SC-200 Practice Test 40 — 15 Questions

Question 1

You are a security operations architect for a company that uses Microsoft Sentinel in a hybrid environment with multiple workspaces. The company has a central SOC team that needs to view incidents from all workspaces in a single pane of glass. Each workspace belongs to a different business unit and has its own retention and access policies. You need to design a solution that provides centralized incident management without duplicating data or requiring users to switch workspaces. You also need to ensure that the SOC team can perform actions on incidents across workspaces. What should you do?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Use Microsoft Sentinel incident multi-view to connect all workspaces.. Microsoft Sentinel incident multi-view allows SOC teams to view and manage incidents across multiple workspaces from a single interface without duplicating data. This feature provides a centralized pane of glass while respecting each workspace's independent retention and access policies, and it enables cross-workspace incident actions without requiring users to switch contexts.

Answer

Create a playbook that copies incidents from all workspaces to a central workspace.

Answer

Use the Microsoft Sentinel data connector to connect all workspaces to a central workspace.

Answer

Create a new Log Analytics workspace that ingests data from all workspaces via diagnostic settings.

Question 2

Your organization uses Microsoft Sentinel. You need to provide a SOC analyst with the ability to create and modify incident comments but not delete incidents. Which role should you assign?

Accepted Answer

Microsoft Sentinel Responder. The Microsoft Sentinel Responder role is designed for SOC analysts who need to manage incidents, including adding and modifying comments, but not delete incidents. Microsoft Sentinel Contributor can delete incidents, so it is too permissive. Microsoft Sentinel Reader is read-only and cannot create or modify comments. Global Administrator has full access to all resources, including the ability to delete incidents, which is excessive for this requirement.

Answer

Global Administrator

Answer

Microsoft Sentinel Contributor

Answer

Microsoft Sentinel Reader

Question 3

Refer to the exhibit. You run this KQL query in Microsoft Sentinel. What does it return?

Accepted Answer

Top 5 incident owners by number of high-severity incidents in the last 7 days.. The KQL query uses `summarize` with `count()` by `Owner`, then `top 5 by count_`, and filters with `where Severity == 'High'` and `TimeGenerated > ago(7d)`. This returns the top 5 incident owners ranked by the number of high-severity incidents they own in the last 7 days, making option C correct.

Answer

Number of high-severity incidents per status.

Answer

Total count of high-severity incidents in the last 7 days.

Answer

Top 5 users assigned to high-severity incidents.

Question 4

Which THREE capabilities are provided by Microsoft Sentinel's UEBA (User and Entity Behavior Analytics)? (Select THREE.)

Accepted Answer

Identify users whose behavior deviates from their peers. Microsoft Sentinel's UEBA uses machine learning models to establish a baseline of normal behavior for each user and then compares individual user activity against peer group behavior. When a user's actions deviate significantly from their peers, such as accessing unusual resources or performing atypical data transfers, an anomaly is generated, enabling security analysts to investigate potential insider threats or compromised accounts.

Answer

Automatically run playbooks when anomalies are detected

Answer

Create watchlists for high-value users

Question 5

Your organization uses Microsoft Sentinel. You need to ensure that incident response times are monitored and reported. Which TWO capabilities should you use?

Accepted Answer

Automation rules. Automation rules (C) are correct because they allow you to define conditions and actions that automatically trigger when an incident is created or updated, enabling consistent assignment, severity changes, and tagging. Workbooks (E) are correct because they provide customizable visualizations and reports that can track key metrics like incident response times, mean time to acknowledge (MTTA), and mean time to remediate (MTTR) using KQL queries against Sentinel's security data.

Answer

Playbooks

Answer

UEBA

Answer

Watchlists

Question 6

You are analyzing a firewall policy in Azure Firewall deployed via Azure Policy. What is the effect of this rule?

Accepted Answer

Denies inbound traffic from IP 10.0.0.5 to any destination.. The rule in Azure Firewall deployed via Azure Policy uses a default deny approach for inbound traffic. Since the rule explicitly denies inbound traffic from IP 10.0.0.5 to any destination, option C is correct. Azure Firewall processes rules in a priority order, and a deny rule for inbound traffic from a specific source IP overrides any allow rules that might match the same traffic.

Answer

Allows outbound traffic from any source to IP 10.0.0.5.

Answer

Allows inbound traffic from IP 10.0.0.5 to any destination.

Answer

Denies outbound traffic from any source to IP 10.0.0.5.

Question 7

Your company deploys Microsoft Sentinel in a multi-workspace environment. You need to centralize incident management across workspaces while maintaining data residency. You configure Sentinel workspaces in each region. What additional configuration is required to view all incidents from a single pane?

Accepted Answer

Use an incident manager with a cross-workspace view.. Microsoft Sentinel supports cross-workspace incident management through the incident manager, which can be configured to display incidents from multiple workspaces in a single view. This is achieved by using the 'cross-workspace view' feature, which leverages Azure Resource Graph to query incidents across workspaces without moving data, thus maintaining data residency requirements.

Answer

Deploy the Microsoft Sentinel solution across workspaces.

Answer

Assign the same Azure RBAC roles to all users in each workspace.

Answer

Merge the workspaces into a single workspace.

Question 8

Refer to the exhibit. You are reviewing a custom Azure Policy definition that should block deployments from specific IP addresses. However, the policy does not seem to be evaluating any resources. What is the most likely issue?

Accepted Answer

The policy definition has not been assigned to any scope. The exhibit shows a custom Azure Policy definition that is syntactically correct, but the policy is not evaluating any resources. The most likely cause is that the policy definition has not been assigned to a scope (e.g., management group, subscription, or resource group). In Azure Policy, a definition alone does nothing; it must be assigned to a scope to take effect and begin evaluating resources.

Answer

The 'in' operator cannot be used with an array parameter

Answer

The policy mode should be 'Indexed' for network policies

Answer

The 'effect' should be 'audit' instead of 'deny'

Question 9

Refer to the exhibit. You are investigating incidents related to suspicious process injection. The KQL query above is run in Microsoft Sentinel. What is the purpose of this query?

Accepted Answer

To get a count of 'Suspicious process injection' alerts grouped by compromised entity and severity, sorted by count. The query uses `summarize` with `count()` to aggregate alerts by `CompromisedEntity` and `Severity`, then sorts by the count in descending order. This directly produces a count of 'Suspicious process injection' alerts grouped by compromised entity and severity, sorted by count. The `where` clause filters for the specific alert name, and the time range is implicitly the last 7 days (as shown in the exhibit's query editor).

Answer

To find alerts that occurred within a specific time range

Answer

To list all alerts of type 'Suspicious process injection' in the last 7 days

Answer

To identify the compromised entities with the highest severity alerts

Question 10

Which TWO roles are included in Microsoft Sentinel built-in roles? (Choose two.)

Accepted Answer

Microsoft Sentinel Responder. Microsoft Sentinel Responder is a built-in role that grants permissions to respond to incidents, including the ability to update incidents, dismiss alerts, and take response actions. This role is designed for security operations center (SOC) analysts who need to triage and remediate threats without full administrative access.

Answer

Microsoft Sentinel Administrator

Answer

Microsoft Sentinel Operator

Answer

Global Administrator

Question 11

Refer to the exhibit. A SOC analyst runs the KQL query in Microsoft Sentinel to identify the top 10 alert names by count. They notice the results include alerts with low severity that are not relevant. What should they add to the query to focus on high-severity alerts only?

Accepted Answer

Add 'where Severity == "High"' before the summarize clause.. In KQL, the `where` clause must be placed before the `summarize` clause to filter raw events before aggregation. Placing `where Severity == "High"` before `summarize` ensures that only high-severity alerts are counted, preventing low-severity alerts from appearing in the top 10 results. This is a fundamental KQL query execution order: filtering first reduces the dataset for aggregation, improving both accuracy and performance.

Answer

Add 'order by Severity' to the query.

Answer

Add 'where Severity == "High"' after the summarize clause.

Answer

Change the time range to last 24 hours.

Question 12

Which TWO features in Microsoft Sentinel can help reduce alert fatigue by grouping related alerts into incidents? (Select two.)

Accepted Answer

Incident merging. Incident merging (Option A) is correct because it automatically combines multiple alerts that share common entities (such as IP addresses, hostnames, or user accounts) into a single incident. This reduces alert fatigue by preventing security analysts from having to triage dozens of separate alerts that are all part of the same attack chain, allowing them to focus on a single, consolidated incident.

Answer

Entity behavior analytics

Answer

Automation rules that run playbooks

Answer

Threat intelligence indicators

Question 13

Which TWO actions can be performed using Microsoft Sentinel automation rules? (Choose two.)

Accepted Answer

Change the severity of an incident. Automation rules in Microsoft Sentinel allow you to automate incident management tasks, including changing the severity of an incident and adding tags. These actions are part of the incident-handling workflow and can be triggered when an incident is created or updated, enabling consistent triage and enrichment without manual intervention.

Answer

Deploy a data connector

Answer

Modify a watchlist

Answer

Create a scheduled query rule

Question 14

Your organization uses Microsoft Sentinel. A security analyst receives an alert indicating that a user account was used to sign in from an unfamiliar location. You need to investigate the incident using Microsoft Defender XDR. Which action should you take first?

Accepted Answer

Review the alert in the Microsoft Defender XDR portal and classify it as a true or false positive.. The first step in incident response is to validate the alert by reviewing it in the Microsoft Defender XDR portal. This allows the analyst to assess the alert's context, such as sign-in logs, user risk, and related entities, before taking any corrective action. Classifying the alert as a true or false positive ensures that subsequent steps (like password reset or account disablement) are based on accurate threat assessment, preventing unnecessary disruption.

Answer

Create an automated playbook to reset the user's password.

Answer

Turn off the user account in Microsoft Entra ID.

Answer

Reset the user's password immediately to prevent further access.

Question 15

During a ransomware incident, security team needs to prevent encryption while preserving forensic data. Which action best achieves this balance?

Accepted Answer

Enable network micro-segmentation to isolate affected systems from file servers and take memory snapshots.. Network micro-segmentation (e.g., using Azure Network Security Groups or software-defined networking) isolates affected systems from file servers, halting lateral movement and preventing encryption of shared data, while memory snapshots (e.g., via Azure VM snapshots or live memory acquisition tools like WinPmem) preserve volatile forensic evidence such as encryption keys or process artifacts. This balances containment with forensic preservation, unlike destructive actions like shutdown or disconnection that lose memory data.

Answer

Shut down all affected servers immediately.

Answer

Run a full antivirus scan on all endpoints.

Answer

Disconnect the network but leave systems running.