Microsoft SC-200 Practice Exam Questions & Answers

In Microsoft Defender for Cloud (previously Azure Security Center and Azure Defender), email notifications for security alerts are configured under the ''Pricing & settings'' section of the workspace or subscription settings. According to Microsoft documentation, each subscription connected to Defender for Cloud has a ''Pricing & settings'' page that allows administrators to manage configurations such as Defender plan activation, data collection settings, and email notifications for security alerts.

To enable the SOC team to receive alert notifications, you navigate to Microsoft Defender for Cloud Environment settings [Select Subscription] Pricing & settings Email notifications. There, you can specify:

The email addresses (up to 200) that will receive alerts.

Whether to send notifications for high-severity alerts only or for all alerts.

Whether to send to subscription owners, contributors, or specific emails.

This configuration ensures that alert emails are automatically sent whenever Defender for Cloud generates new security alerts, allowing the Security Operations team to stay informed without manual monitoring.

The other options are incorrect because:

Security solutions is for integrating third-party or partner security products.

Security policy defines compliance and assessment standards.

Security alerts shows existing alerts but does not control notification settings.

Azure Defender is the protection plan; it doesn't control notification preferences.

Therefore, the correct answer is C. Pricing & settings.

In Microsoft Sentinel, ASIM (Advanced Security Information Model) parsers standardize data ingestion across different log sources. If you need to exclude a specific built-in, source-specific ASIM parser (for instance, to prevent it from being invoked by a unified parser), Microsoft documentation specifies creating a watchlist named _ASIM_Exclusions in your workspace.

The watchlist allows defining rules for exclusion by source or parser type---without modifying core ASIM logic---thus maintaining manageability and upgrade compatibility.

Correct Answer: A. a watch list

Labeling activities are available in Activity explorer.

For example:

Sensitivity label applied

This event is generated each time an unlabeled document is labeled or an email is sent with a sensitivity label.

It is captured at the time of save in Office native applications and web applications.

It is captured at the time of occurrence in Azure Information protection add-ins.

Upgrade and downgrade labels actions can also be monitored via the Label event type field and filter.

In Microsoft Sentinel, during incident investigation, you can label certain entities directly from the incident page as Indicators of Compromise (IOCs). According to Microsoft Sentinel's entity behavior and investigation documentation, entities such as IP addresses, URLs, file hashes, and domains can be directly marked as IOCs because they represent observable threat indicators that can be tracked across the environment.

While entities like User accounts, Hosts, and Malware names are part of incident context, they are not directly taggable as IOCs from the incident page because Sentinel expects IOCs to represent specific, traceable, external threat artifacts (e.g., IPs, domains, or file hashes).

Therefore, from the list provided --- Host, IP address, User account, and Malware name --- only the IP address entity can be directly labeled as an IOC from within the incident interface in Sentinel.

Answer: D. IP address

When User and Entity Behavior Analytics (UEBA) is enabled in Microsoft Sentinel, it automatically monitors Azure AD Sign-in Logs and provides activity templates for detecting common risky behaviors, such as failed sign-in attempts, impossible travel, or infrequent country logins.

To detect failed interactive sign-ins with minimal administrative effort, you can simply enable the UEBA activity template for sign-in failures rather than building a custom scheduled alert or hunting query.

Answer: B. a UEBA activity template

In Azure Security Center (now integrated into Microsoft Defender for Cloud), when you receive a security alert, you can view details and recommended remediation actions directly within the portal. According to Microsoft documentation, each alert in Security Center provides two main sections when you choose Take Action:

Mitigate the threat -- steps to remediate the immediate incident.

Prevent future attacks -- recommendations generated by Defender for Cloud to strengthen your security posture and avoid similar alerts in the future.

To specifically view recommendations to resolve the alert, you expand the Prevent future attacks section. This section includes actionable insights such as enabling Just-In-Time (JIT) VM access, applying system updates, adjusting network security group rules, or enabling endpoint protection.

Other options are incorrect:

The Mitigate the threat section focuses on immediate containment, not preventive recommendations.

Regulatory compliance and Recommendations pages are general assessments, not alert-specific recommendations.

Therefore, the correct answer is A --- select the alert Take Action expand Prevent future attacks.

Live Response in Microsoft Defender for Endpoint is a powerful investigative and remediation capability that lets responders interactively run commands on an endpoint, collect files, and perform remediation steps (collect investigation packages, pull files, run scripts, or take forensic artifacts). However, Live Response is an on-demand tool invoked during or after an investigation; it does not by itself provide continuous detection coverage or automatic blocking of artifacts that a third-party AV missed. The requirement is to ensure devices are protected from malicious artifacts that were undetected by the third-party antivirus. To meet that objective you need capabilities that detect and block artifacts automatically (for example, EDR in block mode which actively blocks/remediates post-breach artifacts even when Defender AV is passive). Live Response helps respond to an identified artifact but does not create the detection and automatic blocking coverage that prevents or remediate undetected malicious artifacts at scale. Therefore enabling Live Response alone does not meet the stated protection goal.