SC-200 Manage a security operations environment — 100 Questions

Question 1

Your SOC team uses Microsoft Sentinel to manage incidents. You want to improve the efficiency of incident triage by automatically enriching incidents with threat intelligence data from Microsoft Threat Intelligence. What should you configure?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Create a playbook that queries the Threat Intelligence API and adds a comment to the incident.. Playbooks in Microsoft Sentinel can be triggered by automation rules and can query the Microsoft Threat Intelligence API to retrieve threat indicators, then add a comment or tag to the incident for enrichment. Watchlists are static and cannot be directly referenced in automation rules for dynamic matching; they require a playbook to look up data. The TAXII connector only ingests indicators, and UEBA is unrelated to threat intelligence enrichment.

Answer

Enable the Threat Intelligence - TAXII connector to ingest threat indicators.

Answer

Create a watchlist containing threat intelligence data and use it in an automation rule to add tags or comments.

Answer

Enable User and Entity Behavior Analytics (UEBA) to detect anomalies.

Question 2

You are reviewing an automation rule in Microsoft Sentinel with the configuration shown in the exhibit. The rule is intended to delete a custom analytics rule when an incident is created. What is the most likely issue with this configuration?

Accepted Answer

The playbook does not have permissions to delete analytics rules.. Automation rules in Microsoft Sentinel are designed to automate incident response actions, such as assigning ownership, changing status, or running playbooks. They cannot directly delete or modify analytics rules; that capability is not part of the automation rule schema or actions. The intended action in the exhibit (deleting a custom analytics rule) is outside the scope of what automation rules can perform.

Answer

The displayName should not contain spaces.

Answer

Automation rules cannot delete analytics rules; they are designed to automate incident response.

Answer

The incidentType should be set to 'AnalyticsRule' instead of 'Alert'.

Question 3

You run the PowerShell command shown in the exhibit to enable diagnostics on an Azure VM. The VM is running Windows Server 2022. You want to collect security events and send them to a Log Analytics workspace. What should you include in the diagnostics.json configuration file?

Accepted Answer

A WindowsEventLog element with ProviderName set to 'Security' and a query of '*'.. The Azure Diagnostics extension for Windows VMs uses a WindowsEventLog element in the diagnostics.json configuration to specify which Windows Event Log channels to collect. Setting ProviderName to 'Security' and query to '*' collects all security events from the Security log, which are then forwarded to the Log Analytics workspace.

Answer

An EtwProvider element with provider GUID for Microsoft-Windows-Security-Auditing.

Answer

A Syslog element with facility set to 'auth' and severity set to 'info'.

Answer

A PerformanceCounter element with a counter for security incidents.

Question 4

Your SOC team uses Microsoft Sentinel analytics rules. You need to ensure that a scheduled rule runs every hour, but only during business hours (8 AM to 6 PM). What configuration should you use?

Accepted Answer

Create two rules: one that runs every hour during business hours and another that runs but suppresses alerts outside business hours.. Microsoft Sentinel scheduled analytics rules do not natively support time-based scheduling restrictions like 'only during business hours'. The recommended workaround is to create two separate rules: one that runs every hour during business hours to generate alerts, and another that runs every hour outside business hours but is configured to suppress alerts (e.g., by setting a low severity or using a suppression query). This ensures detection logic runs continuously while avoiding alert fatigue outside the desired window.

Answer

Use a custom log with a logic app to only trigger the rule during business hours.

Answer

Configure the rule to run continuously with an alert threshold of 0.

Answer

Set the rule to run every hour and use a KQL query to filter events outside business hours.

Question 5

Which TWO of the following are valid methods to reduce the cost of Microsoft Sentinel data ingestion?

Accepted Answer

Configure Basic logs for high-volume, low-value data sources.. Option A is correct because Basic logs (Basic Logs plan) in a Log Analytics workspace cost significantly less for ingestion and retention than the Analytics logs plan, making it ideal for high-volume, low-value data such as verbose logs that are only needed for troubleshooting or occasional searches. Option C is correct because setting a daily ingestion cap on the Log Analytics workspace limits the maximum volume of data ingested per day, preventing unexpected ingestion charges once the cap is reached (though data above the cap is dropped). Option B is not a cost-reduction method for ingestion itself; efficient KQL queries and reduced false positives lower query/analytics costs and noise, not the per-GB ingestion charge. Option D is invalid because Microsoft Sentinel is enabled on a Log Analytics workspace, not on premium storage accounts, and storage tiers do not reduce Sentinel ingestion cost. Option E is incorrect because increasing retention to 90 days increases retention charges rather than reducing ingestion cost.

Answer

Use analytics rules with efficient KQL queries to reduce false positives.

Answer

Enable Sentinel on premium storage accounts.

Answer

Increase the data retention period to 90 days.

Question 6

Refer to the exhibit. You are reviewing a Microsoft Sentinel scheduled analytics rule defined in ARM template format. The rule is enabled but no incidents are being created even though matching sign-in events exist. What is the most likely reason?

Accepted Answer

The rule does not have entity mapping configured. The most likely reason no incidents are being created despite matching sign-in events is that the rule lacks entity mapping. In Microsoft Sentinel, while entity mapping is optional for some rule types, it is required for scheduled analytics rules to generate incidents from query results. Without entity mapping, the rule may run successfully and find results but will not create an incident because Sentinel cannot associate the results with a recognized entity (e.g., Account, IP, Host). This is a common misconfiguration when importing rules via ARM templates.

Answer

The query uses a dynamic list incorrectly

Answer

The suppressionDuration is incorrectly configured

Answer

The queryFrequency is set too high, causing missed events

Question 7

Refer to the exhibit. You are analyzing a KQL query for a Microsoft Sentinel scheduled rule. The query is intended to detect devices that have both a high number of process executions and network connections to a single IP within an hour. However, the query returns no results even though there are devices meeting the criteria. What is the most likely cause?

Accepted Answer

The join condition does not include a time window, causing mismatches. The join between DeviceProcessEvents and DeviceNetworkEvents lacks a time window constraint (e.g., 'on $left.Timestamp between ($right.Timestamp - 1h) and ($right.Timestamp + 1h)'). Without this, the join matches events across arbitrary time ranges, causing mismatches where a device's process executions and network connections to a single IP occur at different times, even if both happen within the same hour. This results in no rows being returned when the intended detection requires temporal proximity.

Answer

The threshold variable is not used correctly

Answer

The DeviceProcessEvents and DeviceNetworkEvents tables are from different data sources

Answer

The summarize function cannot count process executions

Question 8

Refer to the exhibit. You have a Microsoft Sentinel analytic rule configured to detect brute force attacks. The rule runs every 30 minutes and groups alerts into incidents based on Account and IP. You notice that multiple incidents are created for the same user and IP within a short time. What should you do to reduce the number of incidents?

Accepted Answer

Increase the lookback duration to 2 hours. Increasing the lookback duration to 2 hours allows the analytic rule to consider a longer window of historical data when grouping alerts into incidents. This means that alerts for the same Account and IP that occur within that extended timeframe will be merged into a single incident, directly reducing the number of duplicate incidents created for the same user and IP.

Answer

Decrease the query frequency to 1 hour

Answer

Increase the trigger threshold to 10

Answer

Disable alert grouping

Question 9

Your security team uses Microsoft Defender XDR to investigate incidents. You have a custom detection rule that runs a KQL query every hour. Recently, the rule stopped generating alerts. You verify that the query syntax is correct and that data is being ingested. What is the most likely cause?

Accepted Answer

The alert suppression threshold is configured too high.. The custom detection rule uses an alert suppression threshold, which prevents alerts from being generated unless the query results exceed a specified count. If this threshold is set too high, the rule may stop generating alerts even though the query returns valid results, because the number of matching events no longer meets the suppression limit. This is the most likely cause given that the query syntax is correct and data is being ingested.

Answer

The Microsoft Defender XDR license has expired.

Answer

An automation rule is deleting the alerts.

Answer

The query is not returning any results.

Question 10

Which THREE components are required to automate incident response in Microsoft Sentinel using playbooks? (Choose three.)

Accepted Answer

An automation rule in Sentinel.. Option A is correct because an automation rule in Microsoft Sentinel is the mechanism that binds a trigger condition (such as incident creation) to a playbook, enabling automatic execution of the response workflow. Option B is correct because playbooks in Microsoft Sentinel are built on Azure Logic Apps workflows, which contain the actual response actions (e.g., sending emails, blocking IPs, posting to Teams) that perform the automation. Option E is correct because a trigger, such as 'When an incident is created' or 'When an alert is created', is the required starting event that fires the Logic Apps workflow; without a trigger, the playbook cannot run automatically. Option C is not correct because a workbook is only a visualization and reporting tool in Sentinel and does not execute or automate response actions. Option D is not correct because an analytics rule detects threats and generates alerts/incidents, but it does not itself automate the response; it may be referenced by an automation rule, yet it is not a required component for the playbook automation itself.

Answer

A workbook.

Answer

An analytics rule.

Question 11

Refer to the exhibit. Your SOC manager runs this KQL query in Microsoft Sentinel to see which analysts have the most active high-severity incidents in the past 7 days. The query returns no results. What is the most likely reason?

Accepted Answer

The SecurityIncident table is not available in the Logs workspace; it is only accessible through the Sentinel incidents blade.. The SecurityIncident table is not available in the standard Log Analytics workspace; it is a Sentinel-specific table that is only accessible through the Microsoft Sentinel incidents blade or via the SecurityIncident table in the Sentinel Logs workspace when Sentinel is enabled. The query fails because the table does not exist in the workspace's schema, not because of syntax or data absence.

Answer

The query has a syntax error.

Answer

The table name is misspelled.

Answer

No high-severity incidents were created in the last 7 days.

Question 12

Your Microsoft Sentinel environment uses multiple workspaces. You need to centrally manage incidents from all workspaces in a single interface. What should you use?

Accepted Answer

Use cross-workspace queries in Sentinel incidents.. Cross-workspace queries in Microsoft Sentinel allow you to include multiple workspaces in a single query by using the `workspace()` expression. When you create an incident rule that uses such a query, Sentinel can centrally manage incidents generated from data across all specified workspaces, providing a unified incident queue in the Sentinel interface.

Answer

Create an Azure Monitor workbook.

Answer

Use the Microsoft 365 Defender portal.

Answer

Use Azure Logic Apps to aggregate incidents.

Question 13

Which TWO actions are valid methods to ingest non-Microsoft security logs into Microsoft Sentinel?

Accepted Answer

Configure Syslog forwarding to the Sentinel workspace.. Option B is correct because Microsoft Sentinel supports ingesting non-Microsoft security logs from Linux-based sources via Syslog forwarding, typically using the Log Analytics agent (or Azure Monitor Agent) to forward Syslog events to the Sentinel workspace. Option E is correct because deploying the Log Analytics agent (or its successor, Azure Monitor Agent) on the source device allows collection of custom and non-Microsoft logs into the workspace via custom log tables or Syslog/CEF collection. Option A is not valid for ingesting non-Microsoft logs, as Azure Policy enables diagnostic settings for Azure resources, not external log sources. Option C is incorrect because the Microsoft 365 Defender connector ingests Microsoft security telemetry, not non-Microsoft logs. Option D is incorrect because Intune manages endpoint configuration and does not push a custom log collector for Sentinel ingestion.

Answer

Use Azure Policy to automatically enable diagnostics settings.

Answer

Configure the Microsoft 365 Defender data connector.

Answer

Use Microsoft Intune to push a custom log collector.

Question 14

Your organization uses Microsoft Sentinel and you have configured a fusion analytics rule for advanced multistage attack detection. You notice that the rule is generating a high number of false positives. What should you do to reduce the false positives without disabling the rule?

Accepted Answer

Add entity exclusions to the fusion rule configuration. Fusion analytics rules in Microsoft Sentinel support entity exclusions to reduce false positives. By excluding specific entities (e.g., known benign IPs or users), the rule will not generate incidents for those entities, thus reducing false positives without disabling the rule. Option A is incorrect because disabling the rule is not desired. Option C is incorrect because fusion rules are built-in and do not allow modification of incident creation conditions; they only support exclusions. Option D is incorrect because fusion rules do not have a configurable severity threshold.

Answer

Disable the fusion rule and create custom analytics rules

Answer

Modify the fusion rule’s incident creation conditions

Answer

Reduce the severity threshold for the fusion rule

Question 15

Refer to the exhibit. You are analyzing a KQL query in Microsoft Sentinel that returns accounts with more than 10 failed logins within 5 minutes. The query is not returning any results even though you know there have been multiple failed logins. What is the most likely reason?

Accepted Answer

The filter condition 'Account !startswith "ANONYMOUS LOGON"' is case-sensitive and may be excluding valid results. The `!startswith` operator in KQL is case-sensitive by default. If the actual account name in the SecurityEvent table is stored as 'ANONYMOUS LOGON' with a different case (e.g., 'Anonymous Logon' or 'anonymous logon'), the filter will exclude those rows, causing the query to return no results even though failed logins occurred. This is a common pitfall when using string comparison operators in KQL without considering case sensitivity.

Answer

The 'startswith' operator is not a valid KQL operator

Answer

The 'bin' function is used incorrectly

Answer

The query syntax requires a 'let' statement

Question 16

Your security team uses Microsoft Defender XDR (formerly Microsoft 365 Defender) to investigate incidents. You notice that some alerts from Microsoft Defender for Endpoint are not being automatically correlated into incidents as expected. You have confirmed that the relevant alert sources are enabled in the Microsoft Defender XDR portal. What is the most likely cause?

Accepted Answer

Incident correlation rules are not enabled for the relevant alert sources.. Microsoft Defender XDR uses built-in correlation logic to automatically group related alerts from different sources (e.g., Defender for Endpoint, Defender for Office 365) into incidents. If alerts from a specific source, such as Defender for Endpoint, are not being correlated, the most likely cause is that the incident correlation rules for that source are not enabled in the Microsoft Defender XDR portal. Enabling the alert source alone is insufficient; the correlation engine must be explicitly activated for each source to aggregate alerts into incidents.

Answer

Alert tuning rules are causing the alerts to be excluded.

Answer

Automation rules in Microsoft Sentinel are deleting the alerts.

Answer

Alert suppression rules are blocking the alerts.

Question 17

Which TWO Azure services can be used to automate response actions in Microsoft Sentinel when an incident is created?

Accepted Answer

Azure Logic Apps. Azure Logic Apps (B) is correct because Microsoft Sentinel playbooks are built on Logic Apps, and a playbook with an incident-created trigger can automatically run response actions (e.g., block an IP, post to Teams, create a ticket) when an incident is generated. Power Automate (E) is also correct because it is the same underlying workflow engine as Logic Apps and is supported for creating and running Sentinel playbooks, including automation rules that invoke playbooks on incident creation. Azure Automation (A) is not the Sentinel playbook mechanism; it runs runbooks and can be invoked from a playbook, but it does not itself provide the incident-created automation trigger. Azure Functions (C) is compute code that can be called by a playbook but is not the automation service that responds to Sentinel incident creation. Azure Event Grid (D) is an event-routing service and does not implement Sentinel response actions on incident creation.

Answer

Azure Automation

Answer

Azure Functions

Answer

Azure Event Grid

Question 18

Refer to the exhibit. You are analyzing a KQL query in Microsoft Sentinel. The query returns no results even though you know there are alerts with the name 'Malware detected'. What is the most likely issue?

Accepted Answer

The 'Entities' column might be null for these alerts.. KQL operators are case-insensitive, so the casing of `mv-expand` is not the problem. The most likely issue is that the `Entities` column is null or empty for the matching alerts. `mv-expand` on such rows can drop them, causing the query to return no results even though alerts with the name 'Malware detected' exist.

Answer

The operator 'mv-expand' should be lowercase 'mv-expand'.

Answer

The 'project' operator should be 'project-away'.

Answer

The function 'parse_json' should be 'parse_json()' with parentheses.

Question 19

Your organization has Microsoft Defender for Cloud Apps and Microsoft Sentinel integrated. You need to create an automated playbook that, when a Microsoft Sentinel incident is created from a Defender for Cloud Apps alert, automatically suspends the user in Microsoft Entra ID and sends a notification to the security team. Which two connectors should you use in the playbook?

Accepted Answer

Microsoft Entra ID and Microsoft Teams. Microsoft Entra ID provides the identity management action to suspend a user account, and Microsoft Teams enables sending a notification to the security team via a Teams channel or chat. This combination directly fulfills the requirements of suspending the user in Entra ID and notifying the team when a Sentinel incident is triggered from a Defender for Cloud Apps alert.

Answer

Microsoft Power BI and Microsoft Teams

Answer

Azure Automation and Microsoft Sentinel

Answer

Microsoft Entra ID and Outlook.com

Question 20

Your security team uses Microsoft Defender XDR to investigate a potential malware outbreak. You need to collect a full memory dump from an affected Windows 10 device for forensic analysis. Which action should you take from the Microsoft Defender XDR portal?

Accepted Answer

Initiate a 'Collect investigation package' action.. The 'Collect investigation package' action is the closest built-in forensic collection step in Microsoft Defender XDR, gathering artifacts such as running processes, network connections, autoruns, scheduled tasks, services, installed programs, prefetch files, and the security event log. However, it does not capture a full physical memory dump — that requires a Live Response session in which the analyst runs or uploads a dedicated memory-acquisition tool and then downloads the resulting file.

Answer

Isolate the device from the network.

Answer

Run a full antivirus scan on the device.

Answer

Restrict app execution on the device.