SC-200 Practice Questions & Answers

Loading your practice set…

You are deploying Microsoft Sentinel. What is the fundamental Azure underlying architecture component required to host a Microsoft Sentinel instance?

An Azure Log Analytics workspace (Correct)
An Azure SQL Managed Instance
An on-premises Active Directory Domain Services forest
An Azure Data Lake Storage Gen2 account

Explanation: Microsoft Sentinel is a cloud-native SIEM/SOAR platform built on top of an Azure Log Analytics workspace, which provides the underlying data store, indexing, and KQL query engine.

You are deploying Microsoft Sentinel. What is the fundamental Azure underlying architecture component required to host a Microsoft Sentinel instance?

An Azure Log Analytics workspace (Correct)
An Azure SQL Managed Instance
An on-premises Active Directory Domain Services forest
An Azure Data Lake Storage Gen2 account

Explanation: Microsoft Sentinel is a cloud-native SIEM/SOAR platform built on top of an Azure Log Analytics workspace, which provides the underlying data store, indexing, and KQL query engine.

You need to assign the least privileged built-in Azure RBAC role to a Tier-1 SOC analyst who must manage incidents, assign ownership, and change severity in Microsoft Sentinel, but must not create analytics rules or deploy automation playbooks. Which role should you assign?

Microsoft Sentinel Responder (Correct)
Microsoft Sentinel Contributor
Microsoft Sentinel Reader
Global Administrator

Explanation: The Microsoft Sentinel Responder role allows managing incidents (viewing, assigning, altering status and severity) without granting permissions to author analytics rules, data connectors, or playbooks.

You need to assign the least privileged built-in Azure RBAC role to a Tier-1 SOC analyst who must manage incidents, assign ownership, and change severity in Microsoft Sentinel, but must not create analytics rules or deploy automation playbooks. Which role should you assign?

Microsoft Sentinel Responder (Correct)
Microsoft Sentinel Contributor
Microsoft Sentinel Reader
Global Administrator

An engineer needs to onboard on-premises Windows and Linux physical servers into Microsoft Sentinel to collect Syslog and Security Events. What agent architecture is currently recommended and standard for Microsoft Sentinel ingestion?

Azure Monitor Agent (AMA) with Data Collection Rules (Correct)
Legacy Log Analytics Agent (MMA)
System Center Operations Manager (SCOM) agent
Direct SNMP polling without agents

Explanation: The Azure Monitor Agent (AMA), configured with Data Collection Rules (DCRs), is the current unified agent for streaming Windows event logs, Syslog, and telemetry to Log Analytics and Sentinel.

An engineer needs to onboard on-premises Windows and Linux physical servers into Microsoft Sentinel to collect Syslog and Security Events. What agent architecture is currently recommended and standard for Microsoft Sentinel ingestion?

Azure Monitor Agent (AMA) with Data Collection Rules (Correct)
Legacy Log Analytics Agent (MMA)
System Center Operations Manager (SCOM) agent
Direct SNMP polling without agents

You are configuring data retention for compliance. You need logs in a Sentinel Log Analytics workspace to be searchable via high-speed interactive KQL for 90 days, and retained in low-cost long-term storage for 7 years. How should this be configured?

Interactive Retention for 90 days and Total Retention for 2555 days (Archive tier) (Correct)
Interactive Retention for 2555 days with no Archive tier
Basic logs tier with automatic 30-day deletion
Continuous daily export to local tape drives

Explanation: Configure Interactive Retention (Analytics table tier) for 90 days, and set Total Retention (Archive tier) to 2555 days (7 years). Archived data remains stored cheaply and can be searched using search jobs or restore jobs.

You need to connect an on-premises network firewall that exports Common Event Format (CEF) logs over Syslog to Microsoft Sentinel. What component acts as the intermediate forwarder?

A dedicated Linux Log Forwarder running AMA and a Syslog daemon (Correct)
An on-premises Windows DNS server
An Azure Application Gateway
A direct USB cable connection to an Azure host

Explanation: A dedicated Linux Log Forwarder virtual machine running the Azure Monitor Agent (AMA) and a Syslog daemon (rsyslog or syslog-ng) receives CEF over UDP/TCP 514 and securely streams it to Sentinel.

You need to connect an on-premises network firewall that exports Common Event Format (CEF) logs over Syslog to Microsoft Sentinel. What component acts as the intermediate forwarder?

A dedicated Linux Log Forwarder running AMA and a Syslog daemon (Correct)
An on-premises Windows DNS server
An Azure Application Gateway
A direct USB cable connection to an Azure host

In the Microsoft Defender portal, what permission model allows security teams to manage granular access across endpoints, identities, and cloud apps based on unified role definitions and scopes?

Microsoft Defender XDR Unified Role-Based Access Control (RBAC) (Correct)
Azure classic subscription administrator permissions
Active Directory Schema Admin permissions
SharePoint site collection administrator roles

Explanation: Microsoft Defender XDR Unified Role-Based Access Control (RBAC) centralizes permission management across Defender for Endpoint, Office 365, Identity, and Cloud Apps under a single role assignment engine.

In the Microsoft Defender portal, what permission model allows security teams to manage granular access across endpoints, identities, and cloud apps based on unified role definitions and scopes?

Microsoft Defender XDR Unified Role-Based Access Control (RBAC) (Correct)
Azure classic subscription administrator permissions
Active Directory Schema Admin permissions
SharePoint site collection administrator roles

You are configuring the Microsoft Defender XDR connector in Microsoft Sentinel. What feature should you enable in the connector configuration to avoid duplicate alerts and work tickets in your SOC workflow?

Bidirectional Incident Synchronization / Incident Creation Rules (Correct)
Disabling all Sentinel analytics rules tenant-wide
Deleting the Log Analytics workspace weekly
Enabling continuous manual CSV export

Explanation: Enabling Microsoft Sentinel Incident Creation Rules or Incident Synchronization ensures that Defender XDR incidents and alerts sync bidirectionally without creating duplicate independent incidents.

You are configuring the Microsoft Defender XDR connector in Microsoft Sentinel. What feature should you enable in the connector configuration to avoid duplicate alerts and work tickets in your SOC workflow?

Bidirectional Incident Synchronization / Incident Creation Rules (Correct)
Disabling all Sentinel analytics rules tenant-wide
Deleting the Log Analytics workspace weekly
Enabling continuous manual CSV export

You are configuring Microsoft Defender for Endpoint device groups. Which criteria can be used to automatically place Windows 11 client devices into specific machine groups for scoping remediation permissions?

Device name prefix, OS platform, domain, or machine tags (Correct)
Workstation monitor screen resolution
Manufacturer serial numbers of laptop batteries
The personal home address of the primary user

Explanation: Defender for Endpoint device groups can dynamically group machines based on device name prefix, OS platform, domain, or manual/automated Registry machine tags.

An administrator is deploying Microsoft Sentinel Content Hub solutions. What packaged components are typically included within a packaged Content Hub solution for an enterprise firewall?

Data Connectors, Analytic Rules, Hunting Queries, Workbooks, and Playbooks (Correct)
Windows operating system ISO installation images
Physical server rack wiring schematics
Marketing presentation slide decks

Explanation: A Content Hub solution packages ready-to-deploy Data Connectors, Analytic Rules, Hunting Queries, Workbooks, and Playbooks (Logic Apps) tailored for that vendor.

An administrator is deploying Microsoft Sentinel Content Hub solutions. What packaged components are typically included within a packaged Content Hub solution for an enterprise firewall?

Data Connectors, Analytic Rules, Hunting Queries, Workbooks, and Playbooks (Correct)
Windows operating system ISO installation images
Physical server rack wiring schematics
Marketing presentation slide decks

Explanation: A Content Hub solution packages ready-to-deploy Data Connectors, Analytic Rules, Hunting Queries, Workbooks, and Playbooks (Logic Apps) tailored for that vendor.

You want to ingest AWS CloudTrail management event logs into Microsoft Sentinel. What authentication mechanism is recommended to connect Microsoft Sentinel to the Amazon Web Services environment?

OpenID Connect (OIDC) or AWS AssumeRole with an External ID (Correct)
Storing AWS root administrator passwords in cleartext in Sentinel
Connecting via an unencrypted FTP port 21 session
Manual daily download of AWS CSV files

Explanation: The Microsoft Sentinel AWS S3 or CloudTrail data connector utilizes OpenID Connect (OIDC) or AWS AssumeRole with an external ID to authenticate cross-cloud without storing static IAM secrets.

You want to ingest AWS CloudTrail management event logs into Microsoft Sentinel. What authentication mechanism is recommended to connect Microsoft Sentinel to the Amazon Web Services environment?

OpenID Connect (OIDC) or AWS AssumeRole with an External ID (Correct)
Storing AWS root administrator passwords in cleartext in Sentinel
Connecting via an unencrypted FTP port 21 session
Manual daily download of AWS CSV files

What is the purpose of configuring a Data Collection Rule (DCR) when setting up the Azure Monitor Agent for Windows Security Events?

Defines specific event streams/XPath filters and destination workspaces (Correct)
Overclocks the client computer processor during log bursts
Formats the local hard drive if an unauthorized login occurs
Translates log messages into Latin

Explanation: Data Collection Rules (DCRs) define which specific Windows Event IDs (or filtered XPath queries) to collect and specify which Log Analytics workspace and table to send them to.

What is the purpose of configuring a Data Collection Rule (DCR) when setting up the Azure Monitor Agent for Windows Security Events?

Defines specific event streams/XPath filters and destination workspaces (Correct)
Overclocks the client computer processor during log bursts
Formats the local hard drive if an unauthorized login occurs
Translates log messages into Latin

Explanation: Data Collection Rules (DCRs) define which specific Windows Event IDs (or filtered XPath queries) to collect and specify which Log Analytics workspace and table to send them to.

You need to deploy Microsoft Defender for Identity across 10 on-premises Domain Controllers. Which component must be installed directly on each Domain Controller OS?

The Microsoft Defender for Identity sensor (Correct)
The Apache HTTP server daemon
The Azure Bastion gateway agent
The Microsoft Intune Management Extension

Explanation: The Microsoft Defender for Identity sensor is installed directly onto domain controllers to capture network traffic, parse Kerberos/NTLM authentication requests, and read local event logs.

You need to deploy Microsoft Defender for Identity across 10 on-premises Domain Controllers. Which component must be installed directly on each Domain Controller OS?

The Microsoft Defender for Identity sensor (Correct)
The Apache HTTP server daemon
The Azure Bastion gateway agent
The Microsoft Intune Management Extension

In Microsoft Defender for Identity, what account type must be configured in directory services to query and resolve entities and track active domain membership?

A Group Managed Service Account (gMSA) (Correct)
A Domain Administrator account with a simple password
An anonymous guest user account
A local computer guest account

Explanation: A Directory Service Account (DSA) using a standard Group Managed Service Account (gMSA) is recommended to query Active Directory domain objects securely.

In Microsoft Defender for Identity, what account type must be configured in directory services to query and resolve entities and track active domain membership?

A Group Managed Service Account (gMSA) (Correct)
A Domain Administrator account with a simple password
An anonymous guest user account
A local computer guest account

Explanation: A Directory Service Account (DSA) using a standard Group Managed Service Account (gMSA) is recommended to query Active Directory domain objects securely.

You need to onboard non-Azure virtual machines running in AWS into Microsoft Defender for Cloud and Sentinel with unified management. Which technology bridges these hybrid/multi-cloud servers?

Azure Arc (Correct)
Azure ExpressRoute direct fiber
Point-to-Site SSTP VPN
DirectAccess server farms

Explanation: Azure Arc projects hybrid and multi-cloud servers into Azure Resource Manager, allowing centralized extension management, AMA deployment, and Defender enrollment.

You want to deploy Microsoft Defender for Endpoint to 1,500 macOS devices using an enterprise deployment tool (such as Jamf Pro). What configuration files are required for the installation payload?

The onboarding package script and a mobileconfig configuration profile (Correct)
A compiled Windows .exe installer package
A manual registry patch file (.reg)
A single cleartext password file

Explanation: Deployment requires the onboarding package script (.sh or mobileconfig) and a mobileconfig configuration profile that grants Full Disk Access and System Extensions permissions.

You want to deploy Microsoft Defender for Endpoint to 1,500 macOS devices using an enterprise deployment tool (such as Jamf Pro). What configuration files are required for the installation payload?

The onboarding package script and a mobileconfig configuration profile (Correct)
A compiled Windows .exe installer package
A manual registry patch file (.reg)
A single cleartext password file

Explanation: Deployment requires the onboarding package script (.sh or mobileconfig) and a mobileconfig configuration profile that grants Full Disk Access and System Extensions permissions.

What is the function of Microsoft Sentinel Automation Rules compared to Logic Apps Playbooks?

Automation rules handle basic triage/routing; Playbooks run complex Logic Apps (Correct)
Automation rules only work on Linux; Playbooks only work on Windows
Playbooks cannot interact with external services
There is no functional difference between the two tools

Explanation: Automation rules execute directly inside Sentinel to triage, tag, suppress, assign, or route incidents automatically, and can trigger a Playbook (Azure Logic App) for complex external tasks.

What is the function of Microsoft Sentinel Automation Rules compared to Logic Apps Playbooks?

Automation rules handle basic triage/routing; Playbooks run complex Logic Apps (Correct)
Automation rules only work on Linux; Playbooks only work on Windows
Playbooks cannot interact with external services
There is no functional difference between the two tools

Which built-in role in Microsoft Sentinel allows a security automation engineer to create and edit Azure Logic Apps playbooks triggered by Sentinel incidents?

Logic App Contributor combined with Microsoft Sentinel Contributor (Correct)
Microsoft Sentinel Reader
Billing Administrator
Security Reader

Explanation: The Microsoft Sentinel Playbook Operator role allows running playbooks, but editing and creating playbooks requires the Logic App Contributor role combined with Sentinel Contributor.

In Microsoft Sentinel, what is a Watchlist used for in security operations?

An imported dataset (CSV) used for correlation in KQL analytics queries (Correct)
A live video stream of the security operations floor
A list of corporate employee payroll salaries
A physical security badge scanner database

Explanation: A Watchlist is an imported dataset (such as a CSV of VIP users, terminated staff, or high-value subnets) that can be joined against incoming event streams in KQL analytics rules.

In Microsoft Sentinel, what is a Watchlist used for in security operations?

An imported dataset (CSV) used for correlation in KQL analytics queries (Correct)
A live video stream of the security operations floor
A list of corporate employee payroll salaries
A physical security badge scanner database

Explanation: A Watchlist is an imported dataset (such as a CSV of VIP users, terminated staff, or high-value subnets) that can be joined against incoming event streams in KQL analytics rules.

You need to onboard mobile devices (iOS and Android) into Microsoft Defender for Endpoint. Which service provides enterprise management and deployment for mobile Defender apps?

Microsoft Intune (Correct)
Active Directory Users and Computers
Exchange Management Console
Windows Server Update Services (WSUS)

Explanation: Microsoft Intune is the mobile device management (MDM) solution used to distribute, configure, and enforce the Defender for Endpoint mobile application.

You need to onboard mobile devices (iOS and Android) into Microsoft Defender for Endpoint. Which service provides enterprise management and deployment for mobile Defender apps?

Microsoft Intune (Correct)
Active Directory Users and Computers
Exchange Management Console
Windows Server Update Services (WSUS)

Explanation: Microsoft Intune is the mobile device management (MDM) solution used to distribute, configure, and enforce the Defender for Endpoint mobile application.

You are configuring Microsoft Defender for Cloud Apps. What is the difference between Cloud Discovery and Connected Apps (API Connectors)?

Cloud Discovery parses proxy logs; Connected Apps use direct provider APIs (Correct)
Cloud Discovery requires on-premises tape drives
Connected Apps can only inspect email messages
Both features perform identical endpoint antivirus scans

Explanation: Cloud Discovery analyzes web proxy and firewall logs to discover Shadow IT usage; Connected Apps use provider APIs (e.g., Salesforce, Box) to scan files at rest and enforce tenant policies.

You are configuring Microsoft Defender for Cloud Apps. What is the difference between Cloud Discovery and Connected Apps (API Connectors)?

Cloud Discovery parses proxy logs; Connected Apps use direct provider APIs (Correct)
Cloud Discovery requires on-premises tape drives
Connected Apps can only inspect email messages
Both features perform identical endpoint antivirus scans

You want to deploy Microsoft Sentinel in a multi-tenant Managed Security Service Provider (MSSP) model to view and manage incidents across customer workspaces. What Azure service enables this cross-tenant projection?

Azure Lighthouse (Correct)
Azure ExpressRoute private peering
Azure Site Recovery
Azure Traffic Manager

Explanation: Azure Lighthouse enables multi-tenant management, cross-tenant KQL queries, and consolidated incident review across independent customer Sentinel workspaces.

You want to deploy Microsoft Sentinel in a multi-tenant Managed Security Service Provider (MSSP) model to view and manage incidents across customer workspaces. What Azure service enables this cross-tenant projection?

Azure Lighthouse (Correct)
Azure ExpressRoute private peering
Azure Site Recovery
Azure Traffic Manager

Explanation: Azure Lighthouse enables multi-tenant management, cross-tenant KQL queries, and consolidated incident review across independent customer Sentinel workspaces.

Which component in Microsoft Defender for Endpoint is responsible for blocking malware execution by evaluating behavioral telemetry in the cloud in real time?

Cloud-delivered protection (cloud protection service) (Correct)
Local BIOS hardware firmware
The network router DHCP server
Windows Disk Defragmenter

Explanation: Cloud-delivered protection (cloud protection service) works with local antivirus to inspect metadata, unpack suspicious payloads, and deliver instant zero-day blocking verdicts.

Which component in Microsoft Defender for Endpoint is responsible for blocking malware execution by evaluating behavioral telemetry in the cloud in real time?

Cloud-delivered protection (cloud protection service) (Correct)
Local BIOS hardware firmware
The network router DHCP server
Windows Disk Defragmenter

Explanation: Cloud-delivered protection (cloud protection service) works with local antivirus to inspect metadata, unpack suspicious payloads, and deliver instant zero-day blocking verdicts.

You need to ensure that an alert generated in Defender for Endpoint automatically isolates a machine when ransomware behavior is detected. What setting governs this autonomous action?

Automated Investigation and Response (AIR) in Full Automation mode (Correct)
Semi-automated mode requiring manual email confirmation
Audit mode logging alerts without action
Disabled automation level

Explanation: Automated Investigation and Response (AIR) configured with the "Full - remediate threats automatically" automation level executes remediation and containment without waiting for human approval.

You are auditing Log Analytics ingestion costs in Microsoft Sentinel. Which built-in KQL table records billing and volume statistics for each data type ingested into the workspace?

The Usage table (Correct)
The Heartbeat table
The SecurityAlert table
The Event table

Explanation: The Usage table tracks daily billable data ingestion (in bytes and quantities) aggregated by DataType and solution.

You are auditing Log Analytics ingestion costs in Microsoft Sentinel. Which built-in KQL table records billing and volume statistics for each data type ingested into the workspace?

The Usage table (Correct)
The Heartbeat table
The SecurityAlert table
The Event table

Explanation: The Usage table tracks daily billable data ingestion (in bytes and quantities) aggregated by DataType and solution.

What is the purpose of configuring "Auxiliary logs" or "Basic logs" in an Azure Log Analytics workspace hosting Microsoft Sentinel?

Provides low-cost ingestion tiers for high-volume, low-value debugging logs (Correct)
Deletes all incoming logs immediately to eliminate costs
Overclocks Log Analytics workspace processors
Encrypts user files with BitLocker

Explanation: Basic Logs and Auxiliary Logs offer low-cost ingestion tiers for high-volume, low-value debugging or network logs (e.g., NetFlow, VPC flow), with lower query performance and reduced costs.

You need to configure threat intelligence ingestion into Microsoft Sentinel using STIX/TAXII standards. Which data connector should you configure?

Threat Intelligence - TAXII data connector (Correct)
DNS connector
Syslog over UDP connector
Windows Security Events via AMA

Explanation: The Threat Intelligence - TAXII data connector connects to TAXII 2.0 and 2.1 servers to import STIX format threat intelligence indicators into the ThreatIntelligenceIndicator table.

You need to configure threat intelligence ingestion into Microsoft Sentinel using STIX/TAXII standards. Which data connector should you configure?

Threat Intelligence - TAXII data connector (Correct)
DNS connector
Syslog over UDP connector
Windows Security Events via AMA

Explanation: The Threat Intelligence - TAXII data connector connects to TAXII 2.0 and 2.1 servers to import STIX format threat intelligence indicators into the ThreatIntelligenceIndicator table.

In Microsoft Defender for Endpoint, how can an administrator exclude a legacy internal line-of-business process from antivirus scanning to prevent false positive performance issues?

Configure path, folder, process, or extension exclusions in Defender settings (Correct)
Uninstall Defender for Endpoint from the server
Disable network adapters on the server
Change the server hostname

Explanation: Under Settings > Endpoints > Exclusions, configure path, folder, process, or extension exclusions for Microsoft Defender Antivirus.

In Microsoft Defender for Endpoint, how can an administrator exclude a legacy internal line-of-business process from antivirus scanning to prevent false positive performance issues?

Configure path, folder, process, or extension exclusions in Defender settings (Correct)
Uninstall Defender for Endpoint from the server
Disable network adapters on the server
Change the server hostname

Explanation: Under Settings > Endpoints > Exclusions, configure path, folder, process, or extension exclusions for Microsoft Defender Antivirus.

You want to enforce Attack Surface Reduction (ASR) rules across 2,000 corporate laptops. What management tool provides native configuration profiles to distribute ASR rules?

Microsoft Intune Endpoint Security (Attack surface reduction policies) (Correct)
Windows Control Panel Programs and Features
Microsoft 365 Admin Center Billing blades
Exchange Admin Center mail flow rules

Explanation: Microsoft Intune Endpoint Security policies (under Attack surface reduction) deploy and manage ASR rule GUIDs across enrolled Windows machines.

You want to enforce Attack Surface Reduction (ASR) rules across 2,000 corporate laptops. What management tool provides native configuration profiles to distribute ASR rules?

Microsoft Intune Endpoint Security (Attack surface reduction policies) (Correct)
Windows Control Panel Programs and Features
Microsoft 365 Admin Center Billing blades
Exchange Admin Center mail flow rules

Explanation: Microsoft Intune Endpoint Security policies (under Attack surface reduction) deploy and manage ASR rule GUIDs across enrolled Windows machines.