SC-200 Manage a security operations environment — 10 Questions

Question 1

Your SOC team needs to ensure that all high-severity Microsoft Sentinel incidents are automatically assigned to the senior analyst on call. The team uses Microsoft Teams for communication. Which configuration should you implement?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Create an automation rule that runs when an incident is created with severity High, sets the owner to the senior analyst, and then runs a playbook to post a message to Teams.. Automation rules in Microsoft Sentinel can directly set the incident owner when an incident is created, and then trigger a playbook to post a message to Microsoft Teams. This two-step configuration ensures high-severity incidents are automatically assigned to the senior analyst on call and the SOC team is notified via Teams without manual intervention.

Answer

Configure an analytics rule to set the incident owner to the senior analyst and enable Teams integration in Sentinel settings.

Answer

Create a playbook that reassigns incidents and posts to Teams, and attach it to an automation rule triggered by high-severity incidents.

Answer

Create a workbook that filters high-severity incidents and configure a Teams webhook in the workbook settings.

Question 2

Your organization uses Microsoft Defender for Cloud Apps to monitor SaaS application usage. You need to generate an alert when a user performs more than 50 failed login attempts in 10 minutes, and the alert must be based on a built-in anomaly detection policy. What should you do?

Accepted Answer

Enable the 'Multiple failed login attempts' anomaly detection policy in Defender for Cloud Apps.. Microsoft Defender for Cloud Apps includes a built-in anomaly detection policy named 'Multiple failed login attempts' that specifically monitors for a high volume of failed logins from a single user within a short time window. This policy is enabled by default and can be customized to trigger alerts when the threshold (e.g., more than 50 failed attempts in 10 minutes) is exceeded, without requiring any additional configuration or custom policy creation.

Answer

Create a data loss prevention (DLP) policy in Microsoft Purview that triggers on failed logins.

Answer

Deploy a session policy in Defender for Cloud Apps that blocks after 50 failed logins.

Answer

Configure an app connector for each SaaS app and then create a custom activity policy.

Question 3

You are a security analyst at a company that uses Microsoft 365 Defender. You receive an automated email indicating that a user has been flagged for possible credential theft. The email includes a link to investigate the alert in the Microsoft 365 Defender portal. Which role is responsible for sending this email?

Accepted Answer

Microsoft 365 Defender email notification settings.. The automated email alerting a user about possible credential theft is sent by Microsoft 365 Defender's built-in email notification settings. These settings allow security teams to configure notifications for specific alert severities or categories, such as credential theft, directly from the Microsoft 365 Defender portal. The email includes a link to investigate the alert, which aligns with the notification functionality within Microsoft 365 Defender.

Answer

A mail flow rule in Exchange Online configured to forward alerts.

Answer

Microsoft Defender for Cloud Apps notification settings.

Answer

A Microsoft Sentinel analytics rule configured to send email notifications.

Question 4

Your organization uses Microsoft Sentinel and Microsoft Defender for Office 365. You have configured incident creation from Microsoft Defender for Office 365 alerts in Microsoft Sentinel. However, you notice that some alerts are not creating incidents. Which step should you take to troubleshoot this issue?

Accepted Answer

Examine the analytics rule that creates incidents from Microsoft Defender for Office 365 alerts and verify the severity threshold.. The analytics rule that maps Microsoft Defender for Office 365 alerts to incidents in Microsoft Sentinel includes a severity threshold filter. If the rule is configured to only create incidents for alerts with a severity of 'High' or 'Medium', alerts with 'Low' severity or 'Informational' will be silently dropped and not generate incidents. Verifying and adjusting this threshold directly addresses the root cause of missing incidents.

Answer

Check the Microsoft 365 Defender portal to confirm that the alerts are being generated.

Answer

Review the Microsoft Sentinel workbooks for any visualization errors.

Answer

Verify that the Microsoft Defender for Office 365 data connector in Microsoft Sentinel is connected and data is ingested.

Question 5

Your SOC uses Microsoft Sentinel and Microsoft Defender for Identity (MDI). You have configured MDI to send alerts to Microsoft 365 Defender. From there, Microsoft Sentinel ingests the alerts via the Microsoft 365 Defender connector. You want to ensure that when MDI detects a suspicious activity, the incident in Microsoft Sentinel is created within 5 minutes. Which factors should you consider?

Accepted Answer

The latency depends on the Microsoft 365 Defender connector's polling interval and the analytics rule's frequency.. The incident creation latency in this architecture depends on two factors: the Microsoft 365 Defender connector's polling interval (which retrieves alerts from Microsoft 365 Defender) and the frequency of the Microsoft Sentinel analytics rule that creates incidents from those ingested alerts. Even if MDI sends alerts quickly to Microsoft 365 Defender, the connector polls at a configurable interval (default every 5 minutes), and the analytics rule runs on its own schedule (typically every 5 minutes). Thus, the total time to incident creation is the sum of these intervals, not a fixed 5 minutes.

Answer

The latency is determined solely by the MDI sensor health and network speed.

Answer

The incident creation time is controlled by the Microsoft Defender for Cloud Apps connector.

Answer

The incident will be created within 5 minutes because MDI writes directly to Microsoft Sentinel.

Question 6

Your company uses Microsoft Defender for Cloud to monitor multi-cloud resources. You want to ensure that all critical security recommendations are automatically assigned to the appropriate team leads based on the resource's tags. Which feature should you configure?

Accepted Answer

Use the 'Assign ownership' feature in Microsoft Defender for Cloud to map tags to owners.. The 'Assign ownership' feature in Microsoft Defender for Cloud allows you to map resource tags to specific owners (e.g., team leads) via an automated rule. When a critical security recommendation is generated for a resource with a matching tag, the recommendation is automatically assigned to the designated owner, ensuring accountability without manual intervention.

Answer

Configure a regulatory compliance standard to send email notifications.

Answer

Create a workbook that lists recommendations and manually assign them.

Answer

Create a governance rule that automatically applies a compliance standard.

Question 7

Your organization uses Microsoft Sentinel and has deployed the Microsoft Sentinel Solution for Microsoft Defender XDR. You need to correlate alerts from Microsoft Defender for Endpoint with Microsoft Defender for Office 365 in a single incident. What is the recommended approach?

Accepted Answer

Use the Microsoft 365 Defender connector to ingest unified incidents from Microsoft 365 Defender, which already correlates alerts from both products.. The Microsoft 365 Defender connector ingests unified incidents from Microsoft 365 Defender, which natively correlates alerts from Microsoft Defender for Endpoint and Microsoft Defender for Office 365 into a single incident. This is the recommended approach as it leverages the built-in correlation engine in Microsoft 365 Defender, eliminating the need for custom analytics rules or manual correlation.

Answer

Ingest alerts from both products separately and use a KQL query in an analytics rule to correlate them.

Answer

Create a workbook that displays alerts from both products side by side.

Answer

Use a Microsoft Sentinel fusion rule to correlate the alerts.

Question 8

Which TWO actions can you perform using Microsoft Sentinel automation rules?

Accepted Answer

Assign an incident to a specific analyst.. Microsoft Sentinel automation rules can directly assign an incident to a specific analyst using the 'Assign owner' action. This allows security operations teams to automatically route incidents to the appropriate personnel based on criteria such as severity, tactic, or entity, improving response efficiency.

Answer

Create a new analytics rule based on an incident.

Answer

Modify the data connector's polling interval.

Answer

Automatically create an incident from a log event.

Question 9

Which THREE components are required to ingest Microsoft Entra ID (Azure AD) audit logs into Microsoft Sentinel?

Accepted Answer

A user account with Security Administrator or Global Administrator role to configure the connector.. Configuring the Microsoft Entra ID (Azure AD) data connector in Microsoft Sentinel requires a user account with at least the Security Administrator role (or Global Administrator) to grant the necessary permissions for the connector to read audit logs and sign-in logs from Microsoft Entra ID via the Microsoft Graph API. Without this role, the connector cannot authenticate and retrieve the required data.

Answer

A Log Analytics workspace in the same region as Microsoft Entra ID.

Answer

A playbook to parse the audit logs.

Question 10

Which TWO capabilities are provided by Microsoft Copilot for Security within the Microsoft Sentinel experience?

Accepted Answer

Suggest KQL queries based on a description of what you want to detect.. Microsoft Copilot for Security in Microsoft Sentinel can generate KQL queries from natural language descriptions, allowing analysts to quickly create detection rules without manually writing KQL syntax. This capability leverages AI to interpret the analyst's intent and produce a query that matches the described detection logic.

Answer

Deploy a new workbook template from a description.

Answer

Modify an existing playbook by adding steps through natural language.

Answer

Automatically create an automation rule based on a chat prompt.