SC-200 Practice Test 25 — 15 Questions

Question 1

A SOC team in Microsoft Sentinel wants to automatically assign high-severity incidents to the 'SOC Tier 2' group and automatically close low-severity incidents that have not been updated in 7 days. Which two configuration elements are required in a single automation rule?

Accepted Answer

One condition for 'Severity equals High' with action 'Assign to SOC Tier 2' and add another condition for 'Severity equals Low' AND 'Last update time older than 7 days' with action 'Close incident'.. Option A is correct because a single Microsoft Sentinel automation rule can include multiple conditions using AND/OR logic, and each condition can trigger a different action (e.g., assign or close). This allows the SOC team to handle both high-severity assignment and low-severity auto-closure within one rule, meeting the requirement efficiently.

Answer

Create one rule for high severity assignments and another rule for low severity closure; you cannot combine different actions in one rule.

Answer

Set the automation rule to trigger on incident creation and then use a custom action to assign owner, but closure cannot be automated in an automation rule.

Question 2

A security analyst is investigating a sophisticated attack where an attacker used a compromised account to send a phishing email. The analyst wants to correlate the email event with the subsequent sign-in activity from the same sender's mailbox using Advanced Hunting. Which two tables should the analyst join to link the email sender to the sign-in IP address?

Accepted Answer

EmailEvents and AADSignInEventsBeta. To correlate a phishing email event with the subsequent sign-in activity from the same sender's mailbox, the analyst needs to join the EmailEvents table (which contains email metadata like sender and recipient) with the AADSignInEventsBeta table (which captures Azure AD sign-in logs, including IP addresses). This join allows linking the sender's email address to the sign-in IP address used during the session that sent the email.

Answer

EmailEvents and CloudAppEvents

Answer

EmailAttachmentInfo and AADSignInEventsBeta

Question 3

You are configuring Microsoft Sentinel SOAR capabilities. You need to create an automated response that, when a critical incident is created, triggers a playbook that sends a message to a Teams channel. Which connector should you use in the playbook?

Accepted Answer

Microsoft Teams connector. The Microsoft Teams connector is the correct choice because it enables the playbook to post messages directly to a Teams channel via an HTTP trigger and the Teams webhook action. This connector is specifically designed for sending notifications and messages to Teams, which aligns with the requirement to alert a channel when a critical incident is created.

Answer

Microsoft Exchange connector

Answer

Azure DevOps connector

Answer

Microsoft Entra ID connector

Question 4

You are a security analyst at a company that uses Microsoft 365 Defender. You receive an automated email indicating that a user has been flagged for possible credential theft. The email includes a link to investigate the alert in the Microsoft 365 Defender portal. Which role is responsible for sending this email?

Accepted Answer

Microsoft 365 Defender email notification settings.. The automated email alerting a user about possible credential theft is sent by Microsoft 365 Defender's built-in email notification settings. These settings allow security teams to configure notifications for specific alert severities or categories, such as credential theft, directly from the Microsoft 365 Defender portal. The email includes a link to investigate the alert, which aligns with the notification functionality within Microsoft 365 Defender.

Answer

A mail flow rule in Exchange Online configured to forward alerts.

Answer

Microsoft Defender for Cloud Apps notification settings.

Answer

A Microsoft Sentinel analytics rule configured to send email notifications.

Question 5

Your organization has a Microsoft Sentinel workspace that ingests data from multiple sources. You notice that the cost of data ingestion is higher than expected. You need to reduce costs without affecting security visibility. Which action should you take?

Accepted Answer

Configure specific tables to use the Basic Logs tier instead of Analytics Logs.. Basic Logs in Microsoft Sentinel are a lower-cost option for high-volume, verbose logs that are used for infrequent querying. Option B is correct because you can move verbose logs (e.g., from VMs) to Basic Logs tier. Option A (reducing retention) affects visibility. Option C (turning off connectors) reduces visibility. Option D (using Azure Storage) is not integrated with Sentinel for queries.

Answer

Reduce the data retention period for all tables to 30 days.

Answer

Disable the collection of Windows event logs from domain controllers.

Answer

Export logs to Azure Storage and use Azure Data Explorer for analysis.

Question 6

Your company uses Microsoft Defender for Cloud to assess the security posture of hybrid workloads. You are configuring a governance rule to automatically remediate a specific recommendation that is out of compliance. The recommendation is 'Virtual machines should be migrated to new Azure Resource Manager resources'. You need to ensure that the remediation is applied at scale across all subscriptions in the management group. What should you do?

Accepted Answer

Create a governance rule in Microsoft Defender for Cloud with scope set to the management group, condition on the recommendation, and action set to 'Automatic'.. Option C is correct because governance rules in Microsoft Defender for Cloud allow you to define automatic remediation actions for specific recommendations at scale. By setting the scope to the management group, the rule applies to all subscriptions within that group, and the 'Automatic' action triggers the built-in remediation script for the 'Virtual machines should be migrated to new Azure Resource Manager resources' recommendation without requiring custom scripting or policy assignments.

Answer

Create a PowerShell script that runs on each VM to migrate it, and execute it via Azure Automation.

Answer

Create an Azure Policy initiative that includes the recommendation and assign it with a remediation task at the management group level.

Answer

Create a governance rule in Microsoft Defender for Cloud with scope set to a single subscription and action set to 'Automatic'.

Question 7

Your SOC team uses Microsoft Sentinel analytics rules. You need to ensure that a scheduled rule runs every hour, but only during business hours (8 AM to 6 PM). What configuration should you use?

Accepted Answer

Create two rules: one that runs every hour during business hours and another that runs but suppresses alerts outside business hours.. Option C is correct because Microsoft Sentinel scheduled analytics rules do not natively support time-based scheduling restrictions like 'only during business hours'. The recommended workaround is to create two separate rules: one that runs every hour during business hours to generate alerts, and another that runs every hour outside business hours but is configured to suppress alerts (e.g., by setting a low severity or using a suppression query). This ensures detection logic runs continuously while avoiding alert fatigue outside the desired window.

Answer

Use a custom log with a logic app to only trigger the rule during business hours.

Answer

Configure the rule to run continuously with an alert threshold of 0.

Answer

Set the rule to run every hour and use a KQL query to filter events outside business hours.

Question 8

You are a security operations analyst. You need to review all incidents from the past 24 hours that have a high severity and involve multiple users. In Microsoft Sentinel, which blade should you use?

Accepted Answer

Incidents. Option B is correct because the Incidents blade in Microsoft Sentinel shows all incidents with filters for severity, time, and entities like users. Option A is wrong because Hunting is for proactive threat hunting. Option C is wrong because Workbooks are for dashboards and visualizations. Option D is wrong because Analytics is for creating rules.

Answer

Hunting

Answer

Workbooks

Answer

Analytics

Question 9

Which THREE components are required to automate incident response in Microsoft Sentinel using playbooks? (Choose three.)

Accepted Answer

An automation rule in Sentinel.. Option A is correct because playbooks are based on Azure Logic Apps. Option B is correct because automation rules trigger playbooks. Option C is correct because a trigger is required for the logic app. Option D is wrong because analytics rules create incidents, not playbooks. Option E is wrong because workbooks are visualization, not automation.

Answer

A workbook.

Answer

An analytics rule.

Question 10

Your organization is implementing Microsoft Sentinel. You need to design a solution to automatically disable a user account in Microsoft Entra ID when a high-severity incident is triggered in Microsoft Sentinel related to that user. Which component should you use?

Accepted Answer

A playbook that uses the Microsoft Graph API to disable the user.. A playbook is the correct component because it is an automated workflow that can be triggered by a Microsoft Sentinel incident. By using the Microsoft Graph API within the playbook, you can programmatically disable a user account in Microsoft Entra ID, which is the required action for a high-severity incident. This aligns with the need for an automated response that integrates Sentinel with identity management.

Answer

An analytics rule that includes a query to disable the user.

Answer

An automation rule that runs a PowerShell script on a hybrid worker.

Answer

A workbook that triggers a webhook to disable the user.

Question 11

Which THREE capabilities are provided by Microsoft Defender for Cloud's Cloud Security Posture Management (CSPM) plan? (Select THREE.)

Accepted Answer

Compliance dashboard that shows your posture against regulatory standards.. Option A is correct because Microsoft Defender for Cloud's CSPM plan includes a compliance dashboard that continuously assesses your cloud resources against regulatory standards such as SOC 2, ISO 27001, and PCI DSS. This dashboard provides a real-time view of your compliance posture, mapping security controls to specific regulatory requirements and highlighting non-compliant resources.

Answer

Endpoint detection and response for on-premises machines.

Answer

Integrated vulnerability assessment for virtual machines.

Question 12

Your security team uses Microsoft Sentinel automation rules to respond to incidents. You need to ensure that critical incidents are automatically assigned to a senior analyst in the Americas time zone and that a Teams message is sent to a specific channel. Which configuration should you use?

Accepted Answer

Create a playbook that assigns the incident and sends a Teams message, then attach it to a automation rule. Option D is correct because automation rules in Microsoft Sentinel can trigger a playbook when an incident is created or updated. By creating a playbook that assigns the incident to a specific senior analyst (using Microsoft Entra ID or a watchlist for mapping) and sends a Teams message via the Teams connector, then attaching that playbook to an automation rule with conditions for critical severity, you meet both requirements. This approach leverages native Sentinel automation without custom connectors or manual email triggers.

Answer

Use a watchlist to map critical incidents to senior analysts and trigger an email

Answer

Configure the analytics rule to set the incident owner and add a playbook action

Answer

Create a custom connector in Power Automate to monitor Sentinel incidents

Question 13

Refer to the exhibit. You are running a PowerShell script to enable the Anomalies setting in Microsoft Sentinel. After running the script, you check the Sentinel settings in the portal and see that Anomalies is still disabled. What is the most likely reason?

Accepted Answer

The cmdlet 'Set-AzSentinelSetting' does not exist in the Az module.. The cmdlet 'Set-AzSentinelSetting' does not exist in the official Az.SecurityInsights module. Microsoft Sentinel settings, including Anomalies, are managed via the REST API or the 'Update-AzSentinelSetting' cmdlet (part of the Az.SecurityInsights preview module). Running a non-existent cmdlet would produce an error, not apply any changes, leaving Anomalies disabled in the portal.

Answer

The user does not have Contributor permissions on the workspace.

Answer

The script requires the -PassThru parameter to apply changes.

Answer

The workspace was not retrieved correctly because the name is misspelled.

Question 14

Your organization uses Microsoft Sentinel with UEBA enabled. You notice that the UEBA entity pages are not showing any insights for Azure resources. What is the most likely cause?

Accepted Answer

The resource context data is not being ingested from Azure Resource Manager.. UEBA entity pages for Azure resources rely on resource context data, which includes metadata about Azure resources such as virtual machines, storage accounts, and their activities. This data is ingested from Azure Resource Manager (ARM) via the Azure Activity data connector. If the resource context data is not being ingested, UEBA cannot correlate activities to specific Azure resources, resulting in no insights on entity pages. Option D correctly identifies this missing data source as the root cause.

Answer

UEBA is not enabled for the workspace.

Answer

The user accounts are not synchronized with Microsoft Entra ID.

Answer

The Azure Activity data connector is not configured.

Question 15

Refer to the exhibit. You are reviewing a Microsoft Sentinel scheduled analytics rule defined in ARM template format. The rule is enabled but no incidents are being created even though matching sign-in events exist. What is the most likely reason?

Accepted Answer

The rule does not have entity mapping configured. Option C is correct because the query uses a static list of IP addresses in the `in` operator but they are not wrapped in quotes as strings; `dynamic(['10.0.0.1', '192.168.1.1'])` is valid but the IPs are strings and should be compared as strings. However, the more critical issue is that the `queryPeriod` and `queryFrequency` are both 5 hours, and the `suppressionDuration` is also 5 hours, but suppression is disabled. The real problem is that the `triggerThreshold` is set to 0 and `triggerOperator` is GreaterThan, meaning it will trigger if any results are found. But if no incidents are created, the issue could be that the query is not returning results because the IP addresses are not in the log. However, the exhibit says matching events exist. Another possibility: the rule uses `SigninLogs` which is a table in Microsoft Entra ID, but the data source might not be connected. But the most likely reason is that the `queryPeriod` and `queryFrequency` are the same, which is correct. Actually, the exhibit shows `groupingConfiguration.enabled: false`, so each alert becomes an incident. But the `eventGroupingSettings.aggregationKind` is `SingleAlert`, meaning each alert is a single incident. If incidents are not created, it could be that the rule is not mapping entities correctly. However, the exhibit does not show entity mapping. Option C highlights that entity mapping is missing, which is required for incident creation in some versions of Sentinel. But wait, in Sentinel, incident creation does not strictly require entity mapping; it's recommended but not mandatory. The actual issue might be that the `query` is invalid because `IPAddress` is not a field in `SigninLogs`? Actually, `SigninLogs` has `IPAddress` field. Let's think: the query looks correct. But the rule is set to `createIncident: true`, so incidents should be created. The most plausible answer is that entity mapping is missing because without it, the incident might not be created properly in newer Sentinel versions? Actually, that's not true. The correct answer is that the `queryPeriod` and `queryFrequency` are the same, which is fine. Maybe the issue is that the `suppressionDuration` is set but not used. I think the most likely is that the query returns results but the incident creation fails due to missing entity mapping. I'll go with Option C. But the explanation should be clear.

Answer

The query uses a dynamic list incorrectly

Answer

The suppressionDuration is incorrectly configured

Answer

The queryFrequency is set too high, causing missed events