Free SC-200 Security Operations Analyst Practice Exam (2026)

Your score by topic

Get a free SC-200 study plan on WhatsApp See related CySA+ SOC Analyst Training with pass guarantee

Review answers Only my mistakes Retake

Question 1Security Operations Setup⚑ Flag

Contoso analysts complain that the Microsoft Defender XDR incident queue shows only some Microsoft Entra ID Protection alerts. The SOC wants every Entra ID Protection alert, not just high-impact ones, to appear in Defender XDR. What should you change?

AThe alert service settings BAn alert tuning rule CThe Microsoft Sentinel Entra ID connector DThe Entra ID Protection risk policy

Correct answer: A. The alert service settings
Alert service settings in Defender XDR control whether Entra ID Protection sends only high-impact alerts or all alerts into the portal. An alert tuning rule hides alerts and cannot bring in alerts that are not being sent.

Question 2Incident Response⚑ Flag

An Adatum user received a credential-harvesting message that Microsoft Defender for Office 365 did not catch. The security team wants Microsoft to analyze the message, return a verdict and use the result to improve filtering. What should the team use?

AAn outbound spam policy BA Tenant Allow/Block List entry CAdmin submission to Microsoft DThreat Explorer remediation

Correct answer: C. Admin submission to Microsoft
Admin submissions from the Submissions page send the message to Microsoft for analysis, return a verdict and help improve filtering. A Tenant Allow/Block List entry blocks a sender locally but does not ask Microsoft to analyze the message.

Question 3Threat Hunting⚑ Flag

A Fabrikam hunter wants to find all onboarded devices that connected to the IP address 203.0.113.50 over port 443 in the last week. Which advanced hunting table should the hunter query?

AIdentityQueryEvents BDeviceProcessEvents CDeviceInfo DDeviceNetworkEvents

Correct answer: D. DeviceNetworkEvents
DeviceNetworkEvents records network connections from devices, including remote IP and port. DeviceInfo holds device properties, not connection events.

Question 4Security Operations Setup⚑ Flag

Fabrikam found that local administrators turned off Microsoft Defender Antivirus real-time protection on several laptops. You need to stop local changes to Defender security settings on onboarded devices with minimal effort. What should you turn on?

AAttack surface reduction rules BControlled folder access CNetwork protection DTamper protection

Correct answer: D. Tamper protection
Tamper protection blocks local and unauthorized changes to Defender security settings, including turning off real-time protection. Controlled folder access protects folders from unauthorized writes but does not lock antivirus settings.

Question 5Incident Response⚑ Flag

Tailwind Traders suffers an adversary-in-the-middle phishing attack in which a stolen session cookie is used to start business email compromise. The SOC wants Microsoft Defender XDR to disable the compromised account automatically as the attack is detected, without waiting for an analyst. Which capability provides this?

AThreat Explorer remediation BAutomatic attack disruption CDefender for Cloud Apps anomaly policy DEntra ID Protection user risk policy

Correct answer: B. Automatic attack disruption
Automatic attack disruption uses high-confidence signals across Defender XDR to contain compromised accounts automatically during attacks like AiTM and BEC. An Entra ID Protection risk policy can require a password change on sign-in but does not act across the attack in real time.

Question 6Security Operations Setup⚑ Flag

Litware wants to block gambling and adult websites on all managed Windows devices in Microsoft Edge, Chrome and Firefox using Microsoft Defender for Endpoint. Which configuration meets the requirement?

AA Defender for Cloud Apps session policy BWeb content filtering with network protection in block mode CMicrosoft Defender SmartScreen in Microsoft Edge DCustom URL indicators for each site

Correct answer: B. Web content filtering with network protection in block mode
Web content filtering blocks site categories, and network protection in block mode enforces it in third-party browsers like Chrome and Firefox. SmartScreen only protects Microsoft Edge, so it fails the other browsers.

Question 7Threat Hunting⚑ Flag

A Litware hunter in Microsoft Sentinel wants to find interactive Microsoft Entra sign-ins from unfamiliar countries for a set of users. Which table should the hunter query?

AAuditLogs BIdentityLogonEvents COfficeActivity DSigninLogs

Correct answer: D. SigninLogs
SigninLogs holds interactive Microsoft Entra sign-ins with location, app and result. AuditLogs holds directory changes, not sign-in attempts.

Question 8Incident Response⚑ Flag

Northwind Traders created a decoy service account in Active Directory that no real user or app should ever use. The SOC wants an alert whenever anyone authenticates with it. What should you configure in Microsoft Defender for Identity?

AAn exclusion for the account BA lateral movement path report CA honeytoken entity tag DA sensitive account tag

Correct answer: C. A honeytoken entity tag
Tagging an account as a honeytoken in Defender for Identity raises an alert when anyone authenticates with it. A sensitive tag marks an account as high value but does not alert on every use.

Question 9Security Operations Setup⚑ Flag

Adatum is worried about credential dumping tools that read memory from the Local Security Authority process on Windows clients. You need an attack surface reduction rule that addresses this threat. Which rule should you enable?

ABlock process creations from PSExec and WMI commands BBlock credential stealing from lsass.exe CBlock untrusted processes that run from USB DBlock executable content from email client and webmail

Correct answer: B. Block credential stealing from lsass.exe
The ASR rule that blocks credential stealing from the Windows local security authority subsystem stops untrusted processes from reading lsass.exe memory. The PSExec and WMI rule targets remote process creation, not memory reads from LSASS.

Question 10Incident Response⚑ Flag

A Contoso user shows high risk in Microsoft Entra ID Protection. Investigation proves the account was used by an attacker. The SOC wants the account to be treated as high risk so risk-based Conditional Access policies apply. What should the analyst do?

ADelete the risky sign-in BDismiss user risk CConfirm user compromised DConfirm sign-in safe

Correct answer: C. Confirm user compromised
Confirm user compromised sets the user risk to high, which triggers risk-based policies and improves the risk model. Dismiss user risk would lower the risk and remove that protection.

Question 11Security Operations Setup⚑ Flag

Tailwind Traders needs extra endpoint telemetry, such as specific events that Microsoft Defender for Endpoint does not send by default, for a set of devices. The team wants to avoid deploying another agent. What should you use?

ADefender for Endpoint custom data collection BThe Windows Security Events via AMA connector CAn advanced hunting custom detection DWindows Event Forwarding to a collector

Correct answer: A. Defender for Endpoint custom data collection
Custom data collection rules extend the Defender for Endpoint sensor to collect additional events beyond default telemetry, with no extra agent. The Windows Security Events via AMA connector requires installing the Azure Monitor Agent.

Question 12Threat Hunting⚑ Flag

Adatum collects Windows Security event log entries from its servers into Microsoft Sentinel using the Windows Security Events via AMA connector. A hunter wants to search for event ID 4720, a new user account created. Which table should the hunter use?

ADeviceEvents BSecurityEvent CWindowsEvent DEvent

Correct answer: B. SecurityEvent
The Windows Security Events connector writes Security log entries to the SecurityEvent table. WindowsEvent is used for forwarded events, and Event holds other Windows logs such as System and Application.

Question 13Incident Response⚑ Flag

Fabrikam wants Microsoft Defender for Cloud to run a Logic App automatically whenever a high-severity alert is raised on a production subscription. The Logic App will open a ticket and notify the resource owner. What should you configure in Defender for Cloud?

AWorkflow automation BContinuous export CAlert suppression rules DA regulatory compliance standard

Correct answer: A. Workflow automation
Workflow automation in Defender for Cloud triggers Logic Apps on alerts or recommendations that match chosen conditions. Continuous export streams data to a workspace or Event Hubs but does not run a Logic App.

Question 14Security Operations Setup⚑ Flag

Northwind Traders analysts spend time closing Microsoft Defender for Endpoint alerts after automated investigation finds no threat or has already remediated everything. You need these alerts closed without analyst action. What should you turn on?

ALive Response for servers BRestrict correlation to within scoped device groups CAutomatically resolve alerts DAllow or block file

Correct answer: C. Automatically resolve alerts
The Automatically resolve alerts advanced feature resolves an alert when automated investigation finds no threats or remediates all malicious artifacts. Live Response for servers enables manual sessions and does nothing to close alerts.

Question 15Incident Response⚑ Flag

Litware's Microsoft Defender for Cloud Apps policy detects a user downloading thousands of files from a connected cloud storage app in minutes. Until the activity is reviewed, the user must be blocked from signing in automatically. Which governance action should the policy use?

ANotify the user BRequire the user to sign in again CApply a sensitivity label DSuspend the user

Correct answer: D. Suspend the user
The Suspend user governance action blocks the user from signing in until an admin restores access. Requiring the user to sign in again only ends sessions, so the user could sign back in.

Question 16Security Operations Setup⚑ Flag

Contoso is a managed security service provider that runs Microsoft Sentinel for 12 customers, each with its own Microsoft Entra tenant and workspace. Contoso analysts must manage all customer workspaces from the Contoso tenant without guest accounts. What should you use?

AMicrosoft Entra B2B collaboration BA single shared workspace CCross-workspace queries only DAzure Lighthouse

Correct answer: D. Azure Lighthouse
Azure Lighthouse delegates access to customer subscriptions so the provider's analysts can manage Sentinel from their own tenant. Entra B2B would require guest accounts in each customer tenant, which the requirement excludes.

Question 17Threat Hunting⚑ Flag

A Tailwind Traders hunter has a list of suspicious logons in one query and process events in another. The hunter needs rows where both share the same DeviceId. Which KQL fragment should the hunter use?

A| join kind=inner (ProcessEvents) on DeviceId B| extend DeviceId = ProcessEvents C| summarize by DeviceId D| union ProcessEvents

Correct answer: A. | join kind=inner (ProcessEvents) on DeviceId
An inner join returns only rows that match on DeviceId in both inputs. Union appends the rows of both tables without matching them.

Question 18Security Operations Setup⚑ Flag

A Fabrikam analyst must be able to view and manually run existing Microsoft Sentinel playbooks from incidents. The analyst must not create or edit playbooks. Which role should you assign on the playbooks' resource group?

AMicrosoft Sentinel Automation Contributor BMicrosoft Sentinel Playbook Operator CMicrosoft Sentinel Reader DLogic App Contributor

Correct answer: B. Microsoft Sentinel Playbook Operator
The Playbook Operator role allows listing, viewing and manually running playbooks without editing them. Logic App Contributor would allow creating and changing playbooks, which is more than required.

Question 19Incident Response⚑ Flag

Adatum analysts in Microsoft Purview Insider Risk Management see alerts with masked user names such as AnonIS8-988. Legal approved showing real names to the investigation team. What should you change?

AThe indicators in the insider risk policy template BThe DLP policy rules CThe Audit log retention policy DThe Insider Risk anonymization setting

Correct answer: D. The Insider Risk anonymization setting
Insider Risk privacy settings control whether user names are anonymized in alerts and cases. Changing policy indicators affects which activities generate alerts, not how users are displayed.

Question 20Threat Hunting⚑ Flag

A Northwind Traders custom log stores a single text field such as "user=jsmith action=delete file=report.xlsx". A hunter wants to pull the user, action and file into separate columns. Which KQL operator should the hunter use?

Aproject Bsummarize Cparse Dbin

Correct answer: C. parse
The parse operator extracts parts of a string into new columns based on a pattern. Project only selects or renames existing columns and does not split text.

Question 21Security Operations Setup⚑ Flag

Litware analysts want to right-click a suspicious IP address while investigating a Microsoft Sentinel incident and run a playbook that adds that one address to a firewall block list. Which playbook trigger should you use?

AMicrosoft Sentinel entity BMicrosoft Sentinel incident CMicrosoft Sentinel alert DRecurrence schedule

Correct answer: A. Microsoft Sentinel entity
The entity trigger runs a playbook on a single selected entity, such as an IP address, from an investigation. An incident trigger runs on the whole incident and would need extra logic to pick the right address.

Question 22Incident Response⚑ Flag

A Tailwind Traders analyst reviewing a DLP alert wants to see the history of activities on sensitive items, such as files copied to USB or uploaded to cloud apps, across endpoints over the past weeks. Which Purview tool should the analyst use?

AData lifecycle management BContent explorer CActivity explorer DCommunication compliance

Correct answer: C. Activity explorer
Activity explorer shows a history of labeled and sensitive content activities, including DLP rule matches and endpoint actions. Content explorer shows where sensitive items are stored, not what users did with them.

Question 23Security Operations Setup⚑ Flag

Adatum keeps a list of 200 VIP user accounts that changes monthly. Several Microsoft Sentinel analytics rules must raise severity when one of these users is involved. Analysts must update the list without editing rule queries. What should you use?

AA watchlist with _GetWatchlist() BA hardcoded list inside each rule CA threat intelligence indicator feed DA workbook parameter

Correct answer: A. A watchlist with _GetWatchlist()
A watchlist stores reference data that rules read with _GetWatchlist(), so updating the list changes every rule at once. A hardcoded list would require editing each rule query when users change.

Question 24Incident Response⚑ Flag

A Northwind Traders analyst finds an unknown executable on a device and wants Microsoft to run it in a secure cloud sandbox and report on its behavior, such as network connections and dropped files. What should the analyst use from the file page?

ADownload the file BDeep analysis CCollect investigation package DAdd an allow indicator

Correct answer: B. Deep analysis
Deep analysis submits the file to a cloud sandbox and returns a report of observed behavior. Collect investigation package gathers device artifacts and does not detonate the file.

Question 25Threat Hunting⚑ Flag

A Contoso hunter's query returns 60 columns, but the report should show only Timestamp, DeviceName and ProcessCommandLine. Which KQL fragment should the hunter add?

A| project Timestamp, DeviceName, ProcessCommandLine B| extend Timestamp, DeviceName, ProcessCommandLine C| summarize by Timestamp D| where isnotempty(DeviceName)

Correct answer: A. | project Timestamp, DeviceName, ProcessCommandLine
The project operator keeps only the listed columns in the output. Extend adds computed columns and keeps all existing ones.

Question 26Security Operations Setup⚑ Flag

Tailwind Traders is onboarding Palo Alto firewalls to Microsoft Sentinel and wants the matching data connector, analytics rules, workbooks and parsers deployed together. Administrative effort must be minimal. What should you do?

ACreate a workbook from a blank template BImport each rule from a community repository CInstall the solution from the content hub DBuild a custom connector with the Codeless Connector Framework

Correct answer: C. Install the solution from the content hub
Content hub solutions package connectors, rules, workbooks and parsers for a product so you can deploy them together. Importing rules one at a time from a repository adds work and may miss the connector or parsers.

Question 27Incident Response⚑ Flag

During an incident at Contoso, an unmanaged device that is not onboarded to Microsoft Defender for Endpoint is attacking other machines. You need onboarded devices to block all communication with it. What should you do?

ARestrict app execution on it BContain the device CAdd the device to a device group DIsolate the unmanaged device

Correct answer: B. Contain the device
The contain action instructs onboarded devices to block traffic to and from a device that may not be onboarded. Isolation requires the target device to run the Defender for Endpoint sensor, so it cannot be applied to an unmanaged device.

Question 28Security Operations Setup⚑ Flag

Northwind Traders already uses Windows Event Forwarding to send events from 3,000 workstations to a few collector servers. The SOC wants those forwarded events in Microsoft Sentinel without installing an agent on every workstation. Which connector should you configure on the collectors?

AMicrosoft Defender for Endpoint BWindows Security Events via AMA CSyslog via AMA DWindows Forwarded Events via AMA

Correct answer: D. Windows Forwarded Events via AMA
The Windows Forwarded Events connector uses the Azure Monitor Agent on the collectors to read the Forwarded Events log, and data lands in the WindowsEvent table. The Windows Security Events connector reads the local Security log of each machine with an agent, not the forwarded log.

Question 29Incident Response⚑ Flag

A Fabrikam device may be compromised, and analysts want to stop any unknown tools from starting while they investigate. Only applications signed by Microsoft should be allowed to run. What should the analyst do?

ARestrict app execution BIsolate the device CRun a full antivirus scan DStop and quarantine the file

Correct answer: A. Restrict app execution
Restrict app execution applies a code integrity policy that lets only Microsoft-signed applications run. Isolation cuts network access but still allows unknown tools to start locally.

Question 30Threat Hunting⚑ Flag

A Fabrikam hunter wants to add a new column that shows the length of each command line so long commands can be sorted. Which KQL fragment should the hunter use?

A| where strlen(ProcessCommandLine) > 0 B| extend CmdLength = strlen(ProcessCommandLine) C| project-away ProcessCommandLine D| summarize max(ProcessCommandLine)

Correct answer: B. | extend CmdLength = strlen(ProcessCommandLine)
Extend creates a new calculated column while keeping the existing ones. A where filter removes rows but does not add the length as a column for sorting.

Question 31Security Operations Setup⚑ Flag

Contoso collects Linux logs through Syslog via AMA. The volume is too high, and the SOC only needs authentication messages at Warning severity or above. What should you change?

AThe facility and minimum log level in the DCR BThe table retention of the Syslog table CThe rsyslog port on the forwarder DA transformation in the CommonSecurityLog table

Correct answer: A. The facility and minimum log level in the DCR
The Syslog data collection rule lets you pick facilities, such as auth and authpriv, and a minimum log level for each, which cuts volume at the source. Changing retention reduces storage time but not ingestion volume.

Question 32Incident Response⚑ Flag

A Litware analyst opens a Microsoft Defender XDR incident and wants one list of all files, processes, IP addresses and mailboxes involved, with each item's verdict and remediation status. Which incident tab should the analyst use?

AAlerts BAttack story CAssets DEvidence and Response

Correct answer: D. Evidence and Response
The Evidence and Response tab lists all entities found in the incident with their verdicts and remediation status. The Assets tab focuses on affected devices, users and mailboxes, not every file, process and IP.

Question 33Security Operations Setup⚑ Flag

Fabrikam connected the Microsoft Entra ID connector in Microsoft Sentinel. Audit logs arrive, but the sign-in logs option cannot be enabled. What is the most likely cause?

ANo Microsoft Entra ID P1 or P2 license BThe workspace uses the data lake tier CThe connector requires the Azure Monitor Agent DThe SigninLogs table needs a custom DCR

Correct answer: A. No Microsoft Entra ID P1 or P2 license
Streaming Entra sign-in logs requires a Microsoft Entra ID P1 or P2 license, while audit logs are available without it. The Entra ID connector uses diagnostic settings, not the Azure Monitor Agent.

Question 34Threat Hunting⚑ Flag

A Litware hunter in Microsoft Sentinel wants to be notified in real time, during an active investigation, whenever new events match a hunting query. The hunter does not want to create a permanent analytics rule yet. What should the hunter use?

AA workbook BA hunting bookmark CA livestream session DA summary rule

Correct answer: C. A livestream session
Livestream runs a hunting query continuously on new data and notifies the hunter when results appear, without creating an analytics rule. A bookmark saves existing results but does not watch for new events.

Question 35Security Operations Setup⚑ Flag

Litware wants Microsoft Sentinel to record Exchange Online, SharePoint Online and Teams user and admin activity, such as mailbox rule changes and file sharing. Which table will hold this data after you enable the Microsoft 365 connector?

AOfficeActivity BCloudAppEvents CSecurityEvent DAuditLogs

Correct answer: A. OfficeActivity
The Microsoft 365 connector writes Exchange, SharePoint and Teams activity to the OfficeActivity table. AuditLogs holds Microsoft Entra directory audit events, not Office workload activity.

Question 36Incident Response⚑ Flag

Microsoft Defender XDR added an alert about a Contoso user's unusual mailbox rule to an unrelated device incident. Analysts determine the alert belongs to a separate business email compromise incident. What should they do?

AClose the device incident as false positive BCreate a new analytics rule CDelete the alert from the incident DLink the alert to the correct incident

Correct answer: D. Link the alert to the correct incident
Defender XDR lets analysts link an alert to another incident to fix correlation. Closing the device incident as a false positive would wrongly close real device activity.

Question 37Security Operations Setup⚑ Flag

Adatum creates a custom detection rule in advanced hunting that finds a known ransomware staging command. When the rule matches, the affected device must be isolated immediately with no analyst action. What should you configure?

AAn alert tuning rule BThe rule's isolate device action CAn automation rule in Microsoft Sentinel DA device group set to Full automation level

Correct answer: B. The rule's isolate device action
Custom detection rules can run response actions, such as isolate device, automatically on impacted devices when they fire. A Full automation level applies to automated investigation remediation, not to isolating devices for a custom query match.

Question 38Incident Response⚑ Flag

A Microsoft Sentinel incident at Adatum was raised by a scheduled rule that detected a password spray. Investigation shows it was an approved penetration test. The rule worked as designed. How should the analyst classify the incident when closing it?

AFalse positive - incorrect alert logic BTrue positive - suspicious activity CBenign positive - suspicious but expected DUndetermined

Correct answer: C. Benign positive - suspicious but expected
Benign positive is for real suspicious activity that is expected, such as an authorized test, and it tells rule owners the logic is correct. False positive implies the rule fired incorrectly, which is not the case here.

Question 39Threat Hunting⚑ Flag

Adatum ingests billions of verbose firewall events. Hunters need hourly counts of connections per source IP kept in the analytics tier for fast queries, while the raw logs stay in a lower-cost tier. What should you configure in Microsoft Sentinel?

AA watchlist BA summary rule CA hunting bookmark DA Fusion rule

Correct answer: B. A summary rule
Summary rules run scheduled aggregation queries and store the results in an analytics tier table, keeping summarized data fast to query. A watchlist holds reference data that you upload and cannot aggregate log data on a schedule.

Question 40Security Operations Setup⚑ Flag

A Microsoft Sentinel scheduled rule at Tailwind Traders creates a separate incident every time the same user fails MFA, producing 40 incidents a day for one person. Analysts want related alerts for the same user within 24 hours combined into one incident. What should you configure?

AEvent grouping set to trigger per event BA lower rule frequency CAn NRT version of the rule DAlert grouping in the rule's incident settings

Correct answer: D. Alert grouping in the rule's incident settings
Alert grouping in incident settings combines alerts that match on chosen entities within a time window into one incident. Event grouping controls whether events become one alert or many, not how alerts form incidents.

Question 41Incident Response⚑ Flag

A Tailwind Traders analyst finds a long, obfuscated PowerShell command line in an alert and cannot tell what it does. Microsoft Security Copilot is enabled in the Defender portal. What should the analyst use?

ACopilot KQL query assistant BCopilot script analysis CCopilot incident summary DCopilot guided response

Correct answer: B. Copilot script analysis
Copilot script analysis explains what a command line or script does in plain language. An incident summary describes the whole incident but does not break down a single obfuscated script.

Question 42Security Operations Setup⚑ Flag

Northwind Traders onboarded its Microsoft Sentinel workspace to the Microsoft Defender portal and connected Defender XDR. Analysts now see duplicate incidents for Defender for Endpoint alerts. What should you do?

ACreate an alert tuning rule for each product BDelete the Defender XDR connector CTurn off Microsoft incident creation rules DLower the severity of Defender alerts

Correct answer: C. Turn off Microsoft incident creation rules
When Defender XDR provides incidents, Microsoft incident creation rules for the same products create duplicates, so they should be turned off. Deleting the Defender XDR connector would remove the correlated incidents the SOC needs.

Question 43Incident Response⚑ Flag

Northwind Traders learns that an employee posted a production database password in several Microsoft Teams chats. You need to find every message across the organization that contains the password string. What should you use?

APurview Content search BPurview Audit search CThreat Explorer DActivity explorer

Correct answer: A. Purview Content search
Content search finds messages and files by keyword across Exchange, SharePoint, OneDrive and Teams. Audit search shows who did what and when but does not search message content.

Question 44Threat Hunting⚑ Flag

A Tailwind Traders analyst is investigating a suspicious file entity inside a Microsoft Defender XDR incident. The analyst wants to open advanced hunting with a ready-made query that finds related activity for that file across the organization. What should the analyst select?

ADeep analysis BAdd indicator CCollect investigation package DGo hunt

Correct answer: D. Go hunt
Go hunt opens advanced hunting with a prebuilt query for the selected entity, such as a file, user or IP. Deep analysis detonates the file in a sandbox rather than searching for related activity.

Question 45Security Operations Setup⚑ Flag

Contoso wants Microsoft Sentinel to correlate low-fidelity signals, such as an unusual sign-in followed by mass file download, into a single high-fidelity multistage attack incident using machine learning. Which analytics rule type provides this?

AFusion BThreat intelligence CScheduled DNear-real-time (NRT)

Correct answer: A. Fusion
Fusion uses machine learning to correlate weak signals from multiple sources into high-confidence multistage attack incidents. Scheduled rules run a single KQL query and do not perform this machine learning correlation on their own.

Question 46Incident Response⚑ Flag

Contoso enabled user and entity behavior analytics in Microsoft Sentinel. During an investigation, an analyst wants to compare a user's recent activity with that user's normal baseline and peers to see what is unusual. What should the analyst review?

AThe Action center history BThe raw SigninLogs table for the account CThe user's UEBA anomalies and baseline DThe threat analytics report

Correct answer: C. The user's UEBA anomalies and baseline
UEBA builds baselines for users and peers and records anomalies in behavior analytics data shown on entity pages. Raw SigninLogs show sign-ins but do not compare activity with a baseline.

Question 47Security Operations Setup⚑ Flag

Fabrikam wants alerts when its CEF, DNS or Syslog data matches Microsoft-curated threat indicators, without maintaining its own feed or writing matching queries. Which analytics rule should you enable?

AA scheduled rule that joins the ThreatIntelIndicators table BAn anomaly rule for network traffic CA Fusion rule for multistage attacks DMicrosoft Defender Threat Intelligence Analytics

Correct answer: D. Microsoft Defender Threat Intelligence Analytics
The Microsoft Defender Threat Intelligence Analytics rule matches Microsoft-generated indicators against CEF, DNS and Syslog data with no feed or query to maintain. A custom scheduled join would work but requires writing and maintaining the query.

Question 48Threat Hunting⚑ Flag

A Northwind Traders hunter wants to find process command lines that contain the whole term "encodedcommand" in DeviceProcessEvents, using a fast indexed match. Which KQL fragment should the hunter use?

A| project ProcessCommandLine = "encodedcommand" B| extend Match = "encodedcommand" C| summarize count() by "encodedcommand" D| where ProcessCommandLine has "encodedcommand"

Correct answer: D. | where ProcessCommandLine has "encodedcommand"
The has operator matches whole terms and uses the term index, so it is faster than a substring search. Extend only adds a constant column and does not filter any rows.

Question 49Incident Response⚑ Flag

Microsoft Defender for Identity raises a suspected Golden Ticket alert at Litware, showing forged Kerberos tickets with abnormal lifetimes for domain admin accounts. After removing the attacker's access, you need to invalidate all forged tickets. What should you do?

AIsolate every domain controller BReset the KRBTGT account password twice CReset the passwords of all domain admins DRevoke all sessions in Microsoft Entra ID

Correct answer: B. Reset the KRBTGT account password twice
Golden tickets are signed with the KRBTGT account key, so resetting the KRBTGT password twice, allowing replication between resets, invalidates them. Resetting domain admin passwords does not help because forged tickets do not depend on those passwords.

Question 50Security Operations Setup⚑ Flag

Litware created playbooks in a separate resource group. When an analyst builds an automation rule in Microsoft Sentinel, the playbooks do not appear in the list. What should you do?

ARecreate the playbooks with an entity trigger BAssign the analyst Microsoft Sentinel Contributor CSet playbook permissions for that resource group DMove the workspace into the playbooks' resource group

Correct answer: C. Set playbook permissions for that resource group
Sentinel needs explicit permissions, granted from its playbook permissions setting, which assigns the Automation Contributor role on the resource group that holds the playbooks. Giving the analyst Sentinel Contributor does not give the Sentinel service itself rights to run those playbooks.