SC-200 Mock Exam 87 — 25 Questions

Question 1

Refer to the exhibit. You have a Logic Apps playbook that triggers on Microsoft Sentinel alerts. The playbook is not posting messages to Teams. What is the most likely cause?

Accepted Answer

The playbook is using the wrong trigger type.. The playbook is triggered on Microsoft Sentinel alerts, but Logic Apps requires a specific trigger type to process these alerts correctly. The most likely cause is that the playbook uses a generic HTTP trigger instead of the 'Microsoft Sentinel Incident' or 'Microsoft Sentinel Alert' trigger, which is designed to parse the alert payload and provide the necessary context for downstream actions like posting to Teams. Without the correct trigger, the playbook may not receive the alert data or may fail to execute the Teams connector properly.

Answer

The Teams connector is not authenticated.

Answer

The trigger body is not referencing the correct alert ID.

Answer

The JSON syntax is invalid.

Question 2

Which THREE capabilities are provided by Microsoft Sentinel's UEBA (User and Entity Behavior Analytics)? (Select THREE.)

Accepted Answer

Identify users whose behavior deviates from their peers. Option A is correct because Microsoft Sentinel's UEBA uses machine learning models to establish a baseline of normal behavior for each user and then compares individual user activity against peer group behavior. When a user's actions deviate significantly from their peers, such as accessing unusual resources or performing atypical data transfers, an anomaly is generated, enabling security analysts to investigate potential insider threats or compromised accounts.

Answer

Automatically run playbooks when anomalies are detected

Answer

Create watchlists for high-value users

Question 3

Refer to the exhibit. You are reviewing an Azure Policy definition intended to block malicious IPs by denying the creation of network security group rules that allow traffic from a list of blocked IPs. However, the policy is not working as expected. What is the most likely reason?

Accepted Answer

The policy rule does not evaluate the source IP address; it denies all security rules.. Option D is correct because the policy rule in the exhibit uses the 'sourceAddressPrefix' condition with the parameter 'listOfBlockedIPs', but it does not include a condition to evaluate the 'sourcePortRange' or 'destinationAddressPrefix'. More critically, the rule denies all security rules regardless of the source IP because the condition logic is flawed: it denies if the source IP is in the blocked list, but it does not also check that the rule is allowing traffic (e.g., direction 'Inbound' and access 'Allow'). Without these additional conditions, the policy incorrectly denies all NSG rules, including those that are not allowing traffic from blocked IPs.

Answer

The policy mode is incorrect; it should be 'All' instead of 'Microsoft.Network/virtualNetworks'.

Answer

The parameter 'listOfBlockedIPs' is not used in the policy rule.

Answer

The effect 'deny' is not supported for this resource type.

Question 4

Your company uses Microsoft Defender XDR. The security team needs to restrict access to the Microsoft Defender portal so that only analysts in the 'Security Operations' group can view incidents. What is the most efficient way to achieve this?

Accepted Answer

Create a custom role in the Microsoft Defender portal with permissions to view incidents and assign it to the Security Operations group.. Option D is correct because Microsoft Defender XDR uses role-based access control (RBAC) within the portal itself. Creating a custom role with permissions to view incidents and assigning it to the Security Operations group directly controls access to incident data without affecting broader Azure AD roles or requiring Conditional Access policies. This is the most efficient method as it scopes permissions precisely to the Defender portal's incident management functionality.

Answer

Assign the Security Operations group the Defender for Endpoint administrator role.

Answer

Configure Conditional Access policy to allow only Security Operations group to sign in to the Defender portal.

Answer

Assign the Security Operations group the Security Reader role in Microsoft Entra ID.

Question 5

A SOC analyst receives a high-severity alert for a user who downloaded a malicious file from a phishing email. The analyst needs to quickly assess the scope of the incident across endpoints, email, and identities. Which Microsoft Defender XDR feature should the analyst use to get a unified view of the incident?

Accepted Answer

Microsoft Defender XDR incident queue. The Microsoft Defender XDR incident queue is the correct choice because it aggregates alerts from Microsoft Defender for Endpoint, Office 365, and Identity into a single incident view, enabling the analyst to correlate the malicious file download across endpoints, email, and user identities without switching consoles. This unified incident management is a core feature of Microsoft Defender XDR, designed specifically for rapid triage and scope assessment in multi-domain threats.

Answer

Microsoft Purview compliance portal

Answer

Microsoft Intune device compliance dashboard

Answer

Microsoft Sentinel incidents blade

Question 6

Which THREE components are required to use Microsoft Sentinel's automation rules to automatically respond to incidents?

Accepted Answer

The appropriate permissions to run playbooks.. Option C is correct because automation rules require appropriate permissions (e.g., Microsoft Sentinel Contributor or Automation Contributor) to execute playbooks. Without these permissions, the automation rule cannot invoke the playbook when an incident is created or updated, even if the rule and playbook are properly configured.

Answer

A playbook created in Azure Logic Apps.

Answer

An analytics rule generating alerts.

Question 7

Which THREE of the following are valid methods to archive logs in Microsoft Sentinel to reduce costs?

Accepted Answer

Configure continuous export to Azure Data Lake Storage Gen2. Option A is correct because Microsoft Sentinel supports continuous export of logs to Azure Data Lake Storage Gen2, which allows you to retain raw log data at lower storage costs while still being able to query it using Azure Synapse or other analytics tools. This method reduces the cost of high-volume log retention in Sentinel's native workspace by moving data to a cheaper long-term storage tier.

Answer

Set the workspace to free tier

Answer

Enable Basic Logs ingestion for all tables

Question 8

Refer to the exhibit. You are reviewing a playbook configuration for Microsoft Sentinel. What does this playbook do?

Accepted Answer

It runs when a high severity incident is created. The playbook is configured with a trigger condition that specifies 'When a high severity incident is created'. This means the playbook will only execute when an incident with a severity level of 'High' is generated in Microsoft Sentinel. The condition filters out incidents of other severity levels, ensuring the playbook runs exclusively for high-severity incidents.

Answer

It runs only on medium severity incidents

Answer

It runs when a new alert is generated with high severity

Answer

It runs on all incidents regardless of severity

Question 9

You manage Microsoft Sentinel. You need to ensure that an automated response is triggered when a specific type of incident is created. The response should send an email to the on-call security engineer. What should you use?

Accepted Answer

Create an automation rule that runs a playbook when an incident is created.. Option B is correct because automation rules in Microsoft Sentinel can trigger a playbook (an Azure Logic Apps workflow) when an incident is created. The playbook can include an action to send an email to the on-call security engineer, providing the automated response required by the scenario.

Answer

Use a watchlist to map incident types to email addresses and configure a scheduled query.

Answer

Modify the analytics rule to include an email action in the rule settings.

Answer

Create a workbook that alerts via email when new incidents appear.

Question 10

Which THREE components are part of the Microsoft Defender XDR incident management process?

Accepted Answer

Entities. Entities are a core component of the Microsoft Defender XDR incident management process because they represent the assets (such as users, devices, mailboxes, and applications) that are involved in an incident. The incident graph automatically links related entities to provide a unified view of the attack story, enabling analysts to pivot from an alert to the affected resources for investigation and response.

Answer

User settings

Answer

Playbooks

Question 11

Your Microsoft Sentinel workspace is experiencing high ingestion costs. Which of the following actions will most effectively reduce costs while maintaining security visibility?

Accepted Answer

Configure Basic Logs for verbose logs like Windows events from non-critical servers.. Option B is correct because configuring Basic Logs for verbose logs (e.g., Windows Event ID 4688 from non-critical servers) reduces ingestion costs by storing them in a lower-cost tier while still retaining them for security investigations. Basic Logs are charged at a lower ingestion rate and support simple queries and search jobs, preserving visibility for incident response without the full cost of Analytics Logs.

Answer

Delete unused analytics rules to reduce log ingestion.

Answer

Disable collection of all informational logs.

Answer

Reduce the data retention period to 30 days.

Question 12

Your organization uses Microsoft Sentinel for security operations. You need to ensure that critical alerts are automatically assigned to the appropriate SOC tier for investigation. What should you configure in Microsoft Sentinel?

Accepted Answer

Create an automation rule that sets the incident owner. Automation rules in Microsoft Sentinel allow you to automatically assign incidents to specific owners based on conditions like severity or alert type. This ensures critical alerts are routed to the appropriate SOC tier without manual intervention, directly meeting the requirement.

Answer

Create a playbook that assigns the incident to a user

Answer

Use a watchlist to map alert types to owners

Answer

Configure an analytics rule to set the owner

Question 13

Which TWO actions can be taken directly from the Microsoft Defender XDR incident queue? (Select TWO.)

Accepted Answer

Isolate a device involved in the incident. Option A is correct because the Microsoft Defender XDR incident queue provides direct actions, including device isolation, to contain threats without navigating to separate device management consoles. This capability is built into the incident investigation pane, allowing security analysts to quickly isolate a device involved in an incident from the unified queue.

Answer

Modify a data connector's log collection

Answer

Create a new analytics rule

Answer

Create an automation rule

Question 14

Refer to the exhibit. You are analyzing high severity alerts from Microsoft Defender for Endpoint in Microsoft Sentinel. What does this KQL query do?

Accepted Answer

It lists high severity Defender for Endpoint alerts, grouped by name and day, ordered by frequency. The KQL query uses `summarize` with `count()` to group alerts by `AlertName` and `startofday(TimeGenerated)`, then sorts by `count_` descending. This directly produces a list of high severity Defender for Endpoint alerts grouped by name and day, ordered by frequency, matching option C.

Answer

It counts alerts for a specific alert name

Answer

It displays detailed properties of each alert

Answer

It shows all alerts from Defender for Endpoint in the last week

Question 15

Which TWO actions should you take to improve the performance of Microsoft Sentinel analytics rules that query large datasets?

Accepted Answer

Use a time filter in the query to limit the data range.. Option A is correct because applying a time filter (e.g., using the `TimeGenerated` column) in a KQL query restricts the dataset to only the relevant time window, which significantly reduces the amount of data scanned by Microsoft Sentinel. This directly improves query performance by minimizing I/O and processing overhead, especially when analytics rules run against large log tables.

Answer

Use a watchlist to pre-filter results.

Answer

Change the data type of the columns to string.

Answer

Simplify the event by removing unused columns using project.

Question 16

Refer to the exhibit. You are reviewing an automation rule configuration in Microsoft Sentinel. Based on the JSON snippet, what will happen when a high-severity incident is created?

Accepted Answer

The rule will run a playbook when a high-severity incident is created. Option A is correct because the automation rule's trigger condition is set to 'When incident is created' and the condition filters for incidents with a severity of 'High'. When a high-severity incident is created, the rule will execute the associated playbook, which is a common use case for automated response in Microsoft Sentinel.

Answer

The rule will change the severity of the incident to Medium

Answer

The rule will assign the incident to the SOC manager

Answer

The rule will run the playbook when a new alert is created

Question 17

Refer to the exhibit. You run the KQL query in Microsoft Sentinel to identify analysts with high incident assignments. The query returns no results, but you know incidents exist. What is the most likely reason?

Accepted Answer

Incidents are not assigned to any owner, so the Owner field is null. Option D is correct because if incidents have no assigned owner, the Owner field is null. The KQL query likely filters or groups by Owner, and null values are excluded from results by default in aggregation operations like summarize. Since incidents exist but are unassigned, the query returns no results.

Answer

The summarize operator is incorrectly used

Answer

The SecurityIncident table does not exist

Answer

The query period is too short to capture incidents

Question 18

Your organization uses Microsoft Sentinel and Microsoft Defender XDR. You want to ensure that incidents generated in Microsoft 365 Defender are automatically synchronized to Microsoft Sentinel. What should you configure?

Accepted Answer

Enable the Microsoft Defender XDR data connector in Microsoft Sentinel. Option D is correct because the Microsoft Defender XDR data connector in Microsoft Sentinel is specifically designed to synchronize incidents from Microsoft 365 Defender into Sentinel. When enabled, this connector uses the Microsoft Graph Security API to ingest incidents, alerts, and evidence, ensuring automatic and bidirectional synchronization without requiring additional automation rules or analytics queries.

Answer

Set up an automation rule to import incidents

Answer

Configure the Microsoft Sentinel connector in Microsoft Defender XDR

Answer

Create an analytics rule to query Defender XDR data

Question 19

Which TWO actions can you perform using Microsoft Sentinel automation rules?

Accepted Answer

Change incident status. Automation rules in Microsoft Sentinel allow you to automatically manage incidents by changing their status (e.g., from 'New' to 'Active' or 'Closed') based on conditions like severity or title. They can also trigger playbooks (automated response workflows) when incidents are created or updated, enabling actions such as enrichment, investigation, or remediation. These capabilities are defined in the automation rule's 'Actions' section, where you set the incident status or select a playbook to run.

Answer

Create a new analytics rule

Answer

Modify a data connector

Answer

Delete an incident

Question 20

Your security team receives frequent false positive alerts from Microsoft Defender for Cloud Apps. You need to reduce noise without disabling any threat detection policies. What should you do?

Accepted Answer

Configure suppression rules based on user, IP, or app to automatically dismiss matching alerts.. Option B is correct because suppression rules in Microsoft Defender for Cloud Apps allow you to automatically dismiss alerts that match specific criteria (e.g., user, IP address, or app) without disabling the underlying threat detection policy. This reduces false positive noise while keeping the detection engine active for genuine threats. Disabling policies or adjusting severity thresholds would either remove detection entirely or fail to address the root cause of false positives.

Answer

Disable the built-in anomaly detection policies that generate false positives.

Answer

Adjust the alert severity thresholds in the policy settings.

Answer

Create custom detection policies to override default rules.

SC-200 Mock Exam 87 — 25 Questions

Exhibit

SC-200 Mock Exam 87 — 25 Questions

Exhibit