CertBlaze

Microsoft

SC-200 Free Practice Questions — Page 4

Question 33

HOTSPOT - You have a Microsoft 365 E5 subscription that is linked to a Microsoft Entra tenant named contoso.com. You need to query Microsoft Graph activity logs to identify changes to the roles in contoso.com. How should you complete the KQL query? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point

Illustration for SC-200 question 33
Show Answer
Correct Answer: ("204") RequestUri
Explanation:
Adding a member reference to a directory role uses POST to /directoryRoles/{id}/members/$ref and typically returns HTTP 204 No Content on success. The role identifier is extracted from the RequestUri path by splitting on '/' and taking the third element from the end.

Question 34

You have a Microsoft 365 subscription that uses Microsoft Defender for Endpoint Plan 2. The subscription contains 1,000 Windows 11 devices that run a third-party antivirus software and have Smart App Control enabled. You need to ensure that if Defender for Endpoint detects a malicious artifact that was missed by the third-party software, it will remediate the artifact automatically. What should you configure?

A. endpoint detection and response (EDR) in block mode
B. Allow or block file
C. Automatically resolve alerts
D. tamper protection
Show Answer
Correct Answer: A
Explanation:
EDR in block mode allows Microsoft Defender for Endpoint to provide post-breach detection and automatically block and remediate malicious artifacts even when Microsoft Defender Antivirus is not the primary antivirus because a third-party AV is installed. The other options do not enable this automatic remediation behavior for missed threats.

Question 35

You have a Microsoft 365 subscription. The subscription contains 500 devices that are onboarded to Microsoft Defender for Endpoint. You have an Azure subscription that contains a Microsoft Sentinel workspace. You need to run a pilot on 50 devices that will remediate threats automatically. The solution must meet the following requirements: • Minimize the impact on devices that are excluded from the pilot. • Minimize administrative effort. What should you configure first?

A. a playbook
B. an endpoint security policy
C. a device group
D. an automation rule
Show Answer
Correct Answer: C
Explanation:
Create a device group first to scope automated remediation to only the 50 pilot devices. Device groups in Microsoft Defender for Endpoint allow targeting remediation levels and related security configurations to a subset of devices, minimizing impact on the remaining 450 devices and requiring minimal administrative effort. Playbooks and Sentinel automation rules automate incident response but do not by themselves scope Defender automatic remediation on endpoints. An endpoint security policy is not the first configuration for this pilot.

Question 36

HOTSPOT - You have a Microsoft 365 E5 subscription that uses Microsoft Defender XDR. You need to create a hunting query in KQL that meets the following requirements: • Identifies any devices that received an email containing an attachment named File1.pdf during the last 12 hours and opened the attachment. • Minimizes the resources required to run the query How should you complete the query? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.

Illustration for SC-200 question 36
Show Answer
Correct Answer: inner SHA256
Explanation:
Use an inner join to return only records where the email attachment and the device file event both exist. Join on SHA256 because it uniquely identifies the attachment across EmailAttachmentInfo and DeviceFileEvents, reducing incorrect matches.

Question 37

You have a Microsoft 365 subscription that uses Microsoft Defender XDR. All endpoint devices are onboarded to Microsoft Defender for Endpoint. You have an Azure subscription that contains a Microsoft Sentinel workspace named Workspace1. All Microsoft Defender XDR events are ingested into Workspace1. You have a Microsoft Entra tenant. You create a KQL query named query1 that searches device logs for a known vulnerability. You need to ensure that query1 runs every hour. The solution must minimize administrative effort. What should you configure?

A. a custom detection rule
B. automated investigation and response (AIR)
C. a watchlist
D. an automation rule
Show Answer
Correct Answer: A
Explanation:
A custom detection rule is designed to run a KQL query on a defined schedule (such as every hour) and generate detections or alerts when matches are found. AIR responds to alerts rather than scheduling arbitrary queries, watchlists provide reference data for queries, and automation rules automate incident handling rather than executing KQL queries on a schedule.

Question 38

You have an Azure subscription that uses Microsoft Sentinel. You need to create a custom workbook that will calculate the average time it takes to close security incidents. The solution must minimize administrative effort. Which built-in Microsoft Sentinel workbook template should you select?

A. Security operations efficiency
B. Incident Overview
C. Workspace Usage Report
D. Investigation Insights
Show Answer
Correct Answer: A
Explanation:
The Security operations efficiency workbook template is designed to measure SOC performance metrics, including mean time to acknowledge (MTTA) and mean time to close (MTTC) security incidents. Since the requirement is to calculate the average time to close incidents while minimizing administrative effort, using this built-in template is the appropriate choice.

Question 39

You have a Microsoft 365 subscription that uses Microsoft Defender XDR, Microsoft Purview, and Exchange Online. You have a partner company named Contoso, Ltd. You need to review all the emails that contain PDF attachments and were received from Contoso during the past month. The solution must minimize administrative effort. What should you use?

A. Content search
B. Content explorer
C. Activity explorer
D. Advanced Hunting
Show Answer
Correct Answer: A
Explanation:
Content search in Microsoft Purview is designed to search Exchange Online mailboxes using conditions such as sender/domain, date range, and attachment/file type. It is the appropriate tool to review emails received from a partner domain during the past month that contain PDF attachments. Content explorer classifies sensitive content rather than performing targeted email searches, Activity explorer shows user/activity events, and Advanced Hunting focuses on security telemetry rather than compliance-oriented email content review.

Question 40

HOTSPOT - You have a Microsoft 365 E5 subscription that uses Microsoft Defender XDR. You have an Azure subscription that contains a Log Analytics workspace named Workspace1. You forward all logs to Workspace1. You need to identify all the applications and security principals that made requests to modify Microsoft Entra groups during the previous 24 hours. How should you complete the KQL query? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.

Illustration for SC-200 question 40
Show Answer
Correct Answer: MicrosoftGraphActivityLogs GET
Explanation:
Use MicrosoftGraphActivityLogs because it records Microsoft Graph API requests, including Microsoft Entra group operations, with fields such as RequestUri, AppId, UserId, and ServicePrincipalId. Filtering with RequestMethod != "GET" excludes read-only requests and returns modification operations from the last 24 hours.

Question 41

HOTSPOT - You have a Microsoft Sentinel workspace named Workspace1. You need to create a custom workbook in Workspace1. Workspace1 must display a time chart that shows failed Microsoft Entra sign-ins from the past seven days. The solution must ensure that the chart includes a count of failed sign-ins for each day. How should you complete the KQL query? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.

Illustration for SC-200 question 41
Show Answer
Correct Answer: summarize by bin(TimeGenerated, 1d)
Explanation:
Use summarize with count() grouped into 1-day bins to produce one count per day for the last seven days, which render timechart can plot.

Question 42

You have a Microsoft 365 subscription that uses Microsoft Defender XDR. The subscription contains 500 Windows 11 devices that are onboarded to Microsoft Defender for Endpoint. You discover unauthorized changes to the membership of the Administrators group for the devices. You need to configure a solution that meets the following requirements: • Every hour, check the Administrators group membership of each endpoint. • When a change to the Administrators group membership is detected, create an incident in Microsoft Defender XDR. What should you create first?

A. a device group
B. an advanced hunting query
C. an alert tuning rule
D. a detection rule
Show Answer
Correct Answer: B
Explanation:
The solution requires a custom detection that runs every hour and creates alerts/incidents. In Microsoft Defender XDR, a custom detection rule is built from an Advanced Hunting KQL query. Therefore, the first thing to create is the Advanced Hunting query, which is then used by the detection rule to execute hourly and generate incidents when group membership changes are detected.

$19

Get all 383 questions with detailed answers and explanations

  • Instant download HTML + PDF delivered the moment payment clears.
  • Secure Stripe checkout we never see or store your card details.
  • 7-day refund if files are defective see our refund policy.

Full SC-200 study guide →