SC-200 Identity & Access Management 2

Question 1

A security analyst notices multiple failed sign-in attempts from unfamiliar locations in Microsoft Entra ID Protection. Which risk policy type should be configured to automatically block high-risk sign-ins?

Accepted Answer

Sign-in risk policy

Answer

Sign-in risk policy in Microsoft Entra ID Protection evaluates real-time sign-in risk and can automatically block or require MFA for high-risk sign-ins.

Question 2

Which Microsoft Defender for Identity sensor deployment model is required when monitoring domain controllers that are not directly accessible from the cloud?

Accepted Answer

Lightweight sensor installed on the domain controller

Answer

The lightweight sensor is installed directly on the domain controller and forwards data without requiring a separate server, making it ideal for network-isolated DCs.

Question 3

An attacker performs a DCSync attack against an on-premises Active Directory. Which Microsoft Defender for Identity alert would fire first?

Accepted Answer

Suspected DCSync attack (replication of directory services)

Answer

Defender for Identity specifically detects DCSync by identifying non-DC accounts issuing replication requests to domain controllers.

Question 4

In Microsoft Sentinel, which data connector provides sign-in logs and audit logs from Microsoft Entra ID?

Accepted Answer

Azure Active Directory connector

Answer

The Azure Active Directory (Microsoft Entra ID) connector streams SigninLogs, AuditLogs, and other identity logs directly into Microsoft Sentinel.

Question 5

A user's Entra ID Protection risk level is set to 'High'. The security team wants to force a password reset without blocking the account. Which action accomplishes this?

Accepted Answer

Configure a user risk policy requiring secure password change

Answer

A user risk Conditional Access policy set to require password change allows compromised users to reset credentials and self-remediate without being fully blocked.

(SC-200) Microsoft Security Operations Analyst Practice Test

(SC-200) Microsoft Security Operations Analyst Practice Test

SC-200 Identity & Access Management 2