SC-200 Manage a security operations environment — 15 Questions

Question 1

Your company uses Microsoft Defender for Cloud to assess the security posture of hybrid workloads. You are configuring a governance rule to automatically remediate a specific recommendation that is out of compliance. The recommendation is 'Virtual machines should be migrated to new Azure Resource Manager resources'. You need to ensure that the remediation is applied at scale across all subscriptions in the management group. What should you do?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Create a governance rule in Microsoft Defender for Cloud with scope set to the management group, condition on the recommendation, and action set to 'Automatic'.. Governance rules in Microsoft Defender for Cloud allow you to define automatic remediation actions for specific recommendations at scale. By setting the scope to the management group, the rule applies to all subscriptions within that group, and the 'Automatic' action triggers the built-in remediation script for the 'Virtual machines should be migrated to new Azure Resource Manager resources' recommendation without requiring custom scripting or policy assignments.

Answer

Create a PowerShell script that runs on each VM to migrate it, and execute it via Azure Automation.

Answer

Create an Azure Policy initiative that includes the recommendation and assign it with a remediation task at the management group level.

Answer

Create a governance rule in Microsoft Defender for Cloud with scope set to a single subscription and action set to 'Automatic'.

Question 2

Your SOC team uses Microsoft Sentinel to manage incidents. You want to improve the efficiency of incident triage by automatically enriching incidents with threat intelligence data from Microsoft Threat Intelligence. What should you configure?

Accepted Answer

Create a watchlist containing threat intelligence data and use it in an automation rule to add tags or comments.. Watchlists in Microsoft Sentinel allow you to store and reference static threat intelligence data directly within automation rules. By creating a watchlist with threat indicators and configuring an automation rule to add tags or comments based on matches, you can enrich incidents without requiring external API calls or complex playbooks, thus improving triage efficiency.

Answer

Enable the Threat Intelligence - TAXII connector to ingest threat indicators.

Answer

Create a playbook that queries the Threat Intelligence API and adds a comment to the incident.

Answer

Enable User and Entity Behavior Analytics (UEBA) to detect anomalies.

Question 3

You are analyzing sign-in logs in Microsoft Sentinel. The KQL query shown in the exhibit returns a list of users who have signed into Office 365 Exchange Online more than 10 times in the last 24 hours. You need to identify potential brute-force attacks. What additional information should you add to the query to improve detection?

Accepted Answer

Include both successful and failed sign-in attempts, then filter for users with a high number of failed attempts and at least one successful attempt.. To detect brute-force attacks, you need to look for multiple failed sign-in attempts followed by a success. The current query only shows successful sign-ins. Option A is correct because adding a condition to include failed attempts (ResultType != 0) and then filtering for users with many failures and at least one success would better indicate brute-force. Option B (changing the time window to 1 hour) may help detect rapid attempts but does not consider the success pattern. Option C (filtering by unusual geographic locations) may reduce false positives but does not directly detect brute-force. Option D (excluding users with MFA) is not relevant because MFA reduces risk but does not prevent brute-force detection.

Answer

Change the time window to 1 hour to detect rapid attempts.

Answer

Add a condition to only include sign-ins from unusual geographic locations.

Answer

Add a condition to exclude users who have multi-factor authentication (MFA) enabled.

Question 4

Your SOC team uses Microsoft Sentinel analytics rules. You need to ensure that a scheduled rule runs every hour, but only during business hours (8 AM to 6 PM). What configuration should you use?

Accepted Answer

Create two rules: one that runs every hour during business hours and another that runs but suppresses alerts outside business hours.. Microsoft Sentinel scheduled analytics rules do not natively support time-based scheduling restrictions like 'only during business hours'. The recommended workaround is to create two separate rules: one that runs every hour during business hours to generate alerts, and another that runs every hour outside business hours but is configured to suppress alerts (e.g., by setting a low severity or using a suppression query). This ensures detection logic runs continuously while avoiding alert fatigue outside the desired window.

Answer

Use a custom log with a logic app to only trigger the rule during business hours.

Answer

Configure the rule to run continuously with an alert threshold of 0.

Answer

Set the rule to run every hour and use a KQL query to filter events outside business hours.

Question 5

Which TWO of the following are valid methods to reduce the cost of Microsoft Sentinel data ingestion?

Accepted Answer

Configure Basic logs for high-volume, low-value data sources.. A is correct because Basic logs offer a lower ingestion cost (approximately 25% of the cost of Analytics logs) for high-volume, low-value data sources such as verbose firewall logs or debug events. By routing these logs to the Basic log table tier, you reduce the per-GB ingestion charge while still retaining the data for security investigations when needed. C is correct because setting a daily ingestion cap on the Log Analytics workspace prevents ingestion beyond a specified limit, thereby controlling costs. B is incorrect because using analytics rules with efficient KQL queries only reduces false positives in alerts, but does not reduce the volume of data ingested; ingestion cost is based on data volume, not alert volume. D is incorrect because enabling Sentinel on premium storage accounts does not reduce ingestion costs; it may increase costs. E is incorrect because increasing the data retention period increases storage costs, not ingestion costs.

Answer

Use analytics rules with efficient KQL queries to reduce false positives.

Answer

Enable Sentinel on premium storage accounts.

Answer

Increase the data retention period to 90 days.

Question 6

Your security operations team receives an alert from Microsoft Sentinel about a suspicious sign-in from an unfamiliar IP address. You need to investigate the alert by correlating it with user activity and device information. Which data sources should you query first?

Accepted Answer

Microsoft Entra ID sign-in logs and Microsoft Defender for Endpoint device events. Investigating a suspicious sign-in requires correlating the sign-in event with user activity and device context. Microsoft Entra ID sign-in logs provide the authentication details (IP address, timestamp, user), while Microsoft Defender for Endpoint device events supply device-level telemetry (processes, network connections, logged-on users). This combination directly enables the correlation needed to validate whether the sign-in was legitimate or malicious.

Answer

Microsoft Purview audit logs and Microsoft Intune device compliance

Answer

Microsoft 365 Defender alerts and Microsoft Sentinel incidents

Answer

Azure Activity Logs and Azure Firewall logs

Question 7

Refer to the exhibit. You are reviewing a Microsoft Sentinel scheduled analytics rule defined in ARM template format. The rule is enabled but no incidents are being created even though matching sign-in events exist. What is the most likely reason?

Accepted Answer

The rule does not have entity mapping configured. The most likely reason no incidents are being created despite matching sign-in events is that the rule lacks entity mapping. In Microsoft Sentinel, while entity mapping is optional for some rule types, it is required for scheduled analytics rules to generate incidents from query results. Without entity mapping, the rule may run successfully and find results but will not create an incident because Sentinel cannot associate the results with a recognized entity (e.g., Account, IP, Host). This is a common misconfiguration when importing rules via ARM templates.

Answer

The query uses a dynamic list incorrectly

Answer

The suppressionDuration is incorrectly configured

Answer

The queryFrequency is set too high, causing missed events

Question 8

Which THREE components are required to automate incident response in Microsoft Sentinel using playbooks? (Choose three.)

Accepted Answer

An automation rule in Sentinel.. Playbooks in Microsoft Sentinel are automated workflows that can be triggered by automation rules. The required components are: an automation rule (A) to define the trigger condition and invoke the playbook, a Logic Apps workflow (B) which is the playbook itself, and a trigger (E) such as 'when an incident is created' that starts the Logic App. Option C (workbook) is incorrect because workbooks are for visualization, not automation. Option D (analytics rule) is incorrect because analytics rules generate incidents, not playbooks.

Answer

A workbook.

Answer

An analytics rule.

Question 9

Refer to the exhibit. You are creating a scheduled analytics rule in Microsoft Sentinel using the ARM template snippet. The rule runs every 5 minutes and queries the last 5 minutes of data. The rule is not generating alerts even though malware detections are occurring. What is the most likely issue?

Accepted Answer

The table DeviceEvents is not ingested into the Log Analytics workspace.. DeviceEvents is a table from Microsoft Defender for Endpoint, but it is not automatically available in Microsoft Sentinel's Log Analytics workspace. The data connector for Microsoft Defender for Endpoint must be configured and the table must be mapped to Sentinel's workspace. Without this, the query runs against an empty table, returning no results, so the rule never triggers (even with triggerThreshold of 0). Option A is incorrect: having queryPeriod and queryFrequency both set to 5 minutes is standard for a rule that runs every 5 minutes looking at the last 5 minutes; it does not cause overlapping windows. Option B is incorrect: triggerThreshold of 0 means any result should trigger an alert, but if there are no results due to missing data, the rule won't fire. Option C is incorrect: the ARM template snippet would include the required 'kind' property for a scheduled rule; its absence is not the issue here.

Answer

The queryPeriod and queryFrequency are the same, causing overlapping windows.

Answer

The triggerThreshold is set to 0, which should always trigger.

Answer

The ARM template is missing the required 'kind' property.

Question 10

Your organization uses Microsoft Sentinel to manage security incidents. You need to ensure that critical incidents are automatically assigned to the senior security analyst on duty. What should you configure?

Accepted Answer

Modify the analytics rule to set the owner in the incident creation. Modifying the analytics rule to set the owner during incident creation ensures that critical incidents are automatically assigned to the designated analyst. In Microsoft Sentinel, analytics rules can be configured to specify the incident owner at creation time. Option A is incorrect because automation rules are triggered after incident creation and cannot set the initial owner. Option C is incorrect because playbooks are for automated response actions, not for initial assignment. Option D is incorrect because workbooks are for visualization, not assignment.

Answer

Configure an automation rule with an 'Assign incident' action

Answer

Create a playbook that assigns incidents

Answer

Use a workbook to filter incidents by severity and assign manually

Question 11

Your organization uses Microsoft Sentinel and you have configured a fusion analytics rule for advanced multistage attack detection. You notice that the rule is generating a high number of false positives. What should you do to reduce the false positives without disabling the rule?

Accepted Answer

Add entity exclusions to the fusion rule configuration. Fusion analytics rules in Microsoft Sentinel support entity exclusions to reduce false positives. By excluding specific entities (e.g., known benign IPs or users), the rule will not generate incidents for those entities, thus reducing false positives without disabling the rule. Option A is incorrect because disabling the rule is not desired. Option C is incorrect because fusion rules are built-in and do not allow modification of incident creation conditions; they only support exclusions. Option D is incorrect because fusion rules do not have a configurable severity threshold.

Answer

Disable the fusion rule and create custom analytics rules

Answer

Modify the fusion rule’s incident creation conditions

Answer

Reduce the severity threshold for the fusion rule

Question 12

A SOC manager wants to implement a new workflow where high-severity Microsoft Defender for Cloud Apps alerts are automatically sent to a Teams channel for immediate action. The solution must not require custom code. What should the manager configure?

Accepted Answer

Create an automation rule in Microsoft Sentinel with a playbook that posts to Teams. Microsoft Sentinel's automation rules can trigger a playbook (built on Azure Logic Apps) when a high-severity alert is generated, and the playbook can post a message to a Teams channel without requiring custom code. This directly meets the requirement of automatically sending high-severity Microsoft Defender for Cloud Apps alerts to Teams for immediate action, leveraging built-in connectors.

Answer

Use Microsoft Power Automate to monitor the alerts and send a Teams message

Answer

Configure a rule in Microsoft Defender XDR to send email notifications

Answer

Configure Microsoft Entra ID to send the alerts to Teams

Question 13

Which TWO actions should you take when configuring Microsoft Sentinel to minimize false positives from an analytics rule?

Accepted Answer

Map entities correctly. Mapping entities correctly (Option B) helps minimize false positives by ensuring that alerts are properly correlated with actual assets, reducing noise from unrelated events. Adjusting the rule's query threshold (Option D) allows you to tune the sensitivity of the rule, so only events that exceed a certain count or frequency trigger alerts, filtering out benign or low-frequency activities. These two actions directly reduce false positives, while the other options (playbooks, automatic incident creation, alert grouping) are more about response or organization rather than minimizing false positives.

Answer

Add a playbook to automatically close low-severity alerts

Answer

Enable incident creation automatically

Answer

Configure alert grouping

Question 14

Your organization uses Microsoft Sentinel with a pay-as-you-go pricing tier. You need to reduce costs by archiving older logs that are rarely accessed. Which action should you take?

Accepted Answer

Configure a lifecycle management policy in Azure Storage to transition logs to the archive tier after the retention period.. To archive old logs that are rarely accessed, you should configure a lifecycle management policy in Azure Storage associated with your Log Analytics workspace. This policy can transition logs to the archive tier after the workspace's retention period ends, reducing storage costs while keeping data available for compliance. Option A (Basic Logs) reduces ingestion costs but does not archive logs; it still retains logs in an accessible but limited query state. Option C (reducing retention) would delete logs after 30 days, not archive them. Option D (Data Collection Rule) filters logs before ingestion, which reduces volume but does not archive existing logs.

Answer

Switch the Log Analytics workspace to Basic Logs tier for the Sentinel tables.

Answer

Reduce the workspace retention period from 90 days to 30 days.

Answer

Create a Data Collection Rule to filter out logs before ingestion.

Question 15

You are configuring Microsoft Defender for Cloud Apps session controls for a SharePoint site containing sensitive data. Which condition must be met to apply real-time monitoring?

Accepted Answer

Users must be configured with Conditional Access policies from Microsoft Entra ID.. Microsoft Defender for Cloud Apps session controls for SharePoint require users to be routed through the Cloud App Security proxy, which is invoked by Conditional Access policies in Microsoft Entra ID. Conditional Access app controls apply session policies to traffic when users access SharePoint, enabling real-time monitoring. The Microsoft Entra ID application proxy is designed for on-premises apps, not for SaaS apps like SharePoint Online. Therefore, the correct prerequisite is having Conditional Access policies configured.

Answer

The SharePoint site must be added as a custom app in Defender for Cloud Apps.

Answer

Users must access the site through Microsoft Entra ID application proxy.

Answer

A browser extension must be installed on all client devices.