SC-200 Threat Detection & Monitoring 2 — Questions and Answers
Question 1: A SOC analyst notices repeated failed sign-in attempts followed by a successful login from an unusual country. Which Microsoft Sentinel analytics rule type is BEST suited to detect this pattern?
- Fusion
- Scheduled (Correct answer)
- NRT (Near Real-Time)
- Microsoft Security
Correct answer: Scheduled
Scheduled analytics rules use KQL queries run on a defined schedule and are ideal for detecting multi-step patterns like brute-force followed by success.
Question 2: Which Microsoft Defender XDR feature correlates alerts from multiple Defender products into a single, unified incident?
- Threat Intelligence
- Auto Investigation
- Advanced Hunting
- Automatic Attack Disruption (Correct answer)
Correct answer: Automatic Attack Disruption
Automatic Attack Disruption uses AI to correlate signals across Defender products and contain active attacks by isolating affected assets.
Question 3: You want to hunt for suspicious PowerShell executions across all endpoints in your organization. Which tool in Microsoft Defender XDR should you use?
- Threat Analytics
- Device Inventory
- Advanced Hunting (Correct answer)
- Security Score
Correct answer: Advanced Hunting
Advanced Hunting uses KQL to query up to 30 days of raw telemetry across endpoints, email, identity, and cloud apps.
Question 4: An analyst wants Microsoft Sentinel to automatically assign a severity of High to any incident involving a watchlist match. Which feature enables this?
- Playbook
- Automation Rule (Correct answer)
- Analytics Rule
- Fusion Rule
Correct answer: Automation Rule
Automation rules in Microsoft Sentinel can modify incident properties such as severity, owner, and status based on trigger conditions.
Question 5: Which Microsoft Sentinel data connector uses the Common Event Format (CEF) over Syslog to ingest logs from third-party security appliances?
- Azure Monitor Agent
- Log Analytics API
- CEF via AMA (Correct answer)
- HTTP Data Collector API
Correct answer: CEF via AMA
The CEF via Azure Monitor Agent connector forwards CEF-formatted syslog messages from Linux forwarders directly into Microsoft Sentinel.
Question 6: A threat actor is using living-off-the-land binaries (LOLBins) to evade detection. Which Microsoft Defender for Endpoint capability is specifically designed to block this behavior?
- Endpoint Detection and Response (EDR)
- Attack Surface Reduction (ASR) rules (Correct answer)
- Network Protection
- Controlled Folder Access
Correct answer: Attack Surface Reduction (ASR) rules
Attack Surface Reduction rules include specific rules to block abuse of LOLBins like mshta.exe, wscript.exe, and others.
Question 7: In Microsoft Sentinel, which built-in workbook provides an overview of data ingestion health, including volume trends and connector status?
- Zero Trust Workbook
- Workspace Usage Report
- Data Collection Health (Correct answer)
- SOC Efficiency
Correct answer: Data Collection Health
The Data Collection Health workbook in Sentinel monitors ingestion latency, connector status, and data volume to ensure telemetry is flowing correctly.
SC-200 Threat Detection & Monitoring 2
A SOC analyst notices repeated failed sign-in attempts followed by a successful login from an unusual country.
Which Microsoft Sentinel analytics rule type is BEST suited to detect this pattern?