SC-200 Practice Test 30 — 15 Questions

Question 1

Refer to the exhibit. You have created a scheduled analytics rule in Microsoft Sentinel as shown. The rule is not generating any incidents, even though you know Copilot for Microsoft 365 is accessing sensitive files. What is the most likely cause?

Accepted Answer

The table being queried does not contain Copilot events. The rule queries the 'SensitivityLabelEvents' table, which tracks sensitivity label changes but does not contain Copilot for Microsoft 365 events. Copilot events are stored in the 'MicrosoftCopilotAudit' table (or 'CloudAppEvents' with specific filters). Since the query targets the wrong table, no matching records are returned, and no incidents are generated.

Answer

The triggerThreshold is too high

Answer

The severity is set to Medium, which suppresses incidents

Answer

The queryFrequency is too short

Question 2

A security analyst reports that a scheduled analytics rule in Microsoft Sentinel has stopped generating incidents after a recent update. The rule still runs but produces no alerts. What should you check first?

Accepted Answer

Review the rule's query logic for changes or syntax errors.. Option C is correct because the most likely cause of a scheduled analytics rule running but producing no alerts is a change or error in the KQL query logic. Since the rule still executes, the issue is not with the rule being disabled or paused, but rather with the query failing to return results due to syntax errors, schema changes, or logic flaws introduced during the update.

Answer

Verify that the rule is enabled and not paused.

Answer

Check the entity mapping configuration for missing fields.

Answer

Ensure that the automation rule triggering the incident is still active.

Question 3

Which TWO Microsoft Sentinel features allow you to organize and prioritize incidents for better triage?

Accepted Answer

Incident assignment to analysts.. Options A and D are correct. Option B is wrong because playbooks are for response. Option C is wrong because workbooks are for visualization. Option E is wrong because entities are components of incidents.

Answer

Entity mapping in analytics rules.

Answer

Automation rules with incident creation triggers.

Answer

Workbooks for dashboard reporting.

Question 4

Refer to the exhibit. A security administrator runs this PowerShell script. What is the effect?

Accepted Answer

It creates an automation rule that runs a playbook on medium severity incidents. The PowerShell script uses the `New-AzSentinelAutomationRule` cmdlet to create an automation rule in Microsoft Sentinel. The `-TriggerType` parameter is set to `IncidentCreated`, and the `-Action` parameter specifies a playbook to run. The `-TriggeringLogic` parameter filters for incidents with a severity of `Medium`, so the automation rule triggers the playbook only when a medium-severity incident is created.

Answer

It creates a playbook that runs daily for high severity incidents

Answer

It schedules a daily report generation for all incidents

Answer

It creates a playbook named 'DailySummaryReport'

Question 5

Which TWO permissions are required to configure a data connector in Microsoft Sentinel?

Accepted Answer

Log Analytics Contributor. To configure a data connector, you need Microsoft Sentinel Contributor to manage Sentinel resources and Log Analytics Contributor to manage the workspace. Option B and C are correct. Option A (Reader) is insufficient. Option D (Security Admin) is not a Sentinel-specific role. Option E (Global Admin) is not required.

Answer

Microsoft Sentinel Reader

Answer

Global Administrator

Answer

Security Admin

Question 6

Your organization uses Microsoft Defender for Cloud Apps and Microsoft Sentinel. You discover that a user is performing unusual bulk downloads from SharePoint. You need to automatically create an incident in Sentinel and suspend the user in Microsoft Entra ID. What should you use?

Accepted Answer

Create a scheduled analytics rule in Sentinel and use automation rules to trigger a playbook that suspends the user.. A scheduled analytics rule in Sentinel can detect the unusual bulk download behavior from SharePoint (via ingested logs from Defender for Cloud Apps or Office 365 connector). An automation rule on that analytics rule triggers a playbook (Azure Logic App) that uses the Microsoft Graph API to suspend the user in Microsoft Entra ID, creating an incident automatically as part of the rule's configuration.

Answer

Configure a Microsoft Entra ID Protection policy to require password reset for risky users.

Answer

Use a playbook triggered by an incident creation rule to suspend the user.

Answer

Configure a policy in Defender for Cloud Apps with a governance action to suspend the user.

Question 7

Which THREE components are required to enable automated investigation and response (AIR) in Microsoft Defender XDR for alerts from Microsoft Defender for Identity?

Accepted Answer

Automated investigation and response enabled in Microsoft Defender XDR.. Option B is correct because automated investigation and response (AIR) must be explicitly enabled in Microsoft Defender XDR to allow the platform to automatically respond to alerts. Without this setting enabled, even if other components are in place, the system will not trigger automated actions for Defender for Identity alerts.

Answer

Microsoft Sentinel workspace configured to ingest Defender for Identity alerts.

Answer

A custom playbook in Microsoft Sentinel.

Question 8

You are a security analyst at a company that uses Microsoft Sentinel. You need to ensure that only users with a specific tag in Microsoft Entra ID can access the Sentinel workspace. Which Azure feature should you use?

Accepted Answer

Configure a Conditional Access policy in Microsoft Entra ID.. Conditional Access policies in Microsoft Entra ID can enforce access controls based on user attributes, including tags. By configuring a Conditional Access policy that grants access to Microsoft Sentinel only if the user has a specific tag, you can restrict workspace access at the authentication layer before any Azure RBAC evaluation occurs. This is the correct approach because Conditional Access operates at the identity level, directly controlling which users can authenticate to the Sentinel workspace.

Answer

Assign Azure RBAC roles with a condition on the tag.

Answer

Use Microsoft Entra Privileged Identity Management (PIM) to require approval for access.

Answer

Apply an Azure Policy to deny access if the user does not have the tag.

Question 9

Your organization uses Microsoft Sentinel with UEBA (User and Entity Behavior Analytics) enabled. The SOC team notices that UEBA is not generating any anomalies for a specific user group. What is the most likely cause?

Accepted Answer

The data history for that user group is less than the required baseline period.. Option C is correct because UEBA requires a baseline of at least 21 days. Option A is wrong because UEBA uses its own machine learning, not analytics rules. Option B is wrong because UEBA works with any data connector that provides user activity. Option D is wrong because Identity Protection is for Azure AD, not for UEBA anomalies.

Answer

The user group is excluded from Identity Protection.

Answer

The user group is not being monitored by any data connector.

Answer

The analytics rules for UEBA are not enabled.

Question 10

You are managing a Microsoft Sentinel environment. You need to ensure that incidents are automatically assigned to the appropriate analyst based on the type of attack. The assignment must consider the current workload of each analyst. What should you use?

Accepted Answer

Use an automation rule with a playbook that queries the current incident assignments and assigns to the least busy analyst.. Option B is correct because automation rules in Microsoft Sentinel can trigger a playbook (Azure Logic App) that queries the current incident assignments and assigns the incident to the analyst with the fewest active incidents. This satisfies both the attack-type mapping (via the analytics rule that generates the incident) and the workload-balancing requirement, as the playbook can dynamically evaluate workload using Azure Resource Graph or Sentinel's API.

Answer

Configure multiple analytics rules, each with a different incident owner.

Answer

Create a watchlist that maps attack types to analyst names and use it in an analytics rule.

Answer

Create a workbook that shows analyst workload and manually assign.

Question 11

Your organization uses Microsoft Defender XDR. You notice that automated investigations are being blocked for certain devices due to high-severity alerts. You need to ensure that automated actions can proceed for devices with a risk score below 30. What should you configure?

Accepted Answer

Configure a device group with an automated investigation and response rule that excludes devices with a risk score above 30.. Option A is correct because device groups in Microsoft Defender XDR allow you to scope automated investigation and response (AIR) rules based on device risk scores. By creating a device group that excludes devices with a risk score above 30, you ensure that automated actions proceed only for devices meeting your threshold, directly addressing the requirement.

Answer

Disable automated investigation for all devices and rely on manual investigation.

Answer

Adjust the Microsoft Defender for Cloud Apps policy to allow automated actions for low-risk devices.

Answer

Modify the attack surface reduction rules to allow automated actions on low-risk devices.

Question 12

Your organization uses Microsoft Defender for Office 365. You want to automatically isolate a user's mailbox if a high-confidence phishing email is detected. Which Microsoft Sentinel automation should you use?

Accepted Answer

Create a playbook that uses the Microsoft Graph API to apply a mailbox litigation hold or block access.. Option B is correct because Microsoft Sentinel playbooks, built on Azure Logic Apps, can use the Microsoft Graph API to perform automated remediation actions like applying a mailbox litigation hold or blocking user access. This enables automatic isolation of a user's mailbox when a high-confidence phishing email is detected, which is a key incident response capability in Defender for Office 365.

Answer

Configure a workbook to display the alert and manually isolate the mailbox.

Answer

Enable the Office 365 connector and configure automatic response in the data connector.

Answer

Create a scheduled analytics rule that isolates the mailbox when triggered.

Question 13

Refer to the exhibit. You have a KQL query in a Microsoft Sentinel analytics rule. The rule is not generating incidents even though there are 'Suspicious sign-in' alerts from non-contoso.com users. What is the most likely issue?

Accepted Answer

The query is querying the wrong table. 'Suspicious sign-in' alerts may be in a different table.. Option B is correct because the query is likely querying the 'Alert' table, but 'Suspicious sign-in' alerts from non-contoso.com users are generated by Microsoft Defender for Identity or Azure AD Identity Protection and stored in the 'SecurityAlert' table (or 'AlertEvidence' in the new schema). The rule's query must reference the correct table to retrieve these alerts; otherwise, no matching records are found, and no incidents are created.

Answer

The 'extend' line is incorrectly parsing the entity.

Answer

The 'where' clause using !endswith is incorrect.

Answer

The query does not filter by AlertName correctly.

Question 14

Your organization uses Microsoft Defender for Cloud to manage security posture. You need to assign a custom initiative to a specific management group to track compliance. Which two components must you create?

Accepted Answer

A policy definition and an initiative definition.. To track compliance for a custom initiative in Microsoft Defender for Cloud, you must first create a custom policy definition that specifies the rules or effects to enforce. Then, you must create an initiative definition (a group of policy definitions) that can be assigned to a management group. This assignment enables Defender for Cloud to evaluate resources against the custom initiative and report compliance.

Answer

An Azure Blueprint and a role assignment.

Answer

An Azure RBAC role and a Log Analytics workspace.

Answer

An Azure Monitor workbook and an alert rule.

Question 15

Your organization is migrating to Microsoft Sentinel. You need to ensure that the workspace retains data for 2 years for compliance, but you want to reduce costs by using cheaper storage for data older than 90 days. What should you configure?

Accepted Answer

Set workspace retention to 90 days and configure long-term retention in Azure Data Explorer (ADX).. Option B is correct because Microsoft Sentinel allows you to set the workspace retention to 90 days for interactive, hot-tier access, and then configure long-term retention in Azure Data Explorer (ADX) for data older than 90 days. This approach meets the 2-year compliance requirement while reducing costs, as ADX provides cheaper storage for older data that is queried less frequently.

Answer

Set the workspace retention to 730 days and enable a data cap.

Answer

Export data older than 90 days to a storage account and delete from workspace.

Answer

Configure the workspace retention to 90 days and use Azure Storage archiving.

SC-200 Practice Test 30 — 15 Questions

Exhibit

SC-200 Practice Test 30 — 15 Questions

Exhibit