Investigate Microsoft 365 Activities to Identify Threats SC-200 Practice Questions (Page 1)

Questions 1–5

1. 1application · medium

   You are analyzing Microsoft Graph activity logs and notice a pattern where a service principal is making API calls to read emails from multiple users' mailboxes outside business hours. What should you do to determine if this is a legitimate application behavior?

   • ARun a Content search for the emails read by the service principal.
   • BDelete the service principal immediately.
   • CCheck the application's permissions and consent records in Azure AD.
   • DIgnore the pattern because it is from a service principal.
   Reveal Solution Discussion Select an answer first
2. 2application · medium

   A user reports that their Microsoft 365 account was used to send a large volume of email to external recipients at 3:00 AM. You need to identify the specific actions taken by the account during that time window. You have been granted the necessary permissions. What should you do first?

   • ASearch the Microsoft Purview audit log for activities by the user between 2:45 AM and 3:15 AM.
   • BReview the Microsoft Graph activity logs for the user's sign-in events at 3:00 AM.
   • CCheck the Azure AD sign-in logs for the user's IP address at 3:00 AM.
   • DRun a Content search in Microsoft Purview eDiscovery for emails sent by the user at 3:00 AM.
   Reveal Solution Discussion Select an answer first
4. 3application · medium

   A user reports that a suspicious email was opened and that files were downloaded from SharePoint. You need to determine whether the user's account was used to access SharePoint from an unusual location. You have access to Microsoft Purview. Which action should you take first?

   • AUse the Compliance Manager to check the user's risk score.
   • BSearch the audit log for the user's SharePoint file accesses and review the IP address and geolocation.
   • CReview the Microsoft Graph activity logs for the user's sign-in events.
   • DRun a Content search in eDiscovery for the user's email messages.
   Reveal Solution Discussion Select an answer first
5. 4expert · hard

   You need to find all emails in a user's mailbox that contain the phrase 'confidential' and were sent to a recipient at 'example.com' during the month of January. You are using Content search in eDiscovery. Which KQL query should you use?

   • Asubject:confidential AND recipient:example.com AND received:2024-01
   • Bconfidential AND to:example.com AND date:January
   • Cconfidential OR recipientdomain:example.com OR sent:2024-01-01..2024-01-31
   • Dconfidential AND recipientdomain:example.com AND sent:2024-01-01..2024-01-31
   Reveal Solution Discussion Select an answer first
6. 5foundation · easy

   When analyzing Microsoft Graph activity logs, what pattern might indicate a potential threat?

   • AAPI calls from a known IP address
   • BAPI calls occurring during business hours
   • CA single API call to read a user's profile
   • DA large number of API calls from a single application in a short time
   Reveal Solution Discussion Select an answer first