Detect Threats by Using Microsoft Defender XDR SC-200 Practice Questions (Page 6)

Questions 26–29

1. 26foundation · easy

   A security analyst is using Microsoft Sentinel's entity behavior analytics to investigate a potential threat. What is the primary purpose of analyzing relationships between entities?

   • ATo identify hidden connections between entities that may indicate a coordinated attack
   • BTo replace the need for KQL queries in threat hunting
   • CTo provide a list of all entities that have been compromised
   • DTo automatically block all network traffic between entities
   Reveal Solution Discussion Select an answer first
2. 27application · medium

   A security analyst is investigating a suspicious email that was opened by a user. The email contained a link to a malicious website. The analyst wants to understand the full scope of the attack by examining the relationships between the email, the user, and the website. Which tool should the analyst use?

   • AReview the device timeline for the user's device.
   • BRun an advanced hunting query to find all emails from the same sender.
   • CUse the Sentinel Graph to explore the entity relationships.
   • DUse the threat analytics report for the email campaign.
   Reveal Solution Discussion Select an answer first
4. 28application · medium

   A security analyst is hunting for signs of credential theft. The analyst wants to find instances where a user logged on to a device and then used a different account to access a network share. Which table in Microsoft Defender XDR should the analyst query?

   • ACloudAppEvents
   • BEmailEvents
   • CIdentityLogonEvents
   • DDeviceLogonEvents
   Reveal Solution Discussion Select an answer first
5. 29application · medium

   A security operations center (SOC) analyst is investigating a potential data exfiltration incident. The analyst suspects that a user downloaded a large file from a SharePoint site and then uploaded it to a personal cloud storage service. The analyst wants to use advanced hunting to find evidence of both activities. Which KQL query would be most effective?

   • ACloudAppEvents | where ActionType in ('FileDownloaded', 'FileUploaded') | where AccountObjectId == 'user@contoso.com' | project Timestamp, ActionType, FileName, DestinationURL
   • BIdentityLogonEvents | where ActionType == 'LogonSuccess' | where AccountUpn == 'user@contoso.com' | project Timestamp, AccountUpn, IPAddress
   • CEmailEvents | where ActionType == 'EmailDelivered' | where SenderFromAddress == 'user@contoso.com' | project Timestamp, Subject, AttachmentName
   • DDeviceFileEvents | where ActionType in ('FileCreated', 'FileModified') | where AccountName == 'user' | project Timestamp, ActionType, FileName
   Reveal Solution Discussion Select an answer first