SC-200 practice questions

Question 1

All Microsoft Defender for Endpoint device groups are set to Full - remediate threats automatically. An automated investigation in Microsoft Defender for Office 365 determines that a delivered message contains a malicious URL, yet the recommended soft-delete action shows as Pending approval in the Action center. What best explains this?

Accepted Answer

Malicious email-content remediations are recommended actions that always await SecOps approval; device-group automation levels govern endpoint remediation, not email. In the AIR verdict model, a Malicious verdict on email content (URLs or attachments) produces recommended remediation actions that are pending approval, regardless of device automation. The Full - remediate threats automatically setting applies to device (endpoint) remediation, so email actions still require a SecOps member to approve them.

Question 2

Your tenant has Microsoft Defender for Office 365 but no custom Safe Attachments or Safe Links policies, and you have not enabled the Standard or Strict preset security policies. Which statement about the protection your recipients receive is correct?

Accepted Answer

The Built-in protection preset security policy already provides Safe Links and Safe Attachments protection to all recipients by default. Built-in protection is assigned to all recipients by default and effectively provides default Safe Links and Safe Attachments policies (you can configure exceptions). The Standard and Strict presets are assigned to no one until you enable them and add users.

Question 3

An authorized vulnerability scanner triggers dozens of Microsoft Defender for Endpoint alerts every night. The SOC manager wants these alerts to stop appearing in the alert queue and stop creating incidents, but the threat hunting team requires that the records remain queryable in the AlertInfo and AlertEvidence tables in advanced hunting. Which alert tuning action, configured under Settings, then Microsoft Defender XDR, then Alert tuning, meets all of the requirements?

Accepted Answer

Hide alert Hide alert is the only action that satisfies every requirement: per Microsoft Learn, it suppresses the alert and prevents incident creation, while hidden alerts remain in the AlertInfo and AlertEvidence tables so hunters can still query them. Hide alert is only applicable to Defender for Endpoint alerts, which matches this scenario's source. The rule conditions should be scoped tightly, for example the scanner process name AND its service account, rather than a broad wildcard.

Question 4

You configure a Microsoft Defender XDR custom detection rule against Defender XDR data with a frequency of "Every 3 hours." To avoid missing or double-counting events, what lookback period does the rule apply, and how should your query's time filter relate to it?

Accepted Answer

12-hour lookback; align your query's time filter with the lookback window. A rule that runs every 3 hours looks back 12 hours, not 3. The fixed mapping for custom detections on Defender XDR data: hourly checks the last 4 hours, every 3 hours checks 12 hours, every 12 hours checks 48 hours, and every 24 hours checks 30 days. Match your query's time filter to that lookback window so relevant results aren't ignored.

Question 5

You're reviewing the Secure score recommendations tab in Microsoft Defender for Cloud to decide which security control to prioritize. All listed controls are relevant to your environment. Which security control carries the highest maximum contribution to the classic secure score, and should therefore be prioritized first?

Accepted Answer

Enable MFA In the classic secure score model, each security control has a fixed maximum point value reflecting its relative significance. Enable MFA is weighted at 10 points, the highest of all controls, because Defender for Cloud places a high value on multifactor authentication for protecting subscription users.

Question 6

Executive and support staff need Microsoft's most aggressive email protection, with the admin releasing any blocked messages the users request. A custom anti-spam policy already targets some of these same users. The team assigns the Strict preset security policy to the executives. For those users, how are the anti-spam settings resolved, and how does Built-in protection relate?

Accepted Answer

The Strict preset security policy's settings are applied to those users before the custom anti-spam policy or the default policy; Built-in protection provides only Safe Links and Safe Attachments to recipients not covered by Standard/Strict or custom policies Preset security policies sit at the top of the threat-policy order of precedence: Strict is applied first, then Standard, then Defender for Office 365 evaluation policies, then custom threat policies by priority, and finally the Built-in protection preset (Safe Links/Safe Attachments) and the default policies. So for a user in the Strict preset, the Strict anti-spam settings are applied instead of the custom or default anti-spam policy; no merging occurs. Built-in protection is assigned to all recipients by default but only provides Safe Links and Safe Attachments, and it is the lowest-precedence preset, so it never overrides Strict. Strict is the right choice because it quarantines more aggressively and is designed for high-value targets whose admins review and release messages.

Question 7

After Microsoft Entra flags a risky sign-in for a user, a threat hunter wants to determine whether that user then performed unusual bulk file downloads from SharePoint Online and OneDrive, using data surfaced by Microsoft Defender for Cloud Apps in advanced hunting. Which table holds these cloud app file-activity events (for example, ActionType 'FileDownloaded') to correlate with the sign-in?

Accepted Answer

CloudAppEvents CloudAppEvents contains events involving accounts and objects in Office 365 and other cloud apps and services, populated by Microsoft Defender for Cloud Apps. It records SaaS activities such as FileDownloaded for SharePoint Online and OneDrive, with columns like ActionType, Application, AccountObjectId, and RawEventData that a hunter can pivot on and correlate with the risky sign-in by account. The table requires Defender for Cloud Apps to be deployed and the Microsoft 365 activities connector enabled.

Question 8

You want Microsoft Defender for Identity to disable a compromised on-premises Active Directory account and reset its password from the Microsoft Defender portal. All of your sensors are v2.x running on domain controllers. Which account performs these remediation actions, and how does it differ from the Directory Service Account (DSA)?

Accepted Answer

A dedicated action account (a gMSA you scope with the needed permissions) performs remediation, while the DSA is used only to read Active Directory data; by default the v2.x sensor uses the domain controller's LocalSystem account for actions. Remediation actions such as disabling a user or resetting a password are performed by the action account. By default the v2.x sensor impersonates the domain controller's LocalSystem account; if you want scoped permissions you configure a dedicated gMSA as the action account. This is separate from the DSA, which only reads AD data.

Question 9

During email remediation in Microsoft Defender, which action moves the messages to the user's Recoverable Items\Deletions folder, leaving them recoverable by the user?

Accepted Answer

Soft delete Soft delete moves messages to the Recoverable Items\Deletions folder, where they remain recoverable by the user (and admins). Hard delete purges the message (recoverable only by an admin via single-item recovery), and Move to Deleted Items only places it in the visible Deleted Items folder.

Question 10

In Microsoft Security Exposure Management, a database server matches two critical asset classification rules at the same time: a predefined rule that assigns High criticality and a custom rule that assigns Medium criticality. Months later, the server is rebuilt and no longer matches the High-criticality rule's criteria. How does Exposure Management handle the asset's criticality level across these events?

Accepted Answer

The rule with the highest criticality level takes precedence, so the asset is High; when it no longer meets that rule's criteria, it automatically reverts to the next applicable classification level (Medium). Microsoft Security Exposure Management categorizes assets into four criticality levels: Very High, High, Medium, and Low. When multiple classification rules apply to the same asset, the rule with the highest criticality level takes precedence. That classification remains in effect until the asset no longer meets the criteria for that rule, at which point it automatically reverts to the next applicable classification level. So the server is treated as High while it matches the predefined rule, then automatically drops to Medium after the rebuild. Getting criticality right matters operationally: criticality feeds prioritization surfaces such as device inventory sorting, security recommendations (exposed critical assets), and incident prioritization in the Defender portal.

Question 11

A vulnerability management lead opens Threat analytics in the Microsoft Defender portal (Threat intelligence, then Threat analytics). They want to prioritize patching against tracked threats the organization has not yet generated any alerts for, ranked by how severe the exploited vulnerabilities are and how many onboarded devices carry those weaknesses. Which dashboard section provides this ranking?

Accepted Answer

Highest exposure threats The threat analytics dashboard (https://security.microsoft.com/threatanalytics3) summarizes threats in three sections: Latest threats (most recently published or updated reports), High-impact threats (ranked by the number of active and resolved alerts in your organization), and Highest exposure threats. Per Microsoft Learn, the exposure level is calculated using two pieces of information: how severe the vulnerabilities associated with the threat are, and how many devices in your organization could be exploited by those vulnerabilities. Because exposure is driven by device posture rather than alerts, this section can surface threats the tenant has never seen an alert for, which is exactly what proactive patch prioritization needs.

Question 12

A SOC lead wants to add custom case status values such as 'Pending vendor response' and 'Detection tuning' to case management in the Microsoft Defender portal. The lead currently holds Microsoft Sentinel Responder, which already lets them create cases and link incidents. Using Microsoft Sentinel roles, what is the minimum role required to customize the case status options?

Accepted Answer

Microsoft Sentinel Contributor Customizing case status options requires the Microsoft Sentinel Contributor role, or Core Security settings (manage) under Authorization and settings in unified RBAC. That is the top tier of case management RBAC in the Defender portal: viewing the case queue, details, tasks, comments, and audits needs only Security data basics (read) or Microsoft Sentinel Reader, while creating and managing cases and case tasks, assigning, updating status, and linking or unlinking incidents needs Alerts (manage) or Microsoft Sentinel Responder. The trap is assuming Responder covers everything case-related; changing the status menu is a configuration change, one tier above day-to-day case work and typically a SOC lead or admin function.

Question 13

A SOC has onboarded Microsoft Sentinel to the Microsoft Defender portal. A detection engineer is writing a brand-new detection over DeviceEvents and EmailEvents data and wants native Defender XDR remediation actions with automatic entity mapping, while minimizing ingestion costs. Which detection mechanism does Microsoft currently recommend for this rule?

Accepted Answer

A custom detection rule in the Microsoft Defender portal Microsoft's feature-comparison guidance states that custom detections are now the best way to create new rules across Microsoft Sentinel and Microsoft Defender XDR. Custom detections reduce ingestion costs by running directly against already-available Defender data, provide real-time detections, and integrate directly with Defender XDR data, functions, and native remediation actions with automatic entity mapping. Since this detection targets Defender XDR tables (DeviceEvents, EmailEvents), a custom detection rule is exactly the recommended vehicle. Existing analytics rules keep running, and analytics rules still lead in a few areas (such as full MITRE technique coverage), but new detections on Defender data should be custom detections.

Question 14

A security operations manager still runs Microsoft Sentinel exclusively in the Azure portal and asks how long that experience remains supported before the team must operate from the Microsoft Defender portal. What should you tell them?

Accepted Answer

After March 31, 2027, Microsoft Sentinel will no longer be supported in the Azure portal and will be available only in the Microsoft Defender portal. Microsoft's published retirement timeline states that after March 31, 2027, Microsoft Sentinel will no longer be supported in the Azure portal and will be available only in the Microsoft Defender portal. Microsoft Sentinel is generally available in the Defender portal, including for customers without Defender XDR or an E5 license, and Microsoft recommends that Azure-portal customers start planning their transition now. Teams still operating from the Azure portal should treat this as a hard deadline for moving their SOC workflows.

Question 15

During an incident investigation, Microsoft Defender XDR automatically contained several user accounts and isolated two devices without analyst intervention. The incident carries the 'Attack Disruption' tag. Which feature triggered these containment actions?

Accepted Answer

Automatic attack disruption in Microsoft Defender XDR Automatic attack disruption in Microsoft Defender XDR correlates signals from endpoints, identities, email, and SaaS applications to identify active human-operated attacks (such as ransomware and business email compromise) with high confidence and automatically contains compromised assets. Disrupted incidents are tagged with 'Attack Disruption' and the specific threat type. Actions include containing devices and disabling user accounts.

Question 16

A threat hunting team uses case management in the Microsoft Defender portal to track a long-running phishing campaign that has generated roughly 250 related incidents. The team wants to link every incident to a single case so the whole campaign has one durable record. Which documented service limit forces a different design?

Accepted Answer

Each case supports a maximum of 100 linked incidents, so the campaign's 250 incidents must be split across multiple cases. The Microsoft Sentinel service limits page documents the case management limits: 100,000 cases per tenant, 500 GB of attachments per tenant, and 100 linked incidents per case. Linking 250 incidents to one case exceeds the per-case incident cap, so the team must split the campaign across multiple cases (for example, by wave or by month) and use the case descriptions, tasks, or naming conventions to tie them together. Cases themselves are durable: they do not expire or auto-delete, and case IDs (starting at 1000) are never recycled, which is why archival is handled with custom statuses and filters rather than deletion.

Question 17

While investigating in the incident graph, an analyst switches the associated-incidents view from This incident only to All associated incidents. What is the effect of this change?

Accepted Answer

It expands the graph to show related incidents and alerts for context only; it does not change grouping, correlation rules, merge logic, or the other incidents' separate ownership and lifecycle. The All associated incidents view helps analysts see additional related incidents and alerts in the investigation graph for added context. It does not change incident grouping, correlation rules, or merge logic, and the associated incidents keep their own owner, status, and lifecycle until an actual merge occurs.

Question 18

A SOC lead worries that Security Copilot incident summaries in the Microsoft Defender portal will drain SCU capacity when several analysts open the same high-severity incident during one shift. According to Microsoft's documentation, what actually happens?

Accepted Answer

Copilot saves generated incident summaries for a week; if the incident hasn't changed significantly, the cached summary is automatically redisplayed at no cost. Copilot saves generated incident summaries for a week. If the incident you open already has a summary in the cache and the incident didn't change significantly, the summary is automatically redisplayed at no cost, regardless of the generation setting. This caching behavior is what makes auto-generation financially tolerable when multiple analysts work the same incident. For further SCU control, the Copilot incident summary settings (System, then Settings, then Copilot in Defender) let you choose auto-generate always, auto-generate by minimum incident severity (with estimated incident volume and SCU consumption shown), or generate on demand only.

Question 19

An analyst is investigating a potential insider threat. They need to determine which files a specific user downloaded from SharePoint Online over the past 30 days. Which Microsoft Purview capability should be used first?

Accepted Answer

Audit log search in Microsoft Purview to review the unified audit log for file download events The unified audit log in Microsoft Purview records user and admin operations across Microsoft 365 services, including file downloads from SharePoint Online. Filter it to the user and the 'Downloaded file' activity type over the relevant window and you have the list of what was pulled. The trap is reaching for Content Search first: it locates content, but it never shows who downloaded what or when.

Question 20

A device group is set to 'Semi - require approval for all folders'. While the SOC lead was on two weeks of leave, an automated investigation reached a Malicious verdict and generated a file quarantine action. On return, the lead finds the action no longer appears on the Action center Pending tab, no analyst approved or rejected it, and the malicious file is still present on the device. What happened?

Accepted Answer

The pending action timed out after seven days, and a timed-out action is treated the same as a rejected action, so the remediation never ran Per the automation levels documentation, with semi-automation levels pending remediation actions time out after seven days. When an action times out, the behavior is the same as if the action was rejected: the remediation is not performed, the threat artifact stays on the device, and no one is notified unless alerting on this is built separately. This is the operational risk of semi-automation levels for teams without continuous Action center coverage, and it is why the pending item disappeared without the file being quarantined.

Question 21

During an incident, a SOC analyst creates a 'Block and remediate' file indicator for the SHA-256 hash of a malicious utility found on several servers. The utility sits in D:\Tools\, a folder a server administrator added to the Microsoft Defender Antivirus folder exclusion list years ago. The servers are in the indicator's scope, Defender Antivirus is in active mode, and more than a day has passed, yet the utility still executes. According to Microsoft's documented policy conflict handling for file indicators, why?

Accepted Answer

In the file indicator conflict handling order, a file allowed by a Microsoft Defender Antivirus exclusion is evaluated before block or warn file indicators, so the exclusion wins and the file is allowed The 'Create indicators for files' documentation defines an explicit conflict handling order: after Windows Defender Application Control/AppLocker enforcement, the next check is 'if the file is allowed by the Microsoft Defender Antivirus exclusions, then Allow', which comes before 'if the file is blocked or warned by a block or warn file IoCs, then Block/Warn'. Microsoft's example table confirms this: antivirus exclusion Allow plus file indicator Block results in Allow. The pre-existing folder exclusion therefore neutralizes the block indicator, and the remediation is to remove or narrow the stale exclusion.

Question 22

A device group in Microsoft Defender for Endpoint has its remediation (automation) level set to Semi - require approval for non-temp folders. An automated investigation returns a Malicious verdict for an executable found in the signed-in user's Downloads folder. What happens to the remediation?

Accepted Answer

The remediation runs automatically, because the Downloads folder is treated as a temporary folder. At the Semi - require approval for non-temp folders level, remediation is applied automatically to malicious files/executables located in temporary folders, and Microsoft's temporary-folder list explicitly includes \users\*\downloads\*. Only files outside temporary folders wait for approval on the Pending tab.

Question 23

During an incident, a SOC analyst with the correct RBAC permissions successfully starts live response sessions on compromised Windows 11 laptops but cannot start a session on a compromised Windows Server 2022 machine, even though the server is onboarded and its sensor is healthy. 'Enable live response' is turned on in Advanced features. What is the most likely cause?

Accepted Answer

'Enable live response for servers' is a separate toggle in Advanced features that has not been turned on Live response has two separate enablement toggles under Settings, then Endpoints, then General, then Advanced features: 'Enable live response' and 'Enable live response for servers.' The base toggle does not cover server operating systems - the server toggle must be enabled as well, and it is an easy one to miss because workstation sessions work fine without it. Only admins and users with 'Manage Portal Settings' permissions can enable these toggles. With both toggles on and appropriate RBAC, sessions work on Windows Server 2019, Windows Server 2022 and later, and Server 2012 R2/2016 with the unified agent.

Question 24

You're enabling Defender for Servers on Amazon EC2 instances through the native AWS connector. Beyond turning on the plan, what must be present on the EC2 instances for full protection?

Accepted Answer

Azure Arc for servers (the Arc agent) plus the AWS Systems Manager (SSM) Agent Defender for Servers on AWS requires the EC2 instances to be connected via Azure Arc. Arc autoprovisioning depends on the AWS SSM Agent (with the AmazonSSMManagedInstanceCore policy) being present; if the SSM Agent is missing, Arc autoprovisioning can't proceed.

Question 25

You create a Defender for Endpoint web content filtering policy that blocks only the "Gambling" category. A user reports they can still reach a news site that was never in any blocked category. What is the expected behavior for categories you did not block, and how can you still allow one specific site that falls inside a blocked category?

Accepted Answer

Unblocked categories are automatically audited (access allowed and logged); to allow one site inside a blocked category, create a custom Allow indicator, which supersedes the web content filtering policy. For any category that is not blocked, URLs are automatically audited: users can access them and access statistics are collected. To permit a single site within a blocked category, a custom Allow indicator (URL/domain) takes precedence over the web content filtering policy.

Question 26

A desktop technician links a Group Policy Object that turns off Microsoft Defender Antivirus real-time protection on a lab device onboarded to Microsoft Defender for Endpoint. The GPO applies successfully with no errors, but real-time protection remains enabled after multiple policy refreshes. What is the most likely reason?

Accepted Answer

Tamper protection is enabled, so Group Policy changes to tamper-protected settings such as real-time protection are ignored Real-time protection is one of the tamper-protected settings (along with behavior monitoring, cloud protection, security intelligence updates, IOAV protection, and automatic remediation actions). Microsoft Learn is explicit: when tamper protection is on and you use Group Policy to change Microsoft Defender Antivirus settings, changes to tamper-protected settings are ignored - the change appears to apply but is silently blocked, with no error. If a legitimate change is needed, the documented approach is troubleshooting mode, which temporarily suspends tamper protection on the device; when it ends, tamper-protected settings revert to their configured state. Tamper protection itself cannot be turned off via Group Policy.

Question 27

During a live response session on a compromised Windows device, an analyst who holds the advanced live response commands permission uploads a custom, unsigned PowerShell remediation script to the library and runs it with the run command. The script's syntax is valid, but it fails to execute. What must be enabled?

Accepted Answer

The live response unsigned script execution setting on the Advanced features page Live response can run PowerShell and Bash scripts from the tenant library, but if a PowerShell script is unsigned you must first enable the unsigned script execution setting on the Advanced features page. Without it, an unsigned library script will not run even for an analyst who holds the advanced live response command permission and has already uploaded the file. Microsoft warns that allowing unsigned scripts increases exposure to threats, so it is an opt-in setting.

Question 28

A company onboards its Windows Server 2022 fleet, which runs a non-Microsoft antivirus product that must remain primary, to Microsoft Defender for Endpoint. Soon after onboarding, server admins report severe performance degradation, and both antivirus engines are actively scanning. The Windows 11 workstations onboarded the same week with the same third-party AV show no conflict. What did the deployment team miss on the servers?

Accepted Answer

They should have set the ForceDefenderPassiveMode registry value (REG_DWORD = 1) under HKLM\SOFTWARE\Policies\Microsoft\Windows Advanced Threat Protection before onboarding, because Windows Server does not enter passive mode automatically On Windows 10 and 11, Microsoft Defender Antivirus automatically enters passive mode when a non-Microsoft antivirus registers with Windows Security Center - which is why the workstations were fine. On Windows Server (2012 R2 and later, including Server 2022), that automatic switch does not happen: you must set ForceDefenderPassiveMode (REG_DWORD, value 1) under HKLM\SOFTWARE\Policies\Microsoft\Windows Advanced Threat Protection, and Learn specifically says to set it before onboarding the device. Without it, both products attempt active protection simultaneously, causing exactly this performance conflict. A further trap: beginning with platform 4.18.2208.0, on an onboarded server with tamper protection enabled, tamper protection allows a switch to active mode but blocks the switch back to passive - so setting the key after the fact may not take effect.

Question 29

An administrator creates a web content filtering policy in the Microsoft Defender portal that blocks the 'Gambling' category and scopes it to a device group. What is the behavior for websites in categories the policy does not block?

Accepted Answer

Access is audited: users reach the sites without disruption, and access statistics are collected and shown in the web protection reports Web content filtering follows a block-or-audit model: for any category that is not blocked in a policy, the URLs are automatically audited. Users can access those sites without disruption while access statistics accumulate, and the data appears under Reports, then Web protection in the Defender portal. Microsoft even documents deploying a policy with no categories selected as a deliberate audit-only pattern to understand user behavior before making blocking decisions. Note also that policy changes can take up to two hours to enforce.

Question 30

A security administrator enables the ASR rule 'Block credential stealing from the Windows local security authority subsystem' in Block mode through an Intune endpoint security policy. A legacy single sign-on agent used by the finance team is repeatedly blocked when it reads LSASS memory. The administrator adds the agent's folder to the Microsoft Defender Antivirus exclusion list with Set-MpPreference -ExclusionPath, but the blocks continue. What should the administrator do to exclude only this application without weakening other ASR rules?

Accepted Answer

Add a per-ASR-rule exclusion for the agent's full path to this specific rule in the Intune endpoint security ASR policy, because this rule does not honor Microsoft Defender Antivirus file and folder exclusions The exclusion support matrix in the ASR rules overview shows that 'Block credential stealing from the Windows local security authority subsystem' does not honor Microsoft Defender Antivirus file/folder exclusions; it honors only global ASR exclusions and per-ASR-rule exclusions. A per-rule exclusion is the narrowest option because it applies to this rule alone, while a global ASR exclusion would weaken every rule. Per-ASR-rule exclusions are supported only in Group Policy and Intune endpoint security policies, so adding the agent's path to this rule in the existing Intune policy is the correct fix.

Question 31

A SOC analyst needs to collect a forensic package from a compromised Windows device in Microsoft Defender for Endpoint without disrupting the user's session. Which response action accomplishes this?

Accepted Answer

Select 'Collect investigation package' from the device response actions The 'Collect investigation package' action gathers forensic artifacts from the device, including logs, running processes, network connections, and other investigation data, and makes them available for download. This action does not disconnect the user's session or block network access, so it is the least disruptive option for forensic collection.

Question 32

A vulnerability analyst needs Microsoft Defender for Endpoint to discover and run vulnerability assessments against the organization's Cisco switches and Palo Alto firewalls. These network appliances cannot run the Defender sensor. What is the correct approach?

Accepted Answer

Configure an authenticated network scan that designates an onboarded Windows device as a scanner and queries the appliances over SNMP Network infrastructure devices such as switches, routers, firewalls, WLAN controllers, and VPN gateways cannot run the sensor, so Defender for Endpoint uses authenticated network scans. You designate one or more onboarded Windows devices as scanners, and they periodically query the target appliances using SNMP read-only (SNMPv2 or SNMPv3). Once discovered and classified, the network devices flow into Defender Vulnerability Management so you receive security recommendations and vulnerability findings for them. You configure this under Settings, then Device discovery, then Authenticated scans, and it requires the Manage security settings in Defender permission.

Question 33

After an onboarding wave, an administrator filters the Defender portal device inventory by sensor health and finds a Windows device marked 'Misconfigured' with the sub-state 'No sensor data' rather than 'Impaired communications.' What does this distinction tell the administrator, and what should be checked beyond basic connectivity?

Accepted Answer

The device is communicating with the service but reporting only partial sensor data; beyond proxy and service URL checks, verify the Windows diagnostic data service is running and, if a third-party AV is present, that the Defender Antivirus ELAM driver is enabled The 'Fix unhealthy sensors' article splits Misconfigured into two sub-states with different remediation paths. 'Impaired communications' means limited communication between the device and the service, and the checks are connectivity focused: WinHTTP proxy configuration and access to the Defender for Endpoint service URLs. 'No sensor data' means the device is talking to the service but reporting only partial sensor data, which points past connectivity. On top of the proxy and URL checks, confirm the Windows diagnostic data service is set to start automatically and is running, verify the Early Launch Antimalware (ELAM) driver is enabled when a third-party antimalware client is in use, and check that Defender Antivirus is not disabled by policy.

Question 34

A security engineer is rolling out attack surface reduction rules through an Intune endpoint security policy and plans to use Warn mode across the board, so users can temporarily bypass blocks with the Unblock option during the transition period. For which rule will this plan fail, because the rule does not support Warn mode?

Accepted Answer

Block credential stealing from the Windows local security authority subsystem (lsass.exe) Per the ASR rules overview on Microsoft Learn, two rules do not support Warn mode: 'Block credential stealing from the Windows local security authority subsystem' and 'Block Office applications from injecting code into other processes.' For every other rule, Warn (code 6) behaves like Block but presents a notification with an Unblock option that grants a 24-hour bypass, generating event ID 1129 when a user overrides. Warn mode requires Windows 10 version 1809 or later, antivirus platform 4.18.2008.9+ and engine 1.1.17400.5+, and is not available at all in Microsoft Configuration Manager. The LSASS rule is also one of the three standard protection rules recommended for Block mode from day one.

Question 35

While containing an incident, a SOC analyst opens the profile page of a confirmed malicious .exe file and wants to add a block indicator so the file cannot run anywhere in the organization. The capability to block the file is unavailable in the tenant. Which configuration must be in place for file block indicators to work?

Accepted Answer

The 'Allow or block file' advanced feature turned on, which requires Microsoft Defender Antivirus as the active antimalware solution with cloud-delivered protection enabled Blocking files through indicators is gated by the 'Allow or block file' toggle under Settings, then Endpoints, then General, then Advanced features. Microsoft Learn states blocking is only available if the organization uses Microsoft Defender Antivirus as the active antimalware solution and cloud-delivered protection is enabled (antimalware client 4.18.1901.x or later). Once on, the Add Indicator capability on a file's profile page can block the portable executable from being read, written, or executed on devices across the organization. A related trap: EDR in block mode does not respect Defender for Endpoint indicators, so allow indicators do not exempt files from EDR in block mode's remediation.

Question 36

An analyst uploads a PowerShell script to the live response library and tries to run it during a session, but the run fails because the script is unsigned. Live response is already enabled for the tenant. What must be done so the script can run?

Accepted Answer

Turn on "Live response unsigned script execution" on the Defender for Endpoint Advanced features settings page. Signature verification applies to PowerShell scripts in live response. To run unsigned PowerShell, you must enable "Live response unsigned script execution" on the Advanced features page. This is separate from enabling live response itself.

Question 37

Custom file-hash block indicators created in Microsoft Defender for Endpoint are not being enforced on execution. Microsoft Defender Antivirus is running in passive mode (a third-party AV is primary), cloud-delivered protection is enabled, and the Allow or block file advanced feature is on. Why aren't the files being blocked?

Accepted Answer

File-execution blocking requires Microsoft Defender Antivirus to be in active mode; passive mode and EDR in block mode cannot detect and block based on file execution. Blocking on file execution requires Microsoft Defender Antivirus in active mode. By design, passive mode and EDR in block mode can't detect and block based on file execution, so even with cloud-delivered protection and Allow or block file enabled, indicators are not enforced while Defender Antivirus is passive.

Question 38

A line-of-business app on your finance team's Windows 11 devices is being blocked by the attack surface reduction (ASR) rule "Block all Office applications from creating child processes." Until the vendor ships a fix, the security team wants users to be able to keep working when they acknowledge a prompt, while each trigger is still recorded for review. Which ASR rule mode meets this requirement?

Accepted Answer

Warn mode Warn mode enforces the rule but presents a bypassable prompt so the user can click through (each override is logged as event 1129), which keeps the app usable while still capturing every trigger. Warn is supported on Windows 10 1809+ and Windows 11.

Question 39

Your organization onboarded Microsoft Sentinel to the Defender portal and integrated Microsoft Defender XDR incidents, and you are also ingesting Defender for Cloud alerts. You now see duplicate incidents for the same Defender for Cloud alerts. Which set of actions eliminates the duplicates?

Accepted Answer

Configure the Tenant-based Defender for Cloud connector, disconnect the Subscription-based (Legacy) connector, and turn off any analytics/incident-creation rules that create incidents from Defender for Cloud alerts When Defender for Cloud incidents already flow in through the Defender XDR incident connector, you should use the Tenant-based Defender for Cloud connector to sync alerts, disconnect the Subscription-based (Legacy) connector, and disable any Sentinel analytics/incident-creation rules built on Defender for Cloud alerts. Together these steps prevent the same alert from generating duplicate incidents.

Question 40

You map MITRE ATT&CK tactics and techniques on a custom hunting query, then create bookmarks from that query's results. By default, what MITRE mapping do the new bookmarks have?

Accepted Answer

They inherit the same tactic and technique mappings as the hunting query that produced them, and you can still edit them. Bookmarks default to using the same entity and MITRE ATT&CK technique mappings as the hunting query that produced the bookmarked results. You can still add or change mappings manually on each bookmark.

Question 41

You need to ingest logs from a third-party SaaS security product that exposes only a REST API. Requirements: fully cloud-based with no VM or agent to install and maintain, built-in connector health monitoring, and the ability to package and deploy the connector as a Content hub solution. Which connector approach best fits?

Accepted Answer

Build the connector with the Codeless Connector Framework (CCF). The Codeless Connector Framework (CCF) lets you define a connector in a configuration file that pulls from REST APIs, with no service or agent to install or maintain. CCF connectors are fully SaaS, include health monitoring, are fully supported by Microsoft, and can be deployed to your workspace or published as a Content hub solution.

Question 42

A SOC analyst wants to quickly triage the single most unusual events for a user over the last day, using UEBA's near-real-time, event-level score that ranges from 0 (benign) to 10 (highly anomalous). Which table and field should the KQL query target?

Accepted Answer

BehaviorAnalytics, filtering on InvestigationPriority The InvestigationPriority field in the BehaviorAnalytics table is UEBA's near-real-time, event-level score (0-10) that quantifies how unusual a single event is, combining an entity anomaly score with a time-series score. It is designed for quick triage and drilling into single events.

Question 43

You create a Microsoft Sentinel summary rule to aggregate verbose logs on a schedule. Which statement about the destination table and scheduling is correct?

Accepted Answer

The destination is a custom table whose name ends in _CL and uses the Analytics plan; the aggregation window is set by binSize, with an optional binDelay for late-arriving data. Summary rule results are stored in a custom table (name ending in _CL) that uses the Analytics data plan, so results are fully queryable. binSize defines the aggregation interval, and the optional binDelay (default roughly 3.5 minutes up to 10% of binSize, configurable up to 1440 minutes) waits for late-arriving data before running the bin.

Question 44

In the Entities tab of an incident details page in Microsoft Sentinel (Azure portal), an analyst notices that some entity names appear as clickable links. What is the difference between selecting an entity's name (the link) versus selecting the row the entity is in (but not the name)?

Accepted Answer

Selecting the name opens the full entity page and leaves the incident; selecting the row opens a side panel (Info/Timeline/Insights) without leaving the incident If the entity name appears as a link, selecting it redirects you to the full Microsoft Sentinel entity page, outside the incident. Selecting the row (without clicking the name) displays the entity's details in a side panel with the Info, Timeline, and Insights cards, letting you stay in the incident context.

Question 45

A threat hunter enables User and Entity Behavior Analytics (UEBA) in Microsoft Sentinel and expects entity profiles for on-premises Active Directory users to appear in the IdentityInfo table for enrichment. Cloud (Microsoft Entra ID) users populate correctly, but on-premises-only AD accounts never show up. What is the most likely cause?

Accepted Answer

On-premises AD user synchronization to UEBA requires Microsoft Defender for Identity with an MDI sensor deployed on the domain controllers; without it, UEBA is cloud-only When you configure UEBA you choose which directory services to sync user entities from - Microsoft Entra ID and/or on-premises Active Directory. Syncing on-premises AD user entities into UEBA (the IdentityInfo table) requires Microsoft Defender for Identity, standalone or as part of Defender XDR, with the MDI sensor installed on your domain controllers. Without MDI, UEBA remains cloud-only and on-premises-only AD accounts won't populate IdentityInfo, regardless of other configuration.

Question 46

A detection engineer wants to alert on a specific sign-in pattern within one minute of events arriving in Microsoft Sentinel. Which analytics rule type should be used?

Accepted Answer

Near-real-time (NRT) analytics rule NRT analytics rules are designed to run once every minute and capture events ingested in the preceding minute, with only a two-minute delay to account for ingestion time. They provide the fastest possible detection response within Microsoft Sentinel, making them the right choice when near-instantaneous alerting is required.

Question 47

A security engineer needs to allow a SOC analyst to manage incidents in Microsoft Sentinel but must prevent that analyst from creating or editing analytics rules. Which built-in Microsoft Sentinel role should be assigned?

Accepted Answer

Microsoft Sentinel Responder Microsoft Sentinel Responder grants all Reader permissions plus the ability to manage incidents (triage, assign, close). It does not permit creating or editing analytics rules, workbooks, or other configuration resources. Microsoft Sentinel Contributor adds those configuration rights, which would exceed the required scope.

Question 48

An analyst wants to run one of Microsoft Sentinel's Jupyter notebooks (which use the MSTICPy library) to perform custom machine-learning analysis and visualizations on Sentinel data during an investigation. Within Microsoft Sentinel, what compute platform do these notebooks run on, and what access is required?

Accepted Answer

They run on Azure Machine Learning compute; the analyst needs access to both the Sentinel workspace and an Azure Machine Learning workspace In Microsoft Sentinel, notebooks run on the Azure Machine Learning platform. To run them you must have appropriate access to both the Microsoft Sentinel workspace and an Azure Machine Learning workspace. The notebooks rely on the MSTICPy Python library.

Question 49

While hunting in a Microsoft Sentinel Jupyter notebook running on Azure Machine Learning, the notebook hangs and you restart the kernel to recover. What must you do afterward for the notebook to work correctly?

Accepted Answer

Rerun the initialization and authentication cells, because restarting the kernel clears all variables and state Restarting the kernel deletes all in-memory variables and state. You must rerun the initialization and authentication cells (for example, the MSTICPy setup and sign-in) before continuing, otherwise later cells fail because their prerequisites are gone.

Question 50

During a UEBA investigation you want to know which other users Microsoft Sentinel considers behavioral "peers" of a suspected compromised user, so you can judge whether an action is unusual relative to that peer group. Sentinel ranks the top peers using a TF-IDF weighting in which smaller groups carry higher weight. Which UEBA table holds this dynamically calculated peer ranking?

Accepted Answer

UserPeerAnalytics UserPeerAnalytics contains dynamically calculated peer groups, ranking the top 20 peers based on security group membership, mailing lists, and other associations. It uses the TF-IDF algorithm to normalize weights, so smaller groups carry higher weight.

Question 51

An analyst wants an interactive dashboard visualizing sign-in trends in Microsoft Sentinel and starts from a workbook template that shipped with an installed Content hub solution. After selecting Save on the template, what has actually been created, and where does the data live?

Accepted Answer

An Azure resource (the workbook) saved in the workspace's resource group containing only the workbook's JSON definition - no data - that queries the underlying tables live each time it loads Microsoft Sentinel workbooks are built on Azure Monitor Workbooks. Saving a template creates an Azure resource based on that template in the location you choose; only the workbook's JSON definition is saved there - no data is copied. The workbook runs its queries against the underlying Log Analytics tables each time it is opened or refreshed, so it always reflects current data. You then select View saved workbook and Edit to customize it.

Question 52

You have imported threat indicators into Microsoft Sentinel and want them to automatically generate alerts and incidents when they match events flowing in from your connected data sources (for example, matching a malicious IP against firewall logs). Which type of analytics rule is designed to correlate your imported indicators with ingested events?

Accepted Answer

A "TI map..." analytics rule TI map analytics rules, which use the "TI map..." naming format, map your imported threat indicators against events from connected data sources to automatically generate alerts and incidents when a match occurs.

Question 53

An analyst needs to create a Microsoft Sentinel analytics rule that detects a specific event pattern within one minute of its occurrence and generates an alert for every matching event up to 30 events. Which rule type should the analyst use, and what happens when more than 30 matching events occur in a single run?

Accepted Answer

Use a Near-Real-Time (NRT) analytics rule; when more than 30 matching events occur, single-event alerts are generated for the first 29 events, and a 30th alert summarizes all remaining events. NRT (near-real-time) analytics rules are designed for up-to-the-minute detection and run their queries at one-minute intervals. When the event grouping option is set to generate an alert per event, NRT rules support up to 30 events. If more than 30 events match, single-event alerts are generated for the first 29 events, and a 30th summary alert covers all events in the result set. This is a specific NRT behavior not shared by scheduled rules.

Question 54

A playbook in Microsoft Sentinel is created to run automatically when an incident is created. A junior analyst holds only the Microsoft Sentinel Responder role. They want to manually run this playbook against an open incident. Which additional role must be granted?

Accepted Answer

Microsoft Sentinel Playbook Operator on the playbook resource group The Microsoft Sentinel Responder role can access and manage incidents, including running a playbook manually from within an incident. However, actually running the playbook manually requires the Microsoft Sentinel Playbook Operator role assigned to the resource group where the playbook resides. Responder provides incident access; Playbook Operator provides the run permission.

Question 55

An automation rule must automatically run a playbook (built on a Consumption logic app) when an incident is created. Beyond your own permissions, which role must the Microsoft Sentinel service account hold on the resource group that contains the playbook so that automation rules can execute it?

Accepted Answer

Microsoft Sentinel Automation Contributor Sentinel uses a dedicated service account to run incident-triggered (or manually run) playbooks. That account must be granted the Microsoft Sentinel Automation Contributor role on the playbook's resource group; once granted, automation rules can run any playbook in that resource group. Learn notes this role isn't used for any other purpose.

Question 56

A central SOC uses Microsoft Sentinel workspace manager (preview) to publish standardized content from a central workspace to its member workspaces. Which content type is NOT supported by workspace manager and must therefore be deployed through another method?

Accepted Answer

Playbooks Workspace manager supports publishing analytics rules, automation rules (excluding playbooks), parsers/saved searches/functions, hunting queries, and workbooks. Playbooks are explicitly not supported, including playbooks attached to analytics or automation rules, so they must be deployed by other means such as ARM/CI-CD. (Workspace manager also requires the Microsoft Sentinel Contributor role on both the central and member workspaces.)

Question 57

Your team relied on Microsoft Sentinel livestream to run a query continuously and push notifications when new matches appeared. Per current Microsoft guidance, livestream is being retired. Which alternatives does Microsoft now recommend for persistent query results and notifications to messaging platforms?

Accepted Answer

KQL jobs, analytics rules, or playbooks. Current Learn guidance states Sentinel livestreams are no longer available and directs you to use KQL jobs, analytics rules, or playbooks instead. These alternatives offer persistent query results and support notifications to various messaging platforms.

Question 58

A threat hunter writes an advanced hunting query that joins DeviceLogonEvents (left side) to DeviceProcessEvents (right side) on DeviceId without specifying a join kind. The left table contains dozens of failed logon rows for the same device, but the results include only one failed logon row per device. What explains this behavior?

Accepted Answer

When kind is omitted, KQL uses innerunique, which deduplicates the left table on the join key before matching, keeping a single arbitrary row per unique DeviceId innerunique is the default join flavor when the kind parameter is not specified. Learn documents that it removes duplicate keys from the left side before matching, leaving a single (arbitrary) row for each unique join-key value, then matches that deduplicated left side against the right table. The advanced hunting best practices page calls out this exact trap and recommends specifying kind=inner when you need every matching row combination, such as one row per failed logon.

Question 59

Your cross-table hunting query joins a small table of suspicious IPs (a few hundred rows) with a huge network-flow table (billions of rows). Following KQL best practices, how should you structure the join for best performance?

Accepted Answer

Put the small suspicious-IP table on the left (first) side of the join operator KQL best practice for join is to place the table with the fewest rows on the left (first) side, because the left side is loaded into memory to build the join. Putting the small suspicious-IP set on the left minimizes memory pressure. (For single-column filtering, in is also often preferable to a left semi-join.)

Question 60

A string column in your hunting results contains repeating key=value entries such as: Action=BlockedByPolicy; RuleId=4471; User=contoso\jdoe. In a single step you want to break this into three separate columns (Action, RuleId, User) using the repeating pattern. Which KQL operator is purpose-built for extracting multiple values from one string into new columns?

Accepted Answer

parse The parse operator evaluates a string expression and extracts multiple substrings into new calculated columns based on a pattern, effectively running multiple extract() applications on the same string in one statement. It's the standard tool for structuring key=value or printf-style strings.

Question 61

In DeviceProcessEvents you filter on FileName == "powershell.exe" to find suspicious PowerShell executions. You now need the PARENT process that spawned each PowerShell instance, to spot an Office-app-to-PowerShell chain. Which column holds the name of the process that launched the recorded process?

Accepted Answer

InitiatingProcessFileName In DeviceProcessEvents the recorded (created) process is described by the FileName and Process* columns, while the process that started it is the 'initiating process.' So InitiatingProcessFileName is the immediate parent (e.g., winword.exe launching powershell.exe). InitiatingProcessParentFileName is one level higher: the grandparent.

Question 62

A SOC manager builds a custom workbook from the SecurityIncident table to compute mean time to triage. They notice incident counts are inflated because the table appends a new row every time an incident is created or updated. Which KQL pattern correctly returns only the latest state of each incident before computing metrics?

Accepted Answer

| summarize arg_max(TimeGenerated, *) by IncidentNumber SecurityIncident appends a new row on every incident create and update, so the current state lives in the newest record. summarize arg_max(TimeGenerated, *) by IncidentNumber (or by LastModifiedTime) keeps that latest row with all its columns for each incident, giving you one clean row per incident before computing metrics like mean time to triage. The classic trap is arg_min, which hands back the creation-time snapshot instead.

Question 63

You want to hunt for hosts whose outbound connection counts spike abnormally versus their own seasonal baseline over the past 14 days, using KQL's built-in time-series anomaly detection. Which approach produces input in the correct shape for series_decompose_anomalies()?

Accepted Answer

make-series Count=count() default=0 on TimeGenerated from ago(14d) to now() step 1h by DeviceName, then pipe to series_decompose_anomalies(Count) series_decompose_anomalies() operates on a dynamic numeric array (a series). make-series produces exactly that: one evenly-spaced, gap-filled (default=0) numeric array per DeviceName over the time axis, which is the required input. The function decomposes each series into seasonal/trend/residual components and scores outliers on the residual.

Question 64

A hunting query returns a column named Ips that is a dynamic array holding multiple IP addresses per row, for example ["10.0.0.5","203.0.113.9"]. You need one row per individual IP so you can join each address against a watchlist. Which operator do you use?

Accepted Answer

mv-expand Ips mv-expand expands a multi-value dynamic array into multiple records, generating one row per element and duplicating all other columns onto each row. It is the inverse of the aggregation operators (make-list/make_set) that pack values into an array, and it is the standard way to fan out an array for per-element joins.

SC-200 practice questions, with full explanations

Exam status

The SC-200 bookshelf

Work the 75 questions, one topic at a time

Microsoft Defender XDR (19 questions)