SC-200 Practice Test 34 — 15 Questions

Question 1

You are managing Microsoft Defender XDR. The security team reports that some automated investigations are closing prematurely without sufficient evidence. You need to ensure that investigations only close when a minimum confidence level is reached. What should you modify?

Accepted Answer

Adjust the automation level in the Microsoft 365 Defender security settings.. In Defender XDR, you can set the automation level for investigations, including the confidence level required for automatic closure. Option A is correct. Option B is wrong because action center handles manual actions. Option C is wrong because it's not a tenant-level setting in that location. Option D is wrong because rules don't control investigation closure confidence.

Answer

Change the action center settings to require manual approval.

Answer

Modify the tenant-level advanced features in Microsoft Defender XDR.

Answer

Create a custom detection rule to override default behavior.

Question 2

Your organization uses Microsoft Sentinel with UEBA enabled. You need to identify anomalous user behavior that indicates a potential compromise. Which entity behavior analytics feature should you use?

Accepted Answer

Entity behavior analytics peer comparison. UEBA in Sentinel uses anomaly detection models to baseline user behavior and alert on deviations. Option D is correct. Option A is for alerts. Option B is for automation. Option C is for hunting.

Answer

Automation rules

Answer

Hunting queries

Answer

Anomaly rules in analytics

Question 3

Your team uses Microsoft Defender XDR to manage incidents. You need to ensure that all incidents with a severity of 'High' are automatically assigned to a specific SOC analyst group. What should you configure?

Accepted Answer

Create an automation rule in Microsoft Defender XDR to automatically assign incidents.. Option A is correct because Microsoft Defender XDR allows you to create automation rules that can assign incidents based on criteria like severity. Option B is incorrect because it is for automated investigation and response. Option C is incorrect because it is a PowerShell cmdlet, not a configuration. Option D is incorrect because advanced hunting is for querying data, not automation.

Answer

Set up an advanced hunting query to detect high severity incidents and send email.

Answer

Configure a playbook in Microsoft Sentinel triggered by incidents.

Answer

Use the 'New-MTPIncidentAssignment' cmdlet in a scheduled task.

Question 4

Refer to the exhibit. You are creating an automation rule in Microsoft Sentinel. The rule is enabled but does not assign incidents. What is the most likely issue?

Accepted Answer

The action 'AssignIncident' is not a supported automation rule action.. Option C is correct because the action type 'AssignIncident' is not a valid automation rule action. Valid actions include 'RunPlaybook' and 'ChangeSeverity'. Option A is incorrect because the trigger type is valid. Option B is incorrect because the conditions are valid. Option D is incorrect because the action is not valid.

Answer

The condition 'Owner' property does not support 'Equals' operator.

Answer

The trigger type 'Microsoft.SecurityInsights/Incident' is incorrect.

Answer

The 'assignedTo' value should be a user principal name instead of an email alias.

Question 5

Your organization uses Microsoft Sentinel. You need to ensure that an incident is automatically assigned to a specific analyst when it is created. What should you create?

Accepted Answer

An automation rule with an 'Assign incident' action.. Automation rules in Sentinel can trigger on incident creation and include actions like assigning owner. Option A is correct. Option B is wrong because playbooks require a trigger; automation rules are simpler. Option C is wrong because watchlists are for reference data. Option D is wrong because analytics rules create alerts, not assign incidents.

Answer

An analytics rule with an output to a specific user.

Answer

A playbook triggered by incident creation.

Answer

A watchlist that maps incident types to owners.

Question 6

Your organization uses Microsoft Sentinel. You need to provide a SOC analyst with the ability to create and modify incident comments but not delete incidents. Which role should you assign?

Accepted Answer

Microsoft Sentinel Responder. Option B is correct because Microsoft Sentinel Responder role allows managing incidents including comments but not deletion. Option A is incorrect because Reader is read-only. Option C is incorrect because Contributor can delete incidents. Option D is incorrect because Global Administrator has full access.

Answer

Global Administrator

Answer

Microsoft Sentinel Contributor

Answer

Microsoft Sentinel Reader

Question 7

You have a Microsoft Sentinel automation rule that triggers a playbook. The playbook definition is shown in the exhibit. The playbook runs but no email is sent. What is the most likely cause?

Accepted Answer

The playbook uses a recurrence trigger instead of a Microsoft Sentinel trigger.. The playbook definition shows a 'Recurrence' trigger, but automation rules in Sentinel use 'MicrosoftSentinelIncident' or 'MicrosoftSentinelAlert' triggers. A recurrence trigger is for scheduled playbooks, not incident-triggered. Option C is correct. Option A is wrong because connection names are typically 'office365' and valid. Option B is wrong because the JSON is valid. Option D is wrong because the operation 'SendEmailV2' is valid.

Answer

The JSON syntax is invalid.

Answer

The email operation 'SendEmailV2' is deprecated.

Answer

The connection name 'office365' is incorrect.

Question 8

Your organization uses Microsoft Defender for Office 365. You need to ensure that suspicious email messages are automatically moved to quarantine and an incident is raised in Microsoft Sentinel. What should you configure?

Accepted Answer

Configure the Microsoft Defender for Office 365 data connector in Sentinel.. Defender for Office 365 can automatically quarantine emails based on policies. To raise an incident in Sentinel, you need to stream the alerts to Sentinel via a data connector. Option D is correct. Option A is wrong because the connector is for Defender for Cloud, not Office 365. Option B is wrong because the connector is for Defender for Endpoint. Option C is wrong because the connector is for identity alerts.

Answer

Configure the Microsoft Defender for Cloud data connector in Sentinel.

Answer

Use the Microsoft Defender for Identity data connector.

Answer

Enable the Microsoft Defender for Endpoint data connector.

Question 9

Your organization uses Microsoft Sentinel and Microsoft Defender XDR. You need to ensure that all incidents from Microsoft Defender XDR are synchronized to Microsoft Sentinel with the same status (e.g., 'Active', 'Resolved'). What should you configure?

Accepted Answer

Connect Microsoft Defender XDR to Microsoft Sentinel using the official data connector.. Option A is correct because bi-directional synchronization is built-in when you connect Microsoft Defender XDR to Sentinel. Option B is wrong because a playbook would be unnecessary and could cause duplicates. Option C is wrong because manual synchronization is not practical. Option D is wrong because the Microsoft Defender XDR connector does sync status by default.

Answer

Create a custom playbook to poll Defender XDR API and update Sentinel incidents.

Answer

Manually update status in both systems.

Answer

Disable the Microsoft Defender XDR connector and use separate connectors for each workload.

Question 10

Your organization uses Microsoft Defender XDR. You need to ensure that when a user reports a phishing email in Outlook, it automatically triggers an investigation in Microsoft Defender XDR. What should you configure?

Accepted Answer

Enable user-reported message settings in Microsoft Defender for Office 365 and configure automated investigation.. Option D is correct because Microsoft Defender for Office 365's reporting and automation can trigger automated investigation and response (AIR) when users report phishing. Option A is incorrect because Microsoft Sentinel is not directly integrated with Outlook reporting. Option B is incorrect because Microsoft Purview is for compliance. Option C is incorrect because Microsoft Defender for Cloud Apps focuses on cloud apps.

Answer

Create a playbook in Microsoft Sentinel triggered by a custom connector.

Answer

Configure a data loss prevention policy in Microsoft Purview.

Answer

Set up a session policy in Microsoft Defender for Cloud Apps.

Question 11

Your organization uses Microsoft Sentinel and Microsoft Defender for Cloud. You need to ensure that security alerts from Defender for Cloud are automatically ingested into Sentinel. What should you configure?

Accepted Answer

Add the 'Microsoft Defender for Cloud' data connector in Microsoft Sentinel.. Sentinel can ingest alerts from Defender for Cloud via a data connector specifically for that purpose. Option B is correct. Option A is wrong because diagnostic settings export logs, not alerts directly. Option C is wrong because automation rules work on incidents, not ingestion. Option D is wrong because the connector is for Azure Activity, not Defender for Cloud alerts.

Answer

Enable diagnostic settings on the Defender for Cloud subscription.

Answer

Configure the 'Azure Activity' data connector.

Answer

Create an automation rule in Sentinel to fetch alerts from Defender for Cloud.

Question 12

Your organization uses Microsoft Sentinel. You need to ensure that incident response times are monitored and reported. Which TWO capabilities should you use?

Accepted Answer

Automation rules. Sentinel workbooks can visualize response times, and automation rules can track timestamps. Option A and D are correct. Option B (playbooks) can perform actions but not directly monitor times. Option C (watchlists) are for reference data. Option E (UEBA) is for behavioral analytics.

Answer

Playbooks

Answer

UEBA

Answer

Watchlists

Question 13

Your organization uses Microsoft Defender XDR and Microsoft Sentinel. The security operations center (SOC) team frequently receives false positive alerts for a specific user login pattern from a legacy application. You need to reduce alert fatigue without disabling the underlying detection rule. What should you configure?

Accepted Answer

Configure an automated investigation and remediation rule in Microsoft Defender XDR to suppress alerts matching the legacy application pattern.. Option C is correct because automated investigation and remediation rules in Microsoft Defender XDR allow you to take action on alerts, including suppressing false positives based on conditions. Option A is wrong because modifying the analytics rule in Sentinel would affect all detections of that rule, not just the legacy app pattern. Option B is wrong because a watchlist in Sentinel is used for correlation, not suppression. Option D is wrong because bookmarks are for preserving evidence, not suppressing alerts.

Answer

Use Microsoft Sentinel bookmarks to mark the alerts as false positives.

Answer

Create a watchlist in Microsoft Sentinel containing the legacy application's user accounts and use it in the rule.

Answer

Modify the analytics rule in Microsoft Sentinel to exclude the legacy application IP range.

Question 14

Your organization uses Microsoft Defender for Office 365 and Microsoft Sentinel. You discover that phishing emails are bypassing Defender for Office 365 and being reported by users. You need to ensure that user-reported emails are automatically analyzed and incidents are created in Sentinel for high-confidence phishing. What should you configure?

Accepted Answer

Enable the 'User reported messages' feature in Defender for Office 365 and ensure the Microsoft Defender XDR connector is enabled in Sentinel.. Option D is correct because the User Reported Messages feature in Defender for Office 365 can trigger automated analysis and, when integrated with Sentinel via the connector, can create incidents. Option A is wrong because a mail flow rule cannot create Sentinel incidents. Option B is wrong because creating a submission rule manually does not automate analysis. Option C is wrong because a custom connector would be more complex than using the built-in integration.

Answer

Set up a custom connector using Microsoft Graph API to ingest user-reported messages into Sentinel.

Answer

Use the Microsoft 365 Defender portal to create a submission rule for user-reported messages.

Answer

Configure a mail flow rule to forward user-reported messages to a dedicated mailbox monitored by Sentinel.

Question 15

Your organization uses Microsoft Sentinel. You need to ensure that an alert is created when a user accesses a sensitive SharePoint site from an unusual location. What should you create?

Accepted Answer

An analytics rule. An analytics rule can be created to detect user access from unusual locations using Sentinel's built-in templates or custom KQL. Option B is correct. Option A (automation rule) responds to incidents, not creates alerts. Option C (playbook) is for response. Option D (watchlist) stores data but doesn't generate alerts.

Answer

A watchlist

Answer

A playbook

Answer

An automation rule