add an environment in the Defender for Cloud portal. Adding an environment establishes the connection to the external source (GitHub in this case), allowing Defender for Cloud to discover and monitor the repositories. This is the first step before any scanning or policy enforcement can occur.

Why A is right

In Microsoft Sentinel, only IP addresses can be added to the threat intelligence list directly from the Incident page. Host names and user accounts cannot be added to threat intelligence as indicators from this interface. Threat intelligence in Sentinel is primarily designed for observable indicators like IP addresses, domains, file hashes, and URLs.

Why D is right

Tagging a device as a sensitive entity in Microsoft Defender XDR automatically generates alerts when that device is accessed or targeted, which directly addresses the requirement to detect connection attempts with minimal administrative effort. This is a built-in feature that triggers alerts without requiring custom rule creation or deception infrastructure.

Why C is right

The CommonSecurityLog table is the standard table where Common Event Format (CEF) data is stored in Microsoft Sentinel. This table receives and stores all CEF-formatted events from various data connectors that support CEF ingestion.

Why B is right

UEBA can investigate app name, computer name, IP address, email address, and used client app. These entities are part of standard UEBA analysis from Audit Logs and Sign-in Logs. The Sign-in URL is not a recognized entity type in UEBA; it's a URL string rather than an entity that can be profiled for behavioral analysis.

Why A is right

Adding an indicator in the Microsoft Defender portal allows you to block or alert on specific file hashes, URLs, or IPs. By adding File1.docx as an indicator with a block action, you can prevent users from downloading this known threat file across your organization. This is the direct and efficient method to block a specific file threat.

Why A is right

Microsoft Sentinel allows direct labeling of entities as indicators of compromise (IoC) from the incidents page, but only for certain entity types. IP addresses are one of the supported entity types that can be labeled as IoC. User accounts, Azure VMs, and on-premises servers cannot be directly labeled as IoC from the incidents page interface.

Why C is right

Notebooks in Azure Sentinel provide custom visualization capabilities and integrate Jupyter notebooks with machine learning libraries. They allow security teams to create sophisticated visualizations, perform advanced analysis, and apply machine learning algorithms to detect and investigate threats. This directly addresses both requirements: custom visualization and machine learning-based threat inference.

Why B is right

To safely simulate an attack and generate Defender for Cloud alerts without actual malicious activity, copy any executable file and rename it to ASC_AlertTest_662jfi039N.exe. Defender for Cloud recognizes this specific naming pattern and triggers a test alert when the file is executed. This is the documented method for validating alert functionality.

Why C is right

A livestream in Azure Sentinel monitors a hunting query in real-time and displays matches immediately in the portal with notifications, minimizing effort compared to playbooks or bookmarks which require additional setup. Notebooks are for analysis and visualization, not real-time alerting.

Why B is right

To send a Teams message when a sign-in risk incident is activated, you need to add a playbook (containing the Teams notification logic) and associate it to the analytics rule that generates the sign-in risk incidents. This ensures the playbook triggers automatically when the rule detects and creates the incident.

Why D is right

To send a Teams message when a sign-in risk incident is activated, you need to add a playbook (containing the Teams notification logic) and associate it to the analytics rule that generates the sign-in risk incidents. This ensures the playbook triggers automatically when the rule detects and creates the incident.

Why B is right

In Microsoft Defender for Endpoint live response sessions, you must first upload a script to the library before you can execute it. The library stores approved scripts that can be accessed during live response operations, and uploading Script1.ps1 to the library makes it available for execution in the session.

Why C is right

The Evidence and Response tab within an incident details page in Microsoft 365 Defender portal displays all entities affected by an incident, including devices, users, emails, and other affected assets. This tab provides a comprehensive view of the incident's scope and impact across all affected entities.

Why A is right

To send a Teams message automatically when suspicious sign-ins are detected, you must add a playbook (which contains the logic to send the message) and associate it to an analytics rule or incident so it triggers automatically. A playbook defines the action (Teams notification), and association ensures it executes when the condition is met.

Why B is right

To send a Teams message automatically when suspicious sign-ins are detected, you must add a playbook (which contains the logic to send the message) and associate it to an analytics rule or incident so it triggers automatically. A playbook defines the action (Teams notification), and association ensures it executes when the condition is met.

Why A is right

To enable User1 to access the Microsoft Sentinel plugin in Copilot for Security while following the principle of least privilege, assign the Microsoft Sentinel Reader role. This role provides the minimum necessary permissions to read and query Sentinel data without granting write or administrative capabilities.

Why D is right

The lookback period in a custom detection rule is controlled by the where operator in the KQL query, specifically the time-filtering condition that defines how far back the query searches (e.g., 'where Timestamp > ago(12h)'). Changing this to 'ago(48h)' extends the lookback period from 12 to 48 hours without affecting other rule components.

Why B is right

A playbook, implemented as an Azure Logic App, is the correct tool for creating automated threat responses in Azure Sentinel. Playbooks can automatically execute actions such as blocking users, creating tickets, or sending notifications in response to detected incidents. Data connectors ingest data, workbooks are for visualization, and incident creation rules generate incidents but don't automate responses.

Why D is right

The Incident page in Microsoft Defender XDR provides Tasks, Activity log, and Alert timeline views. These three tools together enable comprehensive investigation of incident tasks that were performed, showing what actions were taken, when they occurred, and their sequence relative to alerts.

Why A is right

Azure Event Hubs is the optimal destination for streaming logs to third-party SIEM tools, as it is designed for real-time data ingestion and is a standard integration point for SIEM solutions. It minimizes administrative effort by providing native streaming capabilities that third-party tools can readily consume.

Why C is right

When dealing with a potential attack using an image file, a file hash indicator is the appropriate choice. File hash indicators allow detection and blocking of specific malicious files based on their cryptographic hash, which is ideal for image files. The Action should be set to 'Alert and block' to both detect and prevent the malicious image from executing. URL/domain indicators are used for web-based threats, and certificate indicators are for SSL/TLS certificate-based threats, neither of which apply to image file attacks.

Why B is right

The bin function in KQL is used to round values into equal-sized groups, which is essential for aggregating data by time intervals (like days) for time chart visualization. The bin function groups continuous values into discrete buckets, making it perfect for time-based aggregation in Azure Sentinel queries.

Why B is right

Enabling the Key Vault firewall is the fastest and most appropriate first action to prevent unauthorized access from suspicious IP addresses. The firewall can be enabled immediately without detailed access policy analysis, and it allows legitimate users to continue accessing the Key Vault through authorized networks while blocking unknown sources. This provides immediate protection with minimal disruption during investigation. Modifying access policies requires more analysis; ASGs are not directly applicable to Key Vault; and modifying access control is less immediate than firewall enablement.

Why A is right

The 'take' operator in KQL is used to limit the number of rows returned from a query. To ensure a grid contains a maximum of 100 rows, you would add 'take 100' to the query. The project operator selects columns, not rows. Settings and Advanced Editor don't directly control row limits; the query itself must enforce this constraint.

Why C is right

Microsoft Security Copilot charges for security compute units on an hourly basis. The minimum billing interval is 1 hour, meaning any usage within an hour is billed as a full hour, and subsequent hours are billed separately.

Why B is right

An automated alert response in Defender for Endpoint allows you to automatically collect investigation packages when malware is detected, minimizing administrative effort. This feature triggers response actions automatically based on alert criteria without requiring manual intervention or additional configuration layers.

Why C is right

To send email to the resource owner instead of a static distribution group, you need to add a condition to evaluate which resource triggered the alert and modify the email action to dynamically use the owner's information. This involves conditional logic and dynamic content in the action configuration to extract and use the resource owner from the incident/alert data.

Why C is right

Creating a device group first allows you to segment the 50 pilot devices separately from the remaining 450 devices. This minimizes impact on non-pilot devices by enabling targeted policies and automation rules that apply only to the pilot group. Device groups are the foundational organizational structure needed before applying pilot-specific automation.

Why C is right

A scheduled query rule automatically creates incidents when a query returns results on a defined schedule. Converting a hunting query into a scheduled query rule ensures that when the attack vector matching the MITRE ATT&CK tactic is detected, an incident is automatically generated in the Sentinel workspace.

Why D is right

The IdentityLogonEvents table in Microsoft Sentinel captures authentication events from Defender for Identity, including LDAP simple bind authentication to domain controllers. This table contains the logon activity data needed to identify LDAP simple binds across the AD DS environment that is being monitored by Defender for Identity.

Why A is right

The Action center's History tab in Microsoft 365 Defender portal allows you to review and revert automated investigation and response actions, including quarantine actions, marking files as safe and removing them from quarantine across multiple devices.

Why B is right

The 'Common' event set captures a full user audit trail including sign-in and sign-out events while minimizing the volume of collected events. It provides the necessary security events for user accountability without the overhead of 'All events' or the limitations of 'Minimal', making it the optimal balance between completeness and data volume reduction.

Why B is right

In Microsoft Sentinel, the AzureActivity table retention must balance interactive query capability with cost. The interactive query period allows running ad-hoc queries on recent data, while older data enters long-term retention at lower cost. 90 days represents the optimal balance-it provides sufficient time for investigation and forensics while minimizing costs compared to longer retention periods, yet still maintains the capability for interactive queries better than shorter periods.

Why C is right

To apply quick fixes to virtual machines in RG1 using Azure Defender while maintaining least privilege, SecAdmin1 should be assigned the Contributor role specifically for RG1. This grants the necessary permissions to modify resources within that resource group without elevating privileges beyond the specific scope. Security Admin role alone does not provide the capability to apply quick fixes; Contributor at subscription level violates least privilege by granting broader access than needed; Owner role is excessive and violates least privilege.

Why D is right

A Conditional Access policy must be created first in Azure AD before you can enable Microsoft Defender for Cloud Apps session control. The Conditional Access policy sets the condition that routes traffic through Cloud Apps for session monitoring and control on the SharePoint Online site.

Why A is right

The SecurityIncident table is the correct target for querying incident information and incident tasks in Microsoft Sentinel. This table contains incident data including tasks that were performed on incidents. SecurityEvent and SecurityAlert contain different event types, while SentinelAudit tracks operational changes to Sentinel itself, not incident tasks.

Why C is right

The Azure Sentinel Contributor role provides the necessary permissions to create, modify, and manage Azure Sentinel resources including rules, workbooks, and queries, which aligns with administrative requirements for managing the security solution.

Why B is right

The IPCustomEntity contains the IP address information associated with the brute force attempt, and reviewing its details in the incident will reveal geolocation information about that IP. The Potential malicious events map (A) shows events on a map but doesn't directly associate with this specific incident's geolocation data. AccountCustomEntity (C) relates to user accounts, not IP geolocation.

Why E is right

Prefetch files in Windows contain detailed execution history including the first and last execution times of applications. When File1.exe is executed, Windows creates prefetch records that track execution timestamps, making this the primary forensic artifact to review in the investigation package for determining execution history.

Why D is right

To customize which details are included when an alert is created for a specific event from the Defender for Cloud data connector, you create a scheduled query rule. This rule allows you to define custom logic that determines alert content and properties based on specific events. UEBA focuses on behavioral analysis, not alert customization. DCRs control data collection, not alert detail customization.

Why D is right

In Azure Sentinel, you can manually test playbooks from the Incidents section. When viewing an incident, you have the option to trigger and test associated playbooks directly from the incident details page. This allows you to validate playbook functionality before deploying them in automated rules.

Why A is right

The Copilot Owner role is the appropriate least-privilege role that grants all three required capabilities: uploading files, viewing the usage dashboard, and sharing promptbooks with all users. Security Administrator and Cloud Application Administrator roles are broader than necessary and violate least privilege. Copilot Contributor cannot share promptbooks with all users. Copilot Owner balances the need to perform these specific tasks without granting unnecessary permissions.

Why D is right

Role-based access control (RBAC) must be configured first to enable users to have the necessary permissions to initiate remote shell connections from the Microsoft 365 Defender portal. RBAC determines which users can perform specific actions like remote shell sessions on managed devices. Without proper RBAC roles assigned, users won't have the capability to perform remote connections regardless of other settings.

Why C is right

The impossible travel policy detects when a user's activities occur in geographically distant locations in an impossible timeframe, which is a key anomaly detection concern. This policy addresses suspicious travel patterns that could indicate compromised accounts. The other options detect different threat patterns but impossible travel is the core anomaly detection policy for geographic violations.

Why B is right

To implement deception rules in Microsoft Defender XDR with limited scope, device tags should be created first. Device tags allow you to organize and segment devices logically, which enables scoping deception rules to specific subsets of devices. While device groups also exist, device tags provide the more granular and flexible approach for limiting the scope of deception rules across your environment.