SC-200 Practice Test 35 — 15 Questions

Question 1

Your SOC uses Microsoft Sentinel with multiple workspaces for different business units. You want to create a single dashboard that shows key performance indicators (KPIs) across all workspaces. Which approach minimizes complexity and query latency?

Accepted Answer

Use cross-workspace queries in a single dashboard that references all workspaces.. Option B is correct because cross-workspace queries in a single dashboard are efficient and avoid data duplication. Option A is wrong because a separate workspace for dashboards adds complexity and latency. Option C is wrong because Azure Data Explorer is not needed for this simple aggregation. Option D is wrong because Power BI would require data export, adding latency.

Answer

Export data to Azure Data Explorer and build the dashboard there.

Answer

Ingest all logs into a single workspace and create the dashboard there.

Answer

Use Power BI to query each workspace separately and combine data.

Question 2

Which TWO actions are valid for automation rules in Microsoft Sentinel? (Choose two.)

Accepted Answer

Change the severity of an incident.. Options A and D are correct because automation rules can run playbooks and change incident severity. Option B is incorrect because automation rules do not modify analytics rules. Option C is incorrect because automation rules do not delete incidents. Option E is incorrect because automation rules do not add tags directly (tags can be added via playbooks).

Answer

Delete an incident.

Answer

Add tags to an incident.

Answer

Modify an existing analytics rule.

Question 3

You are managing Microsoft Defender for Cloud Apps. Which TWO actions can be performed using the Microsoft Defender XDR integration?

Accepted Answer

Investigate user activities across cloud apps.. Defender for Cloud Apps integrated with Defender XDR allows governing apps and investigating user activities. Option B and D are correct. Option A (onboarding devices) is for Defender for Endpoint. Option C (quarantining emails) is for Office 365. Option E (managing Intune devices) is separate.

Answer

Quarantine malicious emails.

Answer

Manage device compliance policies in Microsoft Intune.

Answer

Onboard devices to Microsoft Defender for Endpoint.

Question 4

Your SOC uses Microsoft Sentinel and Microsoft Defender XDR. An incident is created from a Defender for Endpoint alert about a malware detection on a device. The incident has low priority, but you want to automatically isolate the device from the network if the alert is confirmed as a true positive by the SOC. What is the recommended approach?

Accepted Answer

Create an automation rule in Microsoft Sentinel that triggers a playbook with an approval step before executing device isolation.. Option C is correct because automation rules can trigger a playbook that requires manual approval before isolating the device, ensuring a human confirms the alert. Option A is wrong because immediate isolation without confirmation could impact productivity. Option B is wrong because automatic attack disruption may isolate based on severity but does not wait for SOC confirmation. Option D is wrong because a separate analytics rule cannot isolate devices; it only generates incidents.

Answer

Create a separate analytics rule that triggers on the same alert and uses a playbook to isolate the device.

Answer

Use automatic attack disruption in Microsoft Defender XDR to isolate the device automatically.

Answer

Configure an automated response in Defender for Endpoint to isolate the device immediately when an alert is generated.

Question 5

You are reviewing an analytics rule configuration in Microsoft Sentinel using ARM template JSON. The rule is enabled and incident creation is set to true. However, when alerts are generated, they are not being grouped into a single incident. What is the most likely reason?

Accepted Answer

The groupingConfiguration is disabled.. The grouping configuration has enabled set to false. This means that even though incident creation is enabled, alerts will not be grouped; each alert will create its own incident. Option A correctly identifies this. Option B is wrong because matchingMethod is set but grouping is disabled. Option C is wrong because grouping is disabled, not because of lookbackDuration. Option D is wrong because the rule is enabled and incident creation is true.

Answer

The lookbackDuration is set to 5 hours which is too short.

Answer

The matchingMethod is set to 'AllEntities' which is not supported.

Answer

The rule is not enabled properly.

Question 6

Which TWO roles are included in Microsoft Sentinel built-in roles? (Choose two.)

Accepted Answer

Microsoft Sentinel Responder. Microsoft Sentinel has built-in roles: Reader, Responder, Contributor, and Automation Contributor. Operator is not a built-in role. Global Administrator is a Microsoft Entra ID role, not a Sentinel built-in role.

Answer

Microsoft Sentinel Administrator

Answer

Microsoft Sentinel Operator

Answer

Global Administrator

Question 7

Your organization uses Microsoft Defender for Cloud Apps. You need to block downloads from a specific app for users outside the corporate network. What should you configure?

Accepted Answer

A session policy. Conditional Access App Control in Defender for Cloud Apps allows session policies to control actions based on location. Option B is correct. Option A is for access policies. Option C is for alerts. Option D is for data classification.

Answer

An anomaly detection alert

Answer

A file policy

Answer

An access policy

Question 8

You are designing a Microsoft Sentinel deployment for a multinational organization that must comply with GDPR and local data residency requirements. They have offices in the US, EU, and Asia. They want to use a single Microsoft Sentinel workspace for global visibility but need to ensure that data from EU sources remains within the EU. What is the best approach to meet these requirements?

Accepted Answer

Deploy separate Microsoft Sentinel workspaces in the US, EU, and Asia, and use cross-workspace queries and Azure Lighthouse to manage them centrally.. Option B is correct because using separate workspaces per region ensures data residency, and cross-workspace queries provide a unified view. Option A is wrong because a single workspace cannot guarantee data residency for EU data. Option C is wrong because enabling UEBA does not control data residency. Option D is wrong because Azure Lighthouse does not separate data storage.

Answer

Deploy a single Microsoft Sentinel workspace in the US and use Azure Policy to restrict data ingestion from EU sources.

Answer

Deploy a single workspace in the EU and enable UEBA to analyze all data.

Answer

Use Azure Lighthouse to project a single workspace into multiple regions, which automatically separates data storage.

Question 9

Your organization uses Microsoft Sentinel. You need to ensure that only users with the appropriate permissions can run playbooks from within the incident investigation interface. What role should you assign to the security operations team?

Accepted Answer

Microsoft Sentinel Contributor. The Microsoft Sentinel Contributor role is required to run playbooks from the incident interface. Option B is correct because it includes permissions to use playbooks. Option A is wrong because Reader cannot run playbooks. Option C is wrong because Responder can triage but not run playbooks. Option D is wrong because Global Admin is overly privileged and not recommended.

Answer

Microsoft Sentinel Reader

Answer

Microsoft Sentinel Responder

Answer

Global Administrator in Microsoft Entra ID

Question 10

Which THREE of the following are features of Microsoft Defender XDR that help manage a security operations environment?

Accepted Answer

Automated investigation and response. Microsoft Defender XDR includes incident management, automated investigation and response, and advanced hunting. Threat analytics is a feature of Microsoft Defender for Endpoint, but not a core feature of XDR. Sentinel is a separate SIEM. Custom detection rules are part of Defender XDR.

Answer

Sentinel SIEM integration

Answer

Threat analytics

Question 11

Your organization uses Microsoft Sentinel. You need to automatically assign incidents to the appropriate SOC tier based on severity. What should you create?

Accepted Answer

An automation rule with an owner assignment action. Automation rules in Sentinel can automatically assign incidents to owners based on conditions like severity. Option A is correct. Option B is for queries. Option C is for external systems. Option D is for integration.

Answer

A data connector to Microsoft Teams

Answer

A scheduled analytics rule

Answer

A playbook in Microsoft Power Automate

Question 12

A security operations center (SOC) uses Microsoft Sentinel. They want to automatically block a user's account when a high-severity incident is created. Which automation action should you use in a playbook?

Accepted Answer

Run a playbook that calls the Microsoft Graph API to disable the user account.. Option A is correct because Microsoft Sentinel playbooks can integrate with Microsoft Entra ID to disable a user account. Option B is wrong because resetting password is a different action. Option C is wrong because the playbook does not directly modify Microsoft Defender for Cloud Apps, but could trigger a conditional access policy. Option D is wrong because revoking sessions is a different action.

Answer

Run a playbook that revokes the user's current sessions using Microsoft Graph API.

Answer

Run a playbook that resets the user's password.

Answer

Run a playbook that updates a conditional access policy in Microsoft Entra ID.

Question 13

Refer to the exhibit. You have an automation rule in Microsoft Sentinel configured as shown. An analyst reports that low-severity incidents are not being closed automatically. The rule is enabled and has the highest order. What is the most likely reason?

Accepted Answer

The automation rule does not have the required permissions to modify incidents.. Option C is correct because the rule triggers on "Incidents" (should be "Incident") and the trigger condition is "Created". However, the rule might not have permission to modify incidents. The most common cause is that the automation rule's managed identity or service principal does not have the required role (e.g., Microsoft Sentinel Contributor) to modify incidents. Option A is wrong because the rule triggers on incident creation, not alert creation. Option B is wrong because the rule is enabled. Option D is wrong because the rule is set to close incidents.

Answer

The rule is triggered by alerts, not incidents.

Answer

The rule is set to close incidents with classification 'TruePositive' but low-severity incidents are not true positives.

Answer

The rule is disabled due to a conflict with another rule.

Question 14

You are designing a Microsoft Sentinel deployment. You need to minimize ingestion costs while ensuring that all security-relevant events are collected. Which strategy should you use?

Accepted Answer

Use Basic Logs for verbose data sources like Windows firewall logs, and Analytic Logs for high-value security logs. Option A is correct because Basic Logs are cheaper and suitable for verbose logs. Option B is wrong because Analytic logs are more expensive. Option C is wrong because you need some logs. Option D is wrong because not all logs need full retention.

Answer

Use Analytic Logs for all data sources to ensure full query capabilities

Answer

Set short retention periods for all logs and export to storage

Answer

Collect only logs from Microsoft 365 Defender and ignore other sources

Question 15

Your organization uses Microsoft Sentinel with multiple workspaces. You need to ensure that incidents involving the same alert in different workspaces are automatically grouped into a single incident. What should you configure?

Accepted Answer

Configure an incident grouping rule in Microsoft Sentinel.. Incident grouping rules in Sentinel allow grouping of alerts from different workspaces into a single incident based on matching entities or alert details. Option B is correct. Option A is wrong because analytics rules are per workspace. Option C is wrong because automation rules act on incidents, not grouping. Option D is wrong because UEBA doesn't group incidents.

Answer

Enable UEBA to correlate alerts across workspaces.

Answer

Set up an automation rule to merge incidents.

Answer

Create an analytics rule that runs across all workspaces.