SC-200 Practice Exam — SC-200: Microsoft Security Operations Analyst

Analysis: Correct answers (in order of the answer area blanks, top to bottom): First blank: DeviceLogonEvents; Second blank: where DeviceName in ("CFOLaptop", "CEOLaptop", "COOLaptop"); Third blank: ActionType == "LogonFailed"; Fourth blank: summarize LogonFailures=count() by DeviceName, LogonType. We start the query with the correct table: DeviceLogonEvents is the dedicated Microsoft 365 Defender advanced hunting table for device sign-in activity, while DeviceEvents is for general device events not focused on logons. We first filter to only the three target devices, then add an additional filter to only keep failed authentication events, then use the summarize operator to group and count the failed sign-ins to get the required count per device. Key Concept: In Microsoft 365 Defender advanced hunting, you structure queries by selecting the correct data table, filtering results with the where operator, then aggregating results with the summarize operator to count matching events. References: Advanced hunting schema reference - DeviceLogonEvents, Microsoft Learn. https://learn.microsoft.com/en-us/microsoft-365/security/defender/advanced-hunting-devicelogonevents-table?view=o365-worldwide Kusto Query Language for advanced hunting overview, Microsoft Learn. https://learn.microsoft.com/en-us/microsoft-365/security/defender/advanced-hunting-query-language?view=o365-worldwide

Option Analysis: A. Impossible travel is incorrect because this policy detects when the same user signs in from two geographically distant locations in a time period that makes travel between them impossible, not sign-ins from a location never used by any other organization users. B. Activity from anonymous IP addresses is incorrect because this policy detects sign-ins and activity from IP addresses that are known to be anonymizing proxies, not unused geographic locations for the organization. C. Activity from infrequent country is correct because this Azure AD anomaly detection policy alerts on activity from a country/region location that has never been used by any user in your organization, matching the requirement. D. Malware detection is incorrect because this policy detects malicious activity on devices, not anomalous user sign-in locations, so it does not match the requirement. Key Concept: Microsoft Defender for Cloud Apps (formerly Microsoft Cloud App Security) anomaly detection policies each address specific types of anomalous behavior, with Activity from infrequent country specifically triggering alerts for sign-ins from locations never accessed by any organizational user. References: Anomaly detection policies in Microsoft Defender for Cloud Apps, https://learn.microsoft.com/en-us/defender-cloud-apps/anomaly-detection-policy

Option Analysis: A. SharePoint search is incorrect because it cannot be used to automatically detect sensitive content for enforcement within a DLP policy. B. A hunting query in Microsoft 365 Defender is incorrect because hunting is for post-breach threat investigation, not proactive sensitive content detection for DLP policies. C. Azure Information Protection is incorrect because AIP labels classify content, but this question asks what to use to detect the custom 32-character customer account number pattern, which AIP alone does not provide for this scenario. D. RegEx pattern matching is correct because it can be configured in DLP to detect the specific 32 alphanumeric character pattern of the customer account numbers. Key Concept: DLP policies use custom RegEx pattern matching to detect user-defined sensitive data patterns that don’t match built-in sensitive information types. References: Find what sensitive data your DLP policy detects, Create and use custom keywords or regex patterns in DLP

Analysis: Even without explicit options, the two correct commands are from Microsoft Defender for Office's Attack Surface Reduction (ASR) rule configuration: Set-MpPreference -AttackSurfaceReductionRules_Ids 58be1493-54fe-479f-9c70-70e15f857005 -AttackSurfaceReductionRules_Actions Enabled, and Add-MpPreference -AttackSurfaceReductionRules "58be1493-54fe-479f-9c70-70e15f857005=Enabled". The rule in question blocks Office VBA macros from creating downloaded child payload processes, which matches the requirement. Either PowerShell command to enable this ASR rule is a complete solution. Key Concept: Attack Surface Reduction (ASR) rules in Microsoft Defender for Endpoint can block malicious behavior from Office VBA macros including spawning downloaded child payload processes. References: Attack surface reduction rules reference list | Microsoft Learn, https://learn.microsoft.com/en-us/defender-endpoint/attack-surface-reduction-rules-reference Enable attack surface reduction rules | Microsoft Learn, https://learn.microsoft.com/en-us/defender-endpoint/enable-attack-surface-reduction

Option Analysis: A. Option A is incorrect because resolving the alert automatically would close out the alert permanently and does not fit the requirement of only hiding a false positive while maintaining security posture, which is achieved via suppression not automatic resolution. B. Option B is correct because after configuring the suppression rule for the false positive, you hide the existing false positive alert from the Alerts queue as part of the process. C. Option C is incorrect because the false positive only occurs on the accounting team's devices, so scoping the suppression rule to any device is overly broad and weakens the existing security posture unnecessarily. D. Option D is correct because you create a suppression rule scoped to the specific device group containing the accounting team's devices to suppress only this false positive without impacting security for other devices. E. Option E is correct because after creating the suppression rule you need to generate the matching alert to apply the suppression and verify the rule behaves as expected before hiding the existing false positive. Key Concept: Suppression rules for false positive alerts in Microsoft Defender for Endpoint allow you to hide known benign alerts while maintaining security posture by limiting suppression scope to specific device groups. References: Manage suppression rules in Microsoft Defender for Endpoint, https://learn.microsoft.com/en-us/defender-endpoint/manage-alerts#suppress-false-positive-alerts