SC-200 Threat Detection & Monitoring 3 — Questions and Answers
Question 1: Which KQL operator would you use in Microsoft Sentinel to join the SecurityAlert table with the IdentityInfo table to enrich alerts with user department information?
- union
- join (Correct answer)
- lookup
- extend
Correct answer: join
The KQL 'join' operator merges rows from two tables based on a matching key, enabling enrichment of alerts with identity data.
Question 2: A security engineer is configuring Microsoft Defender for Identity. Which on-premises component is required to collect and forward Active Directory signals?
- Azure Arc agent
- MDI sensor (Correct answer)
- Log Analytics agent
- Microsoft Monitoring Agent
Correct answer: MDI sensor
The Microsoft Defender for Identity sensor is installed on domain controllers to capture AD traffic and forward it to the Defender for Identity cloud service.
Question 3: You need to detect when a user's account is used to sign in from two geographically distant locations within an impossibly short time. Which Microsoft Entra ID Protection risk detection covers this?
- Leaked credentials
- Atypical travel (Correct answer)
- Anonymous IP address
- Malware linked IP address
Correct answer: Atypical travel
The 'Atypical travel' risk detection identifies sign-ins from geographically distant locations where travel between them would be impossible given the time elapsed.
Question 4: In Microsoft Defender for Cloud, what does a 'Secure Score' represent?
- The number of active threats detected this month
- A percentage reflecting how many security recommendations have been implemented (Correct answer)
- The total cost of security incidents
- A risk rating based on vulnerability scan results only
Correct answer: A percentage reflecting how many security recommendations have been implemented
Secure Score in Defender for Cloud measures the percentage of security recommendations that have been remediated, giving a posture health percentage.
Question 5: An analyst is reviewing a Microsoft Sentinel incident and sees multiple alerts grouped together. What determines whether alerts are grouped into the same incident?
- Alert severity
- Alert grouping settings in the analytics rule (Correct answer)
- The user account involved
- The time of day the alert was triggered
Correct answer: Alert grouping settings in the analytics rule
Alert grouping is configured within the analytics rule settings, allowing similar alerts to be merged into a single incident based on entity matching criteria.
Question 6: Which Microsoft Sentinel feature allows you to import external threat intelligence feeds and use those indicators in analytics rules?
- Watchlists
- Threat Intelligence data connectors (Correct answer)
- UEBA
- Entity behavior analytics
Correct answer: Threat Intelligence data connectors
Threat Intelligence data connectors in Sentinel ingest IoC feeds (TAXII or flat file) into the ThreatIntelligenceIndicator table for use in detection rules.
Question 7: A SOC analyst receives a high-severity alert about a suspicious process injection. Which Defender for Endpoint action should the analyst take FIRST to preserve forensic evidence while containing the threat?
- Delete the malicious file
- Isolate the device (Correct answer)
- Run antivirus scan
- Offboard the device
Correct answer: Isolate the device
Isolating the device cuts off network access while keeping the device online for investigation, preserving evidence without removing the endpoint from management.
SC-200 Threat Detection & Monitoring 3
Which KQL operator would you use in Microsoft Sentinel to join the SecurityAlert table with the IdentityInfo table to enrich alerts with user department information?