Free SC-200 Exam Flashcards

The unified extended detection and response platform at security.microsoft.com that correlates signals across endpoints, email, identity, apps, and cloud into a single incident with a unified investigation experience.

An alert is a single detection. An incident is a correlated collection of related alerts, assets, and evidence that tells the full attack story, so analysts triage at the incident level, not alert by alert.

A Defender XDR capability that uses high-confidence XDR signals to automatically contain an in-progress attack (e.g., disable a compromised account, isolate a device) before an analyst responds, limiting blast radius.

Secure Score measures your security posture and recommends configuration improvements (proactive). Threat analytics is in-product threat intelligence about active campaigns and your exposure to them (reactive/awareness).

Isolation cuts a device off the network while keeping the Defender connection for investigation. Live response opens a remote shell to collect artifacts and run remediation; it must be enabled in advanced features.

Configurable rules that block common attack behaviors (e.g., Office spawning child processes, credential theft from LSASS). Run in audit mode first to measure impact before switching to block.

Prevents apps, scripts, or the registry from disabling antivirus, real-time protection, or other Defender settings. Blocks attackers from turning off defenses as a precursor to further compromise.

Defender automatically investigates alerts, determines verdicts, and can remediate (quarantine files, kill processes) based on the automation level configured for the device group.

Safe Attachments detonates email attachments in a sandbox before delivery. Safe Links rewrites and time-of-click verifies URLs in mail and Office docs to block weaponized links delivered or armed later.

Retroactively removes already-delivered malicious email from mailboxes once a verdict changes (e.g., a link is later found malicious). Closes the gap between delivery and detection.

Monitors on-premises Active Directory signals to detect identity attacks such as pass-the-hash, pass-the-ticket, DCSync, and reconnaissance. It uses sensors on domain controllers, not endpoint agents.

Distinguishes user risk (likelihood the identity is compromised, e.g., leaked credentials) from sign-in risk (likelihood a specific sign-in is illegitimate, e.g., anonymous IP). Conditional Access acts on these signals.

The CASB that discovers shadow IT, applies app governance and session controls, and detects anomalous SaaS activity. Conditional Access App Control enables real-time session policies via reverse proxy.

Workload protection is enabled per plan (Servers, Containers, Storage, SQL, Key Vault, App Service, APIs, DevOps). Each plan adds specific threat detections and the secure score recommendations for that resource type.

Cloud Security Posture Management (CSPM) assesses misconfigurations and compliance. Cloud Workload Protection Platform (CWPP) provides runtime threat detection for workloads. SC-200 focuses on responding to CWPP alerts.

Used during investigation to search Microsoft 365 content (mail, SharePoint, Teams) and preserve evidence. Audit log search reveals which user performed which activity and when.

DLP prevents sensitive data from leaving via policy at the point of action. Insider Risk Management correlates user behavior signals over time to surface risky data exfiltration patterns for investigation.

The cloud-native SIEM/SOAR built on a Log Analytics workspace. It ingests data via connectors, runs analytics rules to create incidents, and automates response with automation rules and playbooks.

Analytics tier is hot, fully queryable, for active detection/investigation. Basic/Auxiliary is cheaper for high-volume, lower-fidelity logs. The Data lake tier provides low-cost long-term retention with KQL jobs.

AMA is the unified agent that collects Windows Security Events, Syslog, and CEF. CEF and Syslog are ingested via AMA (legacy MMA is deprecated); WEF forwards events from a collector.

DCRs define what AMA collects and how it is filtered/transformed before ingestion. Ingestion-time transformations reduce noise and cost by dropping or shaping data before it lands in the workspace.

A normalized schema with parsers that map diverse source data into common fields (e.g., imAuthentication). Lets one analytics rule or hunting query work across many products regardless of native format.

Imports indicators (IPs, domains, hashes) into the ThreatIntelligenceIndicator table via TAXII or the Upload API. TI matching analytics rules then alert when those indicators appear in logs.

Scheduled (runs on an interval over a lookback), Near-Real-Time/NRT (runs about every minute for fast detection), Microsoft Security (auto-creates incidents from Microsoft alerts), Anomaly, and ML behavior analytics.

Scheduled rules support complex multi-table logic and aggregation but add detection latency. NRT rules run roughly every minute for low-latency detection but support a single query with limited aggregation.

An ML-based Sentinel correlation engine that combines low-fidelity alerts across products into a single high-confidence incident describing a multistage attack. Enabled via an analytics rule, not hand-written KQL.

Maps query columns to entities (account, host, IP, file). It enables entity pages, investigation graphs, and grouping/alert correlation, so configuring it is essential for usable incidents.

Tagging analytics rules with tactics and techniques powers the MITRE ATT&CK coverage view, helping the SOC see detection gaps across the attack lifecycle rather than counting rules.

Automation rules are Sentinel-native triggers that run on incident creation/update to assign, tag, close, or run playbooks. Playbooks are Logic Apps that perform the actual actions (block IP, notify, enrich).

Use the incident trigger to act on whole incidents (preferred for orchestration) or the alert trigger for single alerts. Managed identity is the recommended auth for playbook connectors.

Attach a playbook to an automation rule for hands-off response, or trigger it manually from an incident/alert for analyst-in-the-loop actions. Choose based on confidence and reversibility of the action.

Sentinel recommendations that improve coverage and cost: identify ingested tables not used by any detection (waste) and recommend additional detections to cover MITRE gaps for threats you face.

'where' is the primary row-filtering operator in KQL, applied early to reduce data scanned. Placing 'where' before heavy operations like 'join' or 'summarize' is a key performance practice.

'project' selects/renames a specific set of columns (and drops the rest). 'extend' adds a new computed column while keeping existing columns. Use project to trim output and extend to derive values.

Aggregates rows into groups, e.g., 'summarize count() by Account'. Combine with bin() to bucket by time. It is the core operator for detecting spikes and anomalies in hunting queries.

ago(1d) returns the timestamp 24 hours ago, used with 'where TimeGenerated > ago(1d)' to scope a lookback. bin(TimeGenerated, 1h) rounds timestamps into hourly buckets for time-series aggregation.

inner returns matched rows from both; leftouter keeps all left rows; leftanti returns left rows with NO match (useful to find first-seen or missing events). Choosing the right kind changes hunting logic entirely.

DeviceProcessEvents and DeviceNetworkEvents (endpoint), EmailEvents and EmailUrlInfo (Office 365), IdentityLogonEvents (identity), and CloudAppEvents (Cloud Apps). Picking the right table is half of a good hunt.

SecurityAlert holds individual alerts ingested into Sentinel. SecurityIncident holds the grouped incident records with status and severity. Reporting on response time queries SecurityIncident, not SecurityAlert.

Analytics rules run automatically and generate incidents. Hunting queries are run proactively/interactively by analysts to find threats that no rule caught; a promising hunt can be promoted into an analytics rule.

Preserve interesting query results during a hunt so they can be revisited, annotated, or attached to an incident as evidence. They keep findings from being lost when the query result set changes.

Jupyter notebooks enable advanced, repeatable hunting and ML analysis against Sentinel data. The Sentinel MCP Server lets notebooks and AI tooling query Sentinel through the Model Context Protocol.

KQL jobs run scheduled queries over the low-cost Data lake tier for long-range hunting. Summary rules aggregate verbose logs into compact summary tables, cutting query cost while keeping investigative value.

Sentinel Graph models entity relationships so analysts can visualize how an attack spreads. A blast radius view shows what an attacker could reach from a compromised entity, prioritizing containment.

An interactive visualization of an incident's entities and their connections (accounts, hosts, IPs, files). It helps establish the attack timeline and scope and is driven by correct entity mapping.

In the 2026 update, Copilot for Security is embedded in the unified Defender portal to summarize incidents, guide investigation, and run agentic analysis. Standalone Copilot expertise is validated by SC-5006.

Lets the SOC manage incident lifecycle, assignment, status, and collaboration in one place across Defender XDR and Sentinel, replacing separate tracking and standardizing handoffs.

Closing an incident requires a classification: True Positive, Benign Positive (real but expected), or False Positive. Accurate classification trains automation and improves future detection fidelity.

Tuning adjusts the detection logic/threshold to reduce noise at the source. Suppression hides specific known-benign alerts without changing the rule. Prefer tuning for systemic noise, suppression for narrow exceptions.

Sentinel Reader (view), Sentinel Responder (manage incidents), and Sentinel Contributor (create rules/playbooks). Assign at the resource group/workspace scope using least privilege for SOC tiers.