Microsoft - SC-200: Microsoft Security Operations Analyst
Sample Questions
Question: 461
Measured Skill: Manage security threats (15–20%)
You have a Microsoft 365 E5 subscription that uses Microsoft Defender XDR.
You enable automatic attack disruption.
During a recent ransomware incident, Defender for Endpoint responded automatically to the incident.
You need to review the automatic responses of Defender for Endpoint to the incident.
What should you use in the Microsoft Defender portal?| A | Advanced hunting |
| B | Incidents |
| C | Action center |
| D | Threat analytics |
Correct answer: CExplanation:
When automatic attack disruption or other automated response actions are performed by Microsoft Defender for Endpoint, those actions are recorded and can be reviewed in the Action center in the Microsoft Defender portal. The Action center provides a centralized view of remediation and response actions, including actions taken automatically during incidents.
Reference: Configure automatic attack disruption in Microsoft Defender XDR
Question: 462
Measured Skill: Manage incident response (25–30%)
You have a Windows 11 device named Device1 that is onboarded to Microsoft Defender for Endpoint and has tamper protection enabled.
A user reports that Microsoft Defender Antivirus is blocking the installation of a line-of-business (LOB) application.
You enable troubleshooting mode on Device1.
You need to retrieve the logs and the setting snapshots collected by Defender for Endpoint when Device1 is in troubleshooting mode. The solution must minimize administrative effort.
What should you do?| A | Initiate an automated investigation. |
| B | Collect the Microsoft Defender Antivirus troubleshooting diagnostic files. |
| C | Initiate a live response session. |
| D | Collect an investigation package. |
Correct answer: DExplanation:
Troubleshooting mode in Microsoft Defender for Endpoint enables administrators to troubleshoot various Microsoft Defender Antivirus features, even if devices are managed by organizational policies. For example, if tamper protection is enabled, certain settings can't be modified or turned off, but you can use troubleshooting mode on a device to edit those settings temporarily.
When a device is placed in troubleshooting mode, Microsoft Defender for Endpoint collects troubleshooting artifacts, including:
- Logs gathered during the troubleshooting session.
- A snapshot of MpPreference settings before troubleshooting mode starts.
- A second snapshot taken before troubleshooting mode expires.
Logs and snapshots are collected and are available for an administrator to collect using the Collect investigation package feature on the device page.
References:
Get started with troubleshooting mode in Microsoft Defender for Endpoint
Collect Microsoft Defender Antivirus diagnostic data
Question: 463
Measured Skill: Configure protections and detections (15–20%)
You have a Microsoft Sentinel workspace that is connected to the Microsoft Sentinel data lake.
Newly ingested data can take up to 15 minutes to become queryable in the data lake.
You need to schedule a KQL job that runs daily at 12:10 AM and populates a summary table used by threat hunters. The solution must meet the following requirements:
- Each run must query a fixed 24-hour window that ends 15 minutes before the job runtime.
- Double-counting must be prevented across the daily runs.
- Late-arriving records must be included in the summary.
How should you complete the KQL query?
(To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.)
| A | P1: now() + delay;
P2: endTime + lookback; |
| B | P1: now() + delay;
P2: ago(lookback); |
| C | P1: now() - delay;
P2: endTime - lookback; |
| D | P1: now() - delay;
P2: ago(lookback); |
| E | P1: now() - lookback;
P2: endTime + lookback; |
| F | P1: now() - lookback;
P2: endTime - lookback; |
Correct answer: CExplanation:
We have the following requirements:
- Query a 24-hour window.
- End the window 15 minutes before runtime to allow for data lake latency.
- Avoid overlap between daily runs, preventing double-counting.
- Include late-arriving records by shifting the window back 15 minutes.
To meet all requirements, we need to set endTime = now() - delay and startTime = endTime - lookback.
Question: 464
Measured Skill: Manage security threats (15–20%)
You have a Microsoft Sentinel workspace that is connected to the Microsoft Defender portal.
You enable the User and Entity Behavior Analytics (UEBA) behavior layers and confirm that behavior records are being generated.
You need to create an advanced hunting query that returns only the UEBA behavior records generated by Microsoft Sentinel.
How should you complete the KQL query?
(To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.)
| A | BehaviorEntities
| where Categories <> "Microsoft Sentinel" |
| B | BehaviorEntities
| where Categories has "Microsoft Sentinel" |
| C | BehaviorEntities
| where ServiceSource == "Microsoft Sentinel" |
| D | BehaviorEntities
| where ServiceSource has "Microsoft Sentinel" |
| E | BehaviorEntities
| where Title <> "Microsoft Sentinel" |
| F | BehaviorEntities
| where Title == "Microsoft Sentinel" |
Correct answer: CExplanation:
The ServiceSource field identifies the Microsoft security product that generated the behavior record. To return only UEBA behavior records generated by Microsoft Sentinel, you filter on:
Reference: BehaviorEntities
Question: 465
Measured Skill: Manage security threats (15–20%)
You have a Microsoft Sentinel workspace that ingests endpoint process events into a Log Analytics workspace.
You need to create a hunting query that identifies suspicious, rarely seen processes on Windows devices. The solution must meet the following requirements:
- Return the 20 least common process names observed during the last 24 hours.
- Exclude a list of approved administrative tools.
How should you complete the KQL query?
(To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.)
| A | P1: <= ago(24h)
P2: desc |
| B | P1: <= ago(24h)
P2: Nulls last |
| C | P1: >= ago(24h)
P2: desc |
| D | P1: >= ago(24h)
P2: asc |
| E | P1: between (ago(48h) .. ago(24h))
P2: Nulls last |
| F | P1: between (ago(48h) .. ago(24h))
P2: asc |
Correct answer: DExplanation:
The requirement is to analyze processes observed during the last 24 hours.
- Timestamp >= ago(24h) returns events from now back to 24 hours ago.
- <= ago(24h) would return older events.
- between (ago(48h) .. ago(24h)) would return events from 24 to 48 hours ago, not the last 24 hours.
The requirement is to return the 20 least common process names.
- top 20 by DeviceCount asc returns the smallest values of DeviceCount.
- desc would return the most common processes.