SC-200 Configure Protection and Detection

What is a custom detection rule in Defender XDR?

A rule you build from an Advanced hunting query that runs on a schedule and creates alerts, and can take automatic actions like isolating a device.

What does the Continuous (NRT) frequency do in a custom detection rule?

Checks new events as they arrive, in near real time. It doesn't look back at older data, so it can't cover a time range like the last 14 days.

What are the custom detection rule frequencies and how far back does each one look?

Every 24h → 30 days | Every 12h → 48 hours | Every 3h → 12 hours | Every 1h → 4 hours | Continuous (NRT) → new events only

What is an indicator of compromise (IoC) in Defender for Endpoint?

A custom entry, like a file hash, IP, URL or certificate, that tells Defender what to allow, warn about, audit or block.
Forensic artifacts that indicate a potential intrusion

What is a file hash indicator?

An indicator that matches a specific file by its hash (SHA1 or SHA256). Use it to act on one malicious file, like a bad image file.

What is an IP/URL/Domain indicator?

An indicator that allows or blocks network connections to a specific IP, URL or domain. It acts on network traffic, not on a file.

What is a certificate indicator?

An indicator that allows or blocks files signed with a specific certificate. Its actions are only Allow or Block and remediate.

What does the Audit only response action do on an indicator?

Raises an alert when the indicator is seen but doesn't block anything.

What does Block execution do on an indicator?

Stops the file from running, but leaves existing copies on devices.

What does Block and remediate do on an indicator?

Stops the file from running and quarantines copies already on devices. Use it when you must alert and prevent the attack.

What is the Fusion rule in Sentinel?

A built-in machine learning rule that combines low-level alerts from different products into one high-confidence multistage attack incident. It only works with data from connected sources.

What is a data connector in Sentinel?

The connection that brings logs or alerts from a source, like Azure Activity or Defender for Cloud, into the Sentinel workspace. No connector = no data for rules to use.

What is a custom analytics rule?

A rule you write yourself with a KQL query to detect a specific pattern. It doesn't fix a rule like Fusion that has no data.

What is a Log Analytics workspace?

The storage where Sentinel keeps your logs. Adding another workspace doesn't give an existing rule more data.

What is an anomaly rule in Sentinel?

A built-in machine learning rule that flags unusual behavior compared with normal patterns. Results go to the Anomalies table, not straight into incidents.

What can you manage on the Sentinel Analytics page?

All analytics rules: Scheduled, NRT, Fusion, Microsoft Security and anomaly rules, including which ones are turned on.

What is the Sentinel Watchlist page used for?

reference dataset (ypically a CSV file) that you upload to enrich, correlate, or filter security events across your SIEM.

What is the Sentinel Settings page used for?

Workspace-level settings like playbook permissions, UEBA, anomalies settings and pricing. It doesn't list each rule's status.

What is the Sentinel Data connectors page used for?

Connecting and checking the status of data sources.

What is Defender deception?

A Defender for Endpoint feature that plants fake items to trick attackers. Anyone who touches them triggers a high-confidence alert.

What is the difference between a lure and a decoy?

Lure = the bait, like a fake file or saved password on a real device | Decoy = the fake target the bait leads to, like a fake server or account

What are device tags in Defender for Endpoint?

Labels you add to devices to group them. Used to scope deception rules and to put devices into device groups.

What are device groups in Defender for Endpoint?

Groups of devices used to control who can see them (through Entra groups) and their automation level. Not used to scope deception.

What are roles in Defender for Endpoint?

Permissions that decide what a user is allowed to do in the portal. They don't decide which devices a feature applies to.

What are security groups in Entra ID?

Groups of users or devices used to give access to resources. Used with device groups for access, not to scope deception.

What is a hunting query in Sentinel?

A saved KQL query that an analyst runs to look for threats. It only runs when someone runs it.

What is a livestream session?

A hunting tool that runs a query continuously so an analyst can watch matching events live. It doesn't create incidents and is retired in the current portal.

What is an analytics rule in Sentinel?

A rule that runs a KQL query on a schedule and automatically creates alerts and incidents. It's the answer whenever incidents must be created automatically.

What is a watchlist in Sentinel?

A list of reference data, like accounts or IPs, that queries can use. It only helps once the rule's query is changed to use it.
Collection of data from external data sources for correlation against the events

Why edit the analytics rule to stop false positives for one account?

Adding an exclusion for that account to the rule's query stops its alerts while every other account still alerts, with no ongoing manual work.

What is an Azure Automation runbook?

A PowerShell or Python script that runs in Azure Automation. It can handle alerts after they fire but doesn't stop them being created.

What is a Conditional Access policy?

An Entra ID policy that decides when users can sign in, for example requiring MFA or blocking risky sign-ins. It controls access, not which alerts are raised.
enforce access controls based on user, device, location, and risk signals. (if then)

What is a honeytoken?

A real but unused account or device that you mark as a trap. Any activity on it raises an alert.

Where do you tag a honeytoken?

Settings → Identities → Entity tags → Honeytoken

What are the entity tags in Defender for Identity? (3)

Sensitive = high-value accounts, devices or groups | Honeytoken = trap accounts or devices | Exchange server = marks Exchange servers as sensitive

What does the Exchange server entity tag do?

Marks a device as an Exchange server so Defender for Identity treats it as sensitive. It doesn't alert on every connection like a honeytoken.

What was the Sentinel honeytoken (deception) solution?

A preview Sentinel solution that planted fake keys and secrets in Azure Key Vault. It doesn't tag a real device as a trap.

What is Microsoft Entra ID Protection?

Detects risky users and risky sign-ins (unfamiliar locations, impossible travel, leaked credentials) and can respond with risk-based policies. It can't detect decoy accounts.

What is a sign-in risk policy?

An ID Protection policy that acts on risky sign-ins, usually by requiring MFA. It doesn't watch decoy accounts.

What is a user risk policy?

An ID Protection policy that acts when an account is likely compromised, usually by requiring a secure password change.

What is a suppression rule in Defender for Cloud?

A rule that automatically dismisses expected or false positive alerts, scoped to specific alert types and entities, with an optional expiry (up to 6 months).

Where do you create a suppression rule in Defender for Cloud?

Defender for Cloud → Security alerts → Suppression rules → Create new suppression rule

Which entity do you choose to suppress alerts from one Azure resource, like a Functions app?

Azure Resource, with its Resource ID. An IP entity is wrong when the noise comes from a specific resource.

What is the Security posture page in Defender for Cloud?

Shows your Secure Score and recommendations for improving configuration. It isn't used to suppress alerts.

What does Open query do on a Defender for Cloud alert?

Opens a log query related to the alert for investigation. It doesn't hide or suppress anything.

Which columns must a custom detection query return?

Timestamp, ReportId, and an entity column like DeviceId

What does arg_max(Timestamp, ReportId) do?

Returns the row with the latest Timestamp, and keeps that row's ReportId.

What does make_set() do?

Builds an array of unique values per group. It loses the single ReportId a custom detection needs.

Why does summarize count() by ActionType, DeviceId fail as a custom detection?

It drops Timestamp and ReportId, which custom detections require.

What is agentless scanning in Defender for Cloud?

Scans a copy (snapshot) of a VM's disk for vulnerabilities, secrets and malware, with no agent installed on the VM.

What is the Defender CSPM plan?

Defender for Cloud's paid posture plan. It adds agentless scanning, attack path analysis and Cloud Security Explorer.

What is the Defender for Databases plan?

Threat protection for databases like Azure SQL and Cosmos DB. It doesn't scan VM disks.

What is the Defender for App Service plan?

Threat protection for web apps hosted on Azure App Service. It doesn't scan VM disks.

How do you exclude VMs from agentless scanning?

Add a tag to those VMs

What are Azure tags?

Name-value labels on Azure resources used to organize them, and to include or exclude them from features like agentless scanning.

What is an Azure deployment stack?

A way to deploy and manage a group of Azure resources as one unit. It isn't used to exclude VMs from scanning.

What is an RBAC role assignment?

Gives a user, group or app permission to act on a resource. It controls access, not which resources get scanned.

What two things do you need for an automatic, near real-time alert on an Azure operation?

A data connector (like Azure Activity) and an analytics rule

What is a notebook in Sentinel?

A Jupyter (Python) environment for deep investigation and machine learning. It doesn't send alerts on its own.

What is proactive threat hunting?

Analysts searching manually for threats that haven't triggered alerts. It's not automatic.

What is automatic attack disruption?

Defender XDR automatically stops an attack in progress, for example by disabling the user or containing the device.

What is app governance?

A Defender for Cloud Apps feature that monitors and controls OAuth apps (including third-party apps) that access Microsoft 365 data, and can disable risky ones.

What is the Microsoft 365 app connector in Defender for Cloud Apps?

An API connection that lets Defender for Cloud Apps see and control activities and files in Microsoft 365. This is the M365 connector attack disruption needs.

Is there only one Microsoft 365 connector?

No. Defender for Cloud Apps has the Microsoft 365 app connector (API visibility) | Sentinel has the Microsoft 365 data connector (OfficeActivity table) | The Defender XDR connector brings Defender alerts into Sentinel

What is Cloud Discovery user enrichment?

Defender for Cloud Apps swaps usernames in discovery logs for the matching Entra identities. It isn't needed for attack disruption.

What are network security group (NSG) flow logs?

A Network Watcher feature that logs IP traffic passing through an NSG. It's a network log, not a Defender for Cloud Apps setting.

What is threat intelligence monitoring?

Watching threat intel feeds for known bad indicators. It isn't a step to turn on attack disruption.

What is continuous access evaluation (CAE)?

Lets services like Exchange and SharePoint cut off access almost immediately when a session is revoked, instead of waiting for the token to expire.

What is Microsoft Entra ID Governance?

Tools that control who has access and for how long, like access reviews, access packages and PIM.

What is Microsoft Entra Permissions Management?

A CIEM tool that discovers and manages permissions across cloud environments (Azure, AWS and GCP). Retired in 2025; usually a wrong answer for session or token questions.

What is a named location in Conditional Access?

A saved list of trusted IP ranges or countries, like headquarters, used to decide when MFA is required.

What is an app protection policy?

An Intune policy that protects company data inside apps, like blocking copy and paste to personal apps. It doesn't use locations.

What is a device compliance policy?

An Intune policy that checks whether a device meets your requirements, like encryption or OS version. It doesn't use locations.