SC-200 Practice Test 15 — 15 Questions

Question 1

In Microsoft Sentinel, an incident is created from a Fusion rule that correlates multiple alerts. The incident has a high severity. What should the analyst do first?

Accepted Answer

Triage the incident by reviewing the evidence. The first step in incident response within Microsoft Sentinel is to triage the incident by reviewing the evidence. A Fusion rule correlates multiple alerts into a single incident, and the analyst must examine the correlated alerts, entities, and timeline to validate the incident's legitimacy and understand the scope before taking any action. Automated playbooks or escalations should only occur after triage confirms the incident is a genuine threat.

Answer

Run an automated playbook to contain the threat

Answer

Close the incident as false positive

Answer

Escalate the incident to senior management

Question 2

Your organization is using Microsoft Defender for Identity (MDI) and Microsoft Sentinel. The security team wants to correlate alerts from MDI with other data sources in Sentinel. What is the recommended approach?

Accepted Answer

Enable the Microsoft Defender for Identity data connector in Sentinel. The Microsoft Defender for Identity data connector in Microsoft Sentinel is the recommended approach because it provides native, out-of-the-box integration that automatically ingests MDI alerts and events into Sentinel without requiring additional infrastructure or manual configuration. This connector leverages the Microsoft Graph Security API to pull alerts, enabling seamless correlation with other data sources for unified threat detection and investigation.

Answer

Export MDI logs manually to Sentinel

Answer

Configure MDI to send syslog to Sentinel

Answer

Create a playbook to pull MDI alerts

Question 3

Refer to the exhibit. A SOC analyst runs this KQL query in Microsoft Sentinel. What is the purpose of this query?

Accepted Answer

Find users with more than 5 failed sign-ins from an IP address in the last hour. The KQL query filters for events where the result type is 'Failure' (failed sign-ins), then groups by account and IP address, counting occurrences. The `where count_ > 5` clause ensures only accounts with more than 5 failed sign-ins from a single IP are returned, which is a classic indicator of a brute force attack. This directly matches option D.

Answer

Detect brute force attempts by finding users with many failed sign-ins from a single IP

Answer

List all successful sign-ins in the last hour

Answer

Identify users who successfully signed in from multiple IPs

Question 4

Your organization uses Microsoft Sentinel and Microsoft Defender for Cloud Apps to monitor cloud application usage. You have a custom analytics rule that detects multiple failed login attempts from different IP addresses for the same user within 5 minutes. This rule generates an incident. The security team wants to automatically suspend the user in Microsoft Entra ID (formerly Azure AD) when such an incident is created, but only if the user is not a member of the 'Emergency Access' group. You need to implement this automation. You have already created the analytics rule. What should you do next?

Accepted Answer

Create a playbook that uses the Microsoft Entra ID connector to check if the user is a member of the 'Emergency Access' group. If not, suspend the user. Then create an automation rule that runs this playbook on incident creation.. A playbook can check group membership and take action. Option A is wrong because automation rules cannot conditionally run playbooks based on group membership. Option B is wrong because modifying the analytics rule is not the way to add automation. Option C is wrong because automation rules cannot directly suspend users.

Answer

Modify the analytics rule to include a condition that checks the user's group membership using KQL.

Answer

Create an automation rule that suspends the user directly using a condition on the incident.

Answer

Create an automation rule that triggers on incident creation and runs a playbook that suspends the user.

Question 5

Your company uses Microsoft Defender for Cloud Apps to monitor cloud applications. You have discovered that a user is accessing a sanctioned cloud storage app from an IP address that belongs to a known malicious botnet. You need to automatically block the user's access to the app and require them to re-authenticate. You have already configured session policies in Defender for Cloud Apps. What should you do next?

Accepted Answer

Configure a session policy in Defender for Cloud Apps with the action 'Block' and 'Require re-authentication'.. Session policies in Defender for Cloud Apps can enforce real-time controls on sanctioned apps. By configuring a session policy with the actions 'Block' and 'Require re-authentication', you can immediately terminate the user's session and force them to re-authenticate, which effectively blocks access from the malicious IP while ensuring the user re-verifies their identity.

Answer

Create an access policy in Defender for Cloud Apps to block the user.

Answer

Create an app governance policy in Microsoft Purview to block the app.

Answer

Create a device compliance policy in Microsoft Intune to block the device.

Question 6

Your company uses Microsoft Sentinel and Microsoft Defender for Cloud Apps (MCAS). A security analyst detects that a user is accessing a sanctioned cloud app from an unusual location. The analyst creates an incident in Sentinel. You need to automatically apply a session policy in MCAS to block downloads from that user for the next hour. You have an existing playbook that can apply session policies. What is the most efficient way to automate this response?

Accepted Answer

Create an automation rule in Sentinel that triggers when an incident is created with the relevant conditions and runs the playbook.. To automate the response, you can create an automation rule that triggers on incident creation and runs the playbook. Option A is correct. Option B is wrong because manual actions are not automated. Option C is wrong because the incident creation rule in MCAS is not used for automated response in Sentinel; an automation rule in Sentinel is needed. Option D is wrong because analytics rules do not run playbooks directly; they trigger alerts which create incidents, and then automation rules run the playbook.

Answer

Instruct the analyst to run the playbook manually from the incident page each time.

Answer

Configure the incident creation rule in MCAS to automatically run the playbook.

Answer

Modify the analytics rule that detected the anomaly to run the playbook as an automated response.

Question 7

Your organization, Fabrikam, has a hybrid environment with on-premises Active Directory and Microsoft Entra ID. You are using Microsoft Sentinel and Microsoft Defender XDR. You have enabled Microsoft Defender for Identity (MDI) to protect on-premises Active Directory. Recently, you received an incident in Microsoft Sentinel indicating a potential DCSync attack from a domain controller. The incident was generated from an MDI alert. You need to investigate the incident and determine if the attack was successful. You have the following options: A) Use the Microsoft Sentinel incident investigation graph to view entities and relationships. Then query the IdentityDirectoryEvents table for the domain controller to see if any directory replication requests were made. B) Use the Microsoft Defender XDR advanced hunting to query the IdentityLogonEvents table for the domain controller. C) Use the Microsoft Sentinel workbook for MDI to visualize the attack timeline. D) Use the Microsoft Defender for Cloud Apps activity log to review the domain controller's activities. Which option should you choose?

Accepted Answer

Use the Microsoft Sentinel incident investigation graph to view entities and relationships. Then query the IdentityDirectoryEvents table for the domain controller to see if any directory replication requests were made.. A DCSync attack involves an attacker impersonating a domain controller to request directory replication via the MS-DRSR protocol. The IdentityDirectoryEvents table in Microsoft Defender for Identity captures directory service replication activities, including the DirectoryReplication request action. Querying this table for the domain controller allows you to confirm if unauthorized replication requests were made, directly indicating a successful DCSync attack.

Answer

Use the Microsoft Sentinel workbook for MDI to visualize the attack timeline.

Answer

Use the Microsoft Defender XDR advanced hunting to query the IdentityLogonEvents table for the domain controller.

Answer

Use the Microsoft Defender for Cloud Apps activity log to review the domain controller's activities.

Question 8

Your organization uses Microsoft Sentinel for security operations. You need to ensure that critical alerts are automatically assigned to the appropriate SOC tier for investigation. What should you configure in Microsoft Sentinel?

Accepted Answer

Create an automation rule that sets the incident owner. Automation rules in Microsoft Sentinel allow you to automatically assign incidents to specific owners based on conditions like severity or alert type. This ensures critical alerts are routed to the appropriate SOC tier without manual intervention, directly meeting the requirement.

Answer

Create a playbook that assigns the incident to a user

Answer

Use a watchlist to map alert types to owners

Answer

Configure an analytics rule to set the owner

Question 9

A security analyst uses Microsoft Sentinel to investigate an incident involving data exfiltration from Azure Blob Storage. The analyst needs to determine which user accessed the storage account and from which IP address. Which data source should the analyst query?

Accepted Answer

Azure Activity logs. Azure Activity logs storage account management events, including access logs. Option A is wrong because Azure AD sign-in logs only show authentication to Azure AD, not storage access. Option C is wrong because Azure Monitor metrics are aggregated and don't show per-user access. Option D is wrong because Azure Security Center provides security recommendations, not access logs.

Answer

Azure AD sign-in logs

Answer

Azure Security Center alerts

Answer

Azure Monitor metrics

Question 10

Your company uses Microsoft Sentinel and has a workspace in the East US region. You need to ingest logs from a non-Azure Windows server located in a branch office in Europe. You have limited bandwidth and need to ensure that log ingestion does not impact network performance. What should you use?

Accepted Answer

Install the Azure Monitor Agent on the server and create a data collection rule to filter and compress logs before sending.. The Azure Monitor Agent (AMA) supports data collection rules (DCRs) that can filter logs at the source and compress data before transmission, reducing bandwidth usage. This is critical for the limited bandwidth scenario, and AMA is the modern replacement for the Log Analytics agent, designed for efficient log ingestion across regions.

Answer

Use Microsoft Defender for Endpoint to collect logs from the server and forward them to Sentinel.

Answer

Install the Log Analytics agent (MMA) on the server and configure it to send logs directly to the workspace.

Answer

Configure the server to send logs to an Azure Event Hub, then stream to Sentinel.

Question 11

Refer to the exhibit. You are configuring an analytics rule in Microsoft Sentinel. What is the effect of this configuration?

Accepted Answer

Alerts that share all the same entities are grouped into one incident within 5 hours. The configuration groups alerts into a single incident only when they share all the same entities (e.g., same IP, same host, same account) and are generated within a 5-hour window. This is controlled by the 'Group alerts into incidents' settings, specifically the 'Group alerts into a single incident if all entities match' option combined with the 5-hour re-open period. Option C correctly describes this behavior.

Answer

All alerts that share any entity are grouped into one incident

Answer

Each alert creates a separate incident

Answer

Alerts are grouped by alert type

Question 12

You are configuring Microsoft Sentinel to ingest syslog data from a network appliance. After configuring the data connector, you notice that no data is appearing in the CommonSecurityLog table. The syslog server is sending data to the Azure Monitor Agent (AMA) on the log collector. What should you verify first?

Accepted Answer

Verify that a Data Collection Rule is defined to collect the syslog facilities.. The Azure Monitor Agent (AMA) requires a Data Collection Rule (DCR) to specify which syslog facilities and severity levels to collect. Without a DCR, the AMA will not forward syslog data to the CommonSecurityLog table, even if the syslog server is sending data to the collector. This is the most common missing configuration step after setting up the data connector.

Answer

Check the Heartbeat table for the log collector.

Answer

Ensure the syslog appliance can reach the collector on UDP port 514.

Answer

Check the data connector health status in Sentinel.

Question 13

Refer to the exhibit. You are running a PowerShell script to enable the Anomalies setting in Microsoft Sentinel. After running the script, you check the Sentinel settings in the portal and see that Anomalies is still disabled. What is the most likely reason?

Accepted Answer

The cmdlet 'Set-AzSentinelSetting' does not exist in the Az module.. The cmdlet 'Set-AzSentinelSetting' does not exist in the official Az.SecurityInsights module. Microsoft Sentinel settings, including Anomalies, are managed via the REST API or the 'Update-AzSentinelSetting' cmdlet (part of the Az.SecurityInsights preview module). Running a non-existent cmdlet would produce an error, not apply any changes, leaving Anomalies disabled in the portal.

Answer

The user does not have Contributor permissions on the workspace.

Answer

The script requires the -PassThru parameter to apply changes.

Answer

The workspace was not retrieved correctly because the name is misspelled.

Question 14

Your organization uses Microsoft Defender XDR. You need to ensure that when a user reports a phishing email using the built-in Outlook add-in, the incident is automatically created in Microsoft Sentinel with high severity and a custom tag 'Phishing-Reported'. What is the most efficient way to achieve this?

Accepted Answer

Configure the 'User-reported phishing' policy in Microsoft Defender XDR to create an incident in Microsoft Sentinel with high severity and the tag.. The 'User-reported phishing' policy in Microsoft Defender XDR can be configured to automatically create an incident in Microsoft Sentinel with a specified severity and custom tags. This policy directly processes user-reported phishing emails from the built-in Outlook add-in and integrates natively with Sentinel via the Microsoft Defender XDR connector, making it the most efficient method without requiring additional automation or custom code.

Answer

Set up an automation rule in Microsoft Sentinel to tag incidents from 'Microsoft Defender' connector with the tag when severity is high.

Answer

Create a Power Automate flow that reads from the unified audit log and creates a Sentinel incident via API.

Answer

Use a playbook triggered by a Microsoft Sentinel analytics rule that monitors for 'PhishDeliver' events.

Question 15

Your organization uses Microsoft Sentinel with Microsoft Defender XDR integration. You have a scheduled analytics rule that detects failed logon attempts across multiple on-premises domain controllers. The rule is configured to run every 5 minutes and create an incident when more than 10 failed attempts occur from a single IP address within 5 minutes. Recently, the SOC team noticed that the rule is generating a high volume of low-fidelity incidents, mostly from legitimate users mistyping passwords. You need to reduce the number of false positive incidents while still detecting real brute-force attacks. What should you do?

Accepted Answer

Modify the query to require at least 20 failed attempts from a single IP and include a condition that the attempts are against multiple user accounts.. To reduce false positives, you can increase the threshold to require more failed attempts or add additional conditions like failed attempts across multiple user accounts. Option B is correct because it increases the threshold to 20 and adds a condition for multiple users, which better indicates a brute-force attack. Option A is wrong because increasing the frequency would generate more incidents, not fewer. Option C is wrong because decreasing the threshold would increase incidents. Option D is wrong because disabling the rule would stop detection entirely.

Answer

Increase the query frequency to every 1 minute and reduce the threshold to 5.

Answer

Disable the rule and create a new rule based on successful logons followed by failed attempts.

Answer

Decrease the threshold to 5 and add a condition to exclude known good IP addresses.