SC-200 Security Operations Analyst: Ultimate Self-Contained Study Guide

Exam Target: Microsoft Exam SC-200 (Microsoft Security Operations Analyst)

Official Alignment Date: July 28, 2026 skills measured

Purpose: Completely self-contained, end-to-end study & reference manual. Candidates using this guide do not need to open external links to understand the concepts, portal workflows, KQL queries, administrative steps, API boundaries, or readiness scenarios required to pass SC-200.

Table of Contents

1. Executive Summary & Exam Architecture
2. Domain 1: Manage a Security Operations Environment (40–45%)
   • 1.1 Automation for Defender XDR and Microsoft Sentinel
   • 1.2 Microsoft Sentinel SIEM & Platform Configuration
   • 1.3 Ingest Data into Microsoft Sentinel
   • 1.4 Configure Detections
3. Domain 2: Respond to Security Incidents (35–40%)
   • 2.1 Respond to Alerts & Incidents in Defender XDR
   • 2.2 Respond to Alerts & Incidents in Defender for Endpoint (MDE)
   • 2.3 Investigate M365 Activities to Identify Threats
4. Domain 3: Perform Threat Hunting (20–25%)
   • 3.1 Detect Threats Using Microsoft Defender XDR
   • 3.2 Detect Threats Using Microsoft Sentinel
5. Production KQL Query Reference Library
6. Quick Reference Cheat Sheets & RBAC Matrix
7. Practice Exam & Scenario Drills (with Full Explanations)

1. Executive Summary & Exam Architecture

Exam Weighting & Domain Breakdown

Microsoft Security Operations Ecosystem Architecture

                                  +-------------------------------------------------------+
                                  |            Microsoft Security Copilot (AI)            |
                                  +---------------------------+---------------------------+
                                                              |
                                                              v
+-------------------------------------------------------------+-------------------------------------------------------------+
|                                              Microsoft Defender XDR Portal                                                |
|  +------------------------+  +------------------------+  +------------------------+  +---------------------------------+  |
|  | Defender for Endpoint  |  | Defender for Office365 |  | Defender for Identity  |  | Defender for Cloud Apps (MDCA)  |  |
|  | (MDE) EDR / ASR        |  | (MDO) Email / AIR      |  | (MDI) Identity Alerts  |  | App Governance / OAuth          |  |
|  +-----------+------------+  +-----------+------------+  +-----------+------------+  +----------------+----------------+  |
+--------------|---------------------------|---------------------------|--------------------------------|-------------------+
               |                           |                           |                                |
               v                           v                           v                                v
+---------------------------------------------------------------------------------------------------------------------------+
|                                              Advanced Hunting & XDR Data Engine                                           |
|  Tables: DeviceProcessEvents, DeviceNetworkEvents, EmailEvents, IdentityLogonEvents, CloudAppEvents, etc.                 |
+-------------------------------------------------------------+-------------------------------------------------------------+
                                                              |
                                                     Streaming / Connectors
                                                              v
+-------------------------------------------------------------+-------------------------------------------------------------+
|                                              Microsoft Sentinel SIEM Platform                                             |
|  Workspace: Log Analytics Workspace                                                                                       |
|  Ingestion Tiers: Analytics Tier | Basic Tier | Auxiliary Tier | Data Lake (ADLS Gen2 / ADX)                             |
|  Data Sources: AMA (DCR), WEF, Syslog/CEF via AMA, Azure Diagnostic Settings, Threat Intel Upload API                     |
|  Detections: Scheduled Rules, NRT Rules, Anomaly Rules, Fusion ML, Custom XDR Detections                                  |
|  Automation: Automation Rules -> Logic Apps Playbooks (Managed Identity)                                                  |
|  Investigation: Incidents Queue, Sentinel Graph, Bookmarks, Search Jobs, Summary Rules, Jupyter Notebooks                 |
+---------------------------------------------------------------------------------------------------------------------------+

2. Domain 1: Manage a Security Operations Environment (40–45%)

1.1 Automation for Defender XDR and Microsoft Sentinel

A. Microsoft Defender XDR Email & Alert Notifications

1. Email Notifications Configuration:
   • Incidents & Actions: Navigate to Microsoft Defender Portal (security.microsoft.com) -> Settings -> Microsoft Defender XDR -> Email notifications. Create notification rules based on incident severity (Informational, Low, Medium, High), specific device groups, or alert sources.
   • Threat Analytics Notifications: Configure Defender XDR to dispatch email updates when Microsoft publishes new Threat Analytics analyst reports or updates active threat assessments.
2. Alert Tuning & Suppression Rules:
   • Suppression Rules: Navigate to Settings -> Alert suppression. Define criteria (e.g., File Hash, Remote IP, Command Line, Initiating Process) to automatically mark alerts as *Resolved* or *Hidden* without generating incident noise.
   • Correlation Engine: Defender XDR automatically correlates alerts across endpoints, identities, email, and cloud apps into unified Incidents. SOC analysts modify correlation by manually linking alerts to existing incidents or merging duplicate incidents.

B. Microsoft Defender for Endpoint (MDE) Advanced Features & Policies

1. Advanced features page (Settings -> Endpoints -> Advanced features):
   • Use this page for tenant-level Defender for Endpoint feature toggles. Microsoft documents this as a separate settings surface from device groups and endpoint security policy.
   • Common SC-200-relevant toggles include:
     • Live Response: Enables remote shell sessions on onboarded devices for users with the required permissions.
     • Live Response for Servers: Extends Live Response sessions to supported server devices.
     • Unsigned script execution in Live Response: Allows unsigned scripts during Live Response sessions. Treat as a high-risk operational setting.
     • Custom Network Indicators: Enables custom IP, domain, and URL allow/block indicators through Defender for Endpoint network protection.
     • Tamper Protection: Helps prevent Microsoft Defender Antivirus and related security settings from being disabled or changed.
     • Device Discovery: Uses onboarded devices to discover unmanaged devices on the network and assess exposure.
     • Web Content Filtering: Blocks or audits access to selected web categories; network protection must be in block mode for enforcement.
     • Automatic Attack Disruption: Allows Microsoft Defender XDR to contain compromised assets during active, high-confidence attacks.
     • Microsoft Intune connection: Shares device risk and device data with Intune for Conditional Access and policy workflows.
   • Do not treat every endpoint setting as an advanced feature toggle. Some controls live elsewhere, such as device groups, endpoint security policy, or Microsoft Intune.
2. Automated investigation and remediation (AIR):
   • AIR is enabled by default in current Defender for Endpoint behavior. Microsoft notes that the old Automated Investigation option has been removed from the advanced-features setting.
   • For SC-200, focus on where automation is controlled and reviewed:
     • Device groups: Created under Settings -> Endpoints -> Permissions -> Device groups. They group devices by rules such as name, domain, tag, and operating system.
     • Automation level: Set on the device group and controls whether remediation actions are taken automatically or require approval.
     • Action Center: Shows pending and completed remediation actions from automated investigations.
   • Automation levels to recognize:
     • Full - remediate threats automatically: Automatically remediates entities determined to be malicious; Microsoft recommends full automation for most environments.
     • Semi - require approval for all folders: Requires approval before remediation actions are taken on files.
     • Semi - require approval for core folders remediation: Requires approval for remediation in core folders such as Windows operating system directories; other folders can be remediated automatically.
     • Semi - require approval for non-temp folders remediation: Allows automatic remediation in temporary folders but requires approval elsewhere.
     • No automated response: Automated investigation does not run on devices in that scope; Microsoft does not recommend this setting for normal protection.
3. Restricted response actions for high-value assets:
   • For critical assets, onboarding can restrict which response actions are allowed after the device is onboarded.
   • Categories to recognize:
     • Basic response: Antivirus scan, collect file, and collect investigation package.
     • Advanced response: Isolate device, restrict app execution, and request remediation.
     • Live response: Allows Live Response sessions to the device.
     • Device protection: Allows AIR to run on the device.
4. Attack Surface Reduction (ASR) Rules:
   • Implemented via Intune / MDE Endpoint Security policy.
   • Key ASR Rule Behaviors:
     • *Block executable content from email client and webmail* (BE9B2D53-1B16-410C-A70E-4F3B0A5DA47F).
     • *Block Office applications from creating child processes* (D4F940AB-401B-4EFC-AADC-AD5F3C500641).
     • *Block LSASS memory theft* (9E7145AB-773F-4416-A982-4C377E214716).
     • *Block process creations originating from PSExec and WMI commands* (D1E49862-D22D-46A8-9B1D-63646F799E60).
     • *Block persistence through WMI event subscription* (E6FA005E-7E35-4D05-B410-20807066CAE0).
   • Deployment modes: Disabled, Block, Audit (logs event to DeviceEvents with ActionType == "AsrOfficeChildProcessAudited" without blocking), Warn.

C. Automatic Attack Disruption

• Mechanism: Correlates high-confidence signals across MDE, MDI, MDO, and Entra ID to automatically contain active human-operated attacks (such as Ransomware encryption or Business Email Compromise).
• Automated Actions:
  • Disable/Contain Compromised Identity: Revokes Entra ID refresh tokens and blocks sign-in.
  • Isolate Device: Places compromised endpoints under network isolation in real time.
• Audit Table: Interrogated via Advanced Hunting using DeviceInfo and DeviceAlertEvents or looking for actions tagged with AccountContainment or DeviceIsolation initiated by system service principals.

D. Microsoft Sentinel Automation Rules & Playbooks

1. Automation Rules:
   • Evaluated sequentially based on Order (1, 2, 3...).
   • Triggers: *When incident is created*, *When incident is updated*, *When alert is created*.
   • Conditions: Incident property matches (Severity, Status, Title, Tactics, Entity IP/Account/Host).
   • Actions:
     • Assign owner.
     • Change status (New, Active, Closed).
     • Change severity (Informational -> High).
     • Add tags.
     • Run playbook (Logic App).
2. Sentinel Playbooks (Logic Apps):
   • Built on Azure Logic Apps (Consumption or Standard).
   • Triggers:
     • Microsoft Sentinel Incident (runs in the context of a Sentinel incident).
     • Microsoft Sentinel Alert (runs on individual alerts).
     • Microsoft Sentinel Entity (runs directly against an entity pivot).
   • Authentication & RBAC:
     • Uses Managed Identity (System-Assigned or User-Assigned).
     • To allow Sentinel Automation Rules to trigger a playbook, the Microsoft Sentinel Resource Provider must be granted the Microsoft Sentinel Automation Contributor role on the Resource Group containing the Logic App.
     • To perform actions on Sentinel incidents via API, the Logic App's Managed Identity must hold the Microsoft Sentinel Responder role.

1.2 Microsoft Sentinel SIEM & Platform Configuration

A. Microsoft Sentinel RBAC Roles

B. Microsoft Defender Unified RBAC

Microsoft Defender unified RBAC is the centralized custom-role model for the Microsoft Defender portal. It applies across supported Defender XDR workloads including Defender for Endpoint, Defender for Identity, Defender for Office 365 Plan 2, Defender for Cloud Apps, Defender for Cloud, Security Exposure Management, and selected Microsoft Sentinel experiences.

Exam rule: do not treat unified RBAC, Microsoft Entra global roles, Azure RBAC, API permissions, MDE device groups, and Sentinel row-level scoping as interchangeable. They are different authorization planes that can combine at runtime.

Activation facts to memorize:

• Starting in 2025, unified RBAC is the default permissions model for new Defender for Endpoint and Defender for Identity tenants.
• Starting July 2026, unified RBAC is also the default permissions model for new Defender for Office 365 Plan 2 organizations.
• Existing tenants can keep legacy role configuration until workloads are activated for unified RBAC.
• To activate a Sentinel workspace in unified RBAC, the operator needs Security Administrator plus either subscription Owner or User Access Administrator with Sentinel Contributor on the workspace.
• In unified RBAC, Global Administrator can assign permissions, including to itself, but does not automatically grant workspace access.

Common role-design mappings:

Site reference: Defender XDR Unified RBAC.

C. Log Retention Tiers & Data Lake Lifecycle

[ Ingested Data ] 
       |
       +---> Analytics Tier (Default 90 days; retention 30-730 days; full interactive KQL)
       |
       +---> Basic Tier (8 days retention; low-cost ingestion; simple KQL queries; no scheduled rules)
       |
       +---> Auxiliary Tier (30 days retention; massive log ingestion; search jobs only)
       |
       +---> Data Lake / Long-Term Archival (ADLS Gen2 / ADX export; retention up to 12 years; Search/Restore Jobs)

1. Analytics Table Tier:
   • Designed for core security telemetry required for real-time detections, scheduled analytics rules, and instant KQL hunting.
   • Interactive retention: 30 to 730 days (default is 90 days included with Sentinel).
2. Basic Table Tier:
   • Ideal for high-volume logs (e.g., verbose firewall, netflow, IIS logs) used primarily for ad-hoc troubleshooting.
   • Ingestion cost is ~1/5th of Analytics tier.
   • Retention: Fixed at 8 days.
   • Query limits: Single-table simple queries only; no joins, no summaries, cannot be used in Sentinel Scheduled Analytics Rules.
3. Auxiliary Table Tier:
   • Designed for massive audit/compliance telemetry.
   • Retention: Fixed at 30 days.
   • Access: Queried using asynchronous Search Jobs.
4. Data Lake / ADLS Gen2 Export & Search Jobs:
   • Continuous Data Export Rules: Export Log Analytics tables to Azure Data Lake Storage Gen2 (ADLS Gen2) or Azure Data Explorer (ADX) in real-time.
   • Search Jobs: Asynchronous KQL queries executed against long-term archived data or Auxiliary tables. Results are written to a new custom table ending in _SRCH (e.g., SecurityEvent_SRCH).
   • Restore Jobs: Restores archived data for a specified time range into a high-performance active table ending in _RST for deep investigation.

C. Workbooks Configuration

• Interactive dashboards powered by Azure Monitor Workbooks using KQL queries and JSON configuration.
• Components: Text markdown, KQL Query Visualizations (Grid, Line chart, Bar chart, Pie chart, Map, Hive Plot), Parameters (Time Range, Subscriptions, Workspaces, Text Filters).
• Deployment: Custom workbooks saved in Azure Resource Groups; can be pinned to Azure dashboards or shared across SOC teams.

D. SOC Optimization & Recommendations

• Located under Microsoft Sentinel -> Threat management -> SOC Optimization.
• Automatically evaluates log ingestion patterns, coverage against MITRE ATT&CK tactics, and unused data connectors.
• Recommends:
  • Disabling/tuning noisy analytics rules producing high false positives.
  • Adding recommended analytics rules for active connectors.
  • Migrating high-volume non-security tables to Basic or Auxiliary ingestion tiers to optimize costs.

1.3 Ingest Data into Microsoft Sentinel

A. Data Connector Architectures & Selection

+------------------------------------+---------------------------------------------------------------+
| Connector Type                     | Data Sources & Operational Mechanism                          |
+------------------------------------+---------------------------------------------------------------+
| Native Service-to-Service          | Entra ID, Defender XDR, Azure Activity, Office 365, Azure WAF |
|                                    | Direct cloud-to-cloud streaming via Azure Resource Provider.   |
+------------------------------------+---------------------------------------------------------------+
| Azure Monitor Agent (AMA)          | Windows Security Events, Syslog, CEF, Custom Text Logs.       |
|                                    | Uses Data Collection Rules (DCRs) and Data Collection         |
|                                    | Endpoints (DCEs) on VMs and Azure Arc servers.                |
+------------------------------------+---------------------------------------------------------------+
| REST API / Ingestion API           | Threat Intel Upload API, Custom Python/PowerShell scripts.     |
|                                    | HTTP Data Collector API / DCR-based Logs Ingestion API.       |
+------------------------------------+---------------------------------------------------------------+
| Legacy / Codeless (CCPF / Polling)| REST API polling connectors, Azure Functions polling APIs.    |
+------------------------------------+---------------------------------------------------------------+

B. Windows Security Events via Azure Monitor Agent (AMA) & DCRs

1. AMA Architecture: Replaces legacy Log Analytics Agent (MMA). Installed on Windows/Linux virtual machines or on-premises machines via Azure Arc.
2. Data Collection Rules (DCRs):
   • Defines Data Sources (Event Logs), Transformations (KQL at ingest time), and Destinations (Log Analytics Workspace).
   • XPath Filters: Scopes event collection to reduce volume.
     • *All Security Events*: Security!*
     • *Common Security Events*: Collects process creation (4688), logon (4624, 4625), privilege use (4672, 4673), etc.
     • *Custom XPath Example (Only Failed Logons 4625 and Process Creation 4688)*:

       Security!*[System[(EventID=4625 or EventID=4688)]]

1. Tables: Ingests into SecurityEvent table.

C. Windows Event Forwarding (WEF)

• Used when installing AMA on every workstation is impractical.
• Architecture:
  1. Domain Workstations forward Windows Event Logs to a centralized WEF Collector Server via Windows Remote Management (WinRM / HTTP/HTTPS).
  2. Configured via Active Directory Group Policy Objects (GPO) specifying Subscription Manager URL (http://wef-collector.domain.com:5985/wsman/SubscriptionManager/WEC).
  3. The WEF Collector runs the Azure Monitor Agent (AMA) with a DCR that reads forwarded logs and pushes them to Sentinel (SecurityEvent table).

D. Syslog and Common Event Format (CEF) via AMA

1. Architecture:
   • Linux Forwarder VM running rsyslog or syslog-ng daemon + Azure Monitor Agent (AMA).
   • Security appliances (Firewalls, Routers, Linux hosts) transmit Syslog (UDP/TCP 514) or CEF format logs to the Forwarder VM.
2. Configuration:
   • Install AMA on the Linux Forwarder VM.
   • Create a Syslog or CEF DCR in Azure Portal defining Facilities (Auth, Syslog, Daemon, User) and Minimum Log Levels (Info, Warning, Error, Critical).
3. Target Tables:
   • Standard Syslog -> Syslog table.
   • CEF formatted logs -> CommonSecurityLog table.

E. Azure Activity Logs

• Ingests control-plane audit logs for Azure resource creation, modification, and deletion.
• Deployment:
  • Configured at Subscription level via Azure Policy (*Configure Azure Activity logs to streaming to specified Log Analytics workspace*) or Diagnostic Settings.
• Target Table: AzureActivity.

F. Threat Intelligence Ingestion

1. Ingestion Sources:
   • TAXII Data Connector: Connects to STIX/TAXII 2.0 and 2.1 threat feeds (e.g., Anomali, FS-ISAC).
   • Microsoft Sentinel Threat Intelligence Upload API: Ingests indicators via REST API.
   • Defender for Endpoint Indicators API: Pushes IP, Domain, File Hash indicators directly into Defender XDR and Sentinel.
2. Target Table: ThreatIntelligenceIndicator.
3. Watchlists: High-value CSV datasets uploaded directly to Sentinel (e.g., Terminated Employees, VIP User Principal Names, Critical IP Assets). Used in KQL queries via _GetWatchlist('watchlist_alias').

G. Custom Log Tables & Data Collection Endpoints (DCE)

• Created using DCR-based custom log ingestion.
• Naming Rule: Table name MUST end with _CL (e.g., CustomApplication_CL).
• Data Collection Endpoint (DCE): Azure resource that provides the HTTP ingestion URL for sending JSON payloads.
• Ingest-time KQL Transformation: DCR allows transforming incoming JSON before it hits the table:

  source
  | extend EventTime = todatetime(Time),
           User = tostring(RawData.Username),
           ClientIP = tostring(RawData.IPAddress)
  | project-away RawData

1.4 Configure Detections

A. Defender XDR Custom Detection Rules

• Built on KQL queries executed against Advanced Hunting tables.
• Configuration Steps:
  1. Write and validate query in Advanced Hunting. Query must include Timestamp and entity identifiers (Device, Account, IP, File).
  2. Click Create custom detection rule.
  3. Define Details: Rule Name, Frequency (Every 1 hour, 3 hours, 12 hours, 24 hours), Alert Title, Severity, Category (MITRE ATT&CK tactic), Description, Recommendations.
  4. Map Impacted Entities:
     • *Device*: DeviceId or DeviceName.
     • *User*: AccountSid, AccountUpn, or AccountObjectId.
     • *Mailbox*: RecipientEmailAddress.
  5. Define Actions:
     • *Device actions*: Isolate device, Run antivirus scan, Collect investigation package.
     • *User actions*: Mark user as compromised, Disable user.
     • *File actions*: Quarantine file.

B. Microsoft Sentinel Analytics Rule Types

+--------------------------+-----------------------------------------------------------------------------------+
| Rule Type                | Execution Mechanism & Operational Constraints                                     |
+--------------------------+-----------------------------------------------------------------------------------+
| Scheduled Rules          | Evaluates KQL query on schedule (5 min to 14 days). Full entity mapping,          |
|                          | alert grouping, automation rule trigger. Target tables: Analytics tier.           |
+--------------------------+-----------------------------------------------------------------------------------+
| Near-Real-Time (NRT)     | Evaluates KQL query every 1 minute with 1-minute lookback. High priority alerts.  |
|                          | Cannot perform joins or cross-table queries. Single table only.                   |
+--------------------------+-----------------------------------------------------------------------------------+
| Threat Intelligence      | Built-in rules matching ThreatIntelligenceIndicator against event logs           |
|                          | (e.g., SecurityEvent, CommonSecurityLog, DnsEvents).                              |
+--------------------------+-----------------------------------------------------------------------------------+
| Anomaly Rules            | Machine learning algorithms baselining user/device behavior. Outputs results to   |
|                          | `Anomalies` table. Configurable threshold sensitivity (Low, Medium, High).        |
+--------------------------+-----------------------------------------------------------------------------------+
| Fusion Rules             | Graph-based ML correlation engine. Automatically correlates multiple low-severity |
|                          | alerts across MDE, MDO, Entra, and Sentinel into multi-stage attack incidents.    |
+--------------------------+-----------------------------------------------------------------------------------+

C. MITRE ATT&CK Matrix Coverage Analysis

• Both Sentinel and Defender XDR feature a native MITRE ATT&CK Coverage Matrix.
• Maps active scheduled analytics rules and custom detections against MITRE Tactics (Initial Access, Execution, Persistence, Privilege Escalation, Evasion, Credential Access, Discovery, Lateral Movement, Collection, Exfiltration, Command & Control, Impact) and Techniques (e.g., T1059 Command and Scripting Interpreter).
• Highlights security coverage gaps where no active detection rules exist.

3. Domain 2: Respond to Security Incidents (35–40%)

2.1 Respond to Alerts & Incidents in Defender XDR

A. Microsoft Defender for Office 365 (MDO)

1. Phishing & Email Investigation:
   • Key Tables: EmailEvents, EmailUrlInfo, UrlClickEvents, EmailPostDeliveryEvents.
   • Threat Explorer / Email Summary: Allows SOC analysts to search emails by Sender IP, Recipient, Subject, Attachment SHA256, URL, and Delivery Location (Inbox, Junk, Deleted, Quarantine).
2. Automated Investigation & Response (AIR) for Email:
   • Triggered automatically when malicious emails or post-delivery weaponized URLs are reported or detected.
   • Approves remediation actions: Soft-delete email, Hard-delete email, Move email to junk/quarantine.
3. Automatic Attack Disruption for MDO:
   • Automatically revokes user sessions and blocks outbound email routing when a user account is identified sending internal phishing emails at scale.

B. Microsoft Purview Security Integration

1. Audit Logs Investigation:
   • Purview Audit (Standard): Ingests basic audit logs; retained for 180 days.
   • Purview Audit (Premium): Includes high-value forensic logs (Audit.MailItemsAccessed, SearchQueryInitiatedExchange, SearchQueryInitiatedSharePoint), 1-year default retention (upgradeable to 10 years).
   • Table: AuditLogs.
2. Content Search & eDiscovery:
   • Used to locate compromised data, sensitive emails, or unauthorized files across Exchange mailboxes, SharePoint sites, and Teams chats.
3. Insider Risk Management & DLP Alerts:
   • Tracks data exfiltration (mass file downloads, USB transfers, upload to unsanctioned cloud storage). Alerts surface in Defender XDR incident queue.

C. Microsoft Defender for Cloud (MDC) Workload Protections

• Microsoft Defender for Cloud is the CNAPP/CSPM/workload-security product for Azure, AWS, GCP, hybrid servers, containers, databases, storage, Key Vault, and other infrastructure resources.
• Security alerts (e.g., *Possible brute force attack against SSH*, *Suspicious Key Vault access pattern*) can appear in Defender XDR incidents and Sentinel SecurityAlert depending on connector and integration configuration.
• Key hunting table distinction: Defender for Cloud populates CloudAuditEvents for cloud audit events and related cloud infrastructure tables such as CloudDnsEvents, CloudProcessEvents, CloudPolicyEnforcementEvents, and CloudStorageAggregatedEvents when those tables are available.

D. Microsoft Defender for Cloud Apps (MDCA)

1. Product scope: Defender for Cloud Apps is the SaaS/CASB product, formerly Microsoft Cloud App Security (MCAS). It covers SaaS services such as Microsoft 365, Salesforce, Box, Dropbox, GitHub, Atlassian, and other connected cloud apps.
2. Shadow IT Discovery: Discovers unsanctioned cloud applications based on firewall and proxy logs or MDE endpoint network traffic.
3. Key hunting table distinction: Defender for Cloud Apps populates CloudAppEvents, which contains events involving accounts and objects in Microsoft 365 and other cloud apps and services.
4. OAuth App Governance: Investigates third-party applications granted risky OAuth permissions (e.g., Mail.ReadWrite, Files.ReadWrite.All, Directory.ReadWrite.All) to Entra ID tenants. Allows administrators to Ban App or revoke consents.
5. Session Controls & Anomaly Detection: Enforces Conditional Access App Control to block file downloads in real time during risky sessions.

Exam trap: MDCA and MDC are different products. CloudAppEvents means SaaS/CASB activity from Defender for Cloud Apps. CloudAuditEvents means cloud infrastructure audit activity from Defender for Cloud. Do not select Defender for Cloud when the scenario is OAuth app governance or SaaS session control; do not select Defender for Cloud Apps when the scenario is CSPM, server/container/database protection, or Azure/AWS/GCP control-plane audit.

E. Microsoft Entra ID Protection & Compromised Identities

1. Risk Categories:
   • User Risk: Represents probability that the identity is compromised (e.g., *Leaked credentials*, *Defender for Cloud Apps anomaly*).
   • Sign-in Risk: Represents probability that a specific authentication request is unauthorized (e.g., *Impossible travel*, *Anonymous IP address*, *Malicious IP address*).
2. Remediation Actions:
   • Confirm User Compromised: Escalates User Risk level to High; triggers automatic Conditional Access policies.
   • Dismiss User Risk: Clears risk state after verification.
   • Reset Password: Forces password change and revokes active refresh tokens via Revoke-MgUserSignInSession or Microsoft Graph.

F. Microsoft Defender for Identity (MDI)

1. Architecture: Sensors installed directly on Active Directory Domain Controllers (AD DS) and Active Directory Federation Services (AD FS).
2. Monitored Threats:
   • Reconnaissance: Network mapping, DNS reconnaissance.
   • Compromised Credentials: Brute force, Pass-the-Hash, Pass-the-Ticket.
   • Lateral Movement: PSExec execution, WMI abuse, Lateral Movement Paths (LMP).
   • Domain Dominance: Golden Ticket, Silver Ticket, Skeleton Key, DCSync attack (Directory Services Replication).
3. Investigation: Analyzes user-to-device containment and active Directory attack graphs.

G. Microsoft Sentinel Incident Queue & Case Management

1. Incident Lifecycle:
   • Severity: High, Medium, Low, Informational.
   • Status: New -> Active -> Closed.
   • Classification on Close: *True Positive* (Suspicious activity confirmed), *Benign Positive* (Suspicious but expected operational activity), *False Positive* (Incorrect alert logic).
2. Investigation Tools:
   • Sentinel Graph: Interactive visual node-and-edge investigation graph linking Alerts, Users, IPs, Hosts, Files, and Processes.
   • Bookmarks: Promotes KQL hunting findings into evidence attached directly to an active incident.

H. Agentic AI & Microsoft Security Copilot

• Embedded Integration: Security Copilot is natively embedded within Microsoft Defender XDR and Microsoft Sentinel.
• Capabilities:
  • Summarize Incidents: Generates natural language executive summaries of complex multi-stage attacks.
  • Script & Code Analysis: Explains obfuscated PowerShell, Base64 strings, command-line scripts, or VBScript found in alert evidence.
  • Guided Response: Recommends step-by-step containment playbooks and remediation actions based on MITRE ATT&CK framework context.
  • Natural Language to KQL: Converts natural language requests (e.g., "Find all failed logons from external IPs over the last 24 hours") into syntactically valid KQL queries.

2.2 Respond to Alerts & Incidents in Defender for Endpoint (MDE)

A. Device Timeline Analysis

• Located under Microsoft Defender Portal -> Assets -> Devices -> Select Device -> Timeline.
• Provides a chronologically ordered micro-audit of every process execution, file creation, network connection, registry key modification, and user logon on the endpoint.
• Filterable by Event Category (Process creation, File events, Network events, Registry events).

B. MDE Device Response Actions

+------------------------------------+------------------------------------------------------------------+
| Action                             | Operational Impact & Constraints                                 |
+------------------------------------+------------------------------------------------------------------+
| Isolate Device                     | Cuts off network access. Options:                                |
|                                    | - Full Isolation: Blocks all communication.                       |
|                                    | - Selective Isolation: Allows Outlook, Teams, & Skype only.       |
+------------------------------------+------------------------------------------------------------------+
| Collect Investigation Package      | Downloads a .zip archive containing running processes, network   |
|                                    | connections, event logs, autoruns, and memory diagnostics.       |
+------------------------------------+------------------------------------------------------------------+
| Run Antivirus Scan                 | Triggers Quick Scan or Full Scan using Microsoft Defender AV.    |
+------------------------------------+------------------------------------------------------------------+
| Restrict App Execution             | Blocks execution of all binaries except those signed by           |
|                                    | Microsoft.                                                       |
+------------------------------------+------------------------------------------------------------------+
| Initiate Live Response             | Opens interactive remote shell session on endpoint.              |
+------------------------------------+------------------------------------------------------------------+
| Stop and Quarantine Process        | Terminates running malicious process and quarantines binary.     |
+------------------------------------+------------------------------------------------------------------+

C. Live Response Console Commands

• Interactively accessible by SOC analysts holding appropriate MDE RBAC permissions.
• Commands:
  • getfile <path>: Downloads file from endpoint for analysis.
  • putfile <local_path>: Uploads remediation script to endpoint.
  • run <script_name>: Executes script on endpoint.
  • processes: Displays active process list with PIDs.
  • kill <pid>: Terminates target process.
  • remediate file <path>: Removes file and associated registry hooks.
  • analyze: Runs automated memory analysis script.

2.3 Investigate Microsoft 365 Activities to Identify Threats

A. Microsoft Purview Audit (AuditLogs)

• Centralized audit log covering Exchange Online, SharePoint Online, OneDrive, Entra ID, Microsoft Teams, and Power BI.
• KQL Query Example for Mass File Downloads:

  AuditLogs
  | where Operation in ("FileDownloaded", "FileAccessed")
  | extend UserId = tostring(parse_json(AuditData).UserId),
           FileName = tostring(parse_json(AuditData).SourceFileName),
           ClientIP = tostring(parse_json(AuditData).ClientIP)
  | summarize DownloadCount = count() by UserId, ClientIP, bin(TimeGenerated, 1h)
  | where DownloadCount > 100

B. Purview eDiscovery Content Search

• Executed from Purview Compliance Portal -> eDiscovery -> Content search.
• Formulates searches using KQL/Keyword Query Language syntax against mailboxes and SharePoint sites (e.g., subject:"Wire Transfer" AND sent<2026-08-01).
• Used for legal hold, compliance retention, and security threat artifact extraction.

C. Microsoft Graph Activity Logs

• Ingested into the MicrosoftGraphActivityLogs table in Sentinel.
• Tracks all HTTP requests made to Microsoft Graph REST API (graph.microsoft.com).
• Critical for detecting automated token theft, privilege escalation, and rogue administrative scripts:

  MicrosoftGraphActivityLogs
  | where RequestUri has "roleAssignments" or RequestUri has "applications"
  | where ResponseStatusCode == 200
  | project TimeGenerated, ServicePrincipalId, UserId, IPAddress, RequestMethod, RequestUri

4. Domain 3: Perform Threat Hunting (20–25%)

3.1 Detect Threats Using Microsoft Defender XDR

A. Advanced Hunting Table Reference Map

B. Advanced KQL Operator Patterns for Hunting

1. Summarize and Aggregation:

   DeviceProcessEvents
   | where Timestamp > ago(7d)
   | summarize ProcessCount = count(), FirstSeen = min(Timestamp), LastSeen = max(Timestamp) by ProcessCommandLine, AccountName
   | where ProcessCount < 3

1. Joining Endpoint and Identity Telemetry:

   DeviceLogonEvents
   | where Timestamp > ago(24h) and ActionType == "LogonSuccess" and LogonType == "RemoteInteractive"
   | join kind=inner (
       DeviceProcessEvents
       | where Timestamp > ago(24h) and ProcessCommandLine has "powershell"
   ) on DeviceId
   | project Timestamp, DeviceName, AccountName, RemoteIP, ProcessCommandLine

1. Parsing Obfuscated JSON / Regex Extraction:

   DeviceEvents
   | where ActionType == "PowerShellCommand"
   | extend ParsedCommand = parse_json(AdditionalFields).CommandExecution
   | extend EncodedText = extract(@"-[eE][nN][cC][oO][dD][eE][dD][cC][oO][mM][mM][aA][nN][dD]\s+([A-Za-z0-9+/=]+)", 1, tostring(ParsedCommand))
   | where isnotempty(EncodedText)

C. Threat Analytics

• Analyst-curated intelligence reports integrated directly into Defender XDR portal (Threat intelligence -> Threat analytics).
• Displays active global threat campaigns (e.g., APT threat actors, zero-day vulnerabilities).
• Provides pre-built KQL Advanced Hunting queries, detection rules, and impacted asset counts tailored to the organization.

D. Hunting Graphs & Blast Radius Analysis

• Visualizes the lateral spread of an attack from an initial patient-zero asset across connected network nodes.
• Blast Radius: Calculates all devices, identities, service principals, and cloud resources accessible from a compromised entity.

3.2 Detect Threats Using Microsoft Sentinel

A. Sentinel Hunting Queries, Bookmarks & Live Stream

1. Hunting Queries: Pre-authored or custom KQL queries stored under Sentinel -> Threat management -> Hunting. Executed on demand across workspace tables.
2. Bookmarks:
   • When a hunting query yields suspicious rows, the analyst creates a Bookmark.
   • Bookmarks capture table rows, map entity schema (Account, Host, IP, URL), attach analyst notes, and link evidence directly to existing or new Incidents.
3. Live Stream:
   • Executes interactive KQL queries against incoming log streams in real-time as logs arrive at the Log Analytics ingestion pipeline.
   • Generates interactive UI notifications when stream criteria are matched (does not generate formal incidents).

B. Sentinel Data Lake Architecture & KQL Jobs

+---------------------------------------------------------------------------------------------------+
|                                     Sentinel Data Lake Operations                                 |
+------------------------------+------------------------------------+-------------------------------+
| Search Jobs                  | Restore Jobs                       | Summary Rules                 |
+------------------------------+------------------------------------+-------------------------------+
| Runs async queries against   | Restores long-term archived data   | Aggregates high-volume logs   |
| Basic, Auxiliary, or         | into high-performance active table | at ingest or on schedule into |
| archived tables. Results     | ending in _RST for deep KQL        | custom _CL tables for long-   |
| saved to _SRCH tables.       | hunting.                           | term low-cost retention.      |
+------------------------------+------------------------------------+-------------------------------+

1. Search Jobs:
   • Asynchronous queries designed to search large volumes of data across Basic, Auxiliary, or Archived log tables without timing out.
   • Formulated in Sentinel -> Logs -> Search Job.
   • Output stored in a newly provisioned Analytics tier table ending in _SRCH.
2. Restore Jobs:
   • Restores log data from long-term archival for a specific date/time range.
   • Data is restored to an active table ending in _RST. Charged per GB restored per day.
3. Summary Rules:
   • Aggregates verbose raw event logs (e.g., firewall logs, DNS logs) at ingestion time or on a scheduled basis.
   • Aggregated summary statistics are written to a custom _CL table (e.g., DnsSummary_CL).
   • Dramatically reduces storage costs while retaining fast, long-term hunting capabilities.

C. Jupyter Notebooks & Sentinel MCP Server Integration

1. Jupyter Notebooks:
   • Integrated via Sentinel -> Threat management -> Notebooks backed by an Azure Machine Learning workspace.
   • Uses MSTICPy (Microsoft Threat Intelligence Security Tools for Python) to query Sentinel tables, pivot data, execute machine learning algorithms, and visualize attack timelines.
2. Sentinel MCP Server Integration:
   • Connects agentic AI tools and notebook environments directly to Microsoft Sentinel APIs via the Model Context Protocol (MCP).
   • Enables programmatic querying of Sentinel incident metadata, table schemas, and execution of automated hunting workflows.

5. Production KQL Query Reference Library

1. Endpoint Lateral Movement & Remote Process Execution

// Detects remote process execution via WMI or PowerShell remoting
DeviceProcessEvents
| where Timestamp > ago(7d)
| where InitiatingProcessFileName in~ ("wmiprvse.exe", "wsmprovhost.exe", "winrshost.exe")
| where ProcessFileName in~ ("cmd.exe", "powershell.exe", "pwsh.exe", "rundll32.exe", "psexec.exe")
| project Timestamp, DeviceName, AccountName, InitiatingProcessFileName, ProcessFileName, ProcessCommandLine, InitiatingProcessCommandLine
| sort by Timestamp desc

2. Phishing Email to Malicious URL Click Timeline

// Correlates email delivery with user URL clicks within 1 hour
EmailEvents
| where Timestamp > ago(3d)
| where DeliveryAction == "Delivered" and PhishFilterVerdict in ("Phish", "Spam")
| join kind=inner (
    UrlClickEvents
    | where Timestamp > ago(3d)
    | where ClickVerdict in ("Malicious", "Phish")
) on NetworkMessageId
| project Timestamp, AccountUpn, SenderFromAddress, Subject, Url, DeliveryAction, ClickVerdict

3. Identity Password Spray Attack Detection

// Identifies accounts targeted by failed logons from >10 distinct IPs within 1 hour
SigninLogs
| where TimeGenerated > ago(24h)
| where ResultType in (50126, 50053) // Invalid password or account locked out
| summarize FailedIPCount = dcount(IPAddress), IPList = make_set(IPAddress) by UserPrincipalName, bin(TimeGenerated, 1h)
| where FailedIPCount >= 10
| sort by FailedIPCount desc

4. Purview Audit Sensitive File Mass Download

// Tracks users downloading >50 sensitive files from SharePoint/OneDrive in 15 minutes
AuditLogs
| where TimeGenerated > ago(24h)
| where Operation in ("FileDownloaded", "FileAccessed")
| extend AuditDataParsed = parse_json(AuditData)
| extend UserId = tostring(AuditDataParsed.UserId),
         FileName = tostring(AuditDataParsed.SourceFileName),
         SiteUrl = tostring(AuditDataParsed.SiteUrl),
         ClientIP = tostring(AuditDataParsed.ClientIP)
| summarize DownloadedFiles = count(), FileList = make_set(FileName) by UserId, ClientIP, SiteUrl, bin(TimeGenerated, 15m)
| where DownloadedFiles > 50

5. Threat Intelligence Indicator IOC Match

// Matches active Threat Intelligence IP indicators against incoming network events
ThreatIntelligenceIndicator
| where ExpirationDateTime > now() and Active == true
| where isnotempty(NetworkIP)
| join kind=inner (
    DeviceNetworkEvents
    | where Timestamp > ago(24h)
) on $left.NetworkIP == $right.RemoteIP
| project Timestamp, DeviceName, RemoteIP, RemotePort, IndicatorId, ThreatType, Description

6. Graph API Token Theft & Suspicious App Role Grant

// Detects service principals granting high-privilege permissions via Graph API
MicrosoftGraphActivityLogs
| where TimeGenerated > ago(7d)
| where RequestUri has "roleAssignments" or RequestUri has "appRoleAssignments"
| where RequestMethod in ("POST", "PUT", "PATCH")
| where ResponseStatusCode == 200
| project TimeGenerated, ServicePrincipalId, UserId, IPAddress, RequestMethod, RequestUri, ResponseStatusCode

7. Defender for Cloud Apps Consent Grant Abuse

// Detects users consenting to unverified OAuth applications with high-risk permissions
CloudAppEvents
| where Timestamp > ago(7d)
| where ActionType == "Consent to application"
| extend RawDataParsed = parse_json(RawEventData)
| extend AppName = tostring(RawDataParsed.Workload),
         Permissions = tostring(RawDataParsed.ModifiedProperties)
| where Permissions has "Mail.Read" or Permissions has "Files.ReadWrite.All" or Permissions has "Directory.ReadWrite.All"
| project Timestamp, AccountUpn, IPAddress, AppName, Permissions

8. Defender for Identity Kerberoasting Detection

// Identifies suspicious TGS requests targeting service principal names with RC4 encryption
IdentityDirectoryEvents
| where Timestamp > ago(7d)
| where ActionType == "Resource Authentication"
| extend AdditionalFieldsParsed = parse_json(AdditionalFields)
| where AdditionalFieldsParsed.TargetDeviceName != ""
| where AdditionalFieldsParsed.EncryptionType == "RC4-HMAC" // Weak encryption requested in Kerberoasting
| summarize RequestCount = count() by AccountUpn, TargetDevice = tostring(AdditionalFieldsParsed.TargetDeviceName), bin(Timestamp, 1h)
| where RequestCount > 5

6. Quick Reference Cheat Sheets & RBAC Matrix

Microsoft Security RBAC Permission Matrix

Log Retention & Table Tier Comparison

7. Practice Exam & Scenario Drills (with Full Explanations)

Question 1 (Scenario)

Scenario: You are a Security Operations Analyst managing Microsoft Sentinel. A high-volume custom syslog source from a firewall generates 500 GB of data per day. The SOC requires this data for compliance search audits over a 3-year period, but it is never used in scheduled analytics detection rules. You need to design an ingestion and storage strategy that minimizes cost while fulfilling the compliance search requirement.

Options:

• A. Ingest data into an Analytics tier table and configure Log Analytics retention for 1,095 days.
• B. Ingest data into a Basic tier table and configure continuous data export to an Azure Storage account.
• C. Ingest data into an Auxiliary tier table and set total retention (interactive + archive) to 3 years. Use Search Jobs when auditing.
• D. Create a scheduled Analytics Rule that deletes log rows older than 30 days.

Correct Answer: C Explanation: Auxiliary tier tables are designed for high-volume audit logs that are not used in real-time scheduled analytics rules. They offer a ~90% cost reduction on ingestion and support long-term archival up to 12 years. Asynchronous Search Jobs can be executed against Auxiliary tables whenever audit searches are required. Options A and B are incorrect because Analytics tier retention for 3 years is cost-prohibitive, and Basic tier retention is fixed at 8 days.

Question 2 (Scenario)

Scenario: A corporate Windows 11 laptop onboarded to Microsoft Defender for Endpoint (MDE) is actively executing ransomware. You must immediately disconnect the laptop from the network while preserving the ability of the SOC team to perform Live Response remote shell commands and allowing Microsoft Teams for end-user communication.

Options:

• A. Run netsh interface set interface name="Wi-Fi" admin=disabled via Live Response.
• B. Initiate Full Isolation from the MDE device response menu.
• C. Initiate Selective Isolation from the MDE device response menu.
• D. Apply an Attack Surface Reduction (ASR) policy blocking all network connections.

Correct Answer: C Explanation: Selective Isolation cuts off all network traffic from the endpoint *except* for Microsoft Teams, Outlook, Skype, and the MDE cloud channel (which maintains Live Response and SOC communication). Full Isolation (Option B) blocks all network traffic including Teams.

Question 3 (Scenario)

Scenario: You are configuring a Microsoft Sentinel Automation Rule that automatically triggers a Logic App playbook whenever a High-severity incident is created. When the automation rule runs, it fails with the error: Access denied to execute playbook. You confirm that your user account is an Azure Subscription Owner. How should you resolve the issue?

Options:

• A. Assign your user account the Microsoft Sentinel Contributor role.
• B. Grant the Microsoft Sentinel Resource Provider the Microsoft Sentinel Automation Contributor role on the Resource Group containing the Logic App.
• C. Change the Logic App trigger from Microsoft Sentinel Incident to HTTP Webhook.
• D. Assign the Logic App's System-Assigned Managed Identity the Reader role on the workspace.

Correct Answer: B Explanation: In Microsoft Sentinel, for Automation Rules to execute playbooks (Logic Apps), the Microsoft Sentinel Resource Provider must be explicitly granted the Microsoft Sentinel Automation Contributor role on the Resource Group hosting the Logic App. Subscription Owner rights on a user account do not bypass this service-level RBAC requirement.

Question 4 (Scenario)

Scenario: You need to collect Windows Security Event IDs 4624 (Successful Logon) and 4625 (Failed Logon) from 500 Azure virtual machines running Windows Server 2022. You want to filter out all other event IDs at the agent level before data is transmitted to Azure to reduce log ingestion costs. What should you configure?

Options:

• A. Install the Log Analytics Agent (MMA) and configure Workspace Data Collection settings.
• B. Install the Azure Monitor Agent (AMA) and create a Data Collection Rule (DCR) with a custom XPath filter.
• C. Configure Windows Event Forwarding (WEF) using a GPO registry override.
• D. Create a custom Log Analytics ingestion transformation using KQL project-away.

Correct Answer: B Explanation: The Azure Monitor Agent (AMA) uses Data Collection Rules (DCRs) supporting XPath filters. Filtering events using XPath in the DCR (Security!*[System[(EventID=4624 or EventID=4625)]]) ensures unwanted events are discarded on the local machine before transmission, reducing network and ingestion costs.

Question 5 (Scenario)

Scenario: An attacker gains access to an Entra ID user account and registers a rogue multi-tenant OAuth application. The application requests the delegated permission Files.ReadWrite.All. Which Microsoft portal and surface should a Security Operations Analyst use to immediately revoke user consent and ban the application across the tenant?

Options:

• A. Microsoft Defender for Endpoint -> Device Inventory.
• B. Microsoft Defender for Cloud Apps -> App Governance / OAuth Apps.
• C. Microsoft Sentinel -> Workbooks.
• D. Azure Portal -> Resource Groups.

Correct Answer: B Explanation: Microsoft Defender for Cloud Apps (MDCA) includes App Governance and OAuth app investigation capabilities. It allows analysts to review app permissions, evaluate risk scores, revoke user consents, and mark malicious OAuth apps as Banned. Do not confuse this with Microsoft Defender for Cloud (MDC), which is the cloud infrastructure/workload product for CSPM, servers, containers, databases, and Azure/AWS/GCP resources.

Question 6 (Scenario)

Scenario: You write a KQL query in Microsoft Defender XDR Advanced Hunting that identifies malicious process injection. You want this query to automatically run every 1 hour and generate an alert whenever it detects a match. Which feature should you use?

Options:

• A. Sentinel Automation Rule.
• B. Defender XDR Custom Detection Rule.
• C. Sentinel NRT Rule.
• D. Defender for Endpoint Live Response script.

Correct Answer: B Explanation: Custom Detection Rules in Microsoft Defender XDR are created directly from Advanced Hunting KQL queries. They run on defined schedules (e.g., 1 hour, 3 hours, 12 hours) and generate native Defender XDR alerts and incidents with automated response actions.

Question 7 (Scenario)

Scenario: During a threat hunting exercise in Microsoft Sentinel, an analyst discovers a sequence of suspicious KQL query results across DeviceProcessEvents and IdentityLogonEvents pointing to a credential dumping attempt. The analyst needs to preserve these exact log rows as evidence and link them to an active incident without creating a new analytics rule. What feature should the analyst use?

Options:

• A. Live Stream.
• B. Bookmark.
• C. Search Job.
• D. Restore Job.

Correct Answer: B Explanation: Bookmarks in Microsoft Sentinel allow analysts to tag specific KQL query result rows during threat hunting, attach notes, map entity fields, and link the bookmarked evidence directly to an existing or new incident.

Question 8 (Scenario)

Scenario: A company's SOC team needs to investigate a potential email compromise that occurred 6 months ago. The Exchange Online mailboxes are licensed with Microsoft 365 E5. The analyst needs to verify which specific email messages were accessed or downloaded by the compromised user account during the incident window. Which log table and operational log event should be queried in Sentinel/Purview?

Options:

• A. EmailEvents table filtering on DeliveryAction == "Delivered".
• B. AuditLogs table filtering on Operation == "MailItemsAccessed".
• C. SigninLogs table filtering on ResultType == 0.
• D. CloudAppEvents table filtering on ActionType == "MailSent".

Correct Answer: B Explanation: The MailItemsAccessed event is part of Purview Audit (Premium) (included in M365 E5). It logs mail read/download actions across mail protocol syncs and bind operations. It is stored in the AuditLogs table and provides forensic proof of email content access.

Question 9 (Scenario)

Scenario: You need to prevent threat actors from disabling Microsoft Defender Antivirus real-time protection on endpoints via registry edits or local administrator PowerShell commands. Which feature must be enabled?

Options:

• A. Attack Surface Reduction (ASR) rule Block process creations originating from PSExec.
• B. Tamper Protection.
• C. Device Discovery Standard mode.
• D. Web Content Filtering.

Correct Answer: B Explanation: Tamper Protection in Microsoft Defender for Endpoint locks critical antivirus configurations (Real-time protection, Cloud-delivered protection, Behavior monitoring) and prevents local administrators or malware from turning them off via registry keys, PowerShell, or group policy.

Question 10 (Scenario)

Scenario: You are reviewing an active incident in Defender XDR. Automatic Attack Disruption has triggered against a human-operated ransomware attack. What two actions did Automatic Attack Disruption perform automatically without requiring analyst intervention?

Options:

• A. Deleted the domain controller and disabled Microsoft Sentinel.
• B. Contained the compromised identity (revoked refresh tokens) and isolated the compromised device.
• C. Deleted all user emails and formatted the local hard drive.
• D. Generated a workbook report and dispatched a physical mail notification.

Correct Answer: B Explanation: Automatic Attack Disruption leverages high-confidence XDR signals to instantly contain attacks in progress. Its primary automated actions are containing compromised user accounts (revoking Entra ID sessions and blocking sign-in) and isolating infected endpoints to prevent lateral movement and encryption spread.