SC-200 Manage a security operations environment — 40 Questions

Question 1

Your SOC team needs to ensure that all high-severity Microsoft Sentinel incidents are automatically assigned to the senior analyst on call. The team uses Microsoft Teams for communication. Which configuration should you implement?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Create an automation rule that runs when an incident is created with severity High, sets the owner to the senior analyst, and then runs a playbook to post a message to Teams.. Automation rules in Microsoft Sentinel can directly set the incident owner when an incident is created, and then trigger a playbook to post a message to Microsoft Teams. This two-step configuration ensures high-severity incidents are automatically assigned to the senior analyst on call and the SOC team is notified via Teams without manual intervention.

Answer

Configure an analytics rule to set the incident owner to the senior analyst and enable Teams integration in Sentinel settings.

Answer

Create a playbook that reassigns incidents and posts to Teams, and attach it to an automation rule triggered by high-severity incidents.

Answer

Create a workbook that filters high-severity incidents and configure a Teams webhook in the workbook settings.

Question 2

Your organization uses Microsoft Defender for Cloud Apps to monitor SaaS application usage. You need to generate an alert when a user performs more than 50 failed login attempts in 10 minutes, and the alert must be based on a built-in anomaly detection policy. What should you do?

Accepted Answer

Enable the 'Multiple failed login attempts' anomaly detection policy in Defender for Cloud Apps.. Microsoft Defender for Cloud Apps includes a built-in anomaly detection policy named 'Multiple failed login attempts' that specifically monitors for a high volume of failed logins from a single user within a short time window. This policy is enabled by default and can be customized to trigger alerts when the threshold (e.g., more than 50 failed attempts in 10 minutes) is exceeded, without requiring any additional configuration or custom policy creation.

Answer

Create a data loss prevention (DLP) policy in Microsoft Purview that triggers on failed logins.

Answer

Deploy a session policy in Defender for Cloud Apps that blocks after 50 failed logins.

Answer

Configure an app connector for each SaaS app and then create a custom activity policy.

Question 3

You are a security analyst at a company that uses Microsoft 365 Defender. You receive an automated email indicating that a user has been flagged for possible credential theft. The email includes a link to investigate the alert in the Microsoft 365 Defender portal. Which role is responsible for sending this email?

Accepted Answer

Microsoft 365 Defender email notification settings.. The automated email alerting a user about possible credential theft is sent by Microsoft 365 Defender's built-in email notification settings. These settings allow security teams to configure notifications for specific alert severities or categories, such as credential theft, directly from the Microsoft 365 Defender portal. The email includes a link to investigate the alert, which aligns with the notification functionality within Microsoft 365 Defender.

Answer

A mail flow rule in Exchange Online configured to forward alerts.

Answer

Microsoft Defender for Cloud Apps notification settings.

Answer

A Microsoft Sentinel analytics rule configured to send email notifications.

Question 4

Your organization uses Microsoft Sentinel and Microsoft Defender for Office 365. You have configured incident creation from Microsoft Defender for Office 365 alerts in Microsoft Sentinel. However, you notice that some alerts are not creating incidents. Which step should you take to troubleshoot this issue?

Accepted Answer

Examine the analytics rule that creates incidents from Microsoft Defender for Office 365 alerts and verify the severity threshold.. The analytics rule that maps Microsoft Defender for Office 365 alerts to incidents in Microsoft Sentinel includes a severity threshold filter. If the rule is configured to only create incidents for alerts with a severity of 'High' or 'Medium', alerts with 'Low' severity or 'Informational' will be silently dropped and not generate incidents. Verifying and adjusting this threshold directly addresses the root cause of missing incidents.

Answer

Check the Microsoft 365 Defender portal to confirm that the alerts are being generated.

Answer

Review the Microsoft Sentinel workbooks for any visualization errors.

Answer

Verify that the Microsoft Defender for Office 365 data connector in Microsoft Sentinel is connected and data is ingested.

Question 5

Your SOC uses Microsoft Sentinel and Microsoft Defender for Identity (MDI). You have configured MDI to send alerts to Microsoft 365 Defender. From there, Microsoft Sentinel ingests the alerts via the Microsoft 365 Defender connector. You want to ensure that when MDI detects a suspicious activity, the incident in Microsoft Sentinel is created within 5 minutes. Which factors should you consider?

Accepted Answer

The latency depends on the Microsoft 365 Defender connector's polling interval and the analytics rule's frequency.. The incident creation latency in this architecture depends on two factors: the Microsoft 365 Defender connector's polling interval (which retrieves alerts from Microsoft 365 Defender) and the frequency of the Microsoft Sentinel analytics rule that creates incidents from those ingested alerts. Even if MDI sends alerts quickly to Microsoft 365 Defender, the connector polls at a configurable interval (default every 5 minutes), and the analytics rule runs on its own schedule (typically every 5 minutes). Thus, the total time to incident creation is the sum of these intervals, not a fixed 5 minutes.

Answer

The latency is determined solely by the MDI sensor health and network speed.

Answer

The incident creation time is controlled by the Microsoft Defender for Cloud Apps connector.

Answer

The incident will be created within 5 minutes because MDI writes directly to Microsoft Sentinel.

Question 6

Your company uses Microsoft Defender for Cloud to monitor multi-cloud resources. You want to ensure that all critical security recommendations are automatically assigned to the appropriate team leads based on the resource's tags. Which feature should you configure?

Accepted Answer

Use the 'Assign ownership' feature in Microsoft Defender for Cloud to map tags to owners.. The 'Assign ownership' feature in Microsoft Defender for Cloud allows you to map resource tags to specific owners (e.g., team leads) via an automated rule. When a critical security recommendation is generated for a resource with a matching tag, the recommendation is automatically assigned to the designated owner, ensuring accountability without manual intervention.

Answer

Configure a regulatory compliance standard to send email notifications.

Answer

Create a workbook that lists recommendations and manually assign them.

Answer

Create a governance rule that automatically applies a compliance standard.

Question 7

Your organization uses Microsoft Sentinel and has deployed the Microsoft Sentinel Solution for Microsoft Defender XDR. You need to correlate alerts from Microsoft Defender for Endpoint with Microsoft Defender for Office 365 in a single incident. What is the recommended approach?

Accepted Answer

Use the Microsoft 365 Defender connector to ingest unified incidents from Microsoft 365 Defender, which already correlates alerts from both products.. The Microsoft 365 Defender connector ingests unified incidents from Microsoft 365 Defender, which natively correlates alerts from Microsoft Defender for Endpoint and Microsoft Defender for Office 365 into a single incident. This is the recommended approach as it leverages the built-in correlation engine in Microsoft 365 Defender, eliminating the need for custom analytics rules or manual correlation.

Answer

Ingest alerts from both products separately and use a KQL query in an analytics rule to correlate them.

Answer

Create a workbook that displays alerts from both products side by side.

Answer

Use a Microsoft Sentinel fusion rule to correlate the alerts.

Question 8

Which TWO actions can you perform using Microsoft Sentinel automation rules?

Accepted Answer

Assign an incident to a specific analyst.. Microsoft Sentinel automation rules can directly assign an incident to a specific analyst using the 'Assign owner' action. This allows security operations teams to automatically route incidents to the appropriate personnel based on criteria such as severity, tactic, or entity, improving response efficiency.

Answer

Create a new analytics rule based on an incident.

Answer

Modify the data connector's polling interval.

Answer

Automatically create an incident from a log event.

Question 9

Which THREE components are required to ingest Microsoft Entra ID (Azure AD) audit logs into Microsoft Sentinel?

Accepted Answer

A user account with Security Administrator or Global Administrator role to configure the connector.. Configuring the Microsoft Entra ID (Azure AD) data connector in Microsoft Sentinel requires a user account with at least the Security Administrator role (or Global Administrator) to grant the necessary permissions for the connector to read audit logs and sign-in logs from Microsoft Entra ID via the Microsoft Graph API. Without this role, the connector cannot authenticate and retrieve the required data.

Answer

A Log Analytics workspace in the same region as Microsoft Entra ID.

Answer

A playbook to parse the audit logs.

Question 10

Which TWO capabilities are provided by Microsoft Copilot for Security within the Microsoft Sentinel experience?

Accepted Answer

Suggest KQL queries based on a description of what you want to detect.. Microsoft Copilot for Security in Microsoft Sentinel can generate KQL queries from natural language descriptions, allowing analysts to quickly create detection rules without manually writing KQL syntax. This capability leverages AI to interpret the analyst's intent and produce a query that matches the described detection logic.

Answer

Deploy a new workbook template from a description.

Answer

Modify an existing playbook by adding steps through natural language.

Answer

Automatically create an automation rule based on a chat prompt.

Question 11

Refer to the exhibit. You are reviewing a Microsoft Sentinel automation rule created via ARM template. You notice that the rule is not triggering the playbook when a high-severity incident is created. What is the most likely cause?

Accepted Answer

The condition syntax is invalid; automation rules in ARM templates require specific operator properties.. Automation rules in ARM templates require explicit operator properties (e.g., 'Equals', 'Contains') in the condition syntax. If the condition is written without these operators or uses invalid JSON structure, the rule will fail to evaluate triggers correctly, preventing the playbook from being invoked when a high-severity incident is created.

Answer

The playbook resource ID is missing the 'locations' parameter.

Answer

The automation rule is disabled by default and needs to be enabled.

Answer

The playbook does not have a trigger for Microsoft Sentinel.

Question 12

Refer to the exhibit. You are a security analyst reviewing a KQL query in Microsoft Sentinel. The query is intended to show the count of high-severity malware alerts in the last 24 hours. However, the query returns results only for alerts with exact severity string 'High', but you also need to include 'Informational' severity alerts that are related to malware. What should you modify?

Accepted Answer

Change the 'where AlertSeverity == "High"' to 'where AlertSeverity in ("High", "Informational")'.. The query currently filters only for alerts where AlertSeverity equals 'High', but the requirement is to also include 'Informational' severity alerts related to malware. By changing the condition to 'where AlertSeverity in ("High", "Informational")', the query will return both severity levels while keeping the malware-related filter and the 24-hour time window intact.

Answer

Remove the 'summarize' and 'order by' clauses.

Answer

Remove the 'where AlertName contains "malware"' condition.

Answer

Change 'ago(24h)' to 'ago(48h)'.

Question 13

Refer to the exhibit. You are running a PowerShell script to enable the Anomalies setting in Microsoft Sentinel. After running the script, you check the Sentinel settings in the portal and see that Anomalies is still disabled. What is the most likely reason?

Accepted Answer

The cmdlet 'Set-AzSentinelSetting' does not exist in the Az module.. The cmdlet 'Set-AzSentinelSetting' does not exist in the official Az.SecurityInsights module. Microsoft Sentinel settings, including Anomalies, are managed via the REST API or the 'Update-AzSentinelSetting' cmdlet (part of the Az.SecurityInsights preview module). Running a non-existent cmdlet would produce an error, not apply any changes, leaving Anomalies disabled in the portal.

Answer

The user does not have Contributor permissions on the workspace.

Answer

The script requires the -PassThru parameter to apply changes.

Answer

The workspace was not retrieved correctly because the name is misspelled.

Question 14

Your organization has deployed Microsoft Sentinel and configured a workspace with data connectors for Microsoft 365 Defender, Azure Activity, and Office 365. You need to ensure that security incidents are automatically assigned to the appropriate analyst based on the incident type. What should you configure?

Accepted Answer

Create an automation rule that runs when an incident is created, with conditions on the incident title, and an action to assign the incident to a specific owner.. Automation rules in Microsoft Sentinel allow you to define conditions (e.g., incident title containing specific keywords) and actions (e.g., assign incident to a specific owner) that run automatically when an incident is created. This directly meets the requirement to assign incidents to the appropriate analyst based on incident type without manual intervention.

Answer

Create a playbook triggered by incident creation that assigns the incident to a user based on the incident title.

Answer

Add a watchlist that maps incident types to analyst email addresses and configure a scheduled analytics rule.

Answer

Configure a Microsoft 365 Defender incident assignment rule in the Microsoft 365 Defender portal.

Question 15

Your company uses Microsoft Defender for Cloud to assess the security posture of hybrid workloads. You are configuring a governance rule to automatically remediate a specific recommendation that is out of compliance. The recommendation is 'Virtual machines should be migrated to new Azure Resource Manager resources'. You need to ensure that the remediation is applied at scale across all subscriptions in the management group. What should you do?

Accepted Answer

Create a governance rule in Microsoft Defender for Cloud with scope set to the management group, condition on the recommendation, and action set to 'Automatic'.. Governance rules in Microsoft Defender for Cloud allow you to define automatic remediation actions for specific recommendations at scale. By setting the scope to the management group, the rule applies to all subscriptions within that group, and the 'Automatic' action triggers the built-in remediation script for the 'Virtual machines should be migrated to new Azure Resource Manager resources' recommendation without requiring custom scripting or policy assignments.

Answer

Create a PowerShell script that runs on each VM to migrate it, and execute it via Azure Automation.

Answer

Create an Azure Policy initiative that includes the recommendation and assign it with a remediation task at the management group level.

Answer

Create a governance rule in Microsoft Defender for Cloud with scope set to a single subscription and action set to 'Automatic'.

Question 16

As a security operations analyst, you receive an alert from Microsoft Defender for Identity about a suspicious Kerberos activity. You need to investigate the alert and determine if it is a true positive. What should you use to pivot from the alert to the related user and device timeline?

Accepted Answer

From the Microsoft 365 Defender portal, open the alert and click on the user or device name to view their timeline.. In the Microsoft 365 Defender portal, when you open a Microsoft Defender for Identity alert, you can directly click on the user or device name to pivot to their timeline. This timeline provides a consolidated view of activities, including Kerberos events, authentication attempts, and other related signals, enabling you to quickly assess whether the suspicious Kerberos activity is a true positive without leaving the portal.

Answer

Search for the user in Azure AD audit logs.

Answer

Open the alert in Microsoft Sentinel and use the investigation graph.

Answer

Use the Microsoft 365 compliance portal to run an eDiscovery search.

Question 17

Your organization uses Microsoft Defender for Endpoint and has enabled the 'Block at First Sight' feature. You notice that some legitimate executables are being blocked incorrectly. You need to temporarily allow these files while you submit them for analysis. What should you do?

Accepted Answer

Create an indicator of compromise (IoC) in Microsoft Defender for Endpoint to allow the file hash.. Creating an allow indicator (IoC) in Microsoft Defender for Endpoint explicitly overrides the cloud-based 'Block at First Sight' verdict for a specific file hash. This allows the legitimate executable to run while you submit it for analysis, without disabling the broader protection feature. The allow indicator takes precedence over automated blocking actions, providing a temporary, targeted exemption.

Answer

Add an application control policy in Microsoft Intune to allow the files.

Answer

Submit the files to Microsoft for analysis and wait for the verdict.

Answer

Disable the 'Block at First Sight' feature until the files are analyzed.

Question 18

Your SOC team uses Microsoft Sentinel to manage incidents. You want to improve the efficiency of incident triage by automatically enriching incidents with threat intelligence data from Microsoft Threat Intelligence. What should you configure?

Accepted Answer

Create a playbook that queries the Threat Intelligence API and adds a comment to the incident.. Playbooks in Microsoft Sentinel can be triggered by automation rules and can query the Microsoft Threat Intelligence API to retrieve threat indicators, then add a comment or tag to the incident for enrichment. Watchlists are static and cannot be directly referenced in automation rules for dynamic matching; they require a playbook to look up data. The TAXII connector only ingests indicators, and UEBA is unrelated to threat intelligence enrichment.

Answer

Enable the Threat Intelligence - TAXII connector to ingest threat indicators.

Answer

Create a watchlist containing threat intelligence data and use it in an automation rule to add tags or comments.

Answer

Enable User and Entity Behavior Analytics (UEBA) to detect anomalies.

Question 19

You are a security analyst at a company that uses Microsoft Defender for Cloud Apps. You receive an alert that an anomalous activity was detected from a user's device. You need to investigate the activity to determine if it is a true positive. What should you do first?

Accepted Answer

In the Microsoft Defender for Cloud Apps portal, open the alert and then click 'View activity' to see the detailed activity log.. The first step in investigating an anomalous activity alert in Microsoft Defender for Cloud Apps is to open the alert and click 'View activity' to examine the detailed activity log. This log provides the raw telemetry—such as IP address, user agent, timestamp, and activity type—needed to determine if the behavior is malicious or benign. Without reviewing this evidence, you cannot make an informed judgment about the alert's validity.

Answer

Use Microsoft Power BI to analyze user activity data.

Answer

Open the user's page in Microsoft Entra ID to review sign-in logs.

Answer

Create an IP address range policy to block the user's IP.

Question 20

Your company uses Microsoft Sentinel and has a workspace in the East US region. You need to ingest logs from a non-Azure Windows server located in a branch office in Europe. You have limited bandwidth and need to ensure that log ingestion does not impact network performance. What should you use?

Accepted Answer

Install the Azure Monitor Agent on the server and create a data collection rule to filter and compress logs before sending.. The Azure Monitor Agent (AMA) supports data collection rules (DCRs) that can filter logs at the source and compress data before transmission, reducing bandwidth usage. This is critical for the limited bandwidth scenario, and AMA is the modern replacement for the Log Analytics agent, designed for efficient log ingestion across regions.

Answer

Use Microsoft Defender for Endpoint to collect logs from the server and forward them to Sentinel.

Answer

Install the Log Analytics agent (MMA) on the server and configure it to send logs directly to the workspace.

Answer

Configure the server to send logs to an Azure Event Hub, then stream to Sentinel.