SC-200 V3 Concepts - TD

What is Defender deception?

A Defender for Endpoint feature that plants fake items to trick attackers. Anyone who touches them triggers a high-confidence alert.

What is the difference between a lure and a decoy?

Lure = the bait, like a fake file or saved password on a real device | Decoy = the fake target the bait leads to, like a fake server or account

Where do you turn on deception in Defender for Endpoint?

Settings → Endpoints → Advanced features → Deception, then create deception rules

What is a honeytoken?

A real but unused account or device that you mark as a trap. Any activity on it raises an alert.

Where do you tag a honeytoken?

Settings → Identities → Entity tags → Honeytoken

What is Azure Event Hubs?

A service that streams large amounts of logs and events in real time, often used to send data to a third-party SIEM.

What is Azure Event Grid?

A service that sends a notification when something happens, like a file being uploaded. It isn't used for streaming logs.

What is Azure Data Factory?

A service that copies and transforms data between storage systems. It's a common wrong answer for real-time streaming questions.

What is Azure Data Lake Storage?

Storage for large amounts of raw data used in analytics. It doesn't stream data in real time.

What is Global Secure Access?

Microsoft's secure network access service. Entra Internet Access protects internet and SaaS traffic | Entra Private Access gives secure access to internal apps (a VPN replacement)

What is Microsoft Entra Permissions Management?

A CIEM tool that discovers and manages permissions across cloud environments (Azure, AWS and GCP). Retired in 2025; usually a wrong answer for session or token questions.

What is Microsoft Entra ID Governance?

Tools that control who has access and for how long, like access reviews, access packages and PIM.

What does a Privileged Role Administrator do?

Assigns and manages admin roles. It doesn't configure services itself.

What is continuous access evaluation (CAE)?

Lets services like Exchange and SharePoint cut off access almost immediately when a session is revoked, instead of waiting for the token to expire.

What is a commitment tier?

A plan where you commit to a daily data volume (from 100 GB/day) in exchange for a lower price per GB.

What is automatic attack disruption?

Defender XDR automatically stops an attack in progress, for example by disabling the user or containing the device.

What is Cloud Discovery user enrichment?

Defender for Cloud Apps swaps usernames in discovery logs for the matching Entra identities. It isn't needed for attack disruption.

What is a Defender for Cloud Apps app connector?

A connection to a cloud app, like Microsoft 365, that lets Defender for Cloud Apps see and control activity in that app.

What is agentless scanning in Defender for Cloud?

Scans a copy of a VM's disk for vulnerabilities, secrets and malware, with no agent installed on the VM.

What is the MicrosoftGraphActivityLogs table?

A log of every request made to Microsoft Graph, including which app made it and what it did.

What is the Workspace Usage Report workbook?

A built-in Sentinel workbook that shows how much data the workspace ingests, what it costs and how queries perform.

What is IPCustomEntity?

An old way of mapping an IP address entity in analytics rules. Newer rules use entity mapping instead.

What are the main building blocks of a workbook?

Text = headings and notes | Parameters = inputs like a time picker | Query = KQL that draws a chart or table | Metric = a metric chart | Links/tabs = navigation

What are the custom detection rule frequencies and how far back does each one look?

Every 24h → 30 days | Every 12h → 48 hours | Every 3h → 12 hours | Every 1h → 4 hours | Continuous (NRT) → new events only

Which custom detection frequency covers the last 14 days?

Every 24 hours, because it's the only one that looks back 30 days

How do you control which devices deception applies to?

Device tags

How do you get an alert whenever an attacker touches a specific device or account?

Tag it as a honeytoken

How do you detect an attacker using decoy AD accounts?

Tag them as honeytokens in Defender for Identity. An Entra ID Protection risk policy won't detect this.

The Fusion rule is on but never creates alerts. What do you check first?

That the data connectors Fusion needs are connected

One account keeps triggering false positives from a rule. How do you stop the alerts for just that account?

Edit the analytics rule to exclude that account

How do you suppress Defender for Cloud alerts that come from one specific Azure resource?

Create a suppression rule with the Azure Resource entity and its Resource ID (Security alerts → Suppression rules)

Which plan gives you agentless scanning of VMs?

Defender CSPM (also included in Defender for Servers Plan 2)

How do you leave some VMs out of agentless scanning?

Use tags

How do you get a near-real-time alert when something happens in Azure, like storage keys being listed?

Connect the Azure Activity data connector and create an analytics rule

What does automatic attack disruption need from Defender for Cloud Apps?(2)

The Microsoft 365 app connector and app governance turned on

Does a livestream session create incidents automatically?

No. Livestream is just for watching results live. Incidents come from analytics rules.

How do you send logs or alerts to a third-party SIEM in real time?

Azure Event Hubs

Where can Defender for Cloud continuous export send data?

A Log Analytics workspace (stays in Azure) | Azure Event Hubs (goes out to other tools)

How do you collect logs from every subscription, including resources created later?

Use a diagnostic settings connector with Azure Policy and a remediation task

How do you lower costs for a workspace that ingests 200 GB a day?

Use a commitment tier

How long can Sentinel keep data without extra storage cost?

90 days

Who can configure Microsoft Entra Internet Access?

Global Administrator and Global Secure Access Administrator

What's the easiest way to send Linux VM logs to Sentinel?

The Syslog connector (through AMA)

Which role lets someone export Defender for Cloud alert data with least privilege?

Reader, per this test. Some sources say Security Reader, so recognize both.

How do you quickly revoke a compromised user's Outlook on the web session?

A Conditional Access policy (using continuous access evaluation)

When automated investigation (AIR) is on, which response step still needs a person?

Isolating the device

Which live response commands handle background jobs?

run script.ps1 & = run in the background | jobs = list jobs and their command IDs | fg = bring a job back to the front

Which live response commands move files or stop a process?

putfile = library to device | getfile = device to you | remediate process = stop a process

Where do you create bookmarks?

Hunting. In the Defender portal, use Link to incident from Advanced hunting.

Which ASIM parser do you use for DNS events from all sources?

Im_Dns (parsers that start with _Im combine all sources)

Which table shows which app or service principal used the Graph API, for example to change a group?

MicrosoftGraphActivityLogs

With UEBA on, which table shows how well detection rules are working?

Anomalies

With UEBA on, which table holds entity behavior data?

BehaviorAnalytics

Which workbook element runs KQL and shows a chart?

Query

Which workbook element only provides inputs, like a time picker?

Parameters

What do you use for machine learning and custom charts on a large number of alerts?

Notebooks

What's the fastest way to limit query results to 100 rows?

take 100 (top also sorts, which takes longer)

How do you get each user's latest sign-in?

summarize arg_max(TimeGenerated, *) by UserName

How do you alert on and block a malicious file in Defender for Endpoint?

Add a file hash indicator set to Block and remediate

How do you monitor Sentinel workspace usage and performance?

The Workspace Usage Report workbook

What's the least-privilege role for editing workbook queries?

Microsoft Sentinel Contributor

Which roles do you need to turn on UEBA?

Security Administrator (or Global Admin) in Entra ID, plus Microsoft Sentinel Contributor on the workspace

What's the least-privilege role for changing Defender for Cloud security policies?

Security Admin

How do you limit access to trusted office IP ranges?

Named locations in Conditional Access

Which table do you use for a workbook that shows incidents and their tasks?

SecurityIncident

How do you track sensitivity label changes?

Purview Activity explorer

Which servers need Azure Arc before you can use Defender for Servers?

Servers outside Azure (on-premises, AWS, GCP). Azure VMs connect directly.

Where do you see which anomaly rules are turned on?

Analytics, on the Anomalies tab

Where do you see the external IP addresses involved in an incident?

In the incident's IP entities

Which incident tab lists all the users, devices and files involved?

Evidence and Response

What do you use to build a custom report of alert severity trends over 14 days?

A workbook

How do you compare successful and failed sign-ins per account in one result?

join kind=inner on the account

In a custom detection, how do you keep the latest Timestamp and ReportId while counting per device?

summarize (Timestamp, ReportId) = arg_max(Timestamp, ReportId), count() by DeviceId

Which table shows who changed what on Azure resources?

AzureActivity (check the Caller column)