Free SC-200 sample questions

Correct answer: Create a Data Collection Rule (DCR) with a custom text log source and a KQL transformation.

Data Collection Rules (DCRs) with the Azure Monitor Agent are the modern and correct way to ingest custom text logs. A DCR can be configured to collect the proprietary log file, and a KQL transformation within the DCR can parse the multi-line format and extract the required fields before sending the data to the specified custom table (`LegacyApp_CL`). This provides a robust and scalable solution.

Correct answer: Bookmark

Hunting bookmarks in Microsoft Sentinel are specifically designed to capture interesting events found during a threat hunt. An analyst can bookmark one or more log entries, which saves the query results, allows for adding tags and notes, mapping to MITRE ATT&CK tactics and techniques, and can be used to initiate an investigation or promote to an incident.

Correct answer: The message containing the file is blocked, and the user receives a policy tip explaining why.

Microsoft Purview DLP policies for Microsoft Teams are designed to work in near real-time. When a user attempts to share sensitive information that violates a policy, the message will be blocked. The user who sent the message will receive a policy tip explaining that the message was blocked because it contains sensitive information, and administrators will see a corresponding alert.

Correct answer: A large number of malicious emails were retroactively removed from user inboxes after delivery.

ZAP stands for Zero-hour Auto Purge. It is a protection feature in Defender for Office 365 that detects and neutralizes malicious phishing, spam, or malware messages that have already been delivered to Exchange Online mailboxes. A spike in 'ZAP' events means the system identified threats post-delivery and automatically moved them to the junk folder or quarantine.

Correct answer: join

The `join` operator is used in KQL to merge the rows of two tables to form a new table by matching the values of the specified columns from each table. In this case, it correctly joins the two tables on the common `SHA256` column.

Correct answer: Microsoft Sentinel Responder

The Microsoft Sentinel Responder role is designed specifically for this purpose. It grants permissions to perform response actions on incidents, such as assigning, closing, and managing them, without allowing the user to change the configuration of Sentinel itself, like editing analytics rules or data connectors. This follows the principle of least privilege.

Correct answer: An Attack Surface Reduction (ASR) rule

Microsoft Defender for Endpoint includes a specific Attack Surface Reduction (ASR) rule named 'Block credential stealing from the Windows local security authority subsystem (lsass.exe)'. Enabling this rule in block mode directly prevents processes from accessing LSASS memory, which is a common technique used by tools like Mimikatz.

Correct answer: SecurityAlert | where TimeGenerated > ago(1d) | summarize count() by AlertName

This query correctly filters the `SecurityAlert` table for records within the last day (`ago(1d)`). It then uses the `summarize` operator with the `count()` aggregation function to count the number of rows for each unique `AlertName`. The `by AlertName` clause groups the results, producing the desired output of rule names and their corresponding alert counts.