SC-200 Practice Test 40 — 15 Questions

Question 1

Refer to the exhibit. You are deploying an Azure Resource Manager (ARM) template to create a saved search in Microsoft Sentinel. However, the template does not create an analytics rule. What is missing to turn this saved search into a scheduled analytics rule?

Accepted Answer

A Microsoft.OperationalInsights/workspaces/savedSearches/schedules resource. Option D is correct because a saved search alone is not an analytics rule; you need to create an alert rule resource. Option A is wrong because IncidentConfiguration is part of the alert rule. Option B is wrong because the saved search already has a query. Option C is wrong because the template does not have a schedule property.

Answer

A Schedule section with frequency and period

Answer

An IncidentConfiguration section

Answer

A Query property with a valid KQL

Question 2

You need to configure Microsoft Sentinel to comply with a regulatory requirement that all security incidents must be retained for 7 years. Which TWO actions should you take?

Accepted Answer

Set the workspace retention policy to 2555 days (7 years).. Options A and D are correct. Setting a retention policy on the workspace to 7 years ensures data retention. Configuring a data export rule allows long-term retention in a storage account for compliance. Option B is incorrect because Basic Logs have a maximum retention of 30 days. Option C is incorrect because table-level retention cannot exceed workspace retention. Option E is incorrect because log analytics workspace retention can be set to up to 730 days by default, but longer via archive.

Answer

Configure table-level retention policies for each table to 7 years.

Answer

Use Basic Logs for all tables to reduce costs.

Answer

Use Azure Policy to enforce a minimum retention period of 7 years on all workspaces.

Question 3

Your organization is planning to deploy Microsoft Sentinel. You need to ensure that security events from on-premises servers are sent to Sentinel. Which connector should you use?

Accepted Answer

Install the Azure Monitor Agent (AMA) on the servers and configure a Data Collection Rule (DCR) to send events to Sentinel.. The Azure Monitor Agent (AMA) is the recommended agent for collecting logs from Windows and Linux servers to Azure Monitor and Sentinel. Option A is correct. Option B is wrong because the Log Analytics agent is legacy and being deprecated. Option C is wrong because Microsoft Defender for Cloud is for cloud security posture, not log collection. Option D is wrong because Azure Arc is for managing servers outside Azure, but the actual log collection still uses AMA.

Answer

Install the Log Analytics agent (MMA) on the servers and connect to Sentinel workspace.

Answer

Use the Microsoft Defender for Cloud (MDC) connector to stream security events.

Answer

Enable Azure Arc on the servers and use the Arc agent to forward events.

Question 4

You are configuring a Microsoft Sentinel workbook to display incident metrics. You want to show the average time to triage incidents over the last 30 days. Which data source should you use?

Accepted Answer

SecurityIncident table.. Incident data in Sentinel is stored in the SecurityIncident table. Option A is correct. Option B is wrong because Alert is for individual alerts, not incidents. Option C is wrong because CommonSecurityLog is for syslog data. Option D is wrong because SigninLogs is for authentication logs.

Answer

CommonSecurityLog table.

Answer

SecurityAlert table.

Answer

SigninLogs table.

Question 5

Your security operations center (SOC) uses Microsoft Sentinel. Analysts need to collaborate on incidents by adding comments and changing severity. Which feature should they use?

Accepted Answer

Incident management. Incident management in Sentinel allows commenting, severity changes, and assignment. Option A is wrong because Playbooks automate responses. Option B is wrong because Workbooks are for dashboards. Option D is wrong because Hunting is for proactive threat detection.

Answer

Hunting

Answer

Playbooks

Answer

Workbooks

Question 6

Your organization uses Microsoft Sentinel and Microsoft Defender XDR. A security analyst reports that incidents related to ransomware are not being automatically triaged by the SOC automation playbook. You confirm that the playbook is enabled and connected to the analytics rule. What is the most likely cause of the issue?

Accepted Answer

The automation rule that triggers the playbook is set to run only when the incident is created by a specific provider (e.g., Microsoft Defender XDR), but the incident is created by Microsoft Sentinel.. Option D is correct because the playbook uses an automation rule that triggers on incident creation, and if the incident is not created by the correct provider (e.g., Microsoft Defender XDR), the playbook won't fire. Option A is wrong because Sentinel workspaces can be in any region; region mismatch affects data residency but not playbook triggering. Option B is wrong because playbooks are triggered by automation rules, not by the analytics rule itself. Option C is wrong because the incident is already created; the issue is the automation rule trigger.

Answer

The Microsoft Sentinel workspace is in a different region than Microsoft Defender XDR.

Answer

The incident is not being created by the analytics rule.

Answer

The playbook is not associated with the correct analytics rule in the automation rule.

Question 7

Which THREE of the following are capabilities of Microsoft Copilot for Security?

Accepted Answer

Summarize incidents from Microsoft Defender XDR.. Options A, C, and E are correct. Copilot can summarize incidents, generate KQL queries, and analyze scripts. Option B is wrong because Copilot does not directly manage access policies. Option D is wrong because Azure Policy management is not a Copilot capability.

Answer

Manage Azure Policy assignments.

Answer

Automatically configure conditional access policies.

Question 8

You are a SOC analyst using Microsoft Sentinel. You receive an incident with high severity. You need to quickly gather additional context about the affected user account, including recent sign-in logs and role assignments. Which feature should you use?

Accepted Answer

Entity pages. Option D is correct because Entity pages in Sentinel provide contextual information about entities. Option A is wrong because Workbooks are for custom reporting. Option B is wrong because Hunting queries are for proactive threat hunting. Option C is wrong because Analytics rules create incidents.

Answer

Sentinel Workbooks

Answer

Analytics rules

Answer

Hunting queries

Question 9

Your organization uses Microsoft Sentinel and Microsoft Defender XDR. You need to ensure that all incidents generated by Microsoft Defender for Cloud are automatically assigned to the security operations team. What should you configure in Microsoft Sentinel?

Accepted Answer

Create an automation rule that runs when an incident is created with provider: 'Microsoft Defender for Cloud' and sets the owner to a specific group.. Option D is correct because automation rules in Microsoft Sentinel can be used to automatically assign incidents to a specific team or owner based on conditions such as provider. Options A and B are for other purposes. Option C is a legacy feature not best for this.

Answer

Create a playbook that uses the Microsoft Teams connector to send a message to the security team.

Answer

Use the incident creation rule in Microsoft Defender for Cloud to assign incidents.

Answer

Configure analytics rules to set the incident owner in the rule settings.

Question 10

Your organization uses Microsoft Defender XDR and Microsoft Sentinel. You need to ensure that when a user reports a phishing email in Microsoft 365 Defender, the incident in Microsoft Sentinel is automatically updated with the user's comments. Which THREE components are required?

Accepted Answer

The Microsoft 365 Defender data connector in Microsoft Sentinel.. Options A, C, and D are correct. A playbook is needed to process the alert. The Microsoft 365 Defender connector enables the playbook to receive the alert. Automation rules trigger the playbook. Option B is incorrect because the connector for Microsoft Entra ID is not needed. Option E is incorrect because a logic app is a type of playbook, not an additional component.

Answer

A logic app in Azure that is triggered by the Microsoft 365 Defender alert.

Answer

The Microsoft Entra ID data connector in Microsoft Sentinel.

Question 11

You are a SOC analyst using Microsoft Defender XDR. You notice that a user's account has been compromised and is being used to send phishing emails. You need to prevent the user from sending any more emails while preserving the ability to receive emails for investigation. What should you do?

Accepted Answer

Restrict the user from sending email using Microsoft Defender for Office 365 mailbox restrictions.. In Microsoft Defender XDR, you can restrict a user from sending email by applying a mailbox restriction. Option B is correct. Option A is wrong because disabling the user in Entra ID prevents all access. Option C is wrong because deleting the mailbox removes all data. Option D is wrong because removing licenses removes access to all Microsoft 365 services.

Answer

Remove the user's Microsoft 365 license.

Answer

Disable the user account in Microsoft Entra ID.

Answer

Delete the user's mailbox in Exchange Online.

Question 12

Your organization uses Microsoft Sentinel to manage security incidents. The security team wants to automatically assign incidents to the appropriate analyst based on the incident’s severity and category. Which feature should you configure?

Accepted Answer

Automation rules. Option A is correct because automation rules in Microsoft Sentinel allow you to automatically assign incidents based on conditions like severity and category. Option B is wrong because playbooks are used for automated response actions, not assignment. Option C is wrong because analytics rules generate incidents, they don't assign them. Option D is wrong because watchlists are used to correlate data, not assign incidents.

Answer

Analytics rules

Answer

Playbooks

Answer

Watchlists

Question 13

Which TWO of the following are valid actions that can be performed by an automation rule in Microsoft Sentinel? (Select two.)

Accepted Answer

Assign incident to an analyst. Option A and Option C are correct. Automation rules can assign incidents to analysts and run playbooks. Option B is wrong because automation rules do not modify analytics rules. Option D is wrong because automation rules can close incidents, not just create tasks. Option E is wrong because automation rules do not delete watchlists.

Answer

Delete a watchlist

Answer

Create a task

Answer

Modify an analytics rule

Question 14

Refer to the exhibit. A SOC analyst runs the KQL query in Microsoft Sentinel to identify the top 10 alert names by count. They notice the results include alerts with low severity that are not relevant. What should they add to the query to focus on high-severity alerts only?

Accepted Answer

Add 'where Severity == "High"' before the summarize clause.. Adding a filter on the Severity column with 'where Severity == "High"' will restrict results to high-severity alerts. Option B is wrong because filtering after summarize would not reduce the data processed. Option C is wrong because changing the time range doesn't filter severity. Option D is wrong because sorting differently doesn't filter.

Answer

Add 'order by Severity' to the query.

Answer

Add 'where Severity == "High"' after the summarize clause.

Answer

Change the time range to last 24 hours.

Question 15

Which TWO of the following are required to enable Microsoft Sentinel UEBA (User and Entity Behavior Analytics)?

Accepted Answer

Enable UEBA in the Microsoft Sentinel workspace settings.. Options A and D are correct. UEBA requires enabling the UEBA feature in the workspace and having sufficient data sources like Microsoft Entra ID sign-in logs. Option B is wrong because Microsoft Defender for Cloud Apps is not required. Option C is wrong because UEBA is not a separate pricing tier. Option E is wrong because UEBA does not require Azure Key Vault.

Answer

Integrate Microsoft Defender for Cloud Apps.

Answer

Purchase a separate UEBA license.

Answer

Configure Azure Key Vault to store UEBA data.

SC-200 Practice Test 40 — 15 Questions

Exhibit

SC-200 Practice Test 40 — 15 Questions

Exhibit