SC-200 Practice Test 20 — 15 Questions

Question 1

Which TWO data sources can you connect to Microsoft Sentinel to ingest security logs? (Select TWO.)

Accepted Answer

Azure Active Directory (Microsoft Entra ID) audit logs. Microsoft Entra ID (Microsoft Entra ID) audit logs are a native data source for Microsoft Sentinel. They can be connected directly via the Microsoft Entra ID connector, which ingests sign-in logs, audit logs, and provisioning logs into the Log Analytics workspace. This integration is essential for monitoring identity-related security events and is a standard requirement for SC-200 scenarios.

Answer

Google Cloud Platform audit logs

Answer

Trello activity logs

Answer

GitHub Actions logs

Question 2

Which TWO of the following are valid methods to reduce Microsoft Sentinel data ingestion costs?

Accepted Answer

Configure basic logs for high-volume verbose data sources.. Microsoft Sentinel allows you to configure basic logs for high-volume, verbose data sources (e.g., DNS or firewall logs) to reduce costs. Basic logs are stored at a lower ingestion price and support only simple queries, making them ideal for debugging or compliance data that doesn't require advanced analytics.

Answer

Disable all analytics rules.

Answer

Switch all data sources to basic logs.

Answer

Increase the retention period for all tables.

Question 3

A SOC analyst needs to investigate a potential data exfiltration incident involving a user uploading files to an external cloud storage service. Which Microsoft Sentinel data source would provide the MOST relevant information?

Accepted Answer

OfficeActivity. OfficeActivity (D) is the correct data source because it captures audit logs from Microsoft 365 services, including SharePoint Online, OneDrive for Business, and Exchange Online. These logs record file uploads, downloads, and sharing events, making them the most relevant for investigating data exfiltration to external cloud storage services like OneDrive or SharePoint.

Answer

SigninLogs

Answer

CommonSecurityLog

Answer

AzureActivity

Question 4

You are investigating a brute force attack on a user account in Microsoft Entra ID. The sign-in logs show multiple failed attempts from different IP addresses. Which property in the sign-in logs indicates the type of authentication used?

Accepted Answer

authenticationRequirement. The `authenticationRequirement` property in Microsoft Entra ID sign-in logs specifies the type of authentication used for the sign-in attempt, such as single-factor authentication (password), multi-factor authentication, or passwordless authentication. In a brute force attack investigation, this property helps determine whether the failed attempts were against password-based authentication or a more secure method, providing critical context for the attack vector.

Answer

riskEventTypes

Answer

conditionalAccessStatus

Answer

clientAppUsed

Question 5

Which THREE components are part of Microsoft Sentinel's SOAR capabilities? (Choose three.)

Accepted Answer

Incident management. Incident management is a core SOAR component in Microsoft Sentinel because it provides the structured workflow for security analysts to triage, investigate, and respond to security incidents. It integrates with automation rules and playbooks to orchestrate response actions, enabling consistent and efficient handling of threats.

Answer

Workbooks

Answer

Watchlists

Question 6

Your organization uses Microsoft Sentinel and Microsoft Defender for Cloud. During a security incident involving a compromised Azure VM, which THREE actions are appropriate to contain and investigate the incident?

Accepted Answer

Use Microsoft Defender for Cloud's Just-in-Time VM access to isolate the VM.. Microsoft Defender for Cloud's Just-in-Time VM access can be used to lock down inbound traffic to the VM, effectively isolating it from the network while preserving the VM for forensic analysis. This action reduces the attack surface and prevents lateral movement without destroying evidence, which is critical during incident response.

Answer

Delete the compromised VM to prevent further damage.

Answer

Update the VM's operating system to the latest patch.

Question 7

Which THREE of the following are capabilities of Microsoft Copilot for Security?

Accepted Answer

Summarize incidents from Microsoft Defender XDR.. Microsoft Copilot for Security can summarize incidents from Microsoft Defender XDR, providing a concise overview of alerts, affected assets, and attack chains. This capability leverages natural language processing to parse incident data and generate human-readable summaries, aiding analysts in rapid triage.

Answer

Manage Azure Policy assignments.

Answer

Automatically configure conditional access policies.

Question 8

Refer to the exhibit. You have a Microsoft Sentinel playbook created as shown. When you test the playbook manually, it sends an email successfully. However, when an incident triggers the playbook via an automation rule, the email is not sent. What is the most likely cause?

Accepted Answer

The playbook uses an HTTP trigger instead of a Microsoft Sentinel trigger.. The exhibit shows a playbook that begins with an HTTP trigger, not a Microsoft Sentinel trigger. When an incident triggers the playbook via an automation rule, Sentinel expects the playbook to start with a Microsoft Sentinel trigger (e.g., 'When a response to a Microsoft Sentinel incident is triggered'). An HTTP trigger requires an external HTTP request to start the playbook, which the automation rule does not provide, so the playbook never executes the email action.

Answer

The playbook does not have permission to read incidents.

Answer

The email action is not configured correctly.

Answer

The Office 365 connection is not authorized.

Question 9

Match each Microsoft Sentinel data connector to its data source.

Accepted Answer

Azure Activity connector: Azure subscription activity logs. Correct matches: Azure Activity → subscription logs, Office 365 → Exchange/SharePoint/Teams, Microsoft Entra ID → sign-in/audit logs, AWS CloudTrail → API calls. Common confusions include swapping Azure Activity with Microsoft Entra ID logs, and Office 365 with Azure subscription logs.

Answer

Azure Activity connector: Azure AD sign-in and audit logs

Answer

Office 365 connector: Azure subscription activity logs

Question 10

Match each Microsoft Sentinel incident management action to its purpose.

Accepted Answer

Change incident status: Updates the incident state to Active, New, or Closed.. The correct matches are: Change incident status updates the state, Assign incident assigns to an analyst, and Close incident resolves. Common confusions involve swapping Add comments (for notes) and Add tags (for custom labels).

Answer

Add comments: Adds custom classification labels.

Answer

Add tags: Adds notes for collaboration.

Question 11

A security analyst is investigating a ransomware incident in Microsoft 365 Defender. The analyst wants to see a timeline of all actions performed on a specific device, including file creation, registry modifications, and network connections, in chronological order. Which feature should the analyst use?

Accepted Answer

Device timeline. The Device timeline in Microsoft Defender for Endpoint provides a chronological view of all events and actions on a specific device, including file creation, registry modifications, and network connections. This feature is specifically designed for forensic investigation of incidents like ransomware, offering a time-ordered list of activities without requiring custom queries.

Answer

Advanced hunting

Answer

Incident graph

Answer

Action center

Question 12

A company uses Microsoft Sentinel with Microsoft Defender for Cloud Apps. An incident is created when a user downloads 500 GB from SharePoint in one hour. The analyst wants to create a playbook that automatically suspends the user in Microsoft Entra ID when such activity is detected. Which connector and action should the analyst use in the playbook?

Accepted Answer

Microsoft Entra ID connector with 'Update user' action to set accountEnabled to false.. The Microsoft Entra ID connector provides the 'Update user' action, which can set the 'accountEnabled' property to false, effectively suspending the user in Microsoft Entra ID. This directly addresses the requirement to automatically disable a user account when a high-volume SharePoint download incident is detected in Microsoft Sentinel. The playbook can be triggered by the incident and use this action to perform the suspension without manual intervention.

Answer

Microsoft Teams connector with 'Post message' action to notify admin.

Answer

Microsoft 365 Defender connector with 'Run advanced hunting' action.

Answer

Exchange Online connector with 'Set mailbox' action.

Question 13

You have a Microsoft Sentinel analytical rule with the above configuration. During a security incident, multiple high-severity alerts are generated within a 5-minute window. How does the rule handle these alerts?

Accepted Answer

Alerts with the same entities are grouped into a single incident.. The analytical rule is configured with 'Group alerts into incidents by: Grouping alerts into a single incident based on matching entities.' This means that when multiple high-severity alerts are generated within a 5-minute window, the rule evaluates the entities (e.g., IP addresses, user accounts) in each alert. If the alerts share the same entities, they are grouped into a single incident, preventing alert flooding and consolidating related security events.

Answer

Only the first alert creates an incident; subsequent alerts are ignored.

Answer

Each alert creates a separate incident.

Answer

Alerts are suppressed for 5 minutes after the first alert.

Question 14

Your organization uses Microsoft Sentinel. An analyst reports that a scheduled analytics rule is not firing. You verify that the rule is enabled and the query returns results when run manually. What is the most likely cause?

Accepted Answer

The alert threshold is set too high. The most likely cause is that the alert threshold is set too high. Even though the query returns results when run manually, the rule's threshold condition (e.g., 'Number of results greater than X') may not be met by the volume of results returned during each scheduled run. If the threshold is higher than the typical result count, the rule will not trigger an alert despite the query being valid.

Answer

The data connector is disconnected

Answer

The workspace is in a different region

Answer

The query uses unsupported KQL functions

Question 15

Your organization uses Microsoft Defender XDR. You need to ensure that all cloud app alerts are forwarded to Microsoft Sentinel for correlation. What should you configure?

Accepted Answer

In Microsoft Sentinel, enable the data connector for Microsoft Defender for Cloud Apps.. The Microsoft Defender for Cloud Apps data connector in Microsoft Sentinel is specifically designed to ingest alerts and cloud discovery logs from Defender for Cloud Apps. Enabling this connector ensures that all cloud app alerts are automatically forwarded to Sentinel for correlation without requiring custom API queries or external export pipelines.

Answer

Create an analytics rule in Sentinel that queries Defender for Cloud Apps API.

Answer

Configure Microsoft Defender for Cloud Apps to export alerts to Azure Event Hubs.

Answer

In Microsoft Sentinel, enable the data connector for Microsoft Defender for Endpoint.