Question 1

All Microsoft Defender for Endpoint device groups are set to Full - remediate threats automatically. An automated investigation in Microsoft Defender for Office 365 determines that a delivered message contains a malicious URL, yet the recommended soft-delete action shows as Pending approval in the Action center. What best explains this?

Accepted Answer

Correct answer: A. In the AIR verdict model, a Malicious verdict on email content (URLs or attachments) produces recommended remediation actions that are pending approval, regardless of device automation. The Full - remediate threats automatically setting applies to device (endpoint) remediation, so email actions still require a SecOps member to approve them.

Question 2

Your tenant has Microsoft Defender for Office 365 but no custom Safe Attachments or Safe Links policies, and you have not enabled the Standard or Strict preset security policies. Which statement about the protection your recipients receive is correct?

Accepted Answer

Correct answer: D. Built-in protection is assigned to all recipients by default and effectively provides default Safe Links and Safe Attachments policies (you can configure exceptions). The Standard and Strict presets are assigned to no one until you enable them and add users.

Question 3

An authorized vulnerability scanner triggers dozens of Microsoft Defender for Endpoint alerts every night. The SOC manager wants these alerts to stop appearing in the alert queue and stop creating incidents, but the threat hunting team requires that the records remain queryable in the AlertInfo and AlertEvidence tables in advanced hunting. Which alert tuning action, configured under Settings, then Microsoft Defender XDR, then Alert tuning, meets all of the requirements?

Accepted Answer

Correct answer: D. Hide alert is the only action that satisfies every requirement: per Microsoft Learn, it suppresses the alert and prevents incident creation, while hidden alerts remain in the AlertInfo and AlertEvidence tables so hunters can still query them. Hide alert is only applicable to Defender for Endpoint alerts, which matches this scenario's source. The rule conditions should be scoped tightly, for example the scanner process name AND its service account, rather than a broad wildcard.

Question 4

You configure a Microsoft Defender XDR custom detection rule against Defender XDR data with a frequency of "Every 3 hours." To avoid missing or double-counting events, what lookback period does the rule apply, and how should your query's time filter relate to it?

Accepted Answer

Correct answer: C. A rule that runs every 3 hours looks back 12 hours, not 3. The fixed mapping for custom detections on Defender XDR data: hourly checks the last 4 hours, every 3 hours checks 12 hours, every 12 hours checks 48 hours, and every 24 hours checks 30 days. Match your query's time filter to that lookback window so relevant results aren't ignored.

Question 5

Executive and support staff need Microsoft's most aggressive email protection, with the admin releasing any blocked messages the users request. A custom anti-spam policy already targets some of these same users. The team assigns the Strict preset security policy to the executives. For those users, how are the anti-spam settings resolved, and how does Built-in protection relate?

Accepted Answer

Correct answer: A. Preset security policies sit at the top of the threat-policy order of precedence: Strict is applied first, then Standard, then Defender for Office 365 evaluation policies, then custom threat policies by priority, and finally the Built-in protection preset (Safe Links/Safe Attachments) and the default policies. So for a user in the Strict preset, the Strict anti-spam settings are applied instead of the custom or default anti-spam policy; no merging occurs. Built-in protection is assigned to all recipients by default but only provides Safe Links and Safe Attachments, and it is the lowest-precedence preset, so it never overrides Strict. Strict is the right choice because it quarantines more aggressively and is designed for high-value targets whose admins review and release messages.

Question 6

After Microsoft Entra flags a risky sign-in for a user, a threat hunter wants to determine whether that user then performed unusual bulk file downloads from SharePoint Online and OneDrive, using data surfaced by Microsoft Defender for Cloud Apps in advanced hunting. Which table holds these cloud app file-activity events (for example, ActionType 'FileDownloaded') to correlate with the sign-in?

Accepted Answer

Correct answer: B. CloudAppEvents contains events involving accounts and objects in Office 365 and other cloud apps and services, populated by Microsoft Defender for Cloud Apps. It records SaaS activities such as FileDownloaded for SharePoint Online and OneDrive, with columns like ActionType, Application, AccountObjectId, and RawEventData that a hunter can pivot on and correlate with the risky sign-in by account. The table requires Defender for Cloud Apps to be deployed and the Microsoft 365 activities connector enabled.

Question 7

You want Microsoft Defender for Identity to disable a compromised on-premises Active Directory account and reset its password from the Microsoft Defender portal. All of your sensors are v2.x running on domain controllers. Which account performs these remediation actions, and how does it differ from the Directory Service Account (DSA)?

Accepted Answer

Correct answer: D. Remediation actions such as disabling a user or resetting a password are performed by the action account. By default the v2.x sensor impersonates the domain controller's LocalSystem account; if you want scoped permissions you configure a dedicated gMSA as the action account. This is separate from the DSA, which only reads AD data.

Question 8

During email remediation in Microsoft Defender, which action moves the messages to the user's Recoverable Items\Deletions folder, leaving them recoverable by the user?

Accepted Answer

Correct answer: C. Soft delete moves messages to the Recoverable Items\Deletions folder, where they remain recoverable by the user (and admins). Hard delete purges the message (recoverable only by an admin via single-item recovery), and Move to Deleted Items only places it in the visible Deleted Items folder.

Question 9

In Microsoft Security Exposure Management, a database server matches two critical asset classification rules at the same time: a predefined rule that assigns High criticality and a custom rule that assigns Medium criticality. Months later, the server is rebuilt and no longer matches the High-criticality rule's criteria. How does Exposure Management handle the asset's criticality level across these events?

Accepted Answer

Correct answer: B. Microsoft Security Exposure Management categorizes assets into four criticality levels: Very High, High, Medium, and Low. When multiple classification rules apply to the same asset, the rule with the highest criticality level takes precedence. That classification remains in effect until the asset no longer meets the criteria for that rule, at which point it automatically reverts to the next applicable classification level. So the server is treated as High while it matches the predefined rule, then automatically drops to Medium after the rebuild. Getting criticality right matters operationally: criticality feeds prioritization surfaces such as device inventory sorting, security recommendations (exposed critical assets), and incident prioritization in the Defender portal.

Question 10

A vulnerability management lead opens Threat analytics in the Microsoft Defender portal (Threat intelligence, then Threat analytics). They want to prioritize patching against tracked threats the organization has not yet generated any alerts for, ranked by how severe the exploited vulnerabilities are and how many onboarded devices carry those weaknesses. Which dashboard section provides this ranking?

Accepted Answer

Correct answer: D. The threat analytics dashboard (https://security.microsoft.com/threatanalytics3) summarizes threats in three sections: Latest threats (most recently published or updated reports), High-impact threats (ranked by the number of active and resolved alerts in your organization), and Highest exposure threats. Per Microsoft Learn, the exposure level is calculated using two pieces of information: how severe the vulnerabilities associated with the threat are, and how many devices in your organization could be exploited by those vulnerabilities. Because exposure is driven by device posture rather than alerts, this section can surface threats the tenant has never seen an alert for, which is exactly what proactive patch prioritization needs.

Question 11

A SOC lead wants to add custom case status values such as 'Pending vendor response' and 'Detection tuning' to case management in the Microsoft Defender portal. The lead currently holds Microsoft Sentinel Responder, which already lets them create cases and link incidents. Using Microsoft Sentinel roles, what is the minimum role required to customize the case status options?

Accepted Answer

Correct answer: A. Customizing case status options requires the Microsoft Sentinel Contributor role, or Core Security settings (manage) under Authorization and settings in unified RBAC. That is the top tier of case management RBAC in the Defender portal: viewing the case queue, details, tasks, comments, and audits needs only Security data basics (read) or Microsoft Sentinel Reader, while creating and managing cases and case tasks, assigning, updating status, and linking or unlinking incidents needs Alerts (manage) or Microsoft Sentinel Responder. The trap is assuming Responder covers everything case-related; changing the status menu is a configuration change, one tier above day-to-day case work and typically a SOC lead or admin function.

Question 12

A SOC has onboarded Microsoft Sentinel to the Microsoft Defender portal. A detection engineer is writing a brand-new detection over DeviceEvents and EmailEvents data and wants native Defender XDR remediation actions with automatic entity mapping, while minimizing ingestion costs. Which detection mechanism does Microsoft currently recommend for this rule?

Accepted Answer

Correct answer: D. Microsoft's feature-comparison guidance states that custom detections are now the best way to create new rules across Microsoft Sentinel and Microsoft Defender XDR. Custom detections reduce ingestion costs by running directly against already-available Defender data, provide real-time detections, and integrate directly with Defender XDR data, functions, and native remediation actions with automatic entity mapping. Since this detection targets Defender XDR tables (DeviceEvents, EmailEvents), a custom detection rule is exactly the recommended vehicle. Existing analytics rules keep running, and analytics rules still lead in a few areas (such as full MITRE technique coverage), but new detections on Defender data should be custom detections.

Question 13

A security operations manager still runs Microsoft Sentinel exclusively in the Azure portal and asks how long that experience remains supported before the team must operate from the Microsoft Defender portal. What should you tell them?

Accepted Answer

Correct answer: B. Microsoft's published retirement timeline states that after March 31, 2027, Microsoft Sentinel will no longer be supported in the Azure portal and will be available only in the Microsoft Defender portal. Microsoft Sentinel is generally available in the Defender portal, including for customers without Defender XDR or an E5 license, and Microsoft recommends that Azure-portal customers start planning their transition now. Teams still operating from the Azure portal should treat this as a hard deadline for moving their SOC workflows.

Question 14

During an incident investigation, Microsoft Defender XDR automatically contained several user accounts and isolated two devices without analyst intervention. The incident carries the 'Attack Disruption' tag. Which feature triggered these containment actions?

Accepted Answer

Correct answer: D. Automatic attack disruption in Microsoft Defender XDR correlates signals from endpoints, identities, email, and SaaS applications to identify active human-operated attacks (such as ransomware and business email compromise) with high confidence and automatically contains compromised assets. Disrupted incidents are tagged with 'Attack Disruption' and the specific threat type. Actions include containing devices and disabling user accounts.

Question 15

A threat hunting team uses case management in the Microsoft Defender portal to track a long-running phishing campaign that has generated roughly 250 related incidents. The team wants to link every incident to a single case so the whole campaign has one durable record. Which documented service limit forces a different design?

Accepted Answer

Correct answer: A. The Microsoft Sentinel service limits page documents the case management limits: 100,000 cases per tenant, 500 GB of attachments per tenant, and 100 linked incidents per case. Linking 250 incidents to one case exceeds the per-case incident cap, so the team must split the campaign across multiple cases (for example, by wave or by month) and use the case descriptions, tasks, or naming conventions to tie them together. Cases themselves are durable: they do not expire or auto-delete, and case IDs (starting at 1000) are never recycled, which is why archival is handled with custom statuses and filters rather than deletion.

Question 16

While investigating in the incident graph, an analyst switches the associated-incidents view from This incident only to All associated incidents. What is the effect of this change?

Accepted Answer

Correct answer: A. The All associated incidents view helps analysts see additional related incidents and alerts in the investigation graph for added context. It does not change incident grouping, correlation rules, or merge logic, and the associated incidents keep their own owner, status, and lifecycle until an actual merge occurs.

Question 17

A device group is set to 'Semi - require approval for all folders'. While the SOC lead was on two weeks of leave, an automated investigation reached a Malicious verdict and generated a file quarantine action. On return, the lead finds the action no longer appears on the Action center Pending tab, no analyst approved or rejected it, and the malicious file is still present on the device. What happened?

Accepted Answer

Correct answer: C. Per the automation levels documentation, with semi-automation levels pending remediation actions time out after seven days. When an action times out, the behavior is the same as if the action was rejected: the remediation is not performed, the threat artifact stays on the device, and no one is notified unless alerting on this is built separately. This is the operational risk of semi-automation levels for teams without continuous Action center coverage, and it is why the pending item disappeared without the file being quarantined.

Question 18

During an incident, a SOC analyst creates a 'Block and remediate' file indicator for the SHA-256 hash of a malicious utility found on several servers. The utility sits in D:\Tools\, a folder a server administrator added to the Microsoft Defender Antivirus folder exclusion list years ago. The servers are in the indicator's scope, Defender Antivirus is in active mode, and more than a day has passed, yet the utility still executes. According to Microsoft's documented policy conflict handling for file indicators, why?

Accepted Answer

Correct answer: D. The 'Create indicators for files' documentation defines an explicit conflict handling order: after Windows Defender Application Control/AppLocker enforcement, the next check is 'if the file is allowed by the Microsoft Defender Antivirus exclusions, then Allow', which comes before 'if the file is blocked or warned by a block or warn file IoCs, then Block/Warn'. Microsoft's example table confirms this: antivirus exclusion Allow plus file indicator Block results in Allow. The pre-existing folder exclusion therefore neutralizes the block indicator, and the remediation is to remove or narrow the stale exclusion.

Question 19

A device group in Microsoft Defender for Endpoint has its remediation (automation) level set to Semi - require approval for non-temp folders. An automated investigation returns a Malicious verdict for an executable found in the signed-in user's Downloads folder. What happens to the remediation?

Accepted Answer

Correct answer: D. At the Semi - require approval for non-temp folders level, remediation is applied automatically to malicious files/executables located in temporary folders, and Microsoft's temporary-folder list explicitly includes \users\*\downloads\*. Only files outside temporary folders wait for approval on the Pending tab.

Question 20

During an incident, a SOC analyst with the correct RBAC permissions successfully starts live response sessions on compromised Windows 11 laptops but cannot start a session on a compromised Windows Server 2022 machine, even though the server is onboarded and its sensor is healthy. 'Enable live response' is turned on in Advanced features. What is the most likely cause?

Accepted Answer

Correct answer: D. Live response has two separate enablement toggles under Settings, then Endpoints, then General, then Advanced features: 'Enable live response' and 'Enable live response for servers.' The base toggle does not cover server operating systems - the server toggle must be enabled as well, and it is an easy one to miss because workstation sessions work fine without it. Only admins and users with 'Manage Portal Settings' permissions can enable these toggles. With both toggles on and appropriate RBAC, sessions work on Windows Server 2019, Windows Server 2022 and later, and Server 2012 R2/2016 with the unified agent.

Question 21

You create a Defender for Endpoint web content filtering policy that blocks only the "Gambling" category. A user reports they can still reach a news site that was never in any blocked category. What is the expected behavior for categories you did not block, and how can you still allow one specific site that falls inside a blocked category?

Accepted Answer

Correct answer: B. For any category that is not blocked, URLs are automatically audited: users can access them and access statistics are collected. To permit a single site within a blocked category, a custom Allow indicator (URL/domain) takes precedence over the web content filtering policy.

Question 22

A desktop technician links a Group Policy Object that turns off Microsoft Defender Antivirus real-time protection on a lab device onboarded to Microsoft Defender for Endpoint. The GPO applies successfully with no errors, but real-time protection remains enabled after multiple policy refreshes. What is the most likely reason?

Accepted Answer

Correct answer: D. Real-time protection is one of the tamper-protected settings (along with behavior monitoring, cloud protection, security intelligence updates, IOAV protection, and automatic remediation actions). Microsoft Learn is explicit: when tamper protection is on and you use Group Policy to change Microsoft Defender Antivirus settings, changes to tamper-protected settings are ignored - the change appears to apply but is silently blocked, with no error. If a legitimate change is needed, the documented approach is troubleshooting mode, which temporarily suspends tamper protection on the device; when it ends, tamper-protected settings revert to their configured state. Tamper protection itself cannot be turned off via Group Policy.

Question 23

During a live response session on a compromised Windows device, an analyst who holds the advanced live response commands permission uploads a custom, unsigned PowerShell remediation script to the library and runs it with the run command. The script's syntax is valid, but it fails to execute. What must be enabled?

Accepted Answer

Correct answer: D. Live response can run PowerShell and Bash scripts from the tenant library, but if a PowerShell script is unsigned you must first enable the unsigned script execution setting on the Advanced features page. Without it, an unsigned library script will not run even for an analyst who holds the advanced live response command permission and has already uploaded the file. Microsoft warns that allowing unsigned scripts increases exposure to threats, so it is an opt-in setting.

Question 24

A company onboards its Windows Server 2022 fleet, which runs a non-Microsoft antivirus product that must remain primary, to Microsoft Defender for Endpoint. Soon after onboarding, server admins report severe performance degradation, and both antivirus engines are actively scanning. The Windows 11 workstations onboarded the same week with the same third-party AV show no conflict. What did the deployment team miss on the servers?

Accepted Answer

Correct answer: B. On Windows 10 and 11, Microsoft Defender Antivirus automatically enters passive mode when a non-Microsoft antivirus registers with Windows Security Center - which is why the workstations were fine. On Windows Server (2012 R2 and later, including Server 2022), that automatic switch does not happen: you must set ForceDefenderPassiveMode (REG_DWORD, value 1) under HKLM\SOFTWARE\Policies\Microsoft\Windows Advanced Threat Protection, and Learn specifically says to set it before onboarding the device. Without it, both products attempt active protection simultaneously, causing exactly this performance conflict. A further trap: beginning with platform 4.18.2208.0, on an onboarded server with tamper protection enabled, tamper protection allows a switch to active mode but blocks the switch back to passive - so setting the key after the fact may not take effect.

Question 25

An administrator creates a web content filtering policy in the Microsoft Defender portal that blocks the 'Gambling' category and scopes it to a device group. What is the behavior for websites in categories the policy does not block?

Accepted Answer

Correct answer: D. Web content filtering follows a block-or-audit model: for any category that is not blocked in a policy, the URLs are automatically audited. Users can access those sites without disruption while access statistics accumulate, and the data appears under Reports, then Web protection in the Defender portal. Microsoft even documents deploying a policy with no categories selected as a deliberate audit-only pattern to understand user behavior before making blocking decisions. Note also that policy changes can take up to two hours to enforce.

Question 26

A security administrator enables the ASR rule 'Block credential stealing from the Windows local security authority subsystem' in Block mode through an Intune endpoint security policy. A legacy single sign-on agent used by the finance team is repeatedly blocked when it reads LSASS memory. The administrator adds the agent's folder to the Microsoft Defender Antivirus exclusion list with Set-MpPreference -ExclusionPath, but the blocks continue. What should the administrator do to exclude only this application without weakening other ASR rules?

Accepted Answer

Correct answer: C. The exclusion support matrix in the ASR rules overview shows that 'Block credential stealing from the Windows local security authority subsystem' does not honor Microsoft Defender Antivirus file/folder exclusions; it honors only global ASR exclusions and per-ASR-rule exclusions. A per-rule exclusion is the narrowest option because it applies to this rule alone, while a global ASR exclusion would weaken every rule. Per-ASR-rule exclusions are supported only in Group Policy and Intune endpoint security policies, so adding the agent's path to this rule in the existing Intune policy is the correct fix.

Question 27

A SOC analyst needs to collect a forensic package from a compromised Windows device in Microsoft Defender for Endpoint without disrupting the user's session. Which response action accomplishes this?

Accepted Answer

Correct answer: C. The 'Collect investigation package' action gathers forensic artifacts from the device, including logs, running processes, network connections, and other investigation data, and makes them available for download. This action does not disconnect the user's session or block network access, so it is the least disruptive option for forensic collection.

Question 28

A vulnerability analyst needs Microsoft Defender for Endpoint to discover and run vulnerability assessments against the organization's Cisco switches and Palo Alto firewalls. These network appliances cannot run the Defender sensor. What is the correct approach?

Accepted Answer

Correct answer: D. Network infrastructure devices such as switches, routers, firewalls, WLAN controllers, and VPN gateways cannot run the sensor, so Defender for Endpoint uses authenticated network scans. You designate one or more onboarded Windows devices as scanners, and they periodically query the target appliances using SNMP read-only (SNMPv2 or SNMPv3). Once discovered and classified, the network devices flow into Defender Vulnerability Management so you receive security recommendations and vulnerability findings for them. You configure this under Settings, then Device discovery, then Authenticated scans, and it requires the Manage security settings in Defender permission.

Question 29

After an onboarding wave, an administrator filters the Defender portal device inventory by sensor health and finds a Windows device marked 'Misconfigured' with the sub-state 'No sensor data' rather than 'Impaired communications.' What does this distinction tell the administrator, and what should be checked beyond basic connectivity?

Accepted Answer

Correct answer: C. The 'Fix unhealthy sensors' article splits Misconfigured into two sub-states with different remediation paths. 'Impaired communications' means limited communication between the device and the service, and the checks are connectivity focused: WinHTTP proxy configuration and access to the Defender for Endpoint service URLs. 'No sensor data' means the device is talking to the service but reporting only partial sensor data, which points past connectivity. On top of the proxy and URL checks, confirm the Windows diagnostic data service is set to start automatically and is running, verify the Early Launch Antimalware (ELAM) driver is enabled when a third-party antimalware client is in use, and check that Defender Antivirus is not disabled by policy.

Question 30

A security engineer is rolling out attack surface reduction rules through an Intune endpoint security policy and plans to use Warn mode across the board, so users can temporarily bypass blocks with the Unblock option during the transition period. For which rule will this plan fail, because the rule does not support Warn mode?

Accepted Answer

Correct answer: C. Per the ASR rules overview on Microsoft Learn, two rules do not support Warn mode: 'Block credential stealing from the Windows local security authority subsystem' and 'Block Office applications from injecting code into other processes.' For every other rule, Warn (code 6) behaves like Block but presents a notification with an Unblock option that grants a 24-hour bypass, generating event ID 1129 when a user overrides. Warn mode requires Windows 10 version 1809 or later, antivirus platform 4.18.2008.9+ and engine 1.1.17400.5+, and is not available at all in Microsoft Configuration Manager. The LSASS rule is also one of the three standard protection rules recommended for Block mode from day one.

Question 31

While containing an incident, a SOC analyst opens the profile page of a confirmed malicious .exe file and wants to add a block indicator so the file cannot run anywhere in the organization. The capability to block the file is unavailable in the tenant. Which configuration must be in place for file block indicators to work?

Accepted Answer

Correct answer: C. Blocking files through indicators is gated by the 'Allow or block file' toggle under Settings, then Endpoints, then General, then Advanced features. Microsoft Learn states blocking is only available if the organization uses Microsoft Defender Antivirus as the active antimalware solution and cloud-delivered protection is enabled (antimalware client 4.18.1901.x or later). Once on, the Add Indicator capability on a file's profile page can block the portable executable from being read, written, or executed on devices across the organization. A related trap: EDR in block mode does not respect Defender for Endpoint indicators, so allow indicators do not exempt files from EDR in block mode's remediation.

Question 32

Your organization onboarded Microsoft Sentinel to the Defender portal and integrated Microsoft Defender XDR incidents, and you are also ingesting Defender for Cloud alerts. You now see duplicate incidents for the same Defender for Cloud alerts. Which set of actions eliminates the duplicates?

Accepted Answer

Correct answer: B. When Defender for Cloud incidents already flow in through the Defender XDR incident connector, you should use the Tenant-based Defender for Cloud connector to sync alerts, disconnect the Subscription-based (Legacy) connector, and disable any Sentinel analytics/incident-creation rules built on Defender for Cloud alerts. Together these steps prevent the same alert from generating duplicate incidents.

Question 33

You map MITRE ATT&CK tactics and techniques on a custom hunting query, then create bookmarks from that query's results. By default, what MITRE mapping do the new bookmarks have?

Accepted Answer

Correct answer: B. Bookmarks default to using the same entity and MITRE ATT&CK technique mappings as the hunting query that produced the bookmarked results. You can still add or change mappings manually on each bookmark.

Question 34

You need to ingest logs from a third-party SaaS security product that exposes only a REST API. Requirements: fully cloud-based with no VM or agent to install and maintain, built-in connector health monitoring, and the ability to package and deploy the connector as a Content hub solution. Which connector approach best fits?

Accepted Answer

Correct answer: B. The Codeless Connector Framework (CCF) lets you define a connector in a configuration file that pulls from REST APIs, with no service or agent to install or maintain. CCF connectors are fully SaaS, include health monitoring, are fully supported by Microsoft, and can be deployed to your workspace or published as a Content hub solution.

Question 35

A SOC analyst wants to quickly triage the single most unusual events for a user over the last day, using UEBA's near-real-time, event-level score that ranges from 0 (benign) to 10 (highly anomalous). Which table and field should the KQL query target?

Accepted Answer

Correct answer: B. The InvestigationPriority field in the BehaviorAnalytics table is UEBA's near-real-time, event-level score (0-10) that quantifies how unusual a single event is, combining an entity anomaly score with a time-series score. It is designed for quick triage and drilling into single events.

Question 36

You create a Microsoft Sentinel summary rule to aggregate verbose logs on a schedule. Which statement about the destination table and scheduling is correct?

Accepted Answer

Correct answer: D. Summary rule results are stored in a custom table (name ending in _CL) that uses the Analytics data plan, so results are fully queryable. binSize defines the aggregation interval, and the optional binDelay (default roughly 3.5 minutes up to 10% of binSize, configurable up to 1440 minutes) waits for late-arriving data before running the bin.

Question 37

In the Entities tab of an incident details page in Microsoft Sentinel (Azure portal), an analyst notices that some entity names appear as clickable links. What is the difference between selecting an entity's name (the link) versus selecting the row the entity is in (but not the name)?

Accepted Answer

Correct answer: A. If the entity name appears as a link, selecting it redirects you to the full Microsoft Sentinel entity page, outside the incident. Selecting the row (without clicking the name) displays the entity's details in a side panel with the Info, Timeline, and Insights cards, letting you stay in the incident context.

Question 38

A threat hunter enables User and Entity Behavior Analytics (UEBA) in Microsoft Sentinel and expects entity profiles for on-premises Active Directory users to appear in the IdentityInfo table for enrichment. Cloud (Microsoft Entra ID) users populate correctly, but on-premises-only AD accounts never show up. What is the most likely cause?

Accepted Answer

Correct answer: A. When you configure UEBA you choose which directory services to sync user entities from - Microsoft Entra ID and/or on-premises Active Directory. Syncing on-premises AD user entities into UEBA (the IdentityInfo table) requires Microsoft Defender for Identity, standalone or as part of Defender XDR, with the MDI sensor installed on your domain controllers. Without MDI, UEBA remains cloud-only and on-premises-only AD accounts won't populate IdentityInfo, regardless of other configuration.

Question 39

A detection engineer wants to alert on a specific sign-in pattern within one minute of events arriving in Microsoft Sentinel. Which analytics rule type should be used?

Accepted Answer

Correct answer: D. NRT analytics rules are designed to run once every minute and capture events ingested in the preceding minute, with only a two-minute delay to account for ingestion time. They provide the fastest possible detection response within Microsoft Sentinel, making them the right choice when near-instantaneous alerting is required.

Question 40

A security engineer needs to allow a SOC analyst to manage incidents in Microsoft Sentinel but must prevent that analyst from creating or editing analytics rules. Which built-in Microsoft Sentinel role should be assigned?

Accepted Answer

Correct answer: A. Microsoft Sentinel Responder grants all Reader permissions plus the ability to manage incidents (triage, assign, close). It does not permit creating or editing analytics rules, workbooks, or other configuration resources. Microsoft Sentinel Contributor adds those configuration rights, which would exceed the required scope.

Question 41

An analyst wants to run one of Microsoft Sentinel's Jupyter notebooks (which use the MSTICPy library) to perform custom machine-learning analysis and visualizations on Sentinel data during an investigation. Within Microsoft Sentinel, what compute platform do these notebooks run on, and what access is required?

Accepted Answer

Correct answer: A. In Microsoft Sentinel, notebooks run on the Azure Machine Learning platform. To run them you must have appropriate access to both the Microsoft Sentinel workspace and an Azure Machine Learning workspace. The notebooks rely on the MSTICPy Python library.

Question 42

While hunting in a Microsoft Sentinel Jupyter notebook running on Azure Machine Learning, the notebook hangs and you restart the kernel to recover. What must you do afterward for the notebook to work correctly?

Accepted Answer

Correct answer: B. Restarting the kernel deletes all in-memory variables and state. You must rerun the initialization and authentication cells (for example, the MSTICPy setup and sign-in) before continuing, otherwise later cells fail because their prerequisites are gone.

Question 43

During a UEBA investigation you want to know which other users Microsoft Sentinel considers behavioral "peers" of a suspected compromised user, so you can judge whether an action is unusual relative to that peer group. Sentinel ranks the top peers using a TF-IDF weighting in which smaller groups carry higher weight. Which UEBA table holds this dynamically calculated peer ranking?

Accepted Answer

Correct answer: D. UserPeerAnalytics contains dynamically calculated peer groups, ranking the top 20 peers based on security group membership, mailing lists, and other associations. It uses the TF-IDF algorithm to normalize weights, so smaller groups carry higher weight.

Question 44

An analyst wants an interactive dashboard visualizing sign-in trends in Microsoft Sentinel and starts from a workbook template that shipped with an installed Content hub solution. After selecting Save on the template, what has actually been created, and where does the data live?

Accepted Answer

Correct answer: C. Microsoft Sentinel workbooks are built on Azure Monitor Workbooks. Saving a template creates an Azure resource based on that template in the location you choose; only the workbook's JSON definition is saved there - no data is copied. The workbook runs its queries against the underlying Log Analytics tables each time it is opened or refreshed, so it always reflects current data. You then select View saved workbook and Edit to customize it.

Question 45

You have imported threat indicators into Microsoft Sentinel and want them to automatically generate alerts and incidents when they match events flowing in from your connected data sources (for example, matching a malicious IP against firewall logs). Which type of analytics rule is designed to correlate your imported indicators with ingested events?

Accepted Answer

Correct answer: D. TI map analytics rules, which use the "TI map..." naming format, map your imported threat indicators against events from connected data sources to automatically generate alerts and incidents when a match occurs.

Question 46

An analyst needs to create a Microsoft Sentinel analytics rule that detects a specific event pattern within one minute of its occurrence and generates an alert for every matching event up to 30 events. Which rule type should the analyst use, and what happens when more than 30 matching events occur in a single run?

Accepted Answer

Correct answer: A. NRT (near-real-time) analytics rules are designed for up-to-the-minute detection and run their queries at one-minute intervals. When the event grouping option is set to generate an alert per event, NRT rules support up to 30 events. If more than 30 events match, single-event alerts are generated for the first 29 events, and a 30th summary alert covers all events in the result set. This is a specific NRT behavior not shared by scheduled rules.

Question 47

A playbook in Microsoft Sentinel is created to run automatically when an incident is created. A junior analyst holds only the Microsoft Sentinel Responder role. They want to manually run this playbook against an open incident. Which additional role must be granted?

Accepted Answer

Correct answer: A. The Microsoft Sentinel Responder role can access and manage incidents, including running a playbook manually from within an incident. However, actually running the playbook manually requires the Microsoft Sentinel Playbook Operator role assigned to the resource group where the playbook resides. Responder provides incident access; Playbook Operator provides the run permission.

Question 48

A threat hunter writes an advanced hunting query that joins DeviceLogonEvents (left side) to DeviceProcessEvents (right side) on DeviceId without specifying a join kind. The left table contains dozens of failed logon rows for the same device, but the results include only one failed logon row per device. What explains this behavior?

Accepted Answer

Correct answer: A. innerunique is the default join flavor when the kind parameter is not specified. Learn documents that it removes duplicate keys from the left side before matching, leaving a single (arbitrary) row for each unique join-key value, then matches that deduplicated left side against the right table. The advanced hunting best practices page calls out this exact trap and recommends specifying kind=inner when you need every matching row combination, such as one row per failed logon.

Question 49

Your cross-table hunting query joins a small table of suspicious IPs (a few hundred rows) with a huge network-flow table (billions of rows). Following KQL best practices, how should you structure the join for best performance?

Accepted Answer

Correct answer: B. KQL best practice for join is to place the table with the fewest rows on the left (first) side, because the left side is loaded into memory to build the join. Putting the small suspicious-IP set on the left minimizes memory pressure. (For single-column filtering, in is also often preferable to a left semi-join.)

Question 50

A string column in your hunting results contains repeating key=value entries such as: Action=BlockedByPolicy; RuleId=4471; User=contoso\jdoe. In a single step you want to break this into three separate columns (Action, RuleId, User) using the repeating pattern. Which KQL operator is purpose-built for extracting multiple values from one string into new columns?

Accepted Answer

Correct answer: B. The parse operator evaluates a string expression and extracts multiple substrings into new calculated columns based on a pattern, effectively running multiple extract() applications on the same string in one statement. It's the standard tool for structuring key=value or printf-style strings.

Question 51

In DeviceProcessEvents you filter on FileName == "powershell.exe" to find suspicious PowerShell executions. You now need the PARENT process that spawned each PowerShell instance, to spot an Office-app-to-PowerShell chain. Which column holds the name of the process that launched the recorded process?

Accepted Answer

Correct answer: B. In DeviceProcessEvents the recorded (created) process is described by the FileName and Process* columns, while the process that started it is the 'initiating process.' So InitiatingProcessFileName is the immediate parent (e.g., winword.exe launching powershell.exe). InitiatingProcessParentFileName is one level higher: the grandparent.

Question 52

A SOC manager builds a custom workbook from the SecurityIncident table to compute mean time to triage. They notice incident counts are inflated because the table appends a new row every time an incident is created or updated. Which KQL pattern correctly returns only the latest state of each incident before computing metrics?

Accepted Answer

Correct answer: D. SecurityIncident appends a new row on every incident create and update, so the current state lives in the newest record. summarize arg_max(TimeGenerated, *) by IncidentNumber (or by LastModifiedTime) keeps that latest row with all its columns for each incident, giving you one clean row per incident before computing metrics like mean time to triage. The classic trap is arg_min, which hands back the creation-time snapshot instead.

Question 53

You want to hunt for hosts whose outbound connection counts spike abnormally versus their own seasonal baseline over the past 14 days, using KQL's built-in time-series anomaly detection. Which approach produces input in the correct shape for series_decompose_anomalies()?

Accepted Answer

Correct answer: D. series_decompose_anomalies() operates on a dynamic numeric array (a series). make-series produces exactly that: one evenly-spaced, gap-filled (default=0) numeric array per DeviceName over the time axis, which is the required input. The function decomposes each series into seasonal/trend/residual components and scores outliers on the residual.

Question 54

A hunting query returns a column named Ips that is a dynamic array holding multiple IP addresses per row, for example ["10.0.0.5","203.0.113.9"]. You need one row per individual IP so you can join each address against a watchlist. Which operator do you use?

Accepted Answer

Correct answer: C. mv-expand expands a multi-value dynamic array into multiple records, generating one row per element and duplicating all other columns onto each row. It is the inverse of the aggregation operators (make-list/make_set) that pack values into an array, and it is the standard way to fan out an array for per-element joins.

Question 55

During an investigation, an analyst wants a single result set containing every row from both DeviceFileEvents and DeviceImageLoadEvents that references a suspicious SHA1 hash, stacked vertically, with an extra column showing which table each row came from. Which KQL construct does this?

Accepted Answer

Correct answer: B. union takes two or more tables and returns all their rows stacked vertically. The withsource parameter adds a new column whose value in each row is the name of the table the row came from, which is exactly what is needed to trace each hit back to its origin when combining multiple event tables in a hunt.

Question 56

An analyst's advanced hunting query completes successfully but the portal displays a message indicating the displayed results are partial due to size constraints. Which service limit was reached, and what is the most effective fix?

Accepted Answer

Correct answer: C. Advanced hunting enforces a 64-MB limit on the overall size of the results data. The limit is not just about record count: the number of columns, data types, and field lengths all contribute. When a query result exceeds 64 MB, the portal returns the maximum number of records it can fit within the limit and displays a message that the displayed results are partial due to size constraints. Because width drives the size, the effective fix is narrowing the payload: project only the needed columns, drop large dynamic fields, or summarize before returning.

Question 57

A threat hunter promotes an advanced hunting query on DeviceProcessEvents (Defender XDR data) to a custom detection rule with the frequency set to every hour. The query filters Timestamp > ago(24h). Analysts notice the scheduled rule catches far fewer events than the same query run interactively. What is the cause?

Accepted Answer

Correct answer: B. For custom detections that include Defender XDR data, the lookback period is fixed by the chosen frequency: every 24 hours looks back 30 days, every 12 hours looks back 48 hours, every 3 hours looks back 12 hours, and hourly rules look back four hours. Microsoft Learn explicitly warns to match the time filters in your query with the lookback period, because results outside of the lookback period are ignored. An hourly rule therefore only ever evaluates four hours of data, no matter what the query's ago() filter says. Only rules targeting Microsoft Sentinel data exclusively get a configurable lookback.

Question 58

An analyst investigating a potential business email compromise (BEC) attack needs to find all logon events made by email recipients within 30 minutes after they received emails that were identified as malware and where Zero-hour Auto Purge (ZAP) failed. Which pair of Advanced Hunting tables provides the data needed to correlate these events in a single KQL query?

Accepted Answer

Correct answer: B. EmailPostDeliveryEvents captures security events that occur after email delivery, including ZAP actions and their results (ActionType contains 'ZAP' and ActionResult can be 'Error' for failures). IdentityLogonEvents captures authentication events on Active Directory and Microsoft online services, enabling correlation with RecipientEmailAddress matching AccountUpn. This is the canonical table pair for ZAP-failure + subsequent logon correlation shown in Microsoft's own hunting scenario examples.

Question 59

An analyst is writing an Advanced Hunting query in Microsoft Defender XDR to find all devices where a potentially compromised user account (username: 'jsmith') has logged on, and then list all active alerts triggered on those devices. Which table should be the starting point, and what join strategy correctly avoids duplicating device records?

Accepted Answer

Correct answer: B. The documented Microsoft example for this exact scenario starts with DeviceInfo filtered for LoggedOnUsers containing the account name, then takes distinct DeviceIds to avoid duplication, then performs a kind=inner join to AlertEvidence on DeviceId (inner join prevents deduplication of left-side DeviceId values that could cause fan-out), projects AlertId, and then joins AlertInfo to retrieve alert details. This is the canonical multi-table hunting pattern shown in the Microsoft Advanced Hunting documentation.

Question 60

A threat hunter suspects malware established persistence by adding a value under HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run on managed endpoints. Which advanced hunting table should the query target to find the creation or modification of that value, along with the process that made the change?

Accepted Answer

Correct answer: C. DeviceRegistryEvents contains information about the creation and modification of registry entries, exposing RegistryKey, RegistryValueName, and RegistryValueData columns to filter for the Run key, plus PreviousRegistryValueData for modifications and the InitiatingProcess* columns identifying which process (and account) made the change. The table is populated by Microsoft Defender for Endpoint, so it only returns rows on devices onboarded to MDE.

Question 61

A threat hunter wants to write a Microsoft Defender XDR Advanced Hunting query to find all devices where a file from a known malicious sender (MaliciousSender@example.com) was delivered as an email attachment and is now present on the device. Which table join correctly maps email attachment file hashes to device file events?

Accepted Answer

Correct answer: B. The canonical Microsoft hunting scenario for 'check if files from a known malicious sender are on your devices' filters EmailAttachmentInfo by SenderFromAddress, then joins to DeviceFileEvents on SHA256. The hash is what makes the correlation trustworthy: file names get renamed, but the SHA256 stays consistent from email attachment to file on disk.

Question 62

A SOC manager wants threat hunters to document each proactive investigation with a stated hypothesis, work from cloned copies of hunting queries scoped to that investigation, collect bookmarks and their entities in one place, and report program metrics such as validated hypotheses and new analytics rules created. Which Microsoft Sentinel capability should the team use?

Accepted Answer

Correct answer: D. The Hunts feature is Microsoft Sentinel's end-to-end proactive hunting workflow. A hunt is a named investigation container with a hypothesis state you update as evidence accumulates, queries that are cloned into the hunt so they can be edited without affecting the workspace query library, hunt-specific bookmarks with an Entities tab that deduplicates mapped entities, a comment thread for collaboration, and direct actions to create analytics rules and incidents. The metrics bar on the Hunts tab tracks validated hypotheses, new incidents created, and new analytics rules created. Using the feature requires the Microsoft Sentinel Contributor role or a custom Azure RBAC role with Microsoft.SecurityInsights/hunts permissions.

Question 63

You're reviewing the Secure score recommendations tab in Microsoft Defender for Cloud to decide which security control to prioritize. All listed controls are relevant to your environment. Which security control carries the highest maximum contribution to the classic secure score, and should therefore be prioritized first?

Accepted Answer

Correct answer: B. In the classic secure score model, each security control has a fixed maximum point value reflecting its relative significance. Enable MFA is weighted at 10 points, the highest of all controls, because Defender for Cloud places a high value on multifactor authentication for protecting subscription users.

Question 64

You're enabling Defender for Servers on Amazon EC2 instances through the native AWS connector. Beyond turning on the plan, what must be present on the EC2 instances for full protection?

Accepted Answer

Correct answer: B. Defender for Servers on AWS requires the EC2 instances to be connected via Azure Arc. Arc autoprovisioning depends on the AWS SSM Agent (with the AmazonSSMManagedInstanceCore policy) being present; if the SSM Agent is missing, Arc autoprovisioning can't proceed.

SC-200 practice questions, with full explanations

Microsoft Defender XDR (16 questions)

Your tenant has Microsoft Defender for Office 365 but no custom Safe Attachments or Safe Links policies, and you have not enabled the Standard or Strict preset security policies. Which statement about the protection your recipients receive is correct?

You configure a Microsoft Defender XDR custom detection rule against Defender XDR data with a frequency of "Every 3 hours." To avoid missing or double-counting events, what lookback period does the rule apply, and how should your query's time filter relate to it?

During email remediation in Microsoft Defender, which action moves the messages to the user's Recoverable Items\Deletions folder, leaving them recoverable by the user?

A security operations manager still runs Microsoft Sentinel exclusively in the Azure portal and asks how long that experience remains supported before the team must operate from the Microsoft Defender portal. What should you tell them?

During an incident investigation, Microsoft Defender XDR automatically contained several user accounts and isolated two devices without analyst intervention. The incident carries the 'Attack Disruption' tag. Which feature triggered these containment actions?

While investigating in the incident graph, an analyst switches the associated-incidents view from This incident only to All associated incidents. What is the effect of this change?

Microsoft Defender for Endpoint (15 questions)

A device group in Microsoft Defender for Endpoint has its remediation (automation) level set to Semi - require approval for non-temp folders. An automated investigation returns a Malicious verdict for an executable found in the signed-in user's Downloads folder. What happens to the remediation?

An administrator creates a web content filtering policy in the Microsoft Defender portal that blocks the 'Gambling' category and scopes it to a device group. What is the behavior for websites in categories the policy does not block?

A SOC analyst needs to collect a forensic package from a compromised Windows device in Microsoft Defender for Endpoint without disrupting the user's session. Which response action accomplishes this?

A vulnerability analyst needs Microsoft Defender for Endpoint to discover and run vulnerability assessments against the organization's Cisco switches and Palo Alto firewalls. These network appliances cannot run the Defender sensor. What is the correct approach?

Microsoft Sentinel (16 questions)

Your organization onboarded Microsoft Sentinel to the Defender portal and integrated Microsoft Defender XDR incidents, and you are also ingesting Defender for Cloud alerts. You now see duplicate incidents for the same Defender for Cloud alerts. Which set of actions eliminates the duplicates?

You map MITRE ATT&CK tactics and techniques on a custom hunting query, then create bookmarks from that query's results. By default, what MITRE mapping do the new bookmarks have?

A SOC analyst wants to quickly triage the single most unusual events for a user over the last day, using UEBA's near-real-time, event-level score that ranges from 0 (benign) to 10 (highly anomalous). Which table and field should the KQL query target?

You create a Microsoft Sentinel summary rule to aggregate verbose logs on a schedule. Which statement about the destination table and scheduling is correct?

In the Entities tab of an incident details page in Microsoft Sentinel (Azure portal), an analyst notices that some entity names appear as clickable links. What is the difference between selecting an entity's name (the link) versus selecting the row the entity is in (but not the name)?

A detection engineer wants to alert on a specific sign-in pattern within one minute of events arriving in Microsoft Sentinel. Which analytics rule type should be used?

A security engineer needs to allow a SOC analyst to manage incidents in Microsoft Sentinel but must prevent that analyst from creating or editing analytics rules. Which built-in Microsoft Sentinel role should be assigned?

While hunting in a Microsoft Sentinel Jupyter notebook running on Azure Machine Learning, the notebook hangs and you restart the kernel to recover. What must you do afterward for the notebook to work correctly?

An analyst wants an interactive dashboard visualizing sign-in trends in Microsoft Sentinel and starts from a workbook template that shipped with an installed Content hub solution. After selecting Save on the template, what has actually been created, and where does the data live?

A playbook in Microsoft Sentinel is created to run automatically when an incident is created. A junior analyst holds only the Microsoft Sentinel Responder role. They want to manually run this playbook against an open incident. Which additional role must be granted?

Threat Hunting with KQL (15 questions)

Your cross-table hunting query joins a small table of suspicious IPs (a few hundred rows) with a huge network-flow table (billions of rows). Following KQL best practices, how should you structure the join for best performance?

You want to hunt for hosts whose outbound connection counts spike abnormally versus their own seasonal baseline over the past 14 days, using KQL's built-in time-series anomaly detection. Which approach produces input in the correct shape for series_decompose_anomalies()?

A hunting query returns a column named Ips that is a dynamic array holding multiple IP addresses per row, for example ["10.0.0.5","203.0.113.9"]. You need one row per individual IP so you can join each address against a watchlist. Which operator do you use?

During an investigation, an analyst wants a single result set containing every row from both DeviceFileEvents and DeviceImageLoadEvents that references a suspicious SHA1 hash, stacked vertically, with an extra column showing which table each row came from. Which KQL construct does this?

An analyst's advanced hunting query completes successfully but the portal displays a message indicating the displayed results are partial due to size constraints. Which service limit was reached, and what is the most effective fix?

Manage a security operations environment (13 questions)

You're enabling Defender for Servers on Amazon EC2 instances through the native AWS connector. Beyond turning on the plan, what must be present on the EC2 instances for full protection?

Which statement accurately describes how agentless machine scanning in Microsoft Defender for Cloud operates?

A subscription has Defender CSPM enabled with 'Agentless scanning for machines' turned on, but Defender for Servers Plan 2 is not enabled. The team expects agentless malware detection on their Azure VMs but receives no malware alerts. Why?

Two Defender for Cloud governance rules apply to the same recommendation on an Azure subscription: one rule is defined at the parent management group, the other at the subscription, each specifying a different owner and due date. How does Defender for Cloud resolve the conflict?

In the Just-in-time VM access page in Defender for Cloud, one of your VMs is listed under the Unsupported tab. Which condition explains why Defender for Cloud considers it unsupported for JIT?

You plan to protect Azure VM management ports with just-in-time (JIT) VM access. Which Defender plan is required, and what is the default maximum access time window when JIT is enabled with default settings?

During a security review, you're asked how Defender for Cloud authenticates to a connected AWS account. Which description is correct for the native AWS connector?

You remediated a Defender for Cloud recommendation that is tagged 'Preview' across all affected resources. Eight hours later, your subscription's classic secure score is unchanged. What is the most likely reason?

A SOC analyst is assigned the Security Reader role on an Azure subscription. They open the Regulatory compliance dashboard in Defender for Cloud, but the policy compliance data doesn't appear for them. Which change lets them view the policy compliance data while following least privilege?

You enable Microsoft Defender for Storage (per-storage-account plan) with on-upload malware scanning. To control cost, you want to confirm the default monthly scan cap and how to remove it. Which statement is correct?

When you first enable Microsoft Defender for Cloud on an Azure subscription, which security/compliance standard is automatically assigned and immediately begins assessing your resources by default?

Other certification question sets