Microsoft SC-200 QUESTIONS AND ANSWERS |
VERIFIED AND WELL DETAILED ANSWERS | PLUS
RATIONALES | GUARANTEED PASS | LATEST EXAM
UPDATE | STUVIA VERIFIED | EXAM PREP | STUDY
GUIDE | PRACTICE TEST
Domain 1: Mitigate threats using Microsoft 365 Defender (50 Questions)
1. A security analyst wants to automatically investigate and remediate alerts in Microsoft Defender for Office
365. Which feature should they enable?
,A. Attack Simulator
B. Automated Investigation and Response (AIR)
C. Threat Explorer
D. Safe Attachments
Answer: B
Rationale: Automated Investigation and Response (AIR) is the feature in Microsoft 365 Defender that allows for
automatic investigation and remediation of alerts, reducing the manual effort required by security teams.
2. Which Microsoft 365 Defender portal feature provides a unified view of incidents and alerts across all
Defender workloads?
A. Secure Score
B. Incidents queue
C. Advanced Hunting
D. Reports
Answer: B
Rationale: The Incidents queue in the Microsoft 365 Defender portal is designed to provide a single, unified view
of all correlated incidents and alerts from endpoints, identities, email, and cloud apps.
,3. An analyst needs to proactively hunt for threats using a query language across Microsoft 365 Defender data.
What should they use?
A. Search
B. Advanced Hunting with KQL
C. Alert Explorer
D. Action Center
Answer: B
Rationale: Advanced Hunting uses Kusto Query Language (KQL) to allow analysts to proactively explore raw
data, build custom queries, and hunt for threats across all Microsoft 365 Defender services.
4. What is the primary purpose of Microsoft Secure Score?
A. To provide a numerical score of an organization's security posture and offer improvement actions.
B. To score the severity of individual security incidents.
C. To measure the performance of security analysts.
D. To calculate the licensing cost for security products.
, Answer: A
Rationale: Microsoft Secure Score is a measurement of an organization's security posture, with a higher number
indicating more improvement actions taken. It provides a report and a score to help organizations understand
and improve their security.
5. An alert indicates a user's account was compromised and used to send phishing emails. Which Microsoft 365
Defender workload would be the primary source for this alert?
A. Microsoft Defender for Endpoint
B. Microsoft Defender for Identity
C. Microsoft Defender for Cloud Apps
D. Microsoft Defender for Office 365
Answer: B
Rationale: Microsoft Defender for Identity monitors on-premises Active Directory signals to identify and
investigate compromised identities. A compromised account used to send phishing emails would be detected by
its behavioral analytics.
6. Which tool is used to simulate phishing attacks against users to test and improve security awareness?
A. Threat Explorer
VERIFIED AND WELL DETAILED ANSWERS | PLUS
RATIONALES | GUARANTEED PASS | LATEST EXAM
UPDATE | STUVIA VERIFIED | EXAM PREP | STUDY
GUIDE | PRACTICE TEST
Domain 1: Mitigate threats using Microsoft 365 Defender (50 Questions)
1. A security analyst wants to automatically investigate and remediate alerts in Microsoft Defender for Office
365. Which feature should they enable?
,A. Attack Simulator
B. Automated Investigation and Response (AIR)
C. Threat Explorer
D. Safe Attachments
Answer: B
Rationale: Automated Investigation and Response (AIR) is the feature in Microsoft 365 Defender that allows for
automatic investigation and remediation of alerts, reducing the manual effort required by security teams.
2. Which Microsoft 365 Defender portal feature provides a unified view of incidents and alerts across all
Defender workloads?
A. Secure Score
B. Incidents queue
C. Advanced Hunting
D. Reports
Answer: B
Rationale: The Incidents queue in the Microsoft 365 Defender portal is designed to provide a single, unified view
of all correlated incidents and alerts from endpoints, identities, email, and cloud apps.
,3. An analyst needs to proactively hunt for threats using a query language across Microsoft 365 Defender data.
What should they use?
A. Search
B. Advanced Hunting with KQL
C. Alert Explorer
D. Action Center
Answer: B
Rationale: Advanced Hunting uses Kusto Query Language (KQL) to allow analysts to proactively explore raw
data, build custom queries, and hunt for threats across all Microsoft 365 Defender services.
4. What is the primary purpose of Microsoft Secure Score?
A. To provide a numerical score of an organization's security posture and offer improvement actions.
B. To score the severity of individual security incidents.
C. To measure the performance of security analysts.
D. To calculate the licensing cost for security products.
, Answer: A
Rationale: Microsoft Secure Score is a measurement of an organization's security posture, with a higher number
indicating more improvement actions taken. It provides a report and a score to help organizations understand
and improve their security.
5. An alert indicates a user's account was compromised and used to send phishing emails. Which Microsoft 365
Defender workload would be the primary source for this alert?
A. Microsoft Defender for Endpoint
B. Microsoft Defender for Identity
C. Microsoft Defender for Cloud Apps
D. Microsoft Defender for Office 365
Answer: B
Rationale: Microsoft Defender for Identity monitors on-premises Active Directory signals to identify and
investigate compromised identities. A compromised account used to send phishing emails would be detected by
its behavioral analytics.
6. Which tool is used to simulate phishing attacks against users to test and improve security awareness?
A. Threat Explorer
