Pass the Microsoft Certified: Security Operations Analyst Associate SC-200 Questions and answers with ExamsMirror

In Microsoft Sentinel, to automatically generate incidents when a specific pattern or behavior is detected by a query, you must create a scheduled analytics rule.

A scheduled query rule:

Runs a KQL query on a defined schedule (e.g., every hour).

Triggers an alert and incident when the query returns results.

Can map detections to MITRE ATT&CK tactics and techniques, aligning with the requirement for attack vector mapping.

Other options explained:

Fusion rule – Uses built-in machine learning for correlation, not custom KQL logic.

Query bookmark – Saves hunting results but does not trigger incidents.

Hunting livestream session – Used for live monitoring, not alert generation.

✅ Correct answer: C. a scheduled query rule

In Microsoft Defender for Endpoint, Live Response provides an interactive remote shell for investigating a device directly from the Microsoft Defender portal. It allows security analysts to run commands, collect data, inspect processes, and perform incident response tasks without manually logging into the endpoint.

For this scenario, you must:

Identify all active network connections.

Identify all running processes.

Retrieve login history.

All of these can be achieved efficiently through a Live Response session. Once connected, you can use built-in commands such as:

netstat to view active network connections,

ps to list running processes,

cat or less to review log files containing login history.

According to Microsoft Defender for Endpoint documentation, “Live response enables analysts to perform in-depth investigation on a device remotely to collect forensic data, run scripts, and remediate threats.” It is the least administrative-intensive way to gather this information compared to collecting an investigation package, which is more time-consuming and primarily for offline forensic analysis.

Option A (disable authenticated telemetry) is unrelated to investigation tasks.

Option B (enable unsigned script execution) is only needed for running custom scripts, not built-in commands.

Option C (collect investigation package) gathers data for offline review and does not allow interactive analysis.

Option D (initiate live response) gives immediate, interactive insight into processes, connections, and logs — satisfying all requirements with minimal effort.

✅ Therefore, the correct first step is to initiate a live response session on Device1.

When you have multiple Log Analytics workspaces across several Azure subscriptions, and you want to perform cross-workspace hunting queries from a central Microsoft Sentinel deployment, you must complete two steps according to Microsoft’s official Sentinel documentation:

Add the Microsoft Sentinel solution to each workspace — Microsoft Sentinel must be enabled or connected to every Log Analytics workspace that you want to query. This step allows those workspaces to participate in Sentinel analytics, hunting, and investigation features. Without Sentinel being enabled in each workspace, the hunting queries will not have permission or access to their data.

“To query across multiple workspaces, each workspace must have Microsoft Sentinel enabled.”

Use the workspace() expression and the union operator — Microsoft Sentinel hunting queries can run across multiple workspaces by explicitly referencing them with the workspace() function and combining them with the union operator, for example:

union workspace('ProjectA-Workspace').SecurityEvent,

workspace('ProjectB-Workspace').SecurityEvent,

workspace('ProjectC-Workspace').SecurityEvent

| where EventID == 4625

The workspace() function identifies the remote workspaces, and union combines results into a single query output.

Other options are incorrect:

A and B: alias and resource expressions are used for multi-resource queries within a workspace, not for cross-workspace queries.

E: Adding the Security Events connector applies only to ingesting Windows logs but does not enable cross-workspace hunting.

✅ Correct Answers: C and D

 File1.exe will be blocked on Device3. — No

 User2 will be marked with a risk level of medium. — No

 An investigation package will be collected from Device1. — Yes

Custom detection rules in Microsoft Defender XDR are scoped to devices or device groups and only take device-related actions for devices that are in that scope. As the documentation states, “Only data from devices in the scope will be queried. Also, actions are taken only on those devices.” Therefore a rule scoped to DevGroup1 will apply actions only to devices in DevGroup1 (Device1 and Device2); it will not apply to Device3 because Device3 is in DevGroup2. Microsoft Learn

File blocking is a file-level action triggered by the rule, but blocking is applied only where the rule is in scope. Consequently File1.exe will not be blocked on Device3 (out of scope). For the user action, the rule’s Mark user as compromised action explicitly “sets the users risk level to 'high' in Microsoft Entra ID” — it does not set a medium risk. So the statement that User2 will be marked with risk level medium is incorrect; the documented outcome is a high risk marking. Microsoft Learn

Finally, device actions include Collect investigation package and these are applied to the DeviceId results when the rule matches. Because Device1 is in DevGroup1 (in scope) and the rule specifies collecting an investigation package for matching devices, an investigation package will be collected from Device1 when the rule fires. Microsoft Learn

Sources: Official Microsoft Defender XDR documentation for custom detection rules (actions, scope, and user actions). Microsoft Learn

To automatically send a Microsoft Teams message when an incident (like a sign-in risk) is activated, you must use Logic Apps playbooks in Microsoft Sentinel.

Steps based on Microsoft documentation:

Add (create) a playbook (Option D) — a Logic App workflow that defines the automation (e.g., post a message to a Teams channel).

Associate the playbook to the analytics rule (Option B) that generates the incident — this ensures the playbook triggers automatically whenever that rule fires.

Other options do not accomplish the goal:

Entity behavior analytics (A) provides user and entity context but does not automate actions.

Fusion rule (C) correlates multi-stage attacks automatically but isn’t used to trigger notifications.

Workbooks (E) are for visualization, not automation.

✅ Final Answers:

Question 80: D. Assign the incident

Question 83: B and D

Microsoft Defender for Servers provides threat protection, vulnerability management, and security recommendations for Windows and Linux servers—both in Azure and hybrid/multi-cloud environments.

According to Microsoft Defender for Cloud documentation, enabling Defender for Servers coverage depends on how the server resource is hosted:

Azure virtual machines (VMs) — are automatically onboarded using the built-in Azure Monitor agent and do not require Azure Arc.

On-premises servers — must be onboarded through Azure Arc (Connected Machine agent) to connect to Azure before Defender for Servers can be enabled.

Non-Azure cloud servers (AWS, GCP) — must also use Azure Arc to integrate with Defender for Cloud.

Now, applying this to the table:

Server

Location

Platform

Arc Needed?

Reason

Server1

On-premises

Windows Server

✅ Yes

Non-Azure, must be connected via Azure Arc

Server2

AWS

Linux

✅ Yes

Non-Azure, must be connected via Azure Arc

Server3

Azure

Windows Server

❌ No

Native Azure VM automatically protected

Server4

On-premises

Windows Server

✅ Yes

Non-Azure, must be connected via Azure Arc

✅ Therefore, the servers that require the Azure Arc agent are:

Server1, Server2, and Server4 only.

In Microsoft Defender for Identity (MDI), data collected from Active Directory Domain Services (AD DS) is stored in Microsoft 365 Defender advanced hunting tables under the Identity schema.

When investigating LDAP or authentication activities related to domain controllers, the correct table is IdentityLogonEvents.

The IdentityLogonEvents table contains information about all logons detected by Defender for Identity sensors on domain controllers — including LDAP binds, Kerberos, NTLM, and other authentication types.

You can identify LDAP simple binds using a query such as:

IdentityLogonEvents

| where Protocol == "LDAP"

| where AuthenticationPackage == "SimpleBind"

Other options explained:

AADServicePrincipalRiskEvents – Contains Entra (Azure AD) service principal risk detections, not AD DS activity.

AADDomainServicesAccountLogon – Used for Azure AD Domain Services (AAD DS), not traditional on-prem AD DS.

SigninLogs – Contains Entra (Azure AD) sign-in data, not LDAP or on-prem authentication.

✅ Correct table: IdentityLogonEvents

The scenario describes agentless scanning for virtual machines — a feature of Microsoft Defender for Cloud under the Defender CSPM (Cloud Security Posture Management) plan. Defender CSPM introduces agentless scanning capabilities that use snapshot-based (out-of-band) scanning to assess OS vulnerabilities, sensitive data, and configurations without requiring agents.

Microsoft documentation clarifies:

“Agentless scanning for machines is available in Defender CSPM and Defender for Servers P2. The scanning engine takes snapshots of virtual machines and performs analysis out-of-band to identify vulnerabilities and sensitive data exposure.”

For controlling which virtual machines participate, tag-based inclusion or exclusion is used. You can define which machines to include/exclude using Azure resource tags, such as:

Environment=Production

Scan=Exclude

Microsoft Defender for Cloud reads these tags to determine which resources should have scanning enabled or excluded.

Role-based access control (RBAC) and Azure Policy assignments control access and policy enforcement, but they are not used to exclude specific resources from Defender CSPM agentless scanning.

✅ Final Configuration:

Defender Plan: Defender CSPM

Exclusion Method: Tagging

In Microsoft Sentinel, data connectors are the mechanisms that collect logs and telemetry from various Azure and non-Azure sources into a Log Analytics workspace.

When your goal is to automatically connect multiple Azure subscriptions (both existing and new resources) to Sentinel, the correct approach is to use Azure Policy with connectors that rely on diagnostic settings.

Many Azure resources (e.g., Key Vaults, Storage Accounts, Azure Firewall, and Activity Logs) send logs to Sentinel via diagnostic settings. This connector type allows logs to be exported directly to the Sentinel workspace without requiring agents or manual configuration.

By using Azure Policy, you can automatically enforce and deploy these diagnostic settings across all current and future resources — ensuring continuous log ingestion with minimal administrative overhead.

When applying the Azure Policy, existing resources might not yet have diagnostic settings configured. To fix this, you create a remediation task. This instructs Azure Policy to apply the compliance settings to existing resources, not just new ones. Without a remediation task, only newly created resources would comply automatically.

Connector type: Diagnostic settings → used for policy-based deployment across subscriptions.

Use: A remediation task → ensures policy applies to both existing and new resources for full coverage.

✅ Final Answer:

Connector type: Diagnostic settings

Use: A remediation task