SC-200 Identity & Access Management 2 — Questions and Answers
Question 1: A security analyst notices multiple failed sign-in attempts from unfamiliar locations in Microsoft Entra ID Protection. Which risk policy type should be configured to automatically block high-risk sign-ins?
- User risk policy
- Sign-in risk policy (Correct answer)
- MFA registration policy
- Conditional Access device compliance policy
Correct answer: Sign-in risk policy
Sign-in risk policy in Microsoft Entra ID Protection evaluates real-time sign-in risk and can automatically block or require MFA for high-risk sign-ins.
Question 2: Which Microsoft Defender for Identity sensor deployment model is required when monitoring domain controllers that are not directly accessible from the cloud?
- Cloud sensor
- Standalone sensor
- Lightweight sensor installed on the domain controller (Correct answer)
- Azure AD Connect health agent
Correct answer: Lightweight sensor installed on the domain controller
The lightweight sensor is installed directly on the domain controller and forwards data without requiring a separate server, making it ideal for network-isolated DCs.
Question 3: An attacker performs a DCSync attack against an on-premises Active Directory. Which Microsoft Defender for Identity alert would fire first?
- Pass-the-Hash activity detected
- Suspected DCSync attack (replication of directory services) (Correct answer)
- Kerberoasting activity detected
- Lateral movement using remote execution
Correct answer: Suspected DCSync attack (replication of directory services)
Defender for Identity specifically detects DCSync by identifying non-DC accounts issuing replication requests to domain controllers.
Question 4: In Microsoft Sentinel, which data connector provides sign-in logs and audit logs from Microsoft Entra ID?
- Microsoft 365 Defender connector
- Azure Active Directory connector (Correct answer)
- Microsoft Defender for Cloud connector
- Office 365 connector
Correct answer: Azure Active Directory connector
The Azure Active Directory (Microsoft Entra ID) connector streams SigninLogs, AuditLogs, and other identity logs directly into Microsoft Sentinel.
Question 5: A user's Entra ID Protection risk level is set to 'High'. The security team wants to force a password reset without blocking the account. Which action accomplishes this?
- Dismiss the user risk
- Confirm user is compromised
- Require the user to re-register for MFA
- Configure a user risk policy requiring secure password change (Correct answer)
Correct answer: Configure a user risk policy requiring secure password change
A user risk Conditional Access policy set to require password change allows compromised users to reset credentials and self-remediate without being fully blocked.
Question 6: Which Kusto query table in Microsoft Sentinel contains information about successful and failed Microsoft Entra ID sign-in events?
- SecurityEvent
- AuditLogs
- SigninLogs (Correct answer)
- IdentityLogonEvents
Correct answer: SigninLogs
The SigninLogs table in the Log Analytics workspace populated by the Entra ID connector stores all interactive and non-interactive sign-in records.
Question 7: An organization suspects a service principal is being abused. Which Microsoft Entra ID log should the analyst review to see API calls made by that service principal?
- SigninLogs
- AADNonInteractiveUserSignInLogs
- AuditLogs
- ServicePrincipalSignInLogs (Correct answer)
Correct answer: ServicePrincipalSignInLogs
ServicePrincipalSignInLogs captures authentication events from service principals and managed identities, separate from interactive user sign-ins.
SC-200 Identity & Access Management 2
A security analyst notices multiple failed sign-in attempts from unfamiliar locations in Microsoft Entra ID Protection.
Which risk policy type should be configured to automatically block high-risk sign-ins?