Microsoft Security Operations Analyst - SC-200 FREE EXAM DUMPS QUESTIONS & ANSWERS
You have an Azure subscription that is linked to a hybrid Azure AD tenant and contains a Microsoft Sentinel workspace named Sentinel1.
You need to enable User and Entity Behavior Analytics (UEBA) for Sentinel 1 and configure UEBA to use data collected from Active Directory Domain Services (AD OS).
What should you do? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
You need to enable User and Entity Behavior Analytics (UEBA) for Sentinel 1 and configure UEBA to use data collected from Active Directory Domain Services (AD OS).
What should you do? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Correct Answer:
Explanation:
To the AD DS domain controllers, deploy: Microsoft Defender for Identity sensors For Sentinel1, configure: The Security Events data source To enable User and Entity Behavior Analytics (UEBA) in Microsoft Sentinel using data from on-premises Active Directory Domain Services (AD DS) , you must collect detailed identity and authentication events.
This requires integration with Microsoft Defender for Identity (MDI) - the native tool designed to monitor domain controller traffic and send identity telemetry to Microsoft Sentinel.
Step 1: Deploy Microsoft Defender for Identity sensors According to Microsoft documentation:
"To collect signals from your on-premises Active Directory domain controllers, install Microsoft Defender for Identity sensors directly on each domain controller or on a dedicated server." These sensors capture Windows event logs and network authentication data (Kerberos, NTLM, LDAP) and send the information securely to Defender for Identity cloud service.
The Azure Connected Machine agent and Azure Monitor agent do not provide the specialized identity telemetry required by UEBA. Therefore, the correct deployment is the Microsoft Defender for Identity sensors .
Step 2: Configure the Security Events data source in Sentinel After integrating Defender for Identity, you must connect the right data source in Microsoft Sentinel .
The Security Events data source ingests domain controller event logs (such as sign-ins, account management, and group membership changes) that UEBA relies on for behavioral baselines and anomaly detection.
Microsoft Sentinel UEBA documentation confirms:
"UEBA uses data from identity-related data sources, such as SecurityEvents and Azure Active Directory sign- ins, to build user and entity profiles and detect anomalies." The Audit Logs and Signin Logs tables are specific to Azure AD and cloud identity events - not on-premises AD DS domain controllers.
# Final Configuration:
* Deploy Microsoft Defender for Identity sensors to the domain controllers.
* Configure The Security Events data source for Sentinel1.
You have a Microsoft Sentine1 workspace that contains a custom workbook named Workbook1.
You need to create a visual in Workbook1 that will display the logon count for accounts that have logon event IDs of 4624 and 4634.
How should you complete the query? To answer, select the appropriate options in the answer area.
NOTE Each correct selection is worth one point.
You need to create a visual in Workbook1 that will display the logon count for accounts that have logon event IDs of 4624 and 4634.
How should you complete the query? To answer, select the appropriate options in the answer area.
NOTE Each correct selection is worth one point.
Correct Answer:
Explanation:
First dropdown: join
Second dropdown: full
In Microsoft Sentinel and Kusto Query Language (KQL), when you need to combine two tables based on a common field , you use the join operator. In this scenario, both queries pull from the same SecurityEvent table but filter on different Event IDs - 4624 for logon and 4634 for logoff events. To correlate or compare the two results by Account , you need to join them.
The first query returns the number of logon events per account ( LogOnCount ), while the second returns the number of logoff events per account ( LogOffCount ). The join key is Account , which exists in both result sets.
To ensure that all accounts - those who may have only logon events or only logoff events - are included in the visualization, you use a full join. A full join combines matching records from both sides and keeps unmatched records from either side, filling missing values with nulls. This ensures that every account with either a logon or a logoff count appears in the results.
Therefore, the correct query completion is:
SecurityEvent
| where EventID == " 4624 "
| summarize LogOnCount = count() by EventID, Account
| project LogOnCount, Account
| join kind = full (
SecurityEvent
| where EventID == " 4634 "
| summarize LogOffCount = count() by EventID, Account
| project LogOffCount, Account
) on Account
This query gives a complete view of all accounts and their corresponding logon/logoff counts.
# Correct selections:
* First box # join
* Second box # full
You have a Microsoft 365 E5 subscription that uses Microsoft Defender XDR.
You need to create a hunting query in KQL that meets the following requirements:
* Identifies any devices That received an email containing an attachment named File1 .pdf during the last 12 hours and opened the attachment.
* Minimizes the resources required to run the query.
How should you complete the query? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
You need to create a hunting query in KQL that meets the following requirements:
* Identifies any devices That received an email containing an attachment named File1 .pdf during the last 12 hours and opened the attachment.
* Minimizes the resources required to run the query.
How should you complete the query? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Correct Answer:
Explanation:
In Microsoft Defender XDR hunting, EmailAttachmentInfo includes metadata for received attachments (name, subject, and the file's SHA256 ), while DeviceFileEvents records file operations on endpoints (open
/read/execute) and also carries the SHA256 hash. Microsoft's guidance for efficient joins in KQL recommends correlating artifacts using stable, high-cardinality identifiers (hashes) rather than paths or URLs, because paths can change and URLs may not be preserved on disk; hashes uniquely identify the same file across mail and endpoint telemetry. To minimize query resources , Kusto's join kind=innerunique is preferred when the left side (EmailAttachmentInfo) is expected to have unique keys (one attachment hash per message instance) and you want at most one match per left record. It reduces shuffle/duplication compared to inner , improving performance while returning only devices that actually opened the same file (by matching SHA256 ) within the last 12 hours.
So the optimal query structure is:
EmailAttachmentInfo
| where Timestamp > ago(12h)
| where Subject == " Document Attachment " and FileName == " File1.pdf "
| join kind=innerunique
(DeviceFileEvents | where Timestamp > ago(12h))
on SHA256
This precisely identifies devices that received the email with File1.pdf and opened that same file, using the most efficient join strategy and a reliable correlation key.
You have a Microsoft 365 E5 subscription that contains a database server named DB1. DB1 is onboarded to Microsoft Defender XDR.
You need to ensure that DB1 appears on the attack surface map.
What should you configure?
You need to ensure that DB1 appears on the attack surface map.
What should you configure?
Correct Answer: B
Vote an answer
Explanation: Only visible for FreeCram members. You can sign-up / login (it's free).
Your company uses Azure Sentinel to manage alerts from more than 10,000 IoT devices.
A security manager at the company reports that tracking security threats is increasingly difficult due to the large number of incidents.
You need to recommend a solution to provide a custom visualization to simplify the investigation of threats and to infer threats by using machine learning.
What should you include in the recommendation?
A security manager at the company reports that tracking security threats is increasingly difficult due to the large number of incidents.
You need to recommend a solution to provide a custom visualization to simplify the investigation of threats and to infer threats by using machine learning.
What should you include in the recommendation?
Correct Answer: B
Vote an answer
You create a hunting query in Azure Sentinel.
You need to receive a notification in the Azure portal as soon as the hunting query detects a match on the query. The solution must minimize effort.
What should you use?
You need to receive a notification in the Azure portal as soon as the hunting query detects a match on the query. The solution must minimize effort.
What should you use?
Correct Answer: C
Vote an answer
Explanation: Only visible for FreeCram members. You can sign-up / login (it's free).
You have a Microsoft 365 subscription that uses Microsoft Defender for Endpoint Plan 2 and contains a Windows device named Device1.
Twenty files on Device1 are quarantined by custom indicators as part of an investigation.
You need to release the 20 files from quarantine.
How should you complete the command? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Twenty files on Device1 are quarantined by custom indicators as part of an investigation.
You need to release the 20 files from quarantine.
How should you complete the command? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Correct Answer:
Explanation:
To release quarantined items on a Windows device protected by Microsoft Defender for Endpoint/Antivirus
, you use the Microsoft Defender command-line utility MpCmdRun.exe . This tool supports maintenance actions including scanning, definition management, and quarantine operations. For quarantine specifically, the supported switch is -Restore , which restores items from quarantine. The typical syntax for restoring all items for a specific threat name is:
MpCmdRun.exe -Restore -Name " < ThreatName > " -All
Here, the -Name parameter specifies the detected threat family or name (for custom indicators it reflects the custom threat label, e.g., EUS:Win32/CustomEnterpriseBlock ), and -All applies the restore operation to all items associated with that name-ideal when multiple files (e.g., 20) were quarantined by the same indicator.
Other options are not appropriate for this task:
* -GetFiles collects diagnostic logs for support.
* -RemoveDefinitions and -ResetPlatform handle antimalware engine/definitions, not quarantine.
* MsMpEng.exe is the Defender service binary (not invoked directly), and Start-MpRollback is a separate PowerShell cmdlet for rolling back remediations, not for restoring quarantined files by name.
Therefore, to release the 20 files: MpCmdRun.exe -Restore -Name " EUS:Win32/CustomEnterpriseBlock
" -All .
You have a Microsoft 365 subscription that uses Microsoft 365 Defender and contains a user named User1.
You are notified that the account of User1 is compromised.
You need to review the alerts triggered on the devices to which User1 signed in.
How should you complete the query? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
You are notified that the account of User1 is compromised.
You need to review the alerts triggered on the devices to which User1 signed in.
How should you complete the query? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Correct Answer:
Explanation:
Box 1: join
An inner join.
This query uses kind=inner to specify an inner-join, which prevents deduplication of left side values for DeviceId.
This query uses the DeviceInfo table to check if a potentially compromised user ( < account-name > ) has logged on to any devices and then lists the alerts that have been triggered on those devices.
DeviceInfo
//Query for devices that the potentially compromised account has logged onto
| where LoggedOnUsers contains ' < account-name > '
| distinct DeviceId
//Crosscheck devices against alert records in AlertEvidence and AlertInfo tables
| join kind=inner AlertEvidence on DeviceId
| project AlertId
//List all alerts on devices that user has logged on to
| join AlertInfo on AlertId
| project AlertId, Timestamp, Title, Severity, Category
DeviceInfo LoggedOnUsers AlertEvidence " project AlertID "
Box 2: project
Reference: https://docs.microsoft.com/en-us/ microsoft-365/security/defender/advanced-hunting-query-emails- devices?view=o365-worldwide
You have a Microsoft Sentinel workspace named Workspace1 that contains the AzureActivity table.
You need to configure the retention period for the AzureActivity table. The solution must meet the following requirements:
* Maximize the period during which you can run interactive queries.
* Minimize retention costs.
To what should you set the retention period? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
You need to configure the retention period for the AzureActivity table. The solution must meet the following requirements:
* Maximize the period during which you can run interactive queries.
* Minimize retention costs.
To what should you set the retention period? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Correct Answer: A
Vote an answer
You use Azure Defender.
You have an Azure Storage account that contains sensitive information.
You need to run a PowerShell script if someone accesses the storage account from a suspicious IP address.
Which two actions should you perform? Each correct answer presents part of the solution.
NOTE: Each correct selection is worth one point.
You have an Azure Storage account that contains sensitive information.
You need to run a PowerShell script if someone accesses the storage account from a suspicious IP address.
Which two actions should you perform? Each correct answer presents part of the solution.
NOTE: Each correct selection is worth one point.
Correct Answer: C,D
Vote an answer
Explanation: Only visible for FreeCram members. You can sign-up / login (it's free).
You are configuring Microsoft Cloud App Security.
You have a custom threat detection policy based on the IP address ranges of your company's United States- based offices.
You receive many alerts related to impossible travel and sign-ins from risky IP addresses.
You determine that 99% of the alerts are legitimate sign-ins from your corporate offices.
You need to prevent alerts for legitimate sign-ins from known locations.
Which two actions should you perform? Each correct answer presents part of the solution.
NOTE: Each correct selection is worth one point.
You have a custom threat detection policy based on the IP address ranges of your company's United States- based offices.
You receive many alerts related to impossible travel and sign-ins from risky IP addresses.
You determine that 99% of the alerts are legitimate sign-ins from your corporate offices.
You need to prevent alerts for legitimate sign-ins from known locations.
Which two actions should you perform? Each correct answer presents part of the solution.
NOTE: Each correct selection is worth one point.
Correct Answer: A,D
Vote an answer
Explanation: Only visible for FreeCram members. You can sign-up / login (it's free).
You have an on-premises datacenter that contains a custom web app named Appl. App1 uses Active Directory Domain Services (AD DS) authentication and is accessible by using Microsoft Entra application proxy.
You have a Microsoft 365 E5 subscription that uses Microsoft Defender XDR.
You receive an alert that a user downloaded highly confidential documents.
You need to remediate the risk associated with the alert by requiring multi-factor authentication (MFA) when users use App1 to initiate the download of documents that have a Highly Confidential sensitivity label applied.
What should you do? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
You have a Microsoft 365 E5 subscription that uses Microsoft Defender XDR.
You receive an alert that a user downloaded highly confidential documents.
You need to remediate the risk associated with the alert by requiring multi-factor authentication (MFA) when users use App1 to initiate the download of documents that have a Highly Confidential sensitivity label applied.
What should you do? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Correct Answer:
Explanation:
In this scenario, App1 is a custom web app published through Microsoft Entra Application Proxy and authenticated using Active Directory Domain Services (AD DS) . Because it's integrated with Microsoft Entra ID (formerly Azure AD) for access control, the most appropriate and supported way to require MFA for users accessing the application is through Conditional Access .
Microsoft Entra Conditional Access policies evaluate user sign-in conditions such as risk level, device compliance, location, and sensitivity of data before granting access. Specifically, Microsoft's documentation states:
"Conditional Access policies allow administrators to require multi-factor authentication, block access, or enforce specific controls such as app protection or session policies for cloud and on-premises applications integrated with Microsoft Entra ID." Therefore, to make MFA mandatory for users accessing App1, a Conditional Access policy must be created targeting that application.
For the second part, to implement a session policy that controls or monitors user behavior (such as downloading highly confidential documents), the correct choice is Microsoft Defender for Cloud Apps (MDA) . Microsoft's official guidance says:
"Session policies in Microsoft Defender for Cloud Apps provide real-time session controls that enable administrators to monitor and restrict user activity in cloud apps, including download, cut/copy, and upload actions based on sensitivity labels or user risk." These session policies integrate seamlessly with Conditional Access via the "Use Conditional Access App Control" setting to apply continuous access evaluation during a user's session.
Hence, the correct verified configuration is:
* Require MFA: Conditional Access
* Implement session policy: Microsoft Defender for Cloud Apps