SC-200 Threat Intelligence & Analysis 2 — Questions and Answers
Question 1: A security analyst is reviewing Microsoft Sentinel threat intelligence indicators. Which STIX object type is used to represent a malicious IP address as a threat indicator?
- Intrusion Set
- Indicator (Correct answer)
- Campaign
- Threat Actor
Correct answer: Indicator
In STIX 2.0/2.1, the Indicator object type is used to represent detectable patterns such as malicious IP addresses, domains, or file hashes.
Question 2: In Microsoft Defender Threat Intelligence (MDTI), what does the 'Reputation' score of an artifact primarily indicate?
- The age of the threat indicator in the database
- The likelihood that the artifact is associated with malicious activity (Correct answer)
- The number of times the indicator has been observed globally
- The severity of the CVE associated with the artifact
Correct answer: The likelihood that the artifact is associated with malicious activity
MDTI Reputation scores indicate the likelihood that an artifact (IP, domain, hash) is malicious based on historical threat data and behavioral signals.
Question 3: A SOC team wants to automatically enrich incidents in Microsoft Sentinel with threat intelligence data from MDTI. Which feature should they configure?
- Azure Logic Apps with MDTI connector (Correct answer)
- Microsoft Sentinel Fusion analytics rule
- TAXII server data connector
- Workbook with threat intelligence template
Correct answer: Azure Logic Apps with MDTI connector
Azure Logic Apps with the MDTI connector can be used to automate enrichment of Sentinel incidents with threat intelligence context from MDTI.
Question 4: When threat intelligence is imported into Microsoft Sentinel via a TAXII data connector, where are the indicators stored?
- The ThreatIntelligenceIndicator table in Log Analytics (Correct answer)
- The SecurityAlert table in Log Analytics
- Azure Key Vault as secrets
- The CommonSecurityLog table
Correct answer: The ThreatIntelligenceIndicator table in Log Analytics
Threat intelligence indicators imported into Microsoft Sentinel are stored in the ThreatIntelligenceIndicator table within Log Analytics workspace.
Question 5: Which Microsoft Sentinel feature allows threat hunting by pivoting on threat intelligence indicators to find related entities across your environment?
- Fusion ML detection
- Threat Intelligence Workbook
- UEBA timeline
- Hunting queries with ThreatIntelligenceIndicator joins (Correct answer)
Correct answer: Hunting queries with ThreatIntelligenceIndicator joins
Analysts can write KQL hunting queries that join the ThreatIntelligenceIndicator table with other log tables to find entities matching known malicious indicators.
Question 6: An analyst notices a threat indicator in Sentinel with a 'Confidence' value of 45. How should this indicator be treated?
- Treat it as confirmed malicious and block immediately
- Use it as a low-confidence signal requiring additional corroboration before acting (Correct answer)
- Discard it as it falls below the 50% threshold
- Escalate it to Tier 3 analysts only
Correct answer: Use it as a low-confidence signal requiring additional corroboration before acting
A confidence value of 45 (out of 100) indicates low confidence, meaning the indicator should be treated as a weak signal that requires additional evidence before taking action.
Question 7: In Microsoft Defender Threat Intelligence, what does the 'PDNS' (Passive DNS) data reveal about a domain?
- The domain's current MX record configuration
- Historical IP address resolutions for the domain over time (Correct answer)
- The domain's SSL certificate chain
- Active DNS queries from your network to the domain
Correct answer: Historical IP address resolutions for the domain over time
Passive DNS (PDNS) data shows the historical record of IP addresses that a domain has resolved to over time, which is valuable for tracking infrastructure changes by threat actors.
SC-200 Threat Intelligence & Analysis 2
A security analyst is reviewing Microsoft Sentinel threat intelligence indicators.
Which STIX object type is used to represent a malicious IP address as a threat indicator?