SC-200 Practice Test 22 — 15 Questions

Question 1

A security operations center (SOC) uses Microsoft Sentinel. The team wants to detect anomalous behavior for a specific user account that typically logs in only during business hours from a known IP range. They create a scheduled analytics rule that queries the SigninLogs table for logins outside that range or outside business hours. To reduce false positives, which of the following configurations should the analyst apply?

Accepted Answer

Set the alert threshold to 5 occurrences within the query lookback period.. Option A is correct because setting an alert threshold (e.g., 5 occurrences within the query lookback period) reduces false positives by requiring the anomalous behavior to be persistent rather than a single outlier. In Microsoft Sentinel, the alert threshold filters out noise from occasional legitimate logins that might accidentally fall outside business hours or the known IP range, ensuring the rule only fires when the pattern is repeated enough to indicate a real threat.

Answer

Enable entity mapping for the user account to correlate with other data sources.

Answer

Increase the query scheduling frequency to every 5 minutes from every hour.

Answer

Group all events into a single alert and set the suppression limit to 1 hour.

Question 2

A SOC analyst is configuring a Microsoft Sentinel automation rule to trigger a playbook when an incident is created. The playbook should only run if the incident severity is 'High' and the incident title contains 'Phishing'. Which two conditions should the analyst add to the automation rule? (Select all that apply.) (Choose 2.)

Accepted Answer

Incident severity equals High. Option A is correct because the automation rule condition 'Incident severity equals High' directly matches the requirement that the playbook should only trigger for incidents with a severity of 'High'. In Microsoft Sentinel, automation rules evaluate conditions against incident properties, and severity is a standard field that can be filtered using the 'equals' operator. This ensures the playbook is not invoked for lower-severity incidents.

Answer

Incident status is New

Answer

Incident owner is Unassigned

Question 3

A SOC analyst creates a scheduled analytics rule in Microsoft Sentinel that uses the following KQL query to detect impossible travel: SigninLogs | where TimeGenerated > ago(1d) | summarize Countries = make_set(Location) by UserPrincipalName | where array_length(Countries) > 1 However, the analyst notices that the rule generates too many false positives for users who travel legitimately. What is the best way to refine the rule to reduce false positives without missing actual impossible travel?

Accepted Answer

Modify the query to include a time difference condition using the partition operator or a join to find sign-ins from different countries within a short time window.. Option D is correct because impossible travel detection requires correlating sign-ins from different geographic locations within a time window that is too short for physical travel. By using the partition operator or a join to compare timestamps between sign-ins from different countries, the query can distinguish between legitimate sequential travel (e.g., a user flying from New York to London over 8 hours) and truly impossible simultaneous sign-ins (e.g., sign-ins from New York and London within 30 minutes). This reduces false positives while still catching actual impossible travel.

Answer

Add a condition to filter out VPN IP addresses from the Log Analytics workspace.

Answer

Instead of using make_set, use the dcount() function to estimate distinct countries.

Answer

Use the time series anomaly detection function series_decompose() on the signin data.

Question 4

A SOC analyst has created a custom scheduled analytics rule in Microsoft Sentinel that runs every hour and generates an incident when a certain pattern is detected. The analyst notices that the same set of events is causing a new incident every hour, leading to duplicates. What should the analyst configure to prevent duplicate incident generation from the same events?

Accepted Answer

Set the alert suppression setting in the analytics rule. Option A is correct because the alert suppression setting in a Microsoft Sentinel scheduled analytics rule allows you to configure a time window during which duplicate alerts from the same events are suppressed. When enabled, Sentinel will not generate a new incident from the same set of events until the suppression window expires, preventing the hourly duplication the analyst observed.

Answer

Use an automation rule to close duplicates

Answer

Modify the query to use the 'summarize' operator

Answer

Change the query to use the 'take' operator

Question 5

A SOC analyst in Microsoft Sentinel is creating a scheduled analytics rule to detect anomalous Microsoft Entra ID sign-ins. The rule runs every 5 minutes and queries the SigninLogs table for sign-ins from IP addresses outside the organization's known country codes. To avoid duplicates, the rule should generate an incident only once for a particular user-IP combination until the combination is not seen for 60 minutes. Which configuration should the analyst use in the analytics rule wizard?

Accepted Answer

Incident settings tab - Grouping configuration. Option C is correct because the Incident settings tab's Grouping configuration allows you to group alerts into a single incident based on specific criteria, such as user-IP combination, and to suppress re-creation of an incident for a defined time window (e.g., 60 minutes) after the last occurrence. This directly addresses the requirement to avoid duplicate incidents for the same user-IP pair until it is not seen for 60 minutes.

Answer

Alert details section

Answer

Query scheduling section

Answer

Entity mapping section

Question 6

A SOC analyst needs to create a basic analytics rule in Microsoft Sentinel to detect when an Azure VM is created with an open management port (e.g., SSH or RDP). Which data source should the analyst configure to get the VM creation events?

Accepted Answer

Azure Activity log (AzureActivity). The Azure Activity log (AzureActivity) captures all control-plane operations on Azure resources, including virtual machine creation events (e.g., Microsoft.Compute/virtualMachines/write). When a VM is created with an open management port like SSH (22) or RDP (3389), the activity log records the deployment details, making it the correct data source for triggering a basic analytics rule in Microsoft Sentinel to detect such events.

Answer

Azure Security Center alerts (SecurityAlert)

Answer

Microsoft Entra ID Audit logs (AuditLogs)

Answer

Azure Network Watcher logs (NetworkMonitoring)

Question 7

A SOC analyst needs to create a Microsoft Sentinel scheduled analytics rule that detects a potential brute-force attack. The rule should alert when a single IP address attempts to sign in to more than 10 different user accounts within 5 minutes. The data is in the 'SigninLogs' table. Which KQL operator should the analyst use to count distinct users per IP address per 5-minute time window?

Accepted Answer

summarize dcount(UserPrincipalName) by IPAddress, bin(TimeGenerated, 5m). Option A is correct because the requirement is to count distinct user accounts per IP address within a 5-minute window. The `dcount()` function estimates the number of distinct values of `UserPrincipalName`, `bin(TimeGenerated, 5m)` groups the logs into 5-minute buckets, and `summarize ... by IPAddress` ensures the count is per source IP. This directly matches the brute-force detection logic of more than 10 distinct users from a single IP in 5 minutes.

Answer

summarize count(UserPrincipalName) by IPAddress

Answer

summarize dcount(IPAddress) by UserPrincipalName, bin(TimeGenerated, 5m)

Answer

make-set(UserPrincipalName) by IPAddress

Question 8

A SOC analyst is creating a scheduled analytics rule in Microsoft Sentinel to detect when a user is added to the Global Administrator role in Microsoft Entra ID. The analyst also needs to capture the user who performed the addition. Which Microsoft Entra ID table should the analyst query in the rule's KQL query?

Accepted Answer

AuditLogs. The AuditLogs table in Microsoft Entra ID (formerly Azure AD) records all directory-level changes, including role assignments like adding a user to the Global Administrator role. Each audit log entry contains the 'InitiatedBy' property, which captures the user or service principal who performed the action, meeting the analyst's requirement to identify the actor. SigninLogs only tracks authentication events, not administrative changes, making AuditLogs the correct choice for this detection.

Answer

SigninLogs

Answer

IdentityInfo

Answer

BehaviorAnalytics

Question 9

In Microsoft Defender for Cloud, what does the Secure Score represent?

Accepted Answer

The overall security posture of your resources, based on implemented security controls and recommendations.. The Secure Score in Microsoft Defender for Cloud is a numeric representation of your overall security posture, calculated based on the implementation of security controls and the remediation of recommendations. It aggregates the status of all assessed resources against security best practices, providing a single score that reflects how well you are protecting your workloads. This score helps prioritize actions to improve security, as each recommendation contributes a specific number of points toward the total possible score.

Answer

The number of currently active security alerts.

Answer

The percentage of compliance with the Azure Security Benchmark.

Answer

The number of VMs that have been assessed for vulnerabilities.

Question 10

A SOC analyst wants to create a visual dashboard in Microsoft Sentinel to monitor sign-in activity trends over the past 30 days. Which feature should the analyst use?

Accepted Answer

Workbooks. Workbooks in Microsoft Sentinel provide a flexible canvas for creating custom visual dashboards using Azure Monitor Workbooks. They allow the analyst to query Log Analytics workspaces (e.g., SigninLogs table) and render time-series charts, trend lines, and other visualizations to monitor sign-in activity over the past 30 days. This is the correct feature for building a visual dashboard.

Answer

Analytics rules

Answer

Playbooks

Answer

Threat Intelligence

Question 11

A SOC analyst needs to create an analytics rule in Microsoft Sentinel that triggers when a user logs in from an IP address outside of the organization's typical geographic locations, based on a learned baseline. Which type of analytics rule is best suited for this scenario?

Accepted Answer

Anomaly rule. An Anomaly rule in Microsoft Sentinel uses machine learning to establish a baseline of normal user behavior, such as typical geographic login locations. When a login event deviates from that learned baseline (e.g., from an unusual IP address outside the expected regions), the rule triggers an alert. This is the only rule type specifically designed for behavior-based anomaly detection without requiring static thresholds or predefined patterns.

Answer

Scheduled rule

Answer

NRT (Near-Real-Time) rule

Answer

Fusion rule

Question 12

A SOC analyst is configuring a scheduled analytics rule in Microsoft Sentinel that detects sign-ins from IP addresses contained in a custom threat intelligence watchlist. The analyst wants to avoid creating multiple incidents for the same user and source IP address combination within a 6-hour window. Which configuration in the 'Incident creation' settings should the analyst use to achieve this suppression?

Accepted Answer

Using the 'Event grouping' option under 'Alert grouping' with a 6-hour re-open window. Option A is correct because the 'Event grouping' setting under 'Alert grouping' allows the analyst to group alerts that fire within a specified time window into a single incident. By setting the 'Re-open window' to 6 hours, any new alert matching the same user and source IP address combination will not create a new incident but will instead re-open the existing incident, effectively suppressing duplicate incidents within that window.

Answer

Setting a custom query threshold so that alerts are only generated once per time window

Answer

Enabling 'Suppression' on the 'Schedule' page to stop running the query after the first incident

Answer

Using the 'Custom' alert grouping and setting a time window for re-opening

Question 13

A SOC analyst wants to leverage Microsoft Sentinel's User and Entity Behavior Analytics (UEBA) to detect anomalous sign-in attempts where a user signs in from a country outside their typical pattern. The analyst needs to create an analytics rule that queries the necessary UEBA data. Which Sentinel table should the rule's KQL query primarily reference to evaluate geographic anomalies?

Accepted Answer

BehaviorAnalytics. The BehaviorAnalytics table in Microsoft Sentinel is specifically designed to store UEBA output, including normalized user behavior data such as historical geo-location patterns and anomaly scores. By querying this table, the analyst can directly access pre-computed anomalies for sign-in location deviations without needing to perform complex baseline calculations on raw SigninLogs.

Answer

SigninLogs

Answer

IdentityInfo

Answer

AADUserRiskEvents

Question 14

A SOC analyst wants to automate a response in Microsoft Sentinel such that whenever an incident is created containing a specific user entity (e.g., compromised user), a playbook runs that disables the user in Microsoft Entra ID. Which condition should be configured in the automation rule?

Accepted Answer

When incident is created, and the incident contains a user entity.. Option A is correct because the automation rule must trigger on incident creation and evaluate whether the incident contains a specific user entity to run the playbook that disables the user in Microsoft Entra ID. This ensures the playbook only executes when the relevant entity is present, aligning with the requirement to automate a response based on a compromised user entity.

Answer

When alert is generated, and the alert contains a user entity.

Answer

When incident is created with severity high, then run the playbook.

Answer

When playbook is triggered manually from the incident details page.

Question 15

A SOC analyst wants to ensure that multiple alerts from the same analytics rule that occur within a 1-hour window for the same user are automatically merged into a single incident. Which configuration setting should the analyst adjust in the analytics rule?

Accepted Answer

Incident grouping settings. Option A is correct because the Incident grouping settings in a Microsoft Sentinel analytics rule control whether multiple alerts from the same rule are automatically merged into a single incident. By configuring the grouping to 'Group alerts into a single incident if they match the specified conditions' and setting the time window to 1 hour, the SOC analyst ensures that alerts triggered for the same user within that window are combined, reducing alert noise and improving incident management efficiency.

Answer

Entity mapping

Answer

Alert details

Answer

Query scheduling