SC-200 Practice Questions

You are investigating a complex incident in Microsoft Sentinel. You want to visualize the relationships between the alerted entities (users, IPs, hosts) and identify if they are part of other alerts.

Which tool provides a visual interface to expand entities and explore connections?

A security team receives threat intelligence feeds in STIX format via a TAXII server. They want to import these indicators into Microsoft Sentinel to correlate with their logs.

Which Data Connector should they configure?

You receive complaints that a built-in detection rule in Microsoft Defender for Endpoint is generating too many false positives for a specific internal application 'AppX'. You want to stop alerts for this specific application without disabling the rule entirely for other processes.

What should you create?

A SOC analyst needs to run a custom PowerShell script on a compromised device to collect specific forensic artifacts. The device is isolated but connected to Microsoft Defender for Endpoint. The script is not currently available in the Live Response library.

Which permission is required to upload this script to the Live Response library?

You manage three separate Microsoft Sentinel workspaces: 'US-Ops', 'EU-Ops', and 'Asia-Ops'. You need to write a hunting query that searches for a specific malicious file hash across ALL three workspaces simultaneously.

Which KQL syntax allows you to query multiple workspaces?

You are querying a custom log table AppLogs_CL in Microsoft Sentinel. The logs contain a column named Properties_s which holds a JSON string with dynamic fields like User, Action, and Resource. You need to extract the User field into a separate column for filtering.

Which KQL function should you use?

A user reports an email in their junk folder was automatically moved there, but they believe it is legitimate. Upon investigation in Microsoft Defender for Office 365, you see the email was moved by ZAP (Zero-hour Auto Purge).

What does this indicate about the email?

You want to connect a new SaaS application to Microsoft Sentinel using the Codeless Connector Platform (CCP). You have the API documentation for the SaaS app.

Which file format must you use to define the data connector's polling configuration and data parsing logic?

Before enabling User and Entity Behavior Analytics (UEBA) in Microsoft Sentinel, which two specific data sources MUST be connected and syncing data to the workspace? (Select TWO)

In Microsoft Defender for Identity, you receive a 'Suspected DCSync attack' alert. This attack mimics the replication process of a Domain Controller to steal password hashes.

Which of the following investigation steps is most critical to determine if this is a True Positive or a False Positive?

A security analyst at a retail company is investigating a Microsoft Sentinel incident that contains multiple alerts related to a single user account. The analyst needs to understand the full sequence of events, from a suspicious sign-in to potential data exfiltration, in a chronological order. Which Microsoft Sentinel feature provides a graphical timeline and allows the analyst to explore related entities for this purpose?

A security operations team is configuring Microsoft Defender for Endpoint. They want to ensure that if a high-confidence phishing URL is detected on a device, the device is automatically isolated from the network, but only if the device belongs to the 'Standard User Workstations' device group. Devices in the 'Executive Laptops' group should not be automatically isolated. Which feature should be configured to achieve this specific, conditional automation?