SC-200 Practice Test 8 — 10 Questions

Question 1

Which TWO actions are valid for automation rules in Microsoft Sentinel? (Choose two.)

Accepted Answer

Change the severity of an incident.. Automation rules in Microsoft Sentinel allow you to automate incident management tasks without requiring a playbook. Changing the severity of an incident is a supported action, enabling you to adjust the priority based on custom criteria such as incident properties or enrichment data.

Answer

Delete an incident.

Answer

Add tags to an incident.

Answer

Modify an existing analytics rule.

Question 2

Your organization uses Microsoft Sentinel. You need to ensure that incident response times are monitored and reported. Which TWO capabilities should you use?

Accepted Answer

Automation rules. Automation rules (C) are correct because they allow you to define conditions and actions that automatically trigger when an incident is created or updated, enabling consistent assignment, severity changes, and tagging. Workbooks (E) are correct because they provide customizable visualizations and reports that can track key metrics like incident response times, mean time to acknowledge (MTTA), and mean time to remediate (MTTR) using KQL queries against Sentinel's security data.

Answer

Playbooks

Answer

UEBA

Answer

Watchlists

Question 3

A company has multiple Azure subscriptions managed by Microsoft Defender for Cloud with enhanced security features enabled. The security team wants to ensure that all Azure SQL Servers have Advanced Data Security (ADS) enabled, including Vulnerability Assessment. They decide to use Azure Policy to enforce this at scale. Which built-in policy initiative should they assign to achieve this?

Accepted Answer

Azure Security Benchmark. The Azure Security Benchmark initiative includes built-in policies to enforce Advanced Data Security (ADS) and Vulnerability Assessment on Azure SQL Servers. Assigning this initiative at scale ensures compliance with security best practices across all subscriptions, as it contains the specific policy effect to enable ADS and VA automatically.

Answer

Enable Azure Monitor for VMs

Answer

Deploy Diagnostics Settings for SQL Databases

Answer

Enable Advanced Threat Protection for SQL servers

Question 4

During an incident investigation in Microsoft Sentinel, you need to gather related events from multiple data sources into a single view for analysis. Which feature should you use?

Accepted Answer

Investigation graph. The Investigation graph in Microsoft Sentinel is specifically designed to visually correlate and explore related entities and events across multiple data sources within a single investigation. It allows you to pivot from an alert or entity to see connected users, hosts, IP addresses, and other events, providing a unified view for analysis. This feature directly addresses the need to gather related events from disparate sources into one cohesive view during incident response.

Answer

Workbooks

Answer

Watchlists

Answer

Logs blade

Answer

Analytics rules

Question 5

Your organization is using Microsoft Sentinel and has deployed the Microsoft Entra ID (Azure AD) connector. You need to create an analytics rule that triggers an incident when a user from a specific IP address is assigned the Global Administrator role. The IP address is not in your trusted IP list. Which KQL query should you use as the rule logic?

Accepted Answer

AuditLogs | where ActivityDisplayName == 'Add member to role' and TargetResources[0].displayName == 'Global Administrator' and InitiatedBy.app.ipAddress !in (dynamic(['10.0.0.1', '10.0.0.2'])). It uses the `!in` operator to filter out specific IP addresses from the `InitiatedBy.app.ipAddress` field, ensuring that only events from IP addresses not in the trusted list trigger an incident. The query correctly targets `AuditLogs` with `ActivityDisplayName == 'Add member to role'` and checks that the role assigned is `Global Administrator` via `TargetResources[0].displayName`. This logic matches the requirement to alert when a user from a specific IP address (10.0.0.1) that is not in the trusted list is assigned the Global Administrator role.

Answer

AuditLogs | where ActivityDisplayName == 'Add member to role' and TargetResources[0].displayName == 'Global Administrator' and InitiatedBy.app.ipAddress == '10.0.0.1'

Answer

AuditLogs | where ActivityDisplayName == 'Add member to role' and TargetResources[0].displayName == 'Global Administrator' and InitiatedBy.app.ipAddress !has '10.0.'

Answer

AuditLogs | where ActivityDisplayName == 'Add member to role' and TargetResources[0].displayName == 'Global Administrator' and InitiatedBy.app.ipAddress !in ('trusted IP list')

Question 6

Your organization uses Microsoft Sentinel. You need to ensure that only users with the appropriate permissions can run playbooks from within the incident investigation interface. What role should you assign to the security operations team?

Accepted Answer

Microsoft Sentinel Contributor. The Microsoft Sentinel Contributor role includes the ability to create and edit playbooks, as well as run them from the incident investigation interface. This role grants the necessary permissions to manage automation rules and execute playbooks, which is required for the security operations team to respond to incidents effectively.

Answer

Microsoft Sentinel Reader

Answer

Microsoft Sentinel Responder

Answer

Global Administrator in Microsoft Entra ID

Question 7

Your SOC team uses Microsoft Sentinel incident investigation. An analyst needs to quickly see all related entities (users, IPs, machines) for an incident. Which feature should the analyst use?

Accepted Answer

Incident investigation graph. The Incident investigation graph in Microsoft Sentinel provides a visual, interactive map of all entities (users, IPs, machines) linked to an incident, allowing analysts to quickly see relationships and pivot between entities. This is the dedicated feature for entity-centric incident exploration, unlike other options that serve different purposes.

Answer

Incident timeline

Answer

Hunting blade

Answer

Entity behavior analytics page

Question 8

Your organization uses Microsoft Sentinel and Microsoft Defender XDR. You are responsible for managing the security operations environment. Recently, the SOC team reported that incidents from Microsoft Defender for Endpoint are not appearing in Microsoft Sentinel. You have already configured the data connector for Microsoft Defender XDR and verified that logs are flowing into the 'SecurityAlert' table. However, incidents are not being created in Sentinel. What should you do?

Accepted Answer

Enable 'Create incidents from Microsoft 365 Defender' in the Microsoft Defender XDR data connector.. Incident creation from Defender XDR requires enabling the 'Microsoft 365 Defender' incident creation in the data connector. Option B is wrong because analytics rules are not needed; incidents come from the connector. Option C is wrong because that connector is for alerts, not incidents. Option D is wrong because streaming is not the issue.

Answer

Create an analytics rule that queries the SecurityAlert table and generates incidents.

Answer

Verify the Azure Sentinel solution is installed and enable the streaming of incidents.

Answer

Configure the Microsoft Defender for Endpoint data connector.

Question 9

You are reviewing the automation rule configuration shown in the exhibit. What is the purpose of this rule?

Accepted Answer

Run a playbook to isolate a device when an incident with 'Malware' in the alert title is created. The automation rule is configured to trigger when an incident is created with 'Malware' in the alert title. The action specified is to run a playbook, which in Microsoft Sentinel can perform complex remediation steps such as isolating a device. Option C correctly identifies this combination of trigger condition and action.

Answer

Automatically resolve incidents related to malware

Answer

Automatically close incidents with 'Malware' in the title

Answer

Create a playbook for malware alerts

Question 10

Which TWO actions are valid ways to reduce the number of false positive incidents in Microsoft Sentinel without disabling analytics rules?

Accepted Answer

Modify the rule's query to include additional filters.. Modifying the rule's query to include additional filters directly reduces false positives by narrowing the conditions that trigger an alert. This approach refines the detection logic without disabling the rule, ensuring only events that more precisely match the intended threat pattern generate incidents.

Answer

Configure the rule to group all alerts into a single incident per entity.

Answer

Increase the rule run frequency.

Answer

Change the incident severity to Informational.