SC-200 Mock Exam 89 — 25 Questions

Question 1

Your organization uses Microsoft Sentinel with Azure Policy. You need to ensure that new Log Analytics workspaces are automatically connected to Sentinel and configured with a standard set of data connectors. What should you use?

Accepted Answer

Create Azure Policy definitions that deploy Sentinel and data connectors.. Azure Policy can be used to automatically deploy and configure Microsoft Sentinel and its data connectors on new Log Analytics workspaces. By creating policy definitions with 'DeployIfNotExists' or 'Modify' effects, you ensure that any new workspace is automatically onboarded to Sentinel and has the required data connectors installed, meeting the requirement for automated, consistent configuration at scale.

Answer

Deploy an ARM template to each new workspace manually.

Answer

Use Sentinel automation rules to configure new workspaces.

Answer

Develop a Logic App that runs on a schedule to check for new workspaces.

Question 2

Which THREE are valid ways to ingest data into Microsoft Sentinel? (Select three.)

Accepted Answer

Configuring Syslog using Azure Monitor Agent (AMA). Option A is correct because the Azure Monitor Agent (AMA) can collect Syslog events from Linux-based sources and forward them to a Log Analytics workspace, which is the underlying data store for Microsoft Sentinel. By configuring a Data Collection Rule (DCR) that specifies the Syslog facility and severity levels, AMA streams these logs into the Syslog table in the workspace, making them available for detection and analysis within Sentinel.

Answer

Connecting to Azure DevOps directly

Answer

Importing from Power BI datasets

Question 3

Refer to the exhibit. You are reviewing an Azure Resource Manager (ARM) template for a Microsoft Sentinel analytics rule. Based on the exhibit, which statement is true?

Accepted Answer

The rule will generate one alert per user that has MFA disabled.. Option D is correct because the ARM template configures a Microsoft Sentinel scheduled analytics rule that runs every hour, queries for users with MFA disabled, and uses the 'Alert Per Result' event grouping setting. This setting generates a separate alert for each unique result returned by the query, meaning each user who has MFA disabled triggers its own alert.

Answer

The rule will create one incident per alert and group alerts by entity.

Answer

The rule will only trigger if more than 5 users have MFA disabled.

Answer

The rule runs every hour and looks back 5 hours.

Question 4

You are configuring a Microsoft Sentinel automation rule to automatically assign incidents to a specific owner based on a custom property. Which action type should you use?

Accepted Answer

Assign owner. The 'Assign owner' action type is specifically designed to change the owner of an incident in Microsoft Sentinel. When you need to automatically assign incidents to a specific owner based on a custom property (e.g., a tag or custom field), this action directly modifies the incident's 'Owner' property. Other action types serve different purposes: 'Run playbook' executes a logic app, 'Change status' updates the incident's status (e.g., New, Active, Closed), and 'Create ticket (preview)' creates an external ticket in a connected ticketing system.

Answer

Run playbook

Answer

Change status

Answer

Create ticket (preview)

Question 5

You are the security operations lead for a multinational company that uses Microsoft Sentinel in a single workspace. You have recently onboarded 10 new business units, each with their own analytics rules and automation. The security team is overwhelmed by the number of low-fidelity incidents generated. You need to reduce noise without disabling critical detections. You must ensure that each business unit retains ownership of their incidents and can customize their own suppression rules. You also need centralized reporting on incident trends across all business units. You have identified that many low-fidelity alerts come from a common set of data sources. What should you do?

Accepted Answer

Create a separate analytics rule for low-fidelity alerts that uses alert suppression to group similar alerts.. Option C is correct because creating a separate analytics rule for low-fidelity alerts with alert suppression enabled allows you to group similar alerts into a single incident, reducing noise without disabling the underlying data connectors or critical detections. This approach preserves each business unit's ownership of their incidents and enables them to customize suppression rules via automation rules or analytics rule settings, while centralized reporting on incident trends remains intact because the workspace still ingests all alerts.

Answer

Disable the data connectors that produce the most noise.

Answer

Create an automation rule that automatically closes low-severity incidents.

Answer

Create a workbook that filters out low-severity incidents from the dashboard.

Question 6

Your organization has Microsoft Defender for Cloud Apps (MDA) connected to Microsoft Sentinel. The SOC team wants to receive alerts when a user accesses a sanctioned cloud app from an anonymous IP address. What should you configure?

Accepted Answer

Create an activity policy in Defender for Cloud Apps and connect it to Sentinel.. Option B is correct because an activity policy in Defender for Cloud Apps can be configured to trigger alerts on specific user activities, such as accessing a sanctioned app from an anonymous IP address. This policy can then be connected to Microsoft Sentinel via the Defender for Cloud Apps data connector, which ingests alerts as incidents for SOC review. File policies (A) focus on file-level actions like sharing or malware detection, not user access events, while session policies (D) control real-time access but do not generate alerts for historical or post-access monitoring.

Answer

Create a file policy in Defender for Cloud Apps.

Answer

Enable the Defender for Cloud Apps connector in Sentinel without additional configuration.

Answer

Create a session policy in Defender for Cloud Apps.

Question 7

Which TWO conditions must be met to enable Microsoft Sentinel UEBA? (Choose two.)

Accepted Answer

Microsoft Entra ID P2 licenses must be assigned to users.. Microsoft Sentinel UEBA requires the SecurityInsights solution to be installed in the Log Analytics workspace, as this solution provides the UEBA data connectors and analytics rules. Additionally, Microsoft Entra ID P2 licenses are required because UEBA relies on the identity protection and risk detection capabilities that are only available with P2 licensing, enabling the enrichment of entity behavior profiles with risk data.

Answer

KQL queries must be created for entity behavior.

Answer

Microsoft Defender XDR must be onboarded.

Answer

Azure SQL Database must be deployed.

Question 8

Your organization uses Microsoft Defender XDR and Microsoft Sentinel. You need to ensure that high-severity incidents are automatically escalated to the on-call security engineer via Microsoft Teams. Which three components should you configure?

Accepted Answer

A playbook that uses a condition to check severity and then sends a Teams message.. Option A is correct because a playbook in Microsoft Sentinel can contain a condition action that evaluates the incident severity. If the severity is 'High', the playbook then uses a Microsoft Teams connector to send a message to the on-call security engineer, automating the escalation process.

Answer

An analytics rule that sends a Teams message when a high-severity alert fires.

Answer

A workbook that displays high-severity incidents for manual escalation.

Question 9

Refer to the exhibit. You are configuring an automation rule in Microsoft Sentinel. The rule is enabled but never runs. The playbook exists and is in the same resource group. What is the most likely cause?

Accepted Answer

The trigger type is incorrect; it should be 'Microsoft.SecurityInsights/Alert'.. Option C is correct because the exhibit shows the trigger type set to 'Microsoft.SecurityInsights/Incident', but the playbook is designed to run on alerts, not incidents. Automation rules in Microsoft Sentinel require the trigger type to match the data type the playbook expects; for alert-triggered playbooks, the trigger must be 'Microsoft.SecurityInsights/Alert'. Since the rule is enabled and the playbook exists in the same resource group, the mismatch in trigger type is the most likely reason the rule never runs.

Answer

The condition uses 'Contains' operator, but 'AlertProvider' requires 'Equals'.

Answer

The automation rule is in a 'Disabled' state.

Answer

The playbookId is missing the subscription ID.

Question 10

Your organization has recently deployed Microsoft Sentinel and wants to ensure that all critical Azure resources are monitored for security misconfigurations. You have already enabled Microsoft Defender for Cloud on all subscriptions. You need to configure a solution that will automatically create a Sentinel incident whenever a new security recommendation with severity 'High' is generated in Defender for Cloud. The incident should be assigned to the 'Infrastructure' team. Additionally, you want to run a playbook that will open a ticket in your IT Service Management (ITSM) tool. What should you do?

Accepted Answer

Enable the Defender for Cloud connector, then create an automation rule that triggers on incident creation from the connector, assigns to 'Infrastructure', and runs a playbook.. Option D is correct because the Defender for Cloud connector in Microsoft Sentinel ingests security recommendations and alerts as incidents. By creating an automation rule that triggers on incident creation from this connector, you can automatically assign incidents to the 'Infrastructure' team and run a playbook to open a ticket in your ITSM tool, fulfilling all requirements without custom queries or workbooks.

Answer

Use the Azure Activity connector to ingest recommendations, then create an analytics rule to generate incidents.

Answer

Enable the Defender for Cloud connector and create a workbook to monitor recommendations.

Answer

Create a custom analytics rule that queries the SecurityRecommendation table in the Log Analytics workspace.

Question 11

Your SOC team uses Microsoft Sentinel incident management. You need to ensure that when an incident is created, it automatically runs a playbook to gather additional context from threat intelligence sources. What should you create?

Accepted Answer

Automation rule with a trigger on incident creation.. Option C is correct because Microsoft Sentinel automation rules can be configured with a trigger on incident creation to automatically run a playbook. This allows the SOC team to gather additional context from threat intelligence sources without manual intervention, directly addressing the requirement to execute a playbook when an incident is created.

Answer

Workbook that queries threat intelligence.

Answer

Watchlist that maps to the incident.

Answer

Analytics rule that generates an alert.

Question 12

You are a security operations analyst for a company that uses Microsoft Sentinel. You need to ensure that incidents are automatically assigned to the appropriate team based on the incident type. Which two actions should you take?

Accepted Answer

Define custom details in the analytics rule to include the team name, then use an automation rule to assign.. Option D is correct because custom details in an analytics rule allow you to extract and store the team name from the incident data, and then an automation rule can use that custom detail as a condition to automatically assign the incident to the appropriate owner. This approach ensures dynamic assignment based on the incident type without requiring a playbook or manual intervention.

Answer

Modify the analytics rule to set the incident owner directly.

Answer

Create a playbook that assigns incidents based on the incident type.

Answer

Create a workbook that filters incidents by type and assigns them manually.

Question 13

Your organization uses Microsoft Sentinel and has multiple workspaces for different business units. You need to enable cross-workspace querying for the security operations center (SOC) analysts. What should you do?

Accepted Answer

Use the workspace() expression in KQL queries. The `workspace()` expression in KQL allows a query to reference tables from multiple Log Analytics workspaces within a single query. This enables SOC analysts to perform cross-workspace queries without moving data, which is the correct approach for a multi-workspace Sentinel deployment.

Answer

Configure a data connector for each workspace

Answer

Enable incident merging across workspaces

Answer

Create a single workspace and migrate all data

Question 14

Your organization uses Microsoft Defender for Cloud and Microsoft Sentinel. You need to ensure that security alerts from Defender for Cloud are automatically synchronized to Sentinel and assigned to the cloud security team. Which three actions should you take?

Accepted Answer

Create an automation rule that sets the incident owner to the cloud security team.. Option A is correct because automation rules in Microsoft Sentinel allow you to automatically assign incident owners based on conditions such as alert severity or source connector. By creating an automation rule that sets the incident owner to the cloud security team, you ensure that every Defender for Cloud alert synchronized to Sentinel is immediately assigned to the appropriate team without manual intervention.

Answer

Manually export alerts from Defender for Cloud to Sentinel daily.

Answer

Create a playbook that periodically pulls alerts from Defender for Cloud.

Question 15

Your organization uses Microsoft Sentinel and Microsoft Defender XDR. You are configuring a new automation rule in Sentinel to automatically assign incidents to the appropriate SOC tier based on severity: Low and Medium to Tier 1, High to Tier 2, and Critical to Tier 3. You have created three separate automation rules, one for each tier. However, only the rule for Critical incidents is working. The other rules do not assign incidents. You verify that the other rules are enabled and have the correct conditions. What is the most likely cause?

Accepted Answer

The automation rule for Critical incidents has a higher order number and is processed first, preventing other rules from running.. Option D is correct because automation rules are processed in order, and if the first rule (e.g., for Critical) matches, it will stop processing subsequent rules. The rules for lower severities may never trigger if the incident also meets the conditions of a higher priority rule. Option A is wrong because multiple rules can exist. Option B is wrong because role assignments are not the issue. Option C is wrong because rules can be ordered.

Answer

The automation rules for Tier 1 and Tier 2 are set to trigger on incident update instead of creation.

Answer

The SOC Tier 1 and Tier 2 users do not have the appropriate permissions to own incidents.

Answer

Automation rules cannot be created separately for each severity; you must use a single rule with multiple conditions.

Question 16

Your organization uses Microsoft Sentinel. You need to ensure that all incidents are classified with a specific classification when closed. The classification must be chosen from a predefined list. What should you configure?

Accepted Answer

Configure incident settings in Sentinel to define custom classifications.. Option D is correct because you can create a custom classification in the Sentinel settings under 'Incident settings'. Option A is wrong because automation rules can set classification but not define the list. Option B is wrong because playbooks can set classification but not define options. Option C is wrong because analytics rules don't handle incident closure.

Answer

Modify the analytics rule to require classification.

Answer

Create a playbook that validates classification before closure.

Answer

Create an automation rule that enforces classification on closure.

Question 17

You are a SOC analyst at Contoso Ltd. The company uses Microsoft Sentinel and Microsoft Defender XDR. A high-severity incident is generated from a Sentinel analytics rule that detects multiple failed logins followed by a successful login from a geographically unusual location for a user. The incident includes an alert from Microsoft Defender for Identity indicating a possible brute-force attack. The user's account is a privileged administrator. Your organization has strict compliance requirements: any privileged account compromise must be contained within 15 minutes of detection. You have the following tools available: Microsoft Entra ID with Privileged Identity Management (PIM), Microsoft Defender for Cloud Apps, and Microsoft 365 Defender automation rules. The incident is now 5 minutes old. What should you do to meet the compliance requirement?

Accepted Answer

Disable the user account in Microsoft Entra ID immediately.. Disabling the account is the fastest containment; PIM may take extra steps; alerting is not containment; policies are slower.

Answer

Create an automation rule in Microsoft 365 Defender to alert the security team.

Answer

Create a conditional access policy to block the user's sign-ins.

Answer

Activate PIM and remove the user's role assignments.

Question 18

Your organization uses Microsoft Sentinel with the Microsoft Defender for Cloud connector enabled. You receive an incident that alerts on 'Suspicious resource deployment' from a user who has been compromised. The incident involves the deployment of a virtual machine in a subscription that is normally not used by that user. The incident severity is High. You need to contain the threat immediately. The deployment is still in progress. What should you do first?

Accepted Answer

Apply a resource lock to the subscription to block all deployments.. Option C is correct because locking the subscription prevents any further resource creation, containing the threat immediately. Option A is wrong because investigating logs takes time. Option B is wrong because deleting the VM may not stop other deployments. Option D is wrong because disabling the user account does not stop the deployment session.

Answer

Investigate the Azure Activity logs to see what other resources were deployed.

Answer

Disable the user account in Microsoft Entra ID.

Answer

Delete the virtual machine that is being deployed.

Question 19

Your organization uses Microsoft Sentinel and Microsoft Defender for Identity. An incident is created for a user whose credentials were used from an unusual location to access sensitive HR data. The user's account is a domain admin. The security team needs to ensure the attacker cannot use the account again. What should you do first?

Accepted Answer

Reset the user's password and revoke the Kerberos TGT. Option C is correct because resetting the password and revoking the Kerberos TGT ensures the attacker cannot reuse cached credentials. Option A is wrong because disabling the account may disrupt operations but password reset is more precise. Option B is wrong because logging out alone does not invalidate the TGT. Option D is wrong because removing group membership is secondary.

Answer

Remove the user from the Domain Admins group

Answer

Force the user to log out of all sessions

Answer

Disable the user's account in Active Directory

Question 20

Contoso uses Microsoft Sentinel with Microsoft Defender XDR connector. You receive an incident titled 'Malware detected on endpoint' from Microsoft Defender for Endpoint. The incident includes a detailed timeline showing that the malware was downloaded from a malicious URL. You need to respond to the incident using Microsoft Sentinel and Microsoft Defender XDR capabilities. The affected device is a Windows 10 workstation used by a standard user. You have been asked to contain the threat and prevent recurrence. The organization has a policy to preserve evidence for 90 days. Which action should you take FIRST?

Accepted Answer

Isolate the device using Microsoft Defender for Endpoint device isolation.. Option B is correct: isolating the device in MDE stops the malware from spreading and communicating with C2. Option A is wrong because resetting password does not remove malware. Option C is wrong because creating a detection rule is proactive but not immediate. Option D is wrong because blocking the URL is good but does not contain the already infected device.

Answer

Reset the user's password and revoke sessions in Microsoft Entra ID.

Answer

Create a custom detection rule in Microsoft Sentinel for the malicious URL.

Answer

Block the malicious URL at the firewall using Microsoft Defender for Cloud Apps.